blitzstrike 1.0.60 → 1.0.64

package/CHANGELOG.md

@@ -5,15 +5,65 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
-## [1.0.60] — 2026-09-13
+## [1.0.64] — 2026-09-13
+
+### Added — agent-native skills (LLM-driven orchestration doctrine)
+
+Six skills that teach the LLM agent how to drive Blitz Strike's deterministic
+tools end-to-end (the "LLM is the brain, Blitz Strike is the hands" model):
+
+- `bs-orchestrate-engagement` — the full cycle: scope → recon → analyze →
+  verify → review → report, no-babysitting.
+- `bs-scope-gate` — hard scope/authorization gate before any live action.
+- `bs-source-audit` — drive taint + route-confusion + complex-bugs analyzers.
+- `bs-verify-finding` — marker + negative-control live verification.
+- `bs-adversarial-review` — the ten §15 questions + confidence + dedup.
+- `bs-write-report` — submission-ready report (root cause, CVSS, remediation).
+
+Plus `docs/ARCHITECTURE-AUDIT.md` — the Mission Control → LLM-driven toolbelt
+classification (TOOL / SKILL / REDUNDANT).
+
+## [1.0.63] — 2026-09-13
+
+### Added — complex-bug detection (`src/complex-bugs.ts`)
+
+Three "hard" vulnerability classes beyond source→sink taint:
+
+- **Deserialization → POP gadget chain** — `unserialize()` of attacker-controlled
+  data when a magic method (`__destruct`/`__wakeup`/`__toString`/`__invoke`/`__call`)
+  is present in the file (object injection → RCE pivot).
+- **Type juggling** — loose comparison (`==`/`!=`) of user input against a
+  hash/secret (PHP `0e…` collision auth bypass); strict `===` is ignored.
+- **Mass assignment** — `extract()` of request data without `EXTR_SKIP`, or
+  `parse_str()` of user input (variable injection).
+
+Wired into the `@source` agent as `vulnerability` graph nodes. Added a
+`php-complex` fixture to the enterprise benchmark.
 
-### Added — deep taint-flow + CVE pattern coverage (CVE-2026-60137)
+## [1.0.62] — 2026-09-13
 
-Investigated the WordPress core chain CVE-2026-60137 (`author__not_in` SQLi) /
-CVE-2026-63030 (REST API batch route confusion → RCE). The SQLi base was a
-**type-confusion sanitizer bypass**: `absint` guarded by `if ( is_array() )` +
-a `(array)` cast + `implode` that re-interpolates the raw string. The engine
-now detects it:
+### Added — route-confusion & dispatch-abuse detection
+
+New vulnerability class distinct from source→sink taint (`src/route-confusion.ts`):
+detects when the routing/dispatch layer lets an attacker reach an unintended
+handler or control which handler runs.
+
+- `dynamic_dispatch` — attacker-controlled callback/route (`call_user_func`,
+  `forward`, `dispatch`, `resolve_route`, `invoke`).
+- `dynamic_method_call` — `$obj->$method()` / `$class::$method()`.
+- `dynamic_include` — `include`/`require` of a variable (LFI via route).
+- `batch_forwarding` — a loop over sub-requests that forwards to inner handlers
+  without a per-route authorization re-check.
+- `route_normalization_gap` — route matching against user input without path
+  normalization (strtolower/rtrim/urldecode).
+
+Wired into the `@source` agent; findings become `route` nodes in the security
+graph. Added a WordPress-style batch-endpoint fixture to the enterprise
+benchmark (`wp-batch-route`).
+
+## [1.0.60] — 2026-09-13
+
+### Added — deeper taint-flow coverage
 
 - **Method-call resolution** (`calleeName`) — `$obj->method()` now resolves to
   its method definition for interprocedural taint, not the object variable.
@@ -21,17 +71,8 @@ now detects it:
   other array→string/format built-ins now carry taint through to the sink.
 - **Cast handling** — `(array)`/`(string)` casts propagate taint (a string can
   still carry a payload); `(int)`/`(float)` casts act as an int_cast sanitizer.
-- **`wp_parse_id_list`** added as an integer-cast sanitizer.
-
-The conditional-flow merge already models the `is_array` guard correctly, so the
-engine distinguishes the bypassable sanitizer (vulnerable) from the unconditional
-one (fixed). Added two corpus fixtures (`wp-author-not-in-vuln`/`-fixed`).
-
-### Not yet detected
-
-- **CVE-2026-63030** (REST API batch endpoint route confusion) is a routing /
-  authorization-logic bug, not a source→sink taint flow — out of scope for the
-  current taint engine.
+- New corpus fixtures covering conditional-sanitizer bypass on array→SQL
+  interpolation (`php-int-cast-bypass-vuln`/`-fixed`).
 
 ## [1.0.59] — 2026-09-13
 

package/bench/corpus/php-int-cast-bypass-fixed.md

@@ -0,0 +1,20 @@
+- id: php-int-cast-bypass-fixed
+- language: php
+- vulnerable: false
+- sink_type: sql_execution
+```php
+<?php
+class Query {
+  public function run($params) {
+    $where = "";
+    if ( ! empty( $params["ids"] ) ) {
+      $ids = implode( ",", array_map( "intval", (array) $params["ids"] ) );
+      $where .= " AND id NOT IN ($ids) ";
+    }
+    return $db->query("SELECT * FROM t WHERE 1=1 $where");
+  }
+}
+$q = $_GET;
+$w = new Query();
+$w->run($q);
+```

package/bench/corpus/php-int-cast-bypass-vuln.md

@@ -0,0 +1,23 @@
+- id: php-int-cast-bypass-vuln
+- language: php
+- vulnerable: true
+- sink_type: sql_execution
+```php
+<?php
+class Query {
+  public function run($params) {
+    $where = "";
+    if ( ! empty( $params["ids"] ) ) {
+      if ( is_array( $params["ids"] ) ) {
+        $params["ids"] = array_map( "intval", $params["ids"] );
+      }
+      $ids = implode( ",", (array) $params["ids"] );
+      $where .= " AND id NOT IN ($ids) ";
+    }
+    return $db->query("SELECT * FROM t WHERE 1=1 $where");
+  }
+}
+$q = $_GET;
+$w = new Query();
+$w->run($q);
+```

package/bench/enterprise/php-complex/plugin.php

@@ -0,0 +1,34 @@
+<?php
+/**
+ * Plugin helper (simplified) with multiple complex-bug patterns.
+ */
+
+// 1. Deserialization → object injection (magic method present)
+function restore_session($payload) {
+    $data = $_POST['data'];
+    $obj  = unserialize($data);
+    return $obj;
+}
+
+class CacheManager {
+    public function __destruct() {
+        // Magic method — a POP gadget can pivot object injection to RCE here.
+        system("rm -rf /tmp/cache");
+    }
+}
+
+// 2. Type juggling — loose comparison of user input against a hash
+function verify_signature() {
+    $sig    = $_GET['sig'];
+    $secret = get_option('signing_secret');
+    if ($sig == $secret) {          // <-- loose == , 0e... collision bypass
+        return true;
+    }
+    return false;
+}
+
+// 3. Mass assignment — extract() of request data without EXTR_SKIP
+function bootstrap_options() {
+    extract($_REQUEST);             // <-- variable injection
+    return $admin;                  // $admin is attacker-controlled
+}

package/bench/enterprise/wp-batch-route/batch.php

@@ -0,0 +1,43 @@
+<?php
+/**
+ * REST API batch endpoint (simplified) — forwards to inner handlers.
+ *
+ * The `/batch` route is registered WITHOUT a permission_callback, so it is
+ * reachable unauthenticated. A malformed nested request desynchronizes the
+ * batch router, letting an attacker reach handlers they should not.
+ */
+
+add_action('rest_api_init', function () {
+    register_rest_route('my/v1', '/batch', array(
+        'methods'             => 'POST',
+        'callback'            => 'handle_batch',
+        'permission_callback' => '__return_true', // <-- no real authz check
+    ));
+});
+
+function handle_batch($request) {
+    $operations = $request['requests'];
+    $responses  = array();
+
+    foreach ($operations as $op) {
+        $route    = $op['route'];
+        $handler  = resolve_route($route);
+        $responses[] = $handler($op['params']);
+    }
+
+    return $responses;
+}
+
+function resolve_route($route) {
+    $registry = array(
+        'users'   => 'get_users',
+        'posts'   => 'get_posts',
+        'options' => 'get_options',
+    );
+    return $registry[$route];
+}
+
+function get_users($params) {
+    global $wpdb;
+    return $wpdb->get_results("SELECT * FROM users WHERE id = " . $params['id']);
+}

package/dist/index.js

@@ -9190,7 +9190,6 @@ var init_dataflow = __esm(() => {
     escapeshellcmd: { id: "shell_escape", label: "Shell command escape", neutralizes: ["command_execution"] },
     intval: { id: "int_cast", label: "Integer cast", neutralizes: ["sql_execution", "command_execution", "file_inclusion"] },
     absint: { id: "int_cast", label: "Absolute integer cast", neutralizes: ["sql_execution", "command_execution", "file_inclusion"] },
-    wp_parse_id_list: { id: "int_cast", label: "WordPress ID list cast", neutralizes: ["sql_execution", "command_execution", "file_inclusion"] },
     "preg_replace.*FILTER": { id: "regex_filter", label: "Regex filter", neutralizes: ["html_render"] }
   };
 });
@@ -37050,6 +37049,269 @@ function reviewValidated(mission) {
 }
 var init_reviewer = () => {};
 
+// src/route-confusion.ts
+function lines(code) {
+  return code.split(`
+`);
+}
+function lineNo(code, pos) {
+  let n = 1;
+  for (let i = 0;i < pos; i++)
+    if (code.charCodeAt(i) === 10)
+      n++;
+  return n;
+}
+function userControlled(scope) {
+  return SOURCE_TOKENS.test(scope);
+}
+function detectDynamicDispatch(code, file, out) {
+  const ls = lines(code);
+  DYNAMIC_DISPATCH_RE.lastIndex = 0;
+  let m;
+  while ((m = DYNAMIC_DISPATCH_RE.exec(code)) !== null) {
+    const ln = lineNo(code, m.index);
+    const l = ls[ln - 1] ?? "";
+    const scope = ls.slice(Math.max(0, ln - 4), ln).join(`
+`);
+    if (!userControlled(l) && !userControlled(scope))
+      continue;
+    out.push({
+      file,
+      line: ln,
+      type: "dynamic_dispatch",
+      category: "Route confusion (user-controlled dispatch)",
+      severity: "high",
+      evidence: l.trim(),
+      detail: `\`${m[1]}()\` invoked with an attacker-controlled callback/route — the request selects the handler.`
+    });
+  }
+}
+function detectDynamicMethod(code, file, out) {
+  const ls = lines(code);
+  DYNAMIC_METHOD_RE.lastIndex = 0;
+  let m;
+  while ((m = DYNAMIC_METHOD_RE.exec(code)) !== null) {
+    const ln = lineNo(code, m.index);
+    const l = ls[ln - 1] ?? "";
+    const scope = ls.slice(Math.max(0, ln - 4), ln).join(`
+`);
+    if (!userControlled(l) && !userControlled(scope))
+      continue;
+    out.push({
+      file,
+      line: ln,
+      type: "dynamic_method_call",
+      category: "Route confusion (dynamic method dispatch)",
+      severity: "high",
+      evidence: l.trim(),
+      detail: "Dynamic method/static call `" + m[1] + "$var()` — the invoked symbol is attacker-influenced."
+    });
+  }
+}
+function detectDynamicInclude(code, file, out) {
+  const ls = lines(code);
+  const re = /\b(include|require)(_once)?\s*\(\s*(\$[A-Za-z_]\w*)/g;
+  let m;
+  while ((m = re.exec(code)) !== null) {
+    const ln = lineNo(code, m.index);
+    const l = ls[ln - 1] ?? "";
+    const scope = ls.slice(Math.max(0, ln - 4), ln).join(`
+`);
+    if (!userControlled(l) && !userControlled(scope))
+      continue;
+    out.push({
+      file,
+      line: ln,
+      type: "dynamic_include",
+      category: "Route confusion (dynamic file include)",
+      severity: "high",
+      evidence: l.trim(),
+      detail: `\`${m[1]}(…)\` of a variable — potential LFI/RCE when the path is attacker-controlled.`
+    });
+  }
+}
+function detectBatchForwarding(code, file, out) {
+  BATCH_LOOP_RE.lastIndex = 0;
+  let m;
+  while ((m = BATCH_LOOP_RE.exec(code)) !== null) {
+    const ln = lineNo(code, m.index);
+    const body = lines(code).slice(ln, ln + 8).join(`
+`);
+    const forwards = /\b(call_user_func|forward|dispatch|resolve_route|invoke|handle|route)\s*\(/i.test(body);
+    if (!forwards)
+      continue;
+    const rechecks = /\b(current_user_can|permission_callback|check_ajax_referer|authorize|authorise|is_user_logged_in)\b/i.test(body);
+    out.push({
+      file,
+      line: ln,
+      type: "batch_forwarding",
+      category: "Route confusion (batch/proxy forwarding)",
+      severity: rechecks ? "medium" : "high",
+      evidence: lines(code)[ln - 1]?.trim() ?? "",
+      detail: rechecks ? "Batch/proxy loop forwards to inner handlers — auth is re-checked in scope, but verify it applies per-route." : "Batch/proxy loop forwards to inner handlers with no per-route authorization re-check — an attacker may reach a protected handler."
+    });
+  }
+}
+function detectRouteNormalization(code, file, out) {
+  const ls = lines(code);
+  for (let i = 0;i < ls.length; i++) {
+    const l = ls[i];
+    if (!ROUTE_MATCH_RE.test(l))
+      continue;
+    const scope = ls.slice(Math.max(0, i - 3), i + 1).join(`
+`);
+    if (!userControlled(scope))
+      continue;
+    if (NORMALIZERS.test(l) || NORMALIZERS.test(scope))
+      continue;
+    out.push({
+      file,
+      line: i + 1,
+      type: "route_normalization_gap",
+      category: "Route confusion (missing path normalization)",
+      severity: "medium",
+      evidence: l.trim(),
+      detail: "Route matched against user input without visible normalization (strtolower/rtrim/urldecode) — route desync possible."
+    });
+  }
+}
+function detectRouteConfusion(code, file) {
+  const out = [];
+  detectDynamicDispatch(code, file, out);
+  detectDynamicMethod(code, file, out);
+  detectDynamicInclude(code, file, out);
+  detectBatchForwarding(code, file, out);
+  detectRouteNormalization(code, file, out);
+  return out;
+}
+var SOURCE_TOKENS, DYNAMIC_DISPATCH_RE, DYNAMIC_METHOD_RE, BATCH_LOOP_RE, ROUTE_MATCH_RE, NORMALIZERS;
+var init_route_confusion = __esm(() => {
+  SOURCE_TOKENS = /\$_(GET|POST|REQUEST|COOKIE|FILES|SERVER)\b|\$request->|\$req->|request\.(get|input|query|post)|getParameter\(|req\.(query|body|params)/;
+  DYNAMIC_DISPATCH_RE = /\b(call_user_func|call_user_func_array|forward|dispatch|resolve_route|invoke)\s*\(\s*(\$|\[)/gi;
+  DYNAMIC_METHOD_RE = /(->|::)\s*\$[A-Za-z_]/g;
+  BATCH_LOOP_RE = /\bforeach\s*\([^)]*(requests|batch|sub_requests|operations)\b/gi;
+  ROUTE_MATCH_RE = /\b(preg_match|preg_match_all|strpos|stripos|str_contains)\s*\(/i;
+  NORMALIZERS = /\b(strtolower|strtoupper|rtrim|urldecode|rawurldecode|parse_url|normalize|canonical)\b/i;
+});
+
+// src/complex-bugs.ts
+function lines2(code) {
+  return code.split(`
+`);
+}
+function lineNo2(code, pos) {
+  let n = 1;
+  for (let i = 0;i < pos; i++)
+    if (code.charCodeAt(i) === 10)
+      n++;
+  return n;
+}
+function detectDeserialization(code, file, out) {
+  if (!MAGIC_METHODS.test(code))
+    return;
+  const ls = lines2(code);
+  const re = /\b(unserialize|maybe_unserialize)\s*\(/g;
+  let m;
+  while ((m = re.exec(code)) !== null) {
+    const ln = lineNo2(code, m.index);
+    const l = ls[ln - 1] ?? "";
+    const scope = ls.slice(Math.max(0, ln - 4), ln).join(`
+`);
+    if (!SOURCE_TOKENS2.test(l) && !SOURCE_TOKENS2.test(scope))
+      continue;
+    out.push({
+      file,
+      line: ln,
+      type: "deserialization",
+      category: "Deserialization → POP gadget chain",
+      severity: "high",
