blitzstrike 2.4.180 → 2.4.181

package/CHANGELOG.md

@@ -25,7 +25,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 - `constraint_self_contained`, `record_is_memory` (write-back is anti-compaction
   long-term memory — record immediately, only increments), `wrapup_highest_priority`
   (land conclusions then stop), `high_value_surface` (parsing/charset, upload,
-  (de)serialization, cache race, TOCTOU, type confusion, mass assignment).
+  (de)serialization, cache race, TOCTOU, type confusion, mass assignment),
+  `serial_chain_discipline` (each chain step consumes the prior step's REAL output),
+  `compression_discipline` (synthesize causally, preserve observed/inferred + source ids).
 
 ## [2.4.179] — 2026-10-11
 

package/dist/index.js

@@ -63794,6 +63794,16 @@ var HUNTING_DOCTRINE = [
     id: "high_value_surface",
     title: "High-Value Attack Surface — The Often-Overlooked Faces",
     rule: "When mapping the attack surface, prioritize these often-overlooked high-value faces (pick what applies, not a checklist obligation): input parsing / encoding / charset boundaries; file upload; (de)serialization; built-in routing + pre-auth-reachable handlers; error-handling leaks; cache poisoning / cache race; race conditions (TOCTOU); type confusion (scalar vs array); and mass assignment. These are where the highest-impact bugs hide when the obvious endpoints come up clean — before declaring a surface exhausted, confirm none of these faces remain untested."
+  },
+  {
+    id: "serial_chain_discipline",
+    title: "Serial Chain — Each Step Depends on the Prior Step's REAL Output",
+    rule: "For a serial exploitation chain (①→②→③, where each later step consumes the PRIOR step's actual output — a leaked key, an auth cookie, a session id, a written file, a generated nonce): drive it ONE STEP AT A TIME. Execute step ① and capture its REAL output first; only then design and run step ② against that concrete output; never imagine or assume the output of a step you have not actually run, and never plan/execute step ③ while step ②'s prerequisite still does not exist. Across codebases/interfaces, actively pull the FULL detail of every known clue into the current session to chain gadgets together — do not stop at the summary. A chain is only as real as the weakest link you actually produced."
+  },
+  {
+    id: "compression_discipline",
+    title: "Compression — Synthesize Causally, Preserve Confidence + Provenance",
+    rule: "When summarizing or compressing a set of related exploration nodes (facts/intents/findings), do NOT enumerate — synthesize: trace the causality (which fact birthed which intent, which intent produced which conclusion) and state what this region of the exploration CONCLUDED. Preserve distinctions between different conclusions (do not merge them into one vague sentence). Preserve evidence strength: mark observed vs inferred, and flag an inferred NEGATIVE/doubtful conclusion as inference-that-can-be-rechecked, never as a settled fact. Tag each conclusion with its source id(s) (e.g. #12, #28) so it can be traced back. State only what the inputs contain — never introduce a judgment the inputs do not support. Let length follow content: short when the conclusions are few, long only when they are many and genuinely distinct — always well under the sum of the inputs."
   }
 ];
 var DOMAIN_EXHAUSTION_CHECKLIST = [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.180",
+  "version": "2.4.181",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {