blitzstrike 1.0.84 → 1.0.86

package/CHANGELOG.md

@@ -5,6 +5,29 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [1.0.86] — 2026-09-13
+
+### Added — orchestration framework (`orchestration`)
+
+- New `orchestration` MCP tool + `intelligence/orchestration.json`: the
+  engagement lifecycle (6 phases — scope → recon → analyze → deep → verify →
+  report, each with entry/exit criteria), the sub-agent team (4 roles with
+  tools + deterministic output contract), the handoff contract, and termination
+  criteria. The driving LLM loads it at engagement start instead of improvising.
+- RESOURCE MAP leads with `orchestration()`; `bs-orchestrate-engagement`
+  gained a "Lifecycle, team, and termination" section.
+
+## [1.0.85] — 2026-09-13
+
+### Added — no-babysitting during scan + test
+
+- MCP `instructions` gained a "NO-BABYSITTING (while scanning + testing)"
+  section: scan the whole surface before reporting, test every hypothesis
+  through its full cycle, persist through partial results, and only surface to
+  the user for scope/consent/completion.
+- `bs-orchestrate-engagement` carries the same rule, so a driving agent keeps
+  scanning + testing autonomously instead of pausing to ask after each step.
+
 ## [1.0.84] — 2026-09-13
 
 ### Added — structured failure recovery (`retry_guidance`)

package/dist/index.js

@@ -31671,6 +31671,38 @@ function retryGuidance(signal) {
     return { found: false, signal, suggestions: data.modes.map((m) => m.id) };
   return { found: true, mode: match.id, signal: match.signal, actions: match.actions };
 }
+function orchestration(part) {
+  const data = loadJson("orchestration");
+  if (!data)
+    return { found: false, error: "orchestration.json not found" };
+  if (!part) {
+    return {
+      found: true,
+      phases: data.lifecycle.map((p) => ({ phase: p.phase, name: p.name })),
+      team: data.team.map((r) => ({ id: r.id, name: r.name }))
+    };
+  }
+  const q = part.toLowerCase();
+  if (q === "lifecycle" || q === "phases")
+    return { found: true, lifecycle: data.lifecycle };
+  if (q === "team" || q === "roles")
+    return { found: true, team: data.team };
+  if (q === "handoff")
+    return { found: true, handoff: data.handoff };
+  if (q === "termination" || q === "done")
+    return { found: true, termination: data.termination };
+  const phase = data.lifecycle.find((p) => String(p.phase) === q);
+  if (phase)
+    return { found: true, ...phase };
+  const role = data.team.find((r) => String(r.id) === q);
+  if (role)
+    return { found: true, ...role };
+  return {
+    found: false,
+    part,
+    suggestions: ["lifecycle", "team", "handoff", "termination", ...data.lifecycle.map((p) => String(p.phase)), ...data.team.map((r) => String(r.id))]
+  };
+}
 
 // src/active.ts
 var TIMEOUT_MS2 = 20000;
@@ -53432,7 +53464,7 @@ function createServer() {
     name: "blitzstrike",
     version: "1.0.0"
   }, {
-    instructions: "Blitz Strike is a universal penetration-testing toolbelt with three tiers — " + "BLITZ (reconnaissance / attack-surface mapping), EAGLE-EYE (source-to-sink " + "analysis), STRIKE (live validation) — plus a canonical evidence-first finding " + "engine and a multi-language taint engine.\\n\\n" + "CORE MENTAL MODEL:\\n" + "- A scanner hit is a HYPOTHESIS, not a finding. Live verification (or data-flow " + "  proof) is the verdict. Never report an unverified hit as a vulnerability.\\n" + "- Distinguish REACHABLE from mere PRESENT: a sink is only a finding when tainted " + "  input reaches it AND it is not neutralized by a sanitizer and not guarded by an " + "  auth gate.\\n\\n" + "HOW TO RUN AN AUDIT (start here):\\n" + "0. ROUTE BY TARGET. Classify the target automatically - no need to ask. A " + "   URL - with or without http/https (example.com, 192.168.1.1, host:8080) - " + "   is LIVE (scope-gated, then live_recon + active_scan + strike_verify). A " + "   filesystem path (exists on disk, or a code extension) is SOURCE audit " + "   (blitz_scan + eagle_eye2 + complex_scan/route_scan). If the scheme is " + "   missing, prepend https://. run_engagement auto-detects both internally.\\n" + "1. SCOPE FIRST. Call scope_check(target, scope, mode) before ANY active testing. " + "   Passive analysis (reading source, fingerprinting public pages) needs no gate; " + "   active probing (exploitation, fuzzing, path brute-force) is blocked until scope " + "   authorizes it.\\n" + "2. MAP THE SURFACE (BLITZ). For a source tree use blitz_scan (tree) or blitz_file " + "   (single file) then enrich_scan to match sinks to escalation chains. For a live " + "   URL use live_recon for a full pass (fingerprint/WAF/tech/version/crawler/params/" + "   subdomains/API endpoints/intel correlation) — it returns next_steps. active_scan " + "   is the lighter gated alternative. Both re-check scope internally.\\n" + "3. TRACE REACHABILITY (EAGLE-EYE). For every sink, determine whether attacker " + "   input actually reaches it:\\n" + "   - PHP/JS/TS/Python/Java source: taint_file (auto-detects language) or " + "     taint_scan/taint_tree (PHP AST). list_languages shows what's supported.\\n" + "   - Any language: trace_data_flow (window heuristic) and eagle_eye/eagle_grep " + "     (function-scoped view of sinks + auth gates). Beyond taint: route_scan (route confusion / dispatch abuse / batch forwarding) and complex_scan (deserialization->POP, type juggling, mass assignment) catch classes plain taint misses.\\n" + "   A sink counts only if tainted input reaches it unsanitized and unguarded.\\n" + "4. VALIDATE (STRIKE). Confirm live with strike_verify using a MARKER plus a " + "   NEGATIVE CONTROL plus a BASELINE. The verdict is deterministic: marker " + "   reflected AND control inert = confirmed; both reflected = false_positive; " + "   marker not reflected = unconfirmed. Feed the verdict to strike_resolve to " + "   advance the finding lifecycle (hypothesis->validating->confirmed). Use " + "   read_tool_manual for the exploit tool's manual, payload_lookup for payloads, " + "   detect_waf/tech_correlation for context.\\n" + "5. RECORD + REPORT. Create a canonical finding with finding_create, advance it " + "   through the lifecycle with finding_transition, attach confidence_score, and " + "   redact any secrets before persisting. Only report findings that survived " + "   verification.\\n\\n" + "SUPPORTING LAYERS:\\n" + "- run_engagement: ONE call does the whole audit (no babysitting). Source path -> " + "  full static pipeline + inline report (markdown/JSON/SARIF). URL target -> " + "  autonomous live marker sweep + confirmed findings + report. Prefer this first.\\n" + "- list_chains: 57 escalation chains (source -> sink -> impact).\\n" + "- list_languages / taint_file: multi-language taint (PHP, JS/TS, Python, Java).\\n" + "- tool_lookup / ensure_tool / list_tools: 130-tool catalog, auto-install.\\n" + "- read_playbook / list_playbooks: 17 engagement playbooks (web-app, api-security, " + "  source-code-audit, active-directory, mobile, external-attack-surface, ...).\\n" + "- skill_lookup / read_skill / list_skills: 38 skills (6 bs-* agent doctrine + " + "  technique playbooks: WP/PHP 0-day, AD, malware, mobile, cloud).\\n" + "- read_tool_manual / list_manuals: 317 tool manuals (sqlmap, nmap, commix, ...).\\n" + "- payload_lookup / read_payload: 66 payload collections (sqli, xss, ssti, xxe, lfi).\\n" + "- detect_waf / tech_correlation / cve_correlation / port_correlation: signature " + "  + correlation intelligence.\\n" + "- nvd_lookup / fofa_search: CVE + asset reconnaissance (FOFA needs env creds).\\n" + "- remember / memory_lookup / memory_list: persist + recall verified knowledge.\\n\\n" + "RESOURCE MAP (know what to reach for):\\n" + "- TOOL = acts (scan, taint, verify, record, correlate). Call it to DO something.\\n" + "- PLAYBOOK = campaign plan for a target TYPE. read_playbook(web-application) " + "  BEFORE a full engagement of that type.\\n" + "- SKILL = procedure doctrine. Load the bs-* skill for the phase you are on " + "  (orchestrate, scope, source-audit, verify, review, report); load a technique " + "  skill for the specific technique (WP 0-day, AD, malware).\\n" + "- MANUAL = deep reference for ONE tool. read_tool_manual right before using it.\\n" + "- PAYLOAD = attack payloads for a class. payload_lookup before crafting a probe.\\n" + "- INTELLIGENCE = knowledge. list_attack_vectors (34 categories) maps the " + "  full surface during RECON; list_chains (36) turns a finding into impact; " + "  chain_links composes chains for complex bugs; bypass_lookup when blocked; " + "  payload_lookup when crafting a probe. Reach for them at that moment.\\n\\n" + "PERSISTENCE (complex bugs - do not give up):\\n" + "- On any failure (empty output, blocked probe, failed sub-agent/model), call " + "  retry_guidance(signal) for concrete recovery actions before giving up.\\n" + "- One failed probe != not vulnerable. Vary: alternative sinks, other params, " + "  encoding/case/whitespace bypasses, different injection context.\\n" + "- Empty output != no findings. Re-run (server may be stale after an upgrade - " + "  /reload-mcp), or escalate to route_scan / complex_scan for classes taint " + "  misses (POP chains, type juggling, mass assignment, route confusion).\\n" + "- A 'sanitized' sink may not be safe. Challenge the sanitizer: loose == vs ===, " + "  missing EXTR_SKIP, int cast truncation, weak regex.\\n" + "- An unconfirmed hypothesis is KEPT as hypothesis - try alternate verification, " + "  then let adversarial review decide.\\n" + "- Complex chains (deserialization->POP, LFI->RCE) need the FULL chain traced, " + `  not just the first sink.\\n
+    instructions: "Blitz Strike is a universal penetration-testing toolbelt with three tiers — " + "BLITZ (reconnaissance / attack-surface mapping), EAGLE-EYE (source-to-sink " + "analysis), STRIKE (live validation) — plus a canonical evidence-first finding " + "engine and a multi-language taint engine.\\n\\n" + "CORE MENTAL MODEL:\\n" + "- A scanner hit is a HYPOTHESIS, not a finding. Live verification (or data-flow " + "  proof) is the verdict. Never report an unverified hit as a vulnerability.\\n" + "- Distinguish REACHABLE from mere PRESENT: a sink is only a finding when tainted " + "  input reaches it AND it is not neutralized by a sanitizer and not guarded by an " + "  auth gate.\\n\\n" + "HOW TO RUN AN AUDIT (start here):\\n" + "0. ROUTE BY TARGET. Classify the target automatically - no need to ask. A " + "   URL - with or without http/https (example.com, 192.168.1.1, host:8080) - " + "   is LIVE (scope-gated, then live_recon + active_scan + strike_verify). A " + "   filesystem path (exists on disk, or a code extension) is SOURCE audit " + "   (blitz_scan + eagle_eye2 + complex_scan/route_scan). If the scheme is " + "   missing, prepend https://. run_engagement auto-detects both internally.\\n" + "1. SCOPE FIRST. Call scope_check(target, scope, mode) before ANY active testing. " + "   Passive analysis (reading source, fingerprinting public pages) needs no gate; " + "   active probing (exploitation, fuzzing, path brute-force) is blocked until scope " + "   authorizes it.\\n" + "2. MAP THE SURFACE (BLITZ). For a source tree use blitz_scan (tree) or blitz_file " + "   (single file) then enrich_scan to match sinks to escalation chains. For a live " + "   URL use live_recon for a full pass (fingerprint/WAF/tech/version/crawler/params/" + "   subdomains/API endpoints/intel correlation) — it returns next_steps. active_scan " + "   is the lighter gated alternative. Both re-check scope internally.\\n" + "3. TRACE REACHABILITY (EAGLE-EYE). For every sink, determine whether attacker " + "   input actually reaches it:\\n" + "   - PHP/JS/TS/Python/Java source: taint_file (auto-detects language) or " + "     taint_scan/taint_tree (PHP AST). list_languages shows what's supported.\\n" + "   - Any language: trace_data_flow (window heuristic) and eagle_eye/eagle_grep " + "     (function-scoped view of sinks + auth gates). Beyond taint: route_scan (route confusion / dispatch abuse / batch forwarding) and complex_scan (deserialization->POP, type juggling, mass assignment) catch classes plain taint misses.\\n" + "   A sink counts only if tainted input reaches it unsanitized and unguarded.\\n" + "4. VALIDATE (STRIKE). Confirm live with strike_verify using a MARKER plus a " + "   NEGATIVE CONTROL plus a BASELINE. The verdict is deterministic: marker " + "   reflected AND control inert = confirmed; both reflected = false_positive; " + "   marker not reflected = unconfirmed. Feed the verdict to strike_resolve to " + "   advance the finding lifecycle (hypothesis->validating->confirmed). Use " + "   read_tool_manual for the exploit tool's manual, payload_lookup for payloads, " + "   detect_waf/tech_correlation for context.\\n" + "5. RECORD + REPORT. Create a canonical finding with finding_create, advance it " + "   through the lifecycle with finding_transition, attach confidence_score, and " + "   redact any secrets before persisting. Only report findings that survived " + "   verification.\\n\\n" + "SUPPORTING LAYERS:\\n" + "- run_engagement: ONE call does the whole audit (no babysitting). Source path -> " + "  full static pipeline + inline report (markdown/JSON/SARIF). URL target -> " + "  autonomous live marker sweep + confirmed findings + report. Prefer this first.\\n" + "- list_chains: 57 escalation chains (source -> sink -> impact).\\n" + "- list_languages / taint_file: multi-language taint (PHP, JS/TS, Python, Java).\\n" + "- tool_lookup / ensure_tool / list_tools: 130-tool catalog, auto-install.\\n" + "- read_playbook / list_playbooks: 17 engagement playbooks (web-app, api-security, " + "  source-code-audit, active-directory, mobile, external-attack-surface, ...).\\n" + "- skill_lookup / read_skill / list_skills: 38 skills (6 bs-* agent doctrine + " + "  technique playbooks: WP/PHP 0-day, AD, malware, mobile, cloud).\\n" + "- read_tool_manual / list_manuals: 317 tool manuals (sqlmap, nmap, commix, ...).\\n" + "- payload_lookup / read_payload: 66 payload collections (sqli, xss, ssti, xxe, lfi).\\n" + "- detect_waf / tech_correlation / cve_correlation / port_correlation: signature " + "  + correlation intelligence.\\n" + "- nvd_lookup / fofa_search: CVE + asset reconnaissance (FOFA needs env creds).\\n" + "- remember / memory_lookup / memory_list: persist + recall verified knowledge.\\n\\n" + "RESOURCE MAP (know what to reach for):\\n" + "- ORCHESTRATION = the engagement framework. orchestration() returns the " + "  lifecycle (scope->recon->analyze->deep->verify->report, each with " + "  entry/exit criteria) + sub-agent team + handoff contract + termination " + "  criteria. Load it at engagement start.\\n" + "- TOOL = acts (scan, taint, verify, record, correlate). Call it to DO something.\\n" + "- PLAYBOOK = campaign plan for a target TYPE. read_playbook(web-application) " + "  BEFORE a full engagement of that type.\\n" + "- SKILL = procedure doctrine. Load the bs-* skill for the phase you are on " + "  (orchestrate, scope, source-audit, verify, review, report); load a technique " + "  skill for the specific technique (WP 0-day, AD, malware).\\n" + "- MANUAL = deep reference for ONE tool. read_tool_manual right before using it.\\n" + "- PAYLOAD = attack payloads for a class. payload_lookup before crafting a probe.\\n" + "- INTELLIGENCE = knowledge. list_attack_vectors (34 categories) maps the " + "  full surface during RECON; list_chains (36) turns a finding into impact; " + "  chain_links composes chains for complex bugs; bypass_lookup when blocked; " + "  payload_lookup when crafting a probe. Reach for them at that moment.\\n\\n" + "NO-BABYSITTING (while scanning + testing):\\n" + "- Scan the WHOLE surface before reporting - every file, entry point, and sink. " + "  Do not stop after the first hit to ask; keep enumerating the full tree.\\n" + "- Test every hypothesis through its full verification cycle - vary probes on " + "  failure, apply bypasses when blocked, keep going. Do not pause to ask.\\n" + "- Persist through partial results: a scan that surfaces few sinks is NOT done - " + "  widen the surface, escalate detectors, dig into each reachable sink.\\n" + "- Only surface to the user when: scope/authorization is genuinely unclear, a " + "  destructive or DoS action needs explicit consent, or the engagement is complete.\\n\\n" + "PERSISTENCE (complex bugs - do not give up):\\n" + "- On any failure (empty output, blocked probe, failed sub-agent/model), call " + "  retry_guidance(signal) for concrete recovery actions before giving up.\\n" + "- One failed probe != not vulnerable. Vary: alternative sinks, other params, " + "  encoding/case/whitespace bypasses, different injection context.\\n" + "- Empty output != no findings. Re-run (server may be stale after an upgrade - " + "  /reload-mcp), or escalate to route_scan / complex_scan for classes taint " + "  misses (POP chains, type juggling, mass assignment, route confusion).\\n" + "- A 'sanitized' sink may not be safe. Challenge the sanitizer: loose == vs ===, " + "  missing EXTR_SKIP, int cast truncation, weak regex.\\n" + "- An unconfirmed hypothesis is KEPT as hypothesis - try alternate verification, " + "  then let adversarial review decide.\\n" + "- Complex chains (deserialization->POP, LFI->RCE) need the FULL chain traced, " + `  not just the first sink.\\n
 ` + "- When a probe is BLOCKED by a WAF/filter/sanitizer, call bypass_lookup(defense) " + "  for concrete techniques (encoding, case, comment insertion, chunked, null byte, " + "  double-encoding, verb tampering, header spoofing) and apply them - do not give up.\\n" + "- CHAIN findings: a low-severity finding usually escalates. list_chains and match it " + "  to a multi-stage chain (SSRF->metadata, SQLi->RCE, LFI->RCE, upload->shell) instead " + "  of stopping at the first vuln.\\n\\n" + "- Complex bugs chain ACROSS chains: after confirming one chain, chain_links " + "  shows what follows (SSRF->metadata then default-creds->pivot via stolen IAM). " + "  Trace the full composition, not just a single chain.\\n\\n" + "IRON RULES:\\n" + "- Scope first; authorized targets only. Refuse out-of-scope or destructive/DoS work.\\n" + "- A hit is a hypothesis; a verified exploit (or proven data-flow) is the finding.\\n" + "- Prefer the one-call run_engagement path; fall back to granular tools when you " + "  need finer control."
   });
   server.registerTool("blitz_scan", {
@@ -53945,6 +53977,15 @@ ${statusLine}` : statusLine },
   }, async ({ signal }) => {
     return { content: [{ type: "text", text: JSON.stringify(retryGuidance(signal)) }] };
   });
+  server.registerTool("orchestration", {
+    title: "Orchestration framework",
+    description: "INTEL: return the orchestration framework — the engagement lifecycle (scope→recon→analyze→deep→verify→report, each with entry/exit criteria), the sub-agent team (roles + tools + returns), the handoff contract, and the termination criteria. Load this at engagement start; pass a phase/role id (scope, recon, analyze, deep, verify, report, or team/handoff/termination) to focus.",
+    inputSchema: {
+      part: string2().optional().describe("Optional focus: lifecycle / team / handoff / termination, or a phase id (scope, recon, analyze, deep, verify, report) or role id (recon, taint, deep, verify).")
+    }
+  }, async ({ part }) => {
+    return { content: [{ type: "text", text: JSON.stringify(orchestration(part)) }] };
+  });
   server.registerTool("read_payload", {
     title: "Read a payload collection",
     description: "INTEL: read the full payload collection for a category (or a specific file).",