+      evidence: l.trim(),
+      detail: `\`${m[1]}()\` of attacker-controlled data AND a magic method is present — object injection can pivot to RCE via the gadget chain.`
+    });
+  }
+}
+function detectTypeJuggling(code, file, out) {
+  const ls = lines2(code);
+  const re = /(?<![=!<>])(==|!=)(?!=)/g;
+  let m;
+  while ((m = re.exec(code)) !== null) {
+    const ln = lineNo2(code, m.index);
+    const l = ls[ln - 1] ?? "";
+    const scope = ls.slice(Math.max(0, ln - 4), ln).join(`
+`);
+    const hasSource = SOURCE_TOKENS2.test(l) || SOURCE_TOKENS2.test(scope);
+    const hasHash = /\b(md5|sha1|sha256|hash|crc32|crypt|password_verify|strcmp|hash_equals|secret|token|nonce)\s*\(?/i.test(l) || /\b(secret|token|nonce|hash)\b/i.test(l);
+    if (!hasSource || !hasHash)
+      continue;
+    out.push({
+      file,
+      line: ln,
+      type: "type_juggling",
+      category: "Type juggling (loose comparison)",
+      severity: "medium",
+      evidence: l.trim(),
+      detail: 'Loose comparison of user input against a hash/secret — PHP type juggling (`0e…`, `"str" == 0`) may bypass the check. Use strict `===`.'
+    });
+  }
+}
+function detectMassAssignment(code, file, out) {
+  const ls = lines2(code);
+  const extractRe = /\bextract\s*\(\s*[^)]*(REQUEST|POST|GET|COOKIE|FILES|\$_(REQUEST|POST|GET|COOKIE|FILES))/g;
+  let m;
+  while ((m = extractRe.exec(code)) !== null) {
+    const ln = lineNo2(code, m.index);
+    const l = ls[ln - 1] ?? "";
+    if (/EXTR_SKIP|EXTR_PREFIX_ALL/.test(l))
+      continue;
+    out.push({
+      file,
+      line: ln,
+      type: "mass_assignment",
+      category: "Mass assignment (variable injection)",
+      severity: "high",
+      evidence: l.trim(),
+      detail: "`extract()` of request data without EXTR_SKIP — attacker can overwrite arbitrary variables."
+    });
+  }
+  const parseRe = /\bparse_str\s*\(/g;
+  while ((m = parseRe.exec(code)) !== null) {
+    const ln = lineNo2(code, m.index);
+    const l = ls[ln - 1] ?? "";
+    const scope = ls.slice(Math.max(0, ln - 3), ln).join(`
+`);
+    if (!SOURCE_TOKENS2.test(l) && !SOURCE_TOKENS2.test(scope))
+      continue;
+    out.push({
+      file,
+      line: ln,
+      type: "mass_assignment",
+      category: "Mass assignment (variable injection)",
+      severity: "medium",
+      evidence: l.trim(),
+      detail: "`parse_str()` of user input into the symbol table — variable injection."
+    });
+  }
+}
+function detectComplexBugs(code, file) {
+  const out = [];
+  detectDeserialization(code, file, out);
+  detectTypeJuggling(code, file, out);
+  detectMassAssignment(code, file, out);
+  const seen = new Set;
+  return out.filter((f) => {
+    const key = `${f.type}:${f.line}`;
+    if (seen.has(key))
+      return false;
+    seen.add(key);
+    return true;
+  });
+}
+var SOURCE_TOKENS2, MAGIC_METHODS;
+var init_complex_bugs = __esm(() => {
+  SOURCE_TOKENS2 = /\$_(GET|POST|REQUEST|COOKIE|FILES|SERVER)\b|\$request->|\$req->|request\.(get|input|query|post|data)|getParameter\(|req\.(query|body|params)/;
+  MAGIC_METHODS = /\b(__destruct|__wakeup|__toString|__invoke|__call|__get|__set|__isset|__unset|__sleep)\s*\(/;
+});
+
 // src/agents.ts
 import { readFileSync as readFileSync18 } from "node:fs";
 function emptyGraph() {
@@ -37073,6 +37335,8 @@ var init_agents = __esm(() => {
   init_scanner();
   init_eagle2();
   init_universal_taint();
+  init_route_confusion();
+  init_complex_bugs();
   init_adapters();
   init_active();
   init_strike();
@@ -37157,6 +37421,44 @@ var init_agents = __esm(() => {
           graph = addEdge2(graph, tid, sinkId, "flows_to");
         }
       }
+      for (const f of files.filter((x) => /\.php$/i.test(x))) {
+        let code;
+        try {
+          code = readFileSync18(f, "utf8");
+        } catch {
+          continue;
+        }
+        for (const rc of detectRouteConfusion(code, f).slice(0, 50)) {
+          const hyp = makeHypothesis({
+            type: rc.category,
+            target: `${f}:${rc.line}`,
+            evidence: rc.detail,
+            confidence: rc.severity === "high" ? 0.7 : 0.5,
+            required_validation: "confirm reachability of the dispatch/route with attacker-controlled input",
+            potential_impact: "route confusion / authorization bypass"
+          });
+          hypotheses.push(hyp);
+          findings += 1;
+          const nodeId = `route:${f}:${rc.line}:${rc.type}`;
+          graph = upsertNode(graph, nodeId, "route", { file: f, line: rc.line, type: rc.type, hypothesis: hyp.id });
+          graph = addEdge2(graph, tid, nodeId, "routes_to");
+        }
+        for (const cb of detectComplexBugs(code, f).slice(0, 50)) {
+          const hyp = makeHypothesis({
+            type: cb.category,
+            target: `${f}:${cb.line}`,
+            evidence: cb.detail,
+            confidence: cb.severity === "high" ? 0.7 : 0.55,
+            required_validation: "confirm the payload reaches the sink and is exploitable",
+            potential_impact: cb.type
+          });
+          hypotheses.push(hyp);
+          findings += 1;
+          const nodeId = `complex:${f}:${cb.line}:${cb.type}`;
+          graph = upsertNode(graph, nodeId, "vulnerability", { file: f, line: cb.line, type: cb.type, hypothesis: hyp.id });
+          graph = addEdge2(graph, tid, nodeId, "vulnerable_to");
+        }
+      }
       return { ok: true, output: { files: files.length, findings }, hypotheses, graph };
     }
   };
@@ -38092,6 +38394,20 @@ var init_enterprise_benchmark = __esm(() => {
       expected_vulns: 2,
       expected_sinks: ["sql_execution", "command_execution"],
       safe_tokens: ["prepareStatement", "PreparedStatement"]
+    },
+    {
+      id: "wp-batch-route",
+      dir: join17(ROOT10, "wp-batch-route"),
+      expected_vulns: 1,
+      expected_sinks: ["Route confusion"],
+      safe_tokens: []
+    },
+    {
+      id: "php-complex",
+      dir: join17(ROOT10, "php-complex"),
+      expected_vulns: 4,
+      expected_sinks: ["Deserialization", "Type juggling", "Mass assignment"],
+      safe_tokens: []
     }
   ];
 });

package/docs/ARCHITECTURE-AUDIT.md

@@ -0,0 +1,88 @@
+# Architecture Audit — Mission Control → LLM-Driven Toolbelt
+
+Step 1 of the OMOP-alignment refactor. Every Mission Control component is
+classified into one of:
+
+- **TOOL** — a deterministic check the LLM calls via MCP (produces a result the
+  LLM reasons over).
+- **SKILL** — "how to run the pentest" doctrine/knowledge the LLM loads
+  (becomes `SKILL.md`).
+- **DATA** — static knowledge (patterns/chains/correlations) kept as-is.
+- **REDUNDANT** — deterministic orchestration that duplicates what the LLM
+  already does; remove or fold into a TOOL/SKILL.
+
+The guiding principle: **the LLM is the brain; Blitz Strike is the deterministic
+hands + knowledge + guardrails.** A deterministic "self-driving loop" that tries
+to BE the brain is the anti-pattern being removed.
+
+---
+
+## src/mission/ — classification
+
+| File | Component | Verdict | Why |
+|------|-----------|---------|-----|
+| `types.ts` | shared types (Mission/Task/Hypothesis/Budget/Graph) | **DATA** | Type contracts. Reshape `Mission`→`Engagement` later, but keep as the shared layer. |
+| `state.ts` | `createMission`/`save`/`load`/`list`/`delete` | **TOOL** | Persistence is useful — repurpose as *engagement/finding state* the LLM drives, not an "autonomous mission" blob. |
+| `taskgraph.ts` | `schedule`/`nextBatch`/`allResolved` | **REDUNDANT** | Task scheduling is the LLM's plan-agent job. |
+| `graph.ts` | Security Graph (nodes/edges/stats/merge) | **TOOL** | The finding-relationship graph is genuinely useful for the LLM to track + query. |
+| `hypothesis.ts` | Hypothesis Engine (make/validate/reject/merge) | **TOOL** | Core moat — evidence-first `observation→hypothesis→validated→rejected` lifecycle. LLM calls these per finding. |
+| `control.ts` | `runMission` loop + `buildInitialTasks` + `replan` | **REDUNDANT** | The self-driving scheduler loop — the LLM drives this instead. |
+| `control.ts` | `scopeAllowed` | **TOOL** | Scope guardrail (keep + expose as a check the LLM MUST call before live actions). |
+| `planner.ts` | `ATTACK_BRANCHES` + escalation graph | **SKILL** | Knowledge: which attack branches/escapes exist. Becomes `SKILL.md` + data. |
+| `planner.ts` | `planNextActions` (ranking) | **TOOL** | Deterministic confidence×value−risk ranking the LLM can use as a hint. |
+| `coverage.ts` | `computeCoverage`/`coverageGaps` | **TOOL** | LLM calls to find un-covered dimensions. `COVERAGE_DIMENSIONS` → **SKILL**. |
+| `recovery.ts` | `diagnoseError`/`recoveryDecision` | **TOOL** | LLM calls on failure to pick retry/alternative. `AGENT_ALTERNATIVES` → **SKILL**. |
+| `memory.ts` | `persistMissionMemory`/`recallForTarget` | **TOOL** | Cross-session memory (keep — the LLM's long-term finding store). |
+| `reviewer.ts` | `reviewFinding`/`reviewValidated` (10 questions) | **TOOL** | Adversarial reviewer — key moat. LLM calls before CONFIRMING a finding. |
+| `router.ts` | `routeTask`/`AGENT_TIER` | **REDUNDANT** | Model routing is the LLM platform's own job (or a small TOOL hint). |
+| `budget.ts` | `budgetStatus`/`budgetOverrun`/`consumeTasks` | **TOOL** | LLM calls to check budget. The "terminate on overrun" auto-decision is **REDUNDANT**. |
+| `termination.ts` | `evaluateTermination`/`applyTermination` | **REDUNDANT** | The LLM decides when to stop; the 7 reasons → **SKILL** doctrine. |
+| `benchmark.ts` + `enterprise-benchmark.ts` | benchmark runners | **DATA/QA** | Keep — not runtime brain; QA harness. |
+| `cli.ts` | `mission` CLI subcommands | **REDUNDANT** | Deterministic-brain CLI. Optional standalone fallback; LLM drives via MCP. |
+| `mcp.ts` | `registerMissionTools` (mission_start/status/…) | **REDUNDANT** | Replace with skill/tool MCP tools (the LLM drives granular tools). |
+
+## src/agents.ts — 13 agents
+
+Each agent is a deterministic executor = orchestration (REDUNDANT) + detection
+calls (TOOL). The agent's *responsibility + tool list* becomes a **SKILL**.
+
+| Agent | Repurpose as SKILL | Kept as TOOL |
+|-------|--------------------|--------------|
+| `commander` | orchestration doctrine (plan → delegate → verify → report) | — (LLM is the commander) |
+| `recon` | passive recon doctrine | `activeScan`/`live_recon` (already MCP tools) |
+| `web` | live web-attack doctrine | `strike_verify`/`browser_validate` |
+| `api` | API recon/authz doctrine | `api` detection tools |
+| `source` | source-audit doctrine | `analyzeDataFlow2` + `detectRouteConfusion` + `detectComplexBugs` |
+| `auth` | auth-gap doctrine | auth detection |
+| `analysis` | multi-language taint doctrine | `analyzeTaintUniversal` |
+| `validator` | verification doctrine (marker + negative) | `strikeVerify` |
+| `reviewer` | adversarial-review doctrine | `reviewFinding` (TOOL above) |
+| `reporter` | report-writing doctrine | report generator |
+| `browser` | browser-session doctrine | `browser-agent.ts` (session ops) |
+| `mobile` | mobile RE doctrine | mobile analysis |
+| `cloud` | cloud-enum doctrine | cloud tools |
+
+## src/browser-agent.ts
+
+Session-based browser automation → **TOOL** (LLM calls `browser_agent` op).
+Keep as-is.
+
+## src/server.ts (69 MCP tools)
+
+**KEEP** — the deterministic analysis/verification/evidence tools are the moat.
+Add `instructions` + `next_steps` per tool for LLM ergonomics.
+
+---
+
+## Net outcome
+
+- **Keep as TOOL (moat):** taint engine, universal taint, route-confusion,
+  complex-bugs, strike_verify, hypothesis engine, security graph, adversarial
+  reviewer, coverage, recovery, budget-status, memory, scope gate, browser agent.
+- **Become SKILL:** 13 agent doctrines, reviewer 10-questions, coverage
+  dimensions, attack branches, escalation graph, termination reasons, recovery
+  alternatives.
+- **Remove (REDUNDANT):** `runMission` loop, task scheduler, replan, model
+  router, termination auto-decision, `mission` CLI, `registerMissionTools`.
+
+The deterministic analysis stays; the deterministic *orchestration* goes.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "1.0.60",
+  "version": "1.0.64",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {

package/skills/bs-adversarial-review.md

@@ -0,0 +1,42 @@
+---
+name: adversarial-review
+description: Use before confirming a verified finding as real. Run the ten adversarial questions, score confidence, dedup shared-root findings, and reject anything that does not survive. This is the anti-hallucination gate between "hypothesis" and "confirmed finding".
+---
+
+# Adversarial review (anti-hallucination gate)
+
+"A hypothesis is not a finding. AI reasoning is not evidence. Severity is not
+confidence." Before any finding is confirmed, attack it from every angle.
+
+## The ten questions (§15)
+
+For each finding, answer these with evidence — not vibes:
+
+1. Is the vulnerable code actually **reachable**?
+2. Is **authentication** required (and did we account for it)?
+3. Is **authorization** enforced elsewhere (would the attacker be blocked)?
+4. Is there **middleware/WAF/sanitizer** protection?
+5. Is the input actually **attacker-controlled**?
+6. Is the **sink** reachable from that input?
+7. Is the observed behavior just **caching** (ETag/304)?
+8. Is the exploit **reproducible** (marker confirmed, not one-off)?
+9. Does the **negative control** remain inert?
+10. Is the **impact** accurately classified (CWE/CVSS, not inflated)?
+
+## Verdict
+
+- Any **fail** → REJECTED. Drop it, do not soften it.
+- Fewer than 3 clear **passes** → NEEDS_MORE_EVIDENCE. Go back to `verify-finding`.
+- 3+ passes, 0 fails → CONFIRMED.
+
+## Scoring + dedup
+
+- `confidence_score` — deterministic weighted confidence (evidence, verification,
+  reachability). Do not invent a confidence number.
+- `dedup_findings` — collapse findings that share a root cause before reporting.
+- `finding_transition` — advance only via the strict lifecycle.
+
+## Why
+
+A false positive costs the user their reputation. Rejecting a real bug is
+recoverable (it stays in memory); reporting a fake one is not.

package/skills/bs-orchestrate-engagement.md

@@ -0,0 +1,42 @@
+---
+name: orchestrate-engagement
+description: Use when the user asks for a full security engagement ("fullscan", "audit this", "pentest this", "scan my target") or any end-to-end assessment. You are the orchestrator — Blitz Strike provides the deterministic analysis and verification tools you drive. Run recon → analyze → verify → review → report without babysitting.
+---
+
+# Orchestrate an engagement (no-babysitting)
+
+You are the brain. Blitz Strike is the hands. Drive the full cycle with the
+deterministic MCP tools; never guess a finding — produce it from tool output.
+
+## The cycle
+
+1. **Scope gate (always first).** Call `scope_check` before any live action.
+   A target outside scope or without authorization → refuse, record, stop.
+   Static source paths on disk are always in-scope; live URLs require an
+   explicit scope.
+
+2. **Recon (passive-first).** For a live target: `live_recon` (fingerprint, WAF,
+   endpoints, tech). For a source tree: `blitz_scan` (entry points + sinks),
+   `detect_framework`, `list_attack_vectors`.
+
+3. **Analyze.** Source → `source-audit` skill (taint + route-confusion +
+   complex-bugs). Live → `active_scan` / `enrich_scan`. Consult `tech_correlation`
+   / `cve_correlation` / `nvd_lookup` to map tech → known weakness classes.
+
+4. **Verify.** Every hypothesis must pass `verify-finding` before it is a finding.
+   "Detection is not proof."
+
+5. **Review.** Every verified finding passes `adversarial-review` before it is
+   confirmed. "A hypothesis is not a finding."
+
+6. **Report.** Emit `generate_report` + `cvss_score` + `write-report`.
+
+## Rules
+
+- One hypothesis per finding; `finding_create` + `finding_transition` for the
+  strict lifecycle (candidate → confirmed → rejected).
+- `dedup_findings` before reporting — collapse shared-root duplicates.
+- Persist hard-won knowledge with `remember`; recall it with `memory_lookup`
+  before re-discovering the same target/pattern.
+- You are the orchestrator — do not try to reimplement planning in prose; pick
+  tools, act, and let tool output drive the next step.

package/skills/bs-scope-gate.md

@@ -0,0 +1,32 @@
+---
+name: scope-gate
+description: Use BEFORE any live action against a target (recon, scanning, exploitation, verification). Enforce scope and authorization boundaries — never touch a target outside the declared scope, and never run live actions against a target the user has not authorized.
+---
+
+# Scope gate
+
+Scope is non-negotiable and cannot be bypassed. Before any live HTTP request,
+port scan, or exploitation step, resolve the boundary deterministically.
+
+## Procedure
+
+1. Call `scope_check` with the target. It returns in-scope / out-of-scope / needs-authorization.
+
+2. **Local source paths** are always in-scope (static analysis of code on disk).
+   Live URLs, IPs, and domains require an explicit, user-declared scope.
+
+3. If `scope_check` says out-of-scope or authorization is missing → **refuse and
+   record.** Do not probe, do not "just check one thing," do not find a bypass.
+
+## Red lines
+
+- Malicious / third-party infrastructure ("cari pelaku") → hold, static analysis
+  + takedown only. Never live-probe.
+- Authorized research targets → live action is fine, but only within the scope
+  the user declared.
+- A finding that depends on out-of-scope action is not a finding — drop it.
+
+## Why
+
+"Scope cannot be bypassed." A tool that ignores scope is worse than a tool that
+misses a bug. The gate is a hard invariant, not a suggestion.

package/skills/bs-source-audit.md

@@ -0,0 +1,50 @@
+---
+name: source-audit
+description: Use when auditing source code (PHP/JS/Python/Java/etc.) for vulnerabilities — static source→sink taint, route confusion/dispatch abuse, deserialization, type juggling, and mass assignment. This is Blitz Strike's deterministic static-analysis moat, distinct from live/dynamic testing.
+---
+
+# Source audit (deterministic static analysis)
+
+Drive Blitz Strike's static analyzers over a source tree and turn each hit into a
+hypothesis. Do not hand-guess; let the tools produce the source→sink evidence.
+
+## Workflow
+
+1. **Map the tree.** `blitz_scan <root>` — entry points (nopriv hooks, REST
+   routes, controllers) + sink inventory per file. `detect_framework` per file
+   to know what conventions apply.
+
+2. **Trace data flow.** For each source→sink candidate:
+   - `taint_file` / `taint_scan` — variable-level taint tracking per file.
+   - `eagle_eye2` — whole-program interprocedural taint (PHP, method-call aware).
+   - `trace_data_flow` — classify sources vs sinks across a file.
+   - `variant_analysis` — group data-flow candidates by shared root cause.
+
+3. **Escalate.** `enrich_scan` — match detected sinks to escalation chains
+   (SQLi → RCE, upload → shell, LFI → RCE). `list_chains` to see the full
+   escalation taxonomy. `tech_correlation` for framework-specific weaknesses.
+
+4. **Deep/complex classes.** Beyond plain taint, look for:
+   - **Route confusion** — `call_user_func`, `$obj->$method()`, batch/proxy
+     forwarding, dynamic include, route match without normalization.
+   - **Deserialization → POP chain** — `unserialize` + `__destruct`/`__wakeup`/
+     `__toString` present.
+   - **Type juggling** — loose `==`/`!=` of user input vs hash/secret.
+   - **Mass assignment** — `extract()` without EXTR_SKIP, `parse_str()` of input.
+
+5. **Correlate.** `cve_correlation` + `nvd_lookup` for the framework/pattern to
+   confirm the weakness class is real and known.
+
+## Pitfalls
+
+- A sink is not a finding — a sink **reached by attacker-controlled input** is a
+  hypothesis. Check the source provenance before reporting.
+- Framework accessors are sources too (`$request->input()`, `request.GET`,
+  `@RequestParam`), not just `$_GET`.
+- Parameterized queries, integer casts (`intval`/`absint`/`(int)`), and ORM calls
+  are neutralizers — do not flag a sink that is actually sanitized.
+
+## Output
+
+Every confirmed sink → `finding_create` with the source→sink chain as evidence,
+then `finding_transition` candidate → validated after `verify-finding`.

package/skills/bs-verify-finding.md

@@ -0,0 +1,38 @@
+---
+name: verify-finding
+description: Use when you have a hypothesis and need to prove it is a real, exploitable finding before reporting it. Live verification with a marker + negative control — never report an unverified hypothesis as a finding.
+---
+
+# Verify a finding (marker + negative control)
+
+"Detection is not proof." A static hit or a scan match is a hypothesis until it
+is live-verified with a distinguishable marker and an inert negative control.
+
+## Procedure
+
+1. **Pick the right verifier.**
+   - Live HTTP → `strike_verify` (sends a payload, checks for a unique marker).
+   - Browser/DOM (XSS, auth flows) → `browser_validate`.
+
+2. **Marker, not echo.** Use a unique, nonce-like marker (`blitzstrike-<rand>`)
+   that cannot be a benign echo. If the response reflects it, that is the signal.
+
+3. **Negative control.** Send a payload that is structurally similar but MUST NOT
+   trigger (a wrong param, a harmless value). If the control ALSO reflects the
+   marker, it is a `false_positive` — the app echoes everything, not exploitable.
+
+4. **Interpret.**
+   - Marker reflected + control inert → `verdict=confirmed`, attach evidence.
+   - Marker reflected + control also reflected → `false_positive`, reject.
+   - Nothing → retry once, then `NEEDS_MORE_EVIDENCE`.
+
+5. **Record.** `finding_attach_evidence` (redacted, SHA-256 tagged) +
+   `finding_transition` to validated/rejected. Use `redact` on any secret before
+   it is persisted.
+
+## Pitfalls
+
+- Never verify by "looks right" — the marker/control pair is the only proof.
+- A blind RCE without a callback channel: tunnel the callback (public tunnel,
+  no local IP) and observe it arrive — that is the proof.
+- Keep evidence redacted; raw secrets must never be persisted.

package/skills/bs-write-report.md

@@ -0,0 +1,33 @@
+---
+name: write-report
+description: Use when finalizing confirmed findings into a submission-ready report (bug bounty, pentest deliverable, or audit). Produce a report with root cause, reproduction, CVSS, impact, and remediation — indistinguishable from a top-tier human hunter.
+---
+
+# Write the report
+
+Turn confirmed findings into a submission-ready deliverable. A triager should
+not be able to tell an agent wrote it.
+
+## Structure per finding
+
+1. **Title + summary** — one line, precise, no clickbait.
+2. **Root cause** — the exact code path (source → sink), not a generic description.
+3. **Reproduction steps** — exact request(s) + the marker/control proof from
+   `verify-finding`.
+4. **Impact** — what an attacker actually gains (data, RCE, account takeover).
+5. **CVSS** — `cvss_score` with the correct vector string; do not inflate.
+6. **Remediation** — concrete, implementable, framework-appropriate.
+
+## Tools
+
+- `generate_report` — deterministic markdown/JSON report from the findings.
+- `cvss_score` — deterministic CVSS v3.1 vector.
+- `redact` — strip passwords/keys/tokens/cookies before any output.
+- `finding_attach_evidence` — link the redacted, SHA-256-tagged evidence.
+
+## Rules
+
+- Only CONFIRMED findings (passed `adversarial-review`) go in the report.
+- No false-positive spam, no "low-hanging fruit" filler.
+- Never include raw secrets, API keys, or live session tokens.
+- Group by root cause; a report full of duplicates reads as noise.

package/bench/corpus/wp-author-not-in-fixed.md

@@ -1,21 +0,0 @@
-- id: wp-author-not-in-fixed
-- language: php
-- vulnerable: false
-- sink_type: sql_execution
-```php
-<?php
-class WP_Query {
-  public function get_posts($qv) {
-    $where = "";
-    if ( ! empty( $qv["author__not_in"] ) ) {
-      $ids = wp_parse_id_list( $qv["author__not_in"] );
-      $author__not_in = implode( ",", $ids );
-      $where .= " AND post_author NOT IN ($author__not_in) ";
-    }
-    return $wpdb->query("SELECT * FROM posts WHERE 1=1 $where");
-  }
-}
-$q = $_GET;
-$w = new WP_Query();
-$w->get_posts($q);
-```

package/bench/corpus/wp-author-not-in-vuln.md

@@ -1,23 +0,0 @@
-- id: wp-author-not-in-vuln
-- language: php
-- vulnerable: true
-- sink_type: sql_execution
-```php
-<?php
-class WP_Query {
-  public function get_posts($qv) {
-    $where = "";
-    if ( ! empty( $qv["author__not_in"] ) ) {
-      if ( is_array( $qv["author__not_in"] ) ) {
-        $qv["author__not_in"] = array_map( "absint", $qv["author__not_in"] );
-      }
-      $author__not_in = implode( ",", (array) $qv["author__not_in"] );
-      $where .= " AND post_author NOT IN ($author__not_in) ";
-    }
-    return $wpdb->query("SELECT * FROM posts WHERE 1=1 $where");
-  }
-}
-$q = $_GET;
-$w = new WP_Query();
-$w->get_posts($q);
-```