blitzstrike 2.4.168 → 2.4.170

package/CHANGELOG.md

@@ -5,6 +5,33 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.170] — 2026-10-11
+
+### Added — 3-way retest verdict + planner doctrine (from ARTEX reference)
+
+- `retest_finding` now supports a third verdict `inconclusive` (could not determine —
+  WAF blocked / target down / missing login / evidence insufficient), so one failed
+  request is never recorded as "fixed". `inconclusive -> retesting` re-opens the loop.
+- Added 5 doctrine rules distilled from ARTEX's planner/pentest/worker discipline:
+  `never_stall` (always emit the next action — a 0-action stall is not restraint),
+  `breadth_then_focus` (2-3 mechanically-different routes in parallel, then focus),
+  `quantitative_acceptance` (verify measured coverage/findings before "done"),
+  `negative_recheck_once` (a negative observation is not a verdict — re-check once),
+  `observed_vs_inferred` (never upgrade a version/CVE/inferred hit to confirmed).
+
+## [2.4.169] — 2026-10-11
+
+### Added — finding retest loop (post-confirmation lifecycle)
+
+- The finding lifecycle no longer ends at `confirmed`: added `retesting`, `fixed`,
+  and `still_vulnerable` states with the transitions `confirmed -> retesting ->
+  fixed | still_vulnerable`, and `still_vulnerable -> retesting` (re-retest after
+  the next patch window; `fixed` is terminal).
+- New `retest_finding` tool: pass a confirmed/still_vulnerable finding + a retest
+  verdict (`fixed` or `still_vulnerable`) + reason; it advances the lifecycle and
+  records the verdict + reason as evidence. Run `strike_verify` first to obtain the
+  live verdict, then record it here.
+
 ## [2.4.168] — 2026-10-11
 
 ### Fixed — blind_sqli_extract: space extraction + drift-proof time fallback

package/dist/index.js

@@ -33277,7 +33277,11 @@ var LIFECYCLE_TRANSITIONS = {
   triaged: ["hypothesis", "rejected", "out_of_scope"],
   hypothesis: ["validating", "false_positive", "rejected", "blocked"],
   validating: ["confirmed", "false_positive", "blocked", "out_of_scope"],
-  confirmed: [],
+  confirmed: ["retesting"],
+  retesting: ["fixed", "still_vulnerable", "inconclusive", "false_positive"],
+  fixed: [],
+  still_vulnerable: ["retesting"],
+  inconclusive: ["retesting"],
   false_positive: [],
   rejected: [],
   blocked: [],
@@ -33440,6 +33444,17 @@ function rejectFinding(finding, status, reason, evidence) {
     timestamps: { ...updated.timestamps, updated: new Date().toISOString() }
   };
 }
+function retestFinding(finding, opts) {
+  const retesting = transition(finding, "retesting");
+  const ev = opts.evidence?.map((e) => makeEvidence(e)) ?? [];
+  const result = transition(retesting, opts.verdict);
+  return {
+    ...result,
+    remediation: { ...result.remediation, retest_note: opts.reason },
+    evidence: [...result.evidence, ...ev],
+    timestamps: { ...result.timestamps, updated: new Date().toISOString() }
+  };
+}
 
