blitzstrike 1.0.81 → 1.0.84

package/CHANGELOG.md

@@ -5,6 +5,55 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [1.0.84] — 2026-09-13
+
+### Added — structured failure recovery (`retry_guidance`)
+
+- New `retry_guidance` MCP tool + `intelligence/retry_guidance.json`: 7 failure
+  modes (empty output, blocked, sanitized, subagent failed, model failed,
+  unconfirmed, low severity) → concrete recovery actions, with alias resolution
+  (`rate limit` → model_failed, `stale` → empty_output). Upgrades the
+  "don't give up" doctrine from prose to a data-driven lookup.
+- PERSISTENCE doctrine now leads with: on any failure, call
+  `retry_guidance(signal)` for concrete recovery actions before giving up.
+
+## [1.0.83] — 2026-09-13
+
+### Removed — dead code, dead data, and stale docs (no decoration)
+
+Full dead-code/dead-data audit. Removed:
+
+- 16 `intelligence/*.json` files that were remnants of the removed deterministic
+  engine and no longer loaded by any code (`ab_signals`, `attack_chains`,
+  `awaiting_input_markers`, `endpoint_patterns`, `escalation_patterns`,
+  `file_extensions`, `patterns`, `refusal_markers`, `scan_profiles`, `skills`,
+  `tools`, `tools_meta`, `unified_patterns`, `verification_patterns`,
+  `vuln_ontology`, `waff_bypass`) — superseded by `chains.json`, `skills/`,
+  `tools-catalog.json`, and the live intel files.
+- 3 `examples/*.sh` that invoked the removed `mission`/`benchmark` CLI.
+- `templates/cves.json` (2.1 MB) — never loaded (NVD lookups use the API,
+  CVE correlation uses `cve_correlations.json`).
+
+Rewrote `docs/AUTONOMY.md` (was describing the removed deterministic engine)
+to document the LLM-driven model, and updated `README.md` / `docs/usage.md` /
+`THIRD-PARTY-NOTICES.md` to drop the removed `mission`/`benchmark` CLI,
+`run_benchmark`, and the stale 12-sink-class / 106-check counts.
+
+## [1.0.82] — 2026-09-13
+
+### Added — attack-vector focus + chain-to-chain composition
+
+- Attack vectors are now actionable: each of the 34 categories in
+  `attack_vectors.json` gained a `focus` (what to test / look for), surfaced by
+  `list_attack_vectors` and `attackVectors` — no longer bare names.
+- New `chain_links` MCP tool + `intelligence/chain_links.json`: 18 chain→chain
+  compositions (SSRF→metadata → default-creds→pivot via stolen IAM, XXE→SSRF →
+  cloud metadata, SQLi→RCE → hash-dump, …) so a complex bug can be traced across
+  chains instead of stopping at one.
+- Doctrine: RESOURCE MAP now tells a driving LLM WHEN to reach for each —
+  `list_attack_vectors` during recon, `list_chains` for escalation, `chain_links`
+  to compose chains, `bypass_lookup` when blocked, `payload_lookup` for probes.
+
 ## [1.0.81] — 2026-09-13
 
 ### Added — bypass techniques + chain doctrine

package/README.md

@@ -54,24 +54,25 @@ confirms it.
 
 ---
 
-## Autonomous engine
+## Autonomous, LLM-driven
 
-Beyond single-tool calls, Blitz Strike ships a **self-driving security research
-engine** (Mission Control). Give it a target and a scope — it plans, executes,
-verifies, reviews against false positives, fills coverage gaps, and reports,
-all without babysitting:
+Blitz Strike is driven by the LLM — Claude, Hermes, OpenCode, Codex, or any
+MCP client. **The LLM is the brain** (plans, routes, delegates, judges); **Blitz
+Strike is the deterministic hands + knowledge + guardrails**.
+
+A full engagement is one call, or a granular agent-orchestrated cycle:
 
 ```bash
-npx blitzstrike mission ./path/to/source --mode source
-npx blitzstrike mission https://example.com --mode web --scope example.com
-npx blitzstrike benchmark --full
+npx blitzstrike serve --mcp   # connect your agent, then ask it to
+                              #   "audit ./src" (source) or "audit https://example.com" (live)
 ```
 
-It is deterministic by default (no model calls unless configured), persists
-every mission (resumable), enforces scope + budget + termination policy, and
-keeps long-term memory of findings and failed approaches.
+The LLM classifies the target automatically (URL → live pipeline, filesystem
+path → source pipeline), then drives recon → analyze → verify → review →
+report — guided by the bundled doctrine (`instructions` + skills + per-step
+`next_steps`) and fanned out across the platform's native sub-agents.
 
-→ [Autonomous engine](docs/AUTONOMY.md) — full architecture + reference.
+→ [Autonomy & doctrine](docs/AUTONOMY.md) — how the LLM is steered.