package/intelligence/orchestration.json

@@ -0,0 +1,115 @@
+{
+  "_comment": "The Blitz Strike orchestration framework. The driving LLM loads this at engagement start and follows the lifecycle phase by phase, fanning out the team in parallel where phases are independent.",
+  "lifecycle": [
+    {
+      "phase": "scope",
+      "name": "Scope & gate",
+      "goal": "confirm target, scope, and authorization before touching anything",
+      "entry": "engagement start",
+      "exit": "target classified (URL vs source), scope_check passed",
+      "tools": ["scope_check"],
+      "parallel": false
+    },
+    {
+      "phase": "recon",
+      "name": "Recon (BLITZ)",
+      "goal": "map the full attack surface — entry points, sinks, framework, tech",
+      "entry": "scope confirmed",
+      "exit": "entry points + sinks + framework enumerated (no surface left unmapped)",
+      "tools": ["blitz_scan", "blitz_file", "live_recon", "detect_framework", "list_attack_vectors"],
+      "parallel": true
+    },
+    {
+      "phase": "analyze",
+      "name": "Analyze (EAGLE-EYE)",
+      "goal": "trace source→sink reachability for every candidate sink",
+      "entry": "surface mapped",
+      "exit": "each sink classified reachable / unreachable / sanitized, with a source→sink trace",
+      "tools": ["eagle_eye2", "taint_file", "taint_scan", "trace_data_flow"],
+      "parallel": true
+    },
+    {
+      "phase": "deep",
+      "name": "Deep (complex bugs)",
+      "goal": "hunt complex-bug classes breadth detectors miss",
+      "entry": "taint analysis complete",
+      "exit": "POP chains, type juggling, mass assignment, route confusion candidates enumerated + linked to escalation chains",
+      "tools": ["complex_scan", "route_scan", "list_chains", "chain_links"],
+      "parallel": true
+    },
+    {
+      "phase": "verify",
+      "name": "Verify (STRIKE)",
+      "goal": "confirm each hypothesis live with deterministic evidence",
+      "entry": "hypotheses exist",
+      "exit": "every hypothesis confirmed or rejected (marker + negative control)",
+      "tools": ["strike_verify", "strike_resolve", "finding_create", "finding_transition", "finding_attach_evidence"],
+      "parallel": true
+    },
+    {
+      "phase": "report",
+      "name": "Report",
+      "goal": "emit submission-ready, deduplicated findings",
+      "entry": "verification complete",
+      "exit": "report emitted (markdown/JSON/SARIF) with SHA-256 integrity hash",
+      "tools": ["dedup_findings", "generate_report"],
+      "parallel": false
+    }
+  ],
+  "team": [
+    {
+      "id": "recon",
+      "name": "Recon agent (BLITZ tier)",
+      "responsibility": "map the exposed attack surface",
+      "tools": ["blitz_scan", "blitz_file", "live_recon", "detect_framework", "list_attack_vectors"],
+      "returns": "enumerated entry points + sinks + framework/tech, each with file:line or URL"
+    },
+    {
+      "id": "taint",
+      "name": "Taint agent (EAGLE-EYE tier)",
+      "responsibility": "trace source→sink reachability",
+      "tools": ["eagle_eye2", "taint_file", "taint_scan", "trace_data_flow"],
+      "returns": "reachable sinks with a source→sink trace and a reachability verdict"
+    },
+    {
+      "id": "deep",
+      "name": "Deep agent (complex bugs)",
+      "responsibility": "hunt complex-bug classes taint misses",
+      "tools": ["complex_scan", "route_scan", "list_chains", "chain_links"],
+      "returns": "POP chain / type juggling / mass assignment / route confusion candidates, linked to escalation chains"
+    },
+    {
+      "id": "verify",
+      "name": "Verify agent (STRIKE tier)",
+      "responsibility": "confirm live with evidence",
+      "tools": ["strike_verify", "strike_resolve", "finding_create", "finding_transition", "finding_attach_evidence"],
+      "returns": "confirmed or rejected findings, each with marker + negative control + evidence"
+    }
+  ],
+  "handoff": {
+    "delegate_contract": [
+      "a specific, self-contained goal",
+      "the exact tool names to use",
+      "the exact argument names (source-analysis tools take `path`, only `run_engagement` takes `target`)",
+      "what deterministic output is required back"
+    ],
+    "result_contract": [
+      "deterministic evidence (file:line, sink, trace, marker reflection) — never prose",
+      "a verdict per finding: confirmed / hypothesis / rejected",
+      "no fabricated results — empty is reported as empty, not filled in"
+    ]
+  },
+  "termination": {
+    "done_when": [
+      "every reachable sink has been traced",
+      "every hypothesis is confirmed or rejected",
+      "findings are deduplicated and the report is emitted",
+      "no pending hypotheses remain"
+    ],
+    "not_done_when": [
+      "a scan surfaced few sinks but the target surface is wider",
+      "hypotheses remain unverified",
+      "a low-severity finding has not been checked for escalation (chain_links)"
+    ]
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "1.0.84",
+  "version": "1.0.86",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {

package/skills/bs-orchestrate-engagement.md

@@ -63,6 +63,27 @@ step you are on. Do not improvise a plan the playbook already spells out.
 
 6. **Report.** Emit `generate_report` + `cvss_score` + `write-report`.
 
+## Lifecycle, team, and termination
+
+Load the full framework with `orchestration` (or focus it:
+`orchestration(lifecycle)`, `orchestration(team)`, `orchestration(handoff)`,
+`orchestration(termination)`, or a single phase/role id). It is the authoritative
+reference — do not improvise the shape of the engagement:
+
+- **6 phases, each with entry/exit criteria**: scope → recon (BLITZ) → analyze
+  (EAGLE-EYE) → deep (complex bugs) → verify (STRIKE) → report. A phase is not
+  done until its exit criterion is met.
+- **4 sub-agent roles** with tools + a deterministic output contract:
+  `recon` (surface), `taint` (reachability), `deep` (POP/type-juggling/route
+  confusion), `verify` (live confirmation + evidence).
+- **Handoff contract**: every delegate carries a specific goal, the exact tool
+  names, the exact arg names (`path` vs `target`), and the required evidence
+  back. Results come back as deterministic evidence — never prose.
+- **Termination**: done when every reachable sink is traced, every hypothesis is
+  confirmed or rejected, and the report is emitted (deduplicated). NOT done when
+  the surface is wider than the scan, hypotheses remain unverified, or a
+  low-severity finding hasn't been checked for escalation (`chain_links`).
+
 ## Orchestration pattern (native plan + sub-agents)
 
 You are the orchestrator — use your platform's native planning and delegation
@@ -104,6 +125,12 @@ user sees you working, not a silent tool call.
 
 ## Rules
 
+- **No-babysitting during scan + test.** Scan the whole surface before
+  reporting — every file, entry point, sink. Test every hypothesis through its
+  full cycle — vary probes on failure, apply bypasses when blocked, keep going.
+  A scan that surfaces few sinks is not done: widen the surface and escalate
+  detectors. Only pause for the user when scope is genuinely unclear, a
+  destructive action needs consent, or the engagement is complete.
 - **Persist — complex bugs do not give up.** A failed probe is not "not
   vulnerable" (vary sinks, params, encodings); empty output is not "no
   findings" (re-run or escalate to `route_scan`/`complex_scan`); a "sanitized"