 // src/sinks.ts
 init_secrets();
@@ -63721,6 +63736,31 @@ var HUNTING_DOCTRINE = [
     id: "per_domain_exhaustion",
     title: "Depth-First Per Domain — Drive Each to Exhaustion (Dead-End)",
     rule: "When scope spans many domains/hosts, treat EACH as a SEPARATE engagement and go DEPTH-FIRST: finish one domain to total exhaustion before touching the next — never spray a shallow recon across the whole scope. A domain is EXHAUSTED (a true dead-end) only when EVERY item on the exhaustion checklist passes: (a) every subdomain/host enumerated (asset_discovery), (b) every endpoint/param discovered (param_surface / action_surface / JS refs), (c) every class × eligible shape carries a terminal verdict (confirmed/dead/partial/skipped), (d) every hypothesis verified (strike_verify / OOB) or refuted (dead verdict), (e) every foothold escalated to REAL impact (records/admin/PII) or genuinely blocked, and (f) zero obligations remain pending (next_obligation returns none). Only then move to the next domain — a shallow 'found one bug' pass is NEVER a finished domain, and skipping any checklist item means the domain is NOT done."
+  },
+  {
+    id: "never_stall",
+    title: "Never Stall — Always Emit the Next Action",
+    rule: "HARD BOTTOM LINE: whenever the goal is NOT met and there is no in-flight or queued work (zero pending obligations, zero un-verified hypotheses), you MUST produce at least ONE concrete next action toward the goal — emitting zero actions at that moment is a stall, not restraint. A '0 next steps' answer is only legitimate when (a) every identified direction is already covered by in-flight work, or (b) the next step truly depends on an upstream result that has not landed yet. Never let 'nothing left to do' be the lazy default while a goal is unmet and scope remains untested."
+  },
+  {
+    id: "breadth_then_focus",
+    title: "Breadth-First Route Diversity, Then Focus",
+    rule: "Do NOT tunnel-vision the first promising lead. Open by laying out 2–3 MECHANICALLY-DIFFERENT routes in parallel (e.g. an upload chain vs an auth-bypass chain) and let them progress side-by-side; only concentrate effort on a route once it delivers evidence that actually approaches the goal. Early tunnel-vision onto one elegant route is the single-agent failure mode that misses the real bug. Diversity is bounded by scope/constraints: a direction excluded by scope is never opened no matter how different."
+  },
+  {
+    id: "quantitative_acceptance",
+    title: "Quantitative Acceptance Gate — No Premature 'Done'",
+    rule: "When a goal carries a QUANTITATIVE condition (coverage ≥ X%, N flags, a specific privilege, a named asset), you MUST verify the MEASURED value (coverage %, findings count, obtained privilege) against that condition BEFORE marking it met — never declare 'done' on 'roughly achieved / core is in hand'. If the measured value falls short, keep hunting to close the gap instead of stamping the goal complete early."
+  },
+  {
+    id: "negative_recheck_once",
+    title: "A Negative Observation Is Not a Conclusion — Re-Check Once",
+    rule: "A recorded negative ('not injectable', 'port closed', 'not vulnerable', 'filter blocked it') is an OBSERVATION, not a verdict. Before trusting it as a dead-end, inspect its evidence: if it is solid (controlled disproof, path exhausted via multiple encodings/methods/params) then respect it; if it is weak ('looked like' / 'tried once' / inferred) and the direction is in-scope with no other coverage, dispatch ONE re-check via a DIFFERENT path. Re-check the same negative direction AT MOST ONCE — after a second solid negative, record it as dead and move on; never spin on 'one more try'."
+  },
+  {
+    id: "observed_vs_inferred",
+    title: "Observed vs Inferred — Never Upgrade Inferred to Confirmed",
+    rule: "Tag every conclusion with its confidence honestly: OBSERVED (you directly triggered it and hold the request/response or command output) vs INFERRED (you deduced it from a fingerprint/version/diff/phenomenon without actually triggering it). A version/CVE match, a 'looks injectable' param, or a patch-diff inference is INFERRED and must never be reported as a confirmed finding — record it as a hypothesis and verify it live (strike_verify / OOB / a clean oracle) before it can claim confirmed. Disproof is worth as much as proof: an honest dead verdict is a deliverable, an overstated inferred-as-confirmed is a retraction waiting to happen."
   }
 ];
 var DOMAIN_EXHAUSTION_CHECKLIST = [
@@ -66341,7 +66381,7 @@ ${statusLine}` : statusLine },
   });
   server.registerTool("finding_transition", {