 
 ## Why TypeScript / Bun
 
@@ -136,8 +137,6 @@ blitzstrike serve --mcp       # start MCP server over stdio (default)
 blitzstrike doctor            # health check: runtime + 130-tool catalog + creds
 blitzstrike install           # write MCP config to detected clients (Claude/Cursor/OpenCode)
 blitzstrike install --dry-run # preview the config without writing
-blitzstrike mission <target>  # run an autonomous mission (source or web)
-blitzstrike benchmark         # run the autonomous benchmark (--full for whole corpus)
 blitzstrike sync-data         # fetch heavy datasets (payloads + templates) on-demand
 blitzstrike update            # check for a newer version + refresh the data cache
 blitzstrike version           # print version
@@ -220,8 +219,8 @@ MCP servers. With no client detected, it prints the snippet for manual paste.
 | `cvss_score(AV, AC, PR, UI, S, C, I, A)` | Compute a deterministic CVSS v3.1 base score + vector + severity (self-computed, not read from NVD). |
 | `dedup_findings(findings)` | Collapse findings that share a root cause (sink × source × CWE) into one group per root cause. |
 | `generate_report(findings, format)` | Emit a reproducible markdown/JSON report with summary + SHA-256 integrity hash. |
-| `run_benchmark()` | Run the labelled corpus and report detection rate, false-positive rate, and precision. |
-| `coverage_matrix()` | Enumerate language × sink-class coverage (4 languages × 12 sink classes) + coverage ratio. |
+| `run_enterprise_benchmark()` | Run the labelled enterprise corpus and report detection rate, false-positive rate, and precision. |
+| `coverage_matrix()` | Enumerate language × sink-class coverage (4 languages × 15 sink classes) + coverage ratio. |
 
 ### EAGLE-EYE — taint + data-flow
 
@@ -359,7 +358,7 @@ All other tools need no credentials.
 bun install          # deps
 bun run typecheck    # tsc --noEmit
 bun run build        # ESM bundle → dist/index.js
-bun run test         # regression + benchmark suite (106 checks)
+bun run test         # regression + benchmark suite (183 checks)
 bun run compile      # single static binary → dist/blitzstrike
 ```
 
@@ -370,16 +369,17 @@ bun run compile      # single static binary → dist/blitzstrike
 Blitz Strike carries a benchmark suite and a coverage matrix so quality is a
 number you can re-run, not a claim.
 
-- **Benchmark** (`run_benchmark`) — a labelled corpus of vulnerable + safe
-  fixtures across PHP, JavaScript, Python, and Java. Current result:
+- **Benchmark** (`run_enterprise_benchmark`) — a labelled corpus of vulnerable +
+  safe fixtures across PHP, JavaScript, Python, and Java. Current result:
   detection rate **1.0**, false-positive rate **0**, precision **1.0**.
-- **Coverage matrix** (`coverage_matrix`) — 4 languages × 12 sink classes =
-  35/48 pairs covered (**72.9%**). The two uncovered classes (`xml_processing`,
-  `archive_extraction`) are tracked in the roadmap.
+- **Coverage matrix** (`coverage_matrix`) — 4 languages × 15 sink classes =
+  56/60 pairs covered. The four uncovered pairs are legitimately absent from
+  the language (e.g. Java has no `eval`, Python/Java no PHP-style file
+  inclusion, JS no deserialization sink).
 - **Attack-vector taxonomy** (`list_attack_vectors` / `attack_vectors`) — a
   master reference of 34 attack-vector categories (588 vectors) so a driving
   agent can map the *entire* attack surface, not just the obvious sinks.
-- **Regression suite** — `bun run test` runs 106 checks covering finding
+- **Regression suite** — `bun run test` runs 183 checks covering finding
   lifecycle, evidence integrity, CVSS math, taint tracing, dedup, report
   integrity, and benchmark invariants. CI runs it on every push.
 
@@ -405,7 +405,7 @@ Do not use against systems without explicit permission from the owner.
 
 - [Installation](docs/installation.md) — prerequisites, install, client registration.
 - [Usage](docs/usage.md) — one-call engagement, granular path, modes, memory.
-- [Autonomous engine](docs/AUTONOMY.md) — Mission Control, agents, security graph, benchmark.
+- [Autonomy & doctrine](docs/AUTONOMY.md) — LLM-driven autonomy, resource map, guardrails.
 - [Manifesto](docs/manifesto.md) — the invariants that drive the methodology.
 - [Contributing](CONTRIBUTING.md) — how to add chains, tools, and data.
 - [Changelog](CHANGELOG.md) — version history.

package/THIRD-PARTY-NOTICES.md

@@ -46,7 +46,7 @@ satisfies the attribution requirements of those licenses.
 
 - **Source:** https://github.com/projectdiscovery/nuclei-templates
 - **License:** MIT
-- **Used for:** ~11.9k YAML detection templates (`templates/`) + `cves.json`.
+- **Used for:** ~11.9k YAML detection templates (`templates/`).
 
 ---
 

package/dist/index.js

@@ -31429,7 +31429,7 @@ function listAttackVectors() {
   return {
     total_categories: data.categories.length,
     total_vectors: data.categories.reduce((n, c) => n + c.vectors.length, 0),
-    categories: data.categories.map((c) => ({ id: c.id, title: c.title, count: c.vectors.length }))
+    categories: data.categories.map((c) => ({ id: c.id, title: c.title, count: c.vectors.length, focus: c.focus ?? "" }))
   };
 }
 function attackVectors(category) {
@@ -31442,7 +31442,7 @@ function attackVectors(category) {
     const matches = data.categories.filter((c) => c.title.toLowerCase().includes(category.toLowerCase()) || c.id.includes(q)).slice(0, 5).map((c) => c.id);
     return { found: false, query: category, suggestions: matches };
   }
-  return { found: true, id: found.id, title: found.title, count: found.vectors.length, vectors: found.vectors };
+  return { found: true, id: found.id, title: found.title, focus: found.focus ?? "", count: found.vectors.length, vectors: found.vectors };
 }
 var PACKAGE_PAYLOADS = join8(ROOT3, "payloads");
 var PACKAGE_TEMPLATES = join8(ROOT3, "templates");
@@ -31624,6 +31624,53 @@ function bypassLookup(defense) {
     return { found: false, defense, suggestions: cats.map((c) => c.id) };
   return { found: true, defense: match.defense, techniques: match.techniques };
 }
+function chainLinks() {
+  const data = loadJson("chain_links");
+  if (!data)
+    return { found: false, error: "chain_links.json not found" };
+  return { found: true, total: data.links.length, links: data.links };
+}
+function retryGuidance(signal) {
+  const data = loadJson("retry_guidance");
+  if (!data)
+    return { found: false, error: "retry_guidance.json not found" };
+  if (!signal) {
+    return {
+      found: true,
+      modes: data.modes.map((m) => ({ id: m.id, signal: m.signal, actions: m.actions.length }))
+    };
+  }
+  const ALIASES = {
+    empty: "empty_output",
+    "no output": "empty_output",
+    stale: "empty_output",
+    blocked: "blocked",
+    waf: "blocked",
+    filter: "blocked",
+    firewall: "blocked",
+    sanitized: "sanitized",
+    sanitizer: "sanitized",
+    neutralized: "sanitized",
+    subagent: "subagent_failed",
+    "sub-agent": "subagent_failed",
+    delegate: "subagent_failed",
+    model: "model_failed",
+    "rate limit": "model_failed",
+    ratelimit: "model_failed",
+    quota: "model_failed",
+    context: "model_failed",
+    unconfirmed: "unconfirmed",
+    "not confirmed": "unconfirmed",
+    low: "low_severity",
+    "low severity": "low_severity"
+  };
+  const key = signal.toLowerCase().trim();
+  const norm = ALIASES[key] ?? key.replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+  const match = data.modes.find((m) => m.id === norm || norm.includes(m.id) || m.id.includes(norm));
+  if (!match)
+    return { found: false, signal, suggestions: data.modes.map((m) => m.id) };
+  return { found: true, mode: match.id, signal: match.signal, actions: match.actions };
+}
 
 // src/active.ts
 var TIMEOUT_MS2 = 20000;
@@ -53385,9 +53432,8 @@ function createServer() {
     name: "blitzstrike",
     version: "1.0.0"
   }, {
-    instructions: "Blitz Strike is a universal penetration-testing toolbelt with three tiers — " + "BLITZ (reconnaissance / attack-surface mapping), EAGLE-EYE (source-to-sink " + "analysis), STRIKE (live validation) — plus a canonical evidence-first finding " + "engine and a multi-language taint engine.\\n\\n" + "CORE MENTAL MODEL:\\n" + "- A scanner hit is a HYPOTHESIS, not a finding. Live verification (or data-flow " + "  proof) is the verdict. Never report an unverified hit as a vulnerability.\\n" + "- Distinguish REACHABLE from mere PRESENT: a sink is only a finding when tainted " + "  input reaches it AND it is not neutralized by a sanitizer and not guarded by an " + "  auth gate.\\n\\n" + "HOW TO RUN AN AUDIT (start here):\\n" + "0. ROUTE BY TARGET. Classify the target automatically - no need to ask. A " + "   URL - with or without http/https (example.com, 192.168.1.1, host:8080) - " + "   is LIVE (scope-gated, then live_recon + active_scan + strike_verify). A " + "   filesystem path (exists on disk, or a code extension) is SOURCE audit " + "   (blitz_scan + eagle_eye2 + complex_scan/route_scan). If the scheme is " + "   missing, prepend https://. run_engagement auto-detects both internally.\\n" + "1. SCOPE FIRST. Call scope_check(target, scope, mode) before ANY active testing. " + "   Passive analysis (reading source, fingerprinting public pages) needs no gate; " + "   active probing (exploitation, fuzzing, path brute-force) is blocked until scope " + "   authorizes it.\\n" + "2. MAP THE SURFACE (BLITZ). For a source tree use blitz_scan (tree) or blitz_file " + "   (single file) then enrich_scan to match sinks to escalation chains. For a live " + "   URL use live_recon for a full pass (fingerprint/WAF/tech/version/crawler/params/" + "   subdomains/API endpoints/intel correlation) — it returns next_steps. active_scan " + "   is the lighter gated alternative. Both re-check scope internally.\\n" + "3. TRACE REACHABILITY (EAGLE-EYE). For every sink, determine whether attacker " + "   input actually reaches it:\\n" + "   - PHP/JS/TS/Python/Java source: taint_file (auto-detects language) or " + "     taint_scan/taint_tree (PHP AST). list_languages shows what's supported.\\n" + "   - Any language: trace_data_flow (window heuristic) and eagle_eye/eagle_grep " + "     (function-scoped view of sinks + auth gates). Beyond taint: route_scan (route confusion / dispatch abuse / batch forwarding) and complex_scan (deserialization->POP, type juggling, mass assignment) catch classes plain taint misses.\\n" + "   A sink counts only if tainted input reaches it unsanitized and unguarded.\\n" + "4. VALIDATE (STRIKE). Confirm live with strike_verify using a MARKER plus a " + "   NEGATIVE CONTROL plus a BASELINE. The verdict is deterministic: marker " + "   reflected AND control inert = confirmed; both reflected = false_positive; " + "   marker not reflected = unconfirmed. Feed the verdict to strike_resolve to " + "   advance the finding lifecycle (hypothesis->validating->confirmed). Use " + "   read_tool_manual for the exploit tool's manual, payload_lookup for payloads, " + "   detect_waf/tech_correlation for context.\\n" + "5. RECORD + REPORT. Create a canonical finding with finding_create, advance it " + "   through the lifecycle with finding_transition, attach confidence_score, and " + "   redact any secrets before persisting. Only report findings that survived " + "   verification.\\n\\n" + "SUPPORTING LAYERS:\\n" + "- run_engagement: ONE call does the whole audit (no babysitting). Source path -> " + "  full static pipeline + inline report (markdown/JSON/SARIF). URL target -> " + "  autonomous live marker sweep + confirmed findings + report. Prefer this first.\\n" + "- list_chains: 57 escalation chains (source -> sink -> impact).\\n" + "- list_languages / taint_file: multi-language taint (PHP, JS/TS, Python, Java).\\n" + "- tool_lookup / ensure_tool / list_tools: 130-tool catalog, auto-install.\\n" + "- read_playbook / list_playbooks: 17 engagement playbooks (web-app, api-security, " + "  source-code-audit, active-directory, mobile, external-attack-surface, ...).\\n" + "- skill_lookup / read_skill / list_skills: 38 skills (6 bs-* agent doctrine + " + "  technique playbooks: WP/PHP 0-day, AD, malware, mobile, cloud).\\n" + "- read_tool_manual / list_manuals: 317 tool manuals (sqlmap, nmap, commix, ...).\\n" + "- payload_lookup / read_payload: 66 payload collections (sqli, xss, ssti, xxe, lfi).\\n" + "- detect_waf / tech_correlation / cve_correlation / port_correlation: signature " + "  + correlation intelligence.\\n" + "- nvd_lookup / fofa_search: CVE + asset reconnaissance (FOFA needs env creds).\\n" + "- remember / memory_lookup / memory_list: persist + recall verified knowledge.\\n\\n" + "RESOURCE MAP (know what to reach for):\\n" + "- TOOL = acts (scan, taint, verify, record, correlate). Call it to DO something.\\n" + "- PLAYBOOK = campaign plan for a target TYPE. read_playbook(web-application) " + "  BEFORE a full engagement of that type.\\n" + "- SKILL = procedure doctrine. Load the bs-* skill for the phase you are on " + "  (orchestrate, scope, source-audit, verify, review, report); load a technique " + "  skill for the specific technique (WP 0-day, AD, malware).\\n" + "- MANUAL = deep reference for ONE tool. read_tool_manual right before using it.\\n" + "- PAYLOAD = attack payloads for a class. payload_lookup before crafting a probe.\\n" + `- INTELLIGENCE = knowledge (chains, attack vectors, CVE/tech mapping).\\n
-` + "PERSISTENCE (complex bugs - do not give up):\\n" + "- One failed probe != not vulnerable. Vary: alternative sinks, other params, " + "  encoding/case/whitespace bypasses, different injection context.\\n" + "- Empty output != no findings. Re-run (server may be stale after an upgrade - " + "  /reload-mcp), or escalate to route_scan / complex_scan for classes taint " + "  misses (POP chains, type juggling, mass assignment, route confusion).\\n" + "- A 'sanitized' sink may not be safe. Challenge the sanitizer: loose == vs ===, " + "  missing EXTR_SKIP, int cast truncation, weak regex.\\n" + "- An unconfirmed hypothesis is KEPT as hypothesis - try alternate verification, " + "  then let adversarial review decide.\\n" + "- Complex chains (deserialization->POP, LFI->RCE) need the FULL chain traced, " + `  not just the first sink.\\n
-` + "- When a probe is BLOCKED by a WAF/filter/sanitizer, call bypass_lookup(defense) " + "  for concrete techniques (encoding, case, comment insertion, chunked, null byte, " + "  double-encoding, verb tampering, header spoofing) and apply them - do not give up.\\n" + "- CHAIN findings: a low-severity finding usually escalates. list_chains and match it " + "  to a multi-stage chain (SSRF->metadata, SQLi->RCE, LFI->RCE, upload->shell) instead " + "  of stopping at the first vuln.\\n\\n" + "IRON RULES:\\n" + "- Scope first; authorized targets only. Refuse out-of-scope or destructive/DoS work.\\n" + "- A hit is a hypothesis; a verified exploit (or proven data-flow) is the finding.\\n" + "- Prefer the one-call run_engagement path; fall back to granular tools when you " + "  need finer control."
+    instructions: "Blitz Strike is a universal penetration-testing toolbelt with three tiers — " + "BLITZ (reconnaissance / attack-surface mapping), EAGLE-EYE (source-to-sink " + "analysis), STRIKE (live validation) — plus a canonical evidence-first finding " + "engine and a multi-language taint engine.\\n\\n" + "CORE MENTAL MODEL:\\n" + "- A scanner hit is a HYPOTHESIS, not a finding. Live verification (or data-flow " + "  proof) is the verdict. Never report an unverified hit as a vulnerability.\\n" + "- Distinguish REACHABLE from mere PRESENT: a sink is only a finding when tainted " + "  input reaches it AND it is not neutralized by a sanitizer and not guarded by an " + "  auth gate.\\n\\n" + "HOW TO RUN AN AUDIT (start here):\\n" + "0. ROUTE BY TARGET. Classify the target automatically - no need to ask. A " + "   URL - with or without http/https (example.com, 192.168.1.1, host:8080) - " + "   is LIVE (scope-gated, then live_recon + active_scan + strike_verify). A " + "   filesystem path (exists on disk, or a code extension) is SOURCE audit " + "   (blitz_scan + eagle_eye2 + complex_scan/route_scan). If the scheme is " + "   missing, prepend https://. run_engagement auto-detects both internally.\\n" + "1. SCOPE FIRST. Call scope_check(target, scope, mode) before ANY active testing. " + "   Passive analysis (reading source, fingerprinting public pages) needs no gate; " + "   active probing (exploitation, fuzzing, path brute-force) is blocked until scope " + "   authorizes it.\\n" + "2. MAP THE SURFACE (BLITZ). For a source tree use blitz_scan (tree) or blitz_file " + "   (single file) then enrich_scan to match sinks to escalation chains. For a live " + "   URL use live_recon for a full pass (fingerprint/WAF/tech/version/crawler/params/" + "   subdomains/API endpoints/intel correlation) — it returns next_steps. active_scan " + "   is the lighter gated alternative. Both re-check scope internally.\\n" + "3. TRACE REACHABILITY (EAGLE-EYE). For every sink, determine whether attacker " + "   input actually reaches it:\\n" + "   - PHP/JS/TS/Python/Java source: taint_file (auto-detects language) or " + "     taint_scan/taint_tree (PHP AST). list_languages shows what's supported.\\n" + "   - Any language: trace_data_flow (window heuristic) and eagle_eye/eagle_grep " + "     (function-scoped view of sinks + auth gates). Beyond taint: route_scan (route confusion / dispatch abuse / batch forwarding) and complex_scan (deserialization->POP, type juggling, mass assignment) catch classes plain taint misses.\\n" + "   A sink counts only if tainted input reaches it unsanitized and unguarded.\\n" + "4. VALIDATE (STRIKE). Confirm live with strike_verify using a MARKER plus a " + "   NEGATIVE CONTROL plus a BASELINE. The verdict is deterministic: marker " + "   reflected AND control inert = confirmed; both reflected = false_positive; " + "   marker not reflected = unconfirmed. Feed the verdict to strike_resolve to " + "   advance the finding lifecycle (hypothesis->validating->confirmed). Use " + "   read_tool_manual for the exploit tool's manual, payload_lookup for payloads, " + "   detect_waf/tech_correlation for context.\\n" + "5. RECORD + REPORT. Create a canonical finding with finding_create, advance it " + "   through the lifecycle with finding_transition, attach confidence_score, and " + "   redact any secrets before persisting. Only report findings that survived " + "   verification.\\n\\n" + "SUPPORTING LAYERS:\\n" + "- run_engagement: ONE call does the whole audit (no babysitting). Source path -> " + "  full static pipeline + inline report (markdown/JSON/SARIF). URL target -> " + "  autonomous live marker sweep + confirmed findings + report. Prefer this first.\\n" + "- list_chains: 57 escalation chains (source -> sink -> impact).\\n" + "- list_languages / taint_file: multi-language taint (PHP, JS/TS, Python, Java).\\n" + "- tool_lookup / ensure_tool / list_tools: 130-tool catalog, auto-install.\\n" + "- read_playbook / list_playbooks: 17 engagement playbooks (web-app, api-security, " + "  source-code-audit, active-directory, mobile, external-attack-surface, ...).\\n" + "- skill_lookup / read_skill / list_skills: 38 skills (6 bs-* agent doctrine + " + "  technique playbooks: WP/PHP 0-day, AD, malware, mobile, cloud).\\n" + "- read_tool_manual / list_manuals: 317 tool manuals (sqlmap, nmap, commix, ...).\\n" + "- payload_lookup / read_payload: 66 payload collections (sqli, xss, ssti, xxe, lfi).\\n" + "- detect_waf / tech_correlation / cve_correlation / port_correlation: signature " + "  + correlation intelligence.\\n" + "- nvd_lookup / fofa_search: CVE + asset reconnaissance (FOFA needs env creds).\\n" + "- remember / memory_lookup / memory_list: persist + recall verified knowledge.\\n\\n" + "RESOURCE MAP (know what to reach for):\\n" + "- TOOL = acts (scan, taint, verify, record, correlate). Call it to DO something.\\n" + "- PLAYBOOK = campaign plan for a target TYPE. read_playbook(web-application) " + "  BEFORE a full engagement of that type.\\n" + "- SKILL = procedure doctrine. Load the bs-* skill for the phase you are on " + "  (orchestrate, scope, source-audit, verify, review, report); load a technique " + "  skill for the specific technique (WP 0-day, AD, malware).\\n" + "- MANUAL = deep reference for ONE tool. read_tool_manual right before using it.\\n" + "- PAYLOAD = attack payloads for a class. payload_lookup before crafting a probe.\\n" + "- INTELLIGENCE = knowledge. list_attack_vectors (34 categories) maps the " + "  full surface during RECON; list_chains (36) turns a finding into impact; " + "  chain_links composes chains for complex bugs; bypass_lookup when blocked; " + "  payload_lookup when crafting a probe. Reach for them at that moment.\\n\\n" + "PERSISTENCE (complex bugs - do not give up):\\n" + "- On any failure (empty output, blocked probe, failed sub-agent/model), call " + "  retry_guidance(signal) for concrete recovery actions before giving up.\\n" + "- One failed probe != not vulnerable. Vary: alternative sinks, other params, " + "  encoding/case/whitespace bypasses, different injection context.\\n" + "- Empty output != no findings. Re-run (server may be stale after an upgrade - " + "  /reload-mcp), or escalate to route_scan / complex_scan for classes taint " + "  misses (POP chains, type juggling, mass assignment, route confusion).\\n" + "- A 'sanitized' sink may not be safe. Challenge the sanitizer: loose == vs ===, " + "  missing EXTR_SKIP, int cast truncation, weak regex.\\n" + "- An unconfirmed hypothesis is KEPT as hypothesis - try alternate verification, " + "  then let adversarial review decide.\\n" + "- Complex chains (deserialization->POP, LFI->RCE) need the FULL chain traced, " + `  not just the first sink.\\n
+` + "- When a probe is BLOCKED by a WAF/filter/sanitizer, call bypass_lookup(defense) " + "  for concrete techniques (encoding, case, comment insertion, chunked, null byte, " + "  double-encoding, verb tampering, header spoofing) and apply them - do not give up.\\n" + "- CHAIN findings: a low-severity finding usually escalates. list_chains and match it " + "  to a multi-stage chain (SSRF->metadata, SQLi->RCE, LFI->RCE, upload->shell) instead " + "  of stopping at the first vuln.\\n\\n" + "- Complex bugs chain ACROSS chains: after confirming one chain, chain_links " + "  shows what follows (SSRF->metadata then default-creds->pivot via stolen IAM). " + "  Trace the full composition, not just a single chain.\\n\\n" + "IRON RULES:\\n" + "- Scope first; authorized targets only. Refuse out-of-scope or destructive/DoS work.\\n" + "- A hit is a hypothesis; a verified exploit (or proven data-flow) is the finding.\\n" + "- Prefer the one-call run_engagement path; fall back to granular tools when you " + "  need finer control."
   });
   server.registerTool("blitz_scan", {
     title: "BLITZ scan",
@@ -53883,6 +53929,22 @@ ${statusLine}` : statusLine },
   }, async ({ defense }) => {
     return { content: [{ type: "text", text: JSON.stringify(bypassLookup(defense)) }] };
   });
+  server.registerTool("chain_links", {
+    title: "Chain-to-chain composition",
+    description: "INTEL: return how escalation chains compose — which chain naturally follows another (e.g. SSRF->cloud-metadata then default-creds->internal-pivot via stolen IAM). Use it after confirming a chain to see what a complex bug chains into next, instead of stopping at one chain.",
+    inputSchema: {}
+  }, async () => {
+    return { content: [{ type: "text", text: JSON.stringify(chainLinks()) }] };
+  });
+  server.registerTool("retry_guidance", {
+    title: "Failure recovery guidance",
+    description: "INTEL: return structured recovery actions for a failure mode instead of giving up. Pass a signal (empty output, blocked, sanitized, subagent failed, model failed/rate-limit, unconfirmed, low severity) and get concrete next actions (reload-mcp, escalate detector, bypass_lookup, challenge sanitizer, re-delegate, fall back model, chain_links).",
+    inputSchema: {
+      signal: string2().optional().describe("Failure signal: empty output / blocked / sanitized / subagent failed / model failed / unconfirmed / low severity. Omit to list all modes.")
+    }
+  }, async ({ signal }) => {
+    return { content: [{ type: "text", text: JSON.stringify(retryGuidance(signal)) }] };
+  });
   server.registerTool("read_payload", {
     title: "Read a payload collection",
     description: "INTEL: read the full payload collection for a category (or a specific file).",

package/docs/AUTONOMY.md

@@ -1,147 +1,59 @@
-# Blitz Strike — Autonomous Security Research & Verification Engine
+# Blitz Strike — Autonomous Security Auditing (LLM-Driven)
 
-Blitz Strike's autonomous layer turns the three-tier methodology (BLITZ →
-EAGLE-EYE → STRIKE) into a **self-driving security research engine**. Give it a
-target and a scope; it plans, executes, verifies, reviews, and reports — without
-babysitting.
+Blitz Strike is a **universal security-audit toolbelt** that an LLM agent
+(Hermes, Claude, OpenCode, Codex — any MCP client) drives end-to-end without
+babysitting. The split is deliberate:
 
-This document describes the autonomous engine added on top of the existing
-deterministic core. The core (`blitz_scan`, `eagle_eye2`, `strike_verify`, the
-taint engine, live recon) is unchanged and always available.
+- **The LLM is the brain** — it plans, routes, reasons over results, delegates,
+  and judges. It is never replaced by a deterministic loop.
+- **Blitz Strike is the hands + knowledge + guardrails** — deterministic
+  analysis, verification, the finding lifecycle, and the intelligence data
+  layer.
 
----
+## The three tiers
 
-## 1. Design principles
+| Tier | What it does | Key tools |
+|------|-------------|-----------|
+| **BLITZ** | Attack-surface mapping, recon | `blitz_scan`, `blitz_file`, `live_recon`, `detect_framework`, `list_attack_vectors` |
+| **EAGLE-EYE** | Source→sink reachability | `taint_file`, `eagle_eye2`, `trace_data_flow`, `route_scan`, `complex_scan` |
+| **STRIKE** | Live validation | `strike_verify` (baseline + marker + negative control), `strike_resolve` |
 
-- **Detection is not proof.** A scan hit is a hypothesis; only live verification
-  (or an adversarial review) turns it into a finding.
-- **A hypothesis is not a finding.** They are separate states that never conflate.
-- **AI reasoning is not evidence.** Every finding carries deterministic evidence
-  (marker reflection, negative control, source→sink trace).
-- **The LLM never controls policy.** Routing is
-  `LLM → Planner → Policy engine → Task executor → Tool`, never an arbitrary
-  shell call. The policy engine enforces scope, risk, and budgets.
-- **Deterministic by default.** No model is called unless a provider is
-  explicitly configured (§Model routing).
-
----
-
-## 2. Components
-
-| Component | Module | Role |
-|---|---|---|
-| Mission State | `src/mission/state.ts` | Persistent, resumable missions (`~/.blitzstrike/missions/<id>.json`) |
-| Task Graph | `src/mission/taskgraph.ts` | Dependency-aware, parallel scheduler |
-| Mission Control | `src/mission/control.ts` | The autonomous loop (observe → act → replan → terminate) |
-| Specialized Agents | `src/agents.ts` | 13 deterministic agents (recon, source, auth, validator, reviewer, browser, …) |
-| Security Graph | `src/mission/graph.ts` | Shared world model (targets, sinks, endpoints, chains) |
-| Hypothesis Engine | `src/mission/hypothesis.ts` | observation → hypothesis → validated finding / rejected |
-| Adaptive Planner | `src/mission/planner.ts` | Evidence-driven next actions (SSRF → metadata, LFI → logs, …) |
-| Escalation Graph | `src/mission/planner.ts` | The 57 chains integrated into the world model |
-| Coverage Scheduler | `src/mission/coverage.ts` | Auto-generates tasks for under-explored dimensions |
-| Failure Recovery | `src/mission/recovery.ts` | Diagnose → retry / alternative / record — never repeat a mistake |
-| Adversarial Reviewer | `src/mission/reviewer.ts` | Ten §questions → CONFIRMED / REJECTED / NEEDS_MORE_EVIDENCE |
-| Browser Agent | `src/browser-agent.ts` | Session-based real browser (login flows, DOM issues) |
-| Model Router | `src/mission/router.ts` | Task → model tier (pure routing, deterministic default) |
-| Budget Controller | `src/mission/budget.ts` | time / tasks / requests / tokens / cost + per-task budget |
-| Termination Engine | `src/mission/termination.ts` | Seven traceable termination reasons |
-| Cross-agent Memory | `src/mission/memory.ts` | Persist findings + failed approaches (with `future_policy`) |
-| Benchmark | `src/mission/benchmark.ts` | Full-engine precision / recall / F1 against a labelled corpus |
-
----
-
-## 3. Mission lifecycle
-
-```
-           ┌──────────────────────────────────────────────┐
-           │                 Mission Control              │
- target ─▶ │  OBSERVE → schedule → execute → collect      │
-  scope  ─▶ │     ↓                                       │
-           │  REPLAN (validator → reviewer → reporter,    │
-           │          coverage gaps)                      │
-           │     ↓                                       │
-           │  terminate (traceable reason)                │
-           └──────────────────────────────────────────────┘
-                        │            │
-            Security Graph (world model)  ←→  Hypothesis Engine
-                        │
-            Cross-agent Memory (findings + failed approaches)
-```
-
-A mission is a state machine persisted to disk after every step, so it survives
-a process restart and can be resumed with `blitz mission resume <id>`.
-
-### Termination reasons (§Termination)
-
-`objective_complete` · `no_progress` · `max_iterations` · `budget_exhausted` ·
-`user_interrupted` · `safety_violation` · `scope_violation`. Each is recorded in
-the mission's `decision_log` with a detail string.
-
----
-
-## 4. Safety invariants (never bypassed)
-
-- **Scope gate** — a URL target requires an authorized scope before any agent
-  runs; local source paths are always allowed.
-- **No raw secrets persisted** — `redactSecrets` runs before anything is written.
-- **Negative controls** — a finding is only confirmed when the control stays inert.
-- **No destructive actions** — the engine is read-only / probe-only.
-- **Deterministic by default** — no model call unless configured.
+Plus a canonical evidence-first finding engine (`finding_create` →
+`finding_transition` → `finding_attach_evidence`) and a multi-language taint
+engine (PHP/JS/TS/Python/Java).
 
----
+## How autonomy actually works
 
-## 5. CLI
+The LLM drives a cycle, guided by three coordinated layers:
 
-```bash
-# Run an autonomous mission against a source tree
-blitzstrike mission ./path/to/source --mode source
+1. **Static `instructions`** — the mental model, target routing, resource map,
+   and persistence doctrine, injected when the MCP server connects.
+2. **Skills (doctrine)** — `bs-orchestrate-engagement`, `bs-scope-gate`,
+   `bs-source-audit`, `bs-verify-finding`, `bs-adversarial-review`,
+   `bs-write-report`, loaded per phase.
+3. **Dynamic `next_steps`** — per-result guidance telling the LLM what to do
+   after each tool call.
 
-# Run an autonomous mission against a live URL (requires --scope)
-blitzstrike mission https://example.com --mode web --scope example.com
+A full engagement is orchestrated with the platform's **native plan +
+sub-agent** primitives (e.g. Hermes `plan`/`todo` + `delegate_task`): route the
+target (URL vs source), read the matching playbook, then fan out recon /
+analyze / deep-classes workstreams in parallel, collect, verify, and report.
 
-# Resume / inspect a mission
-blitzstrike mission resume <mission-id>
-blitzstrike mission status <mission-id>
-blitzstrike mission list
+## Guardrails (the anti-hallucination core)
 
-# Run the autonomous benchmark (--full for the whole 101-fixture corpus)
-blitzstrike benchmark --full
-```
-
----
-
-## 6. MCP (autonomous mission mode)
-
-The autonomous layer is exposed alongside the low-level tools:
-
-| Tool | Purpose |
-|---|---|
-| `mission_start` | Start an autonomous mission (target + mode + scope) |
-| `mission_status` | Full mission state (tasks, hypotheses, graph, coverage) |
-| `mission_resume` | Resume an interrupted mission |
-| `mission_stop` | Stop a running mission |
-| `mission_list` | List persisted missions |
-| `browser_agent` | Session-based browser ops (open/click/type/evaluate/…) |
-
-Low-level tools (`blitz_scan`, `eagle_eye2`, `strike_verify`, `run_engagement`,
-…) remain available for manual, step-by-step engagements.
-
----
-
-## 7. No-babysitting
-
-The autonomous mission handles its own recovery, strategy changes, delegation,
-new-task creation, surface discovery, verification, false-positive rejection,
-and coverage gaps. Human input is only needed for: initial authorization/scope,
-high-risk approval when policy requires it, and (optional) final review.
-
----
-
-## 8. Examples
-
-See `examples/` for runnable scripts. The shortest path:
-
-```bash
-npx blitzstrike benchmark --full     # measure the engine
-npx blitzstrike mission ./src --mode source   # autonomous source audit
-```
+- **Detection is not proof.** A scan hit is a hypothesis.
+- **A hypothesis is not a finding.** Separate states, never conflated.
+- **AI reasoning is not evidence.** Every finding carries deterministic evidence
+  (marker reflection, negative control, source→sink trace, SHA-256-tagged).
+- **Scope first.** Out-of-scope or destructive work is refused.
+
+## The resource map (know what to reach for)
+
+- **TOOL** = acts (scan, taint, verify, record).
+- **PLAYBOOK** (17) = campaign plan for a target type (`web-application`,
+  `api-security`, `source-code-audit`, `active-directory`, …).
+- **SKILL** (38) = phase/technique doctrine.
+- **MANUAL** (317) = deep reference for one tool.
+- **PAYLOAD** (66 categories) = attack payloads for a class.
+- **INTELLIGENCE** = 36 escalation chains, 18 chain→chain links, 34 attack-vector
+  categories, bypass techniques, WAF/tech/CVE/port correlations.

package/docs/usage.md

@@ -53,7 +53,7 @@ Only after `strike_verify` reflects your marker AND the chain's
   verified knowledge.
 - `cvss_score` / `dedup_findings` / `generate_report` — self-computed CVSS,
   root-cause dedup, and reproducible reports.
-- `run_benchmark` / `coverage_matrix` — measure detection quality and coverage.
+- `run_enterprise_benchmark` / `coverage_matrix` — measure detection quality and coverage.
 
 ## Memory