     title: "Advance a finding lifecycle (STATEFUL)",
-    description: "FINDINGS: advance a canonical Finding through its lifecycle (detected->triaged->hypothesis->validating->confirmed) and RETURN the updated finding. STATEFUL — pass the FULL finding JSON (from finding_create / run_engagement), not a status string. Rejects illegal transitions with the legal next states. Confirmed is terminal. To confirm FROM a live verdict use strike_resolve instead.",
+    description: "FINDINGS: advance a canonical Finding through its lifecycle (detected->triaged->hypothesis->validating->confirmed, then the retest loop confirmed->retesting->fixed|still_vulnerable) and RETURN the updated finding. STATEFUL — pass the FULL finding JSON (from finding_create / run_engagement), not a status string. Rejects illegal transitions with the legal next states. To confirm FROM a live verdict use strike_resolve; to re-verify a confirmed finding use retest_finding.",
     inputSchema: {
       finding: string2().describe("JSON of the canonical Finding object (from finding_create / run_engagement)"),
       to: string2().describe("Target status (triaged/hypothesis/validating/confirmed/false_positive/rejected/blocked/out_of_scope)")
@@ -66370,6 +66410,43 @@ ${statusLine}` : statusLine },
       }]
     };
   });
+  server.registerTool("retest_finding", {
+    title: "Re-verify a confirmed finding (retest loop)",
+    description: "FINDINGS: re-verify a CONFIRMED (or still_vulnerable/inconclusive) finding to check whether the vendor patched it. Pass the full finding JSON + the retest verdict: 'fixed' (exploit no longer reproduces — patch applied), 'still_vulnerable' (still exploitable), or 'inconclusive' (could NOT determine — WAF blocked / target down / missing login / evidence insufficient; one failed request proves nothing). Advances confirmed -> retesting -> fixed|still_vulnerable|inconclusive and records the verdict + reason as evidence. Run strike_verify FIRST to get the live verdict, then record it here.",
+    inputSchema: {
+      finding: string2().describe("JSON of the canonical Finding object (status confirmed, still_vulnerable, or inconclusive)"),
+      verdict: _enum(["fixed", "still_vulnerable", "inconclusive"]).describe("Retest outcome: fixed (patch applied), still_vulnerable (still exploitable), or inconclusive (could not determine)"),
+      reason: string2().describe("Short note: what changed / what still reproduces / what blocked the check"),
+      evidence: string2().optional().describe("Optional JSON array of evidence entries [{type, description, content}]")
+    }
+  }, async ({ finding, verdict, reason, evidence }) => {
+    let f;
+    try {
+      f = JSON.parse(finding);
+    } catch {
+      return { content: [{ type: "text", text: JSON.stringify({ error: "invalid finding JSON — pass the full Finding object" }) }] };
+    }
+    const from = f.status ?? "detected";
+    if (!(from === "confirmed" || from === "still_vulnerable" || from === "inconclusive")) {
+      return { content: [{ type: "text", text: JSON.stringify({ error: `retest only valid from 'confirmed'/'still_vulnerable'/'inconclusive', not '${from}'`, legal_next: LIFECYCLE_TRANSITIONS[from] ?? [] }) }] };
+    }
+    let ev = [];
+    if (evidence) {
+      try {
+        ev = JSON.parse(evidence);
+      } catch {
+        ev = [];
+      }
+    }
+    const updated = retestFinding(f, { verdict, reason, evidence: ev });
+    const hint = updated.status === "fixed" ? "FIXED — the vendor patched it. The retest closes this finding's loop." : updated.status === "inconclusive" ? "INCONCLUSIVE — could not determine (blocker). One failed request proves nothing; re-retest via retest_finding once the blocker clears." : "STILL_VULNERABLE — re-retest later via retest_finding after the next patch window.";
+    return {
+      content: [{
+        type: "text",
+        text: JSON.stringify({ ...updated, transition: `${from} -> retesting -> ${updated.status}`, hint })
+      }]
+    };
+  });
   server.registerTool("capture_false_positive", {
     title: "Capture a verified false positive (self-hardening)",
     description: "SELF-HARDENING: record a VERIFIED false positive (a code pattern the detector flagged but live verification ruled out) into the writable benchmark corpus, so the next run_benchmark measures whether the detector STILL flags it. Pass the triggering CODE + language + detector + a short note. Every capture makes the detector more precise — close the loop, never just discard a refuted lead.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.168",
+  "version": "2.4.170",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {