blitzstrike 2.4.186 → 2.4.188

package/CHANGELOG.md

@@ -5,16 +5,28 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
-## [2.4.186] — 2026-11-03
+## [2.4.188] — 2026-11-03
 
-### Added — 5 doctrine rules (multi-agent pentest orchestration)
+### Added — 2 doctrine rules (swarm verification + stigmergic priority)
+
+- `verification_oracle` (proof lives outside the model: OOB callback / differential
+  response / timing oracles; OOB never disproves; proof outranks confidence; probe
+  error = inconclusive) and `stigmergic_priority` (time-decaying attention weight —
+  volatile state like sessions/tokens decays fast, durable discoveries like ports/CVEs
+  persist; act on what is still hot).
+
+## [2.4.187] — 2026-11-03
+
+### Added — 6 doctrine rules (multi-agent pentest orchestration)
 
 - `failure_classification` (Technical/Environmental/Conceptual/External — classify
   before retry; 2 similar failures ⇒ conceptual ⇒ pivot), `plan_budget_distribution`
   (10% setup / 30% explore / 30% select / 30% execute; refine by delta, not regenerate),
   `cli_argument_protocol` (verify flags via --help, never copy flags across tools, quote
   shell metacharacters), `technical_channel_english` (technical channel stays English for
-  indexing; anonymize stored techniques with {target_ip}/{username}/{token} placeholders).
+  indexing; anonymize stored techniques with {target_ip}/{username}/{token} placeholders),
+  `compression_preserve_oob` (never drop OOB callback IP/ports/DNS in summaries; summaries
+  are lossless).
 
 ### Added — typed lineage edges for facts
 

package/dist/index.js

@@ -63829,6 +63829,16 @@ var HUNTING_DOCTRINE = [
     id: "compression_preserve_oob",
     title: "Compression Must Never Drop OOB Infrastructure — Summaries Are Lossless",
     rule: "When compressing or summarizing context, NEVER drop out-of-band (OOB) infrastructure — the public callback IP, listener ports, DNS exfiltration domains, and callback URLs. These are the most fragile context (a single line, easily lost in a summary) yet the most load-bearing: you need them to re-establish or verify blind RCE/SSRF/XXE, and once dropped they cannot be reconstructed. Preserve them verbatim in any summary. Likewise, when re-summarizing content that is ALREADY a summary, retain EVERY previously-distilled point — a summary-of-a-summary must be lossless, never a lossy re-compression that silently discards a prior conclusion."
+  },
+  {
+    id: "verification_oracle",
+    title: "Proof Lives Outside the Model — Three Oracles, and OOB Never Disproves",
+    rule: "The line between a scanner that GUESSES a vulnerability and one that PROVES it is a signal OUTSIDE the model: a stronger model re-reading a finding is still a model grading a model. Confirm high-stakes findings against the live target with a non-model oracle, and trust that verdict over any model claim. Three oracles: (1) OOB CALLBACK — the target makes an out-of-band request to infrastructure you control; a fired callback PROVES, but silence never DISPROVES (WAF/egress/slow all look silent); (2) DIFFERENTIAL RESPONSE — an attack response diverges from the negative control; (3) TIMING — an induced delay clears the target's noise floor (and, in ladder mode, scales with the payload). Each oracle returns Proven / Disproven / Inconclusive, and a PROBE ERROR (missing tool, network failure, out-of-scope) is always Inconclusive — infrastructure failure can neither confirm nor condemn. PROOF OUTRANKS CONFIDENCE: a proven finding is worth more than a higher-CVSS-but-unproven one; prefer the verified low over the guessed high."
+  },
+  {
+    id: "stigmergic_priority",
+    title: "Stigmergic Priority — Attention Decays; Durable Discoveries Outlast Volatile State",
+    rule: "Treat every finding/state item as carrying a time-decaying attention weight (like a pheromone trail). VOLATILE state — session tokens, one-shot probe results, transient errors — should decay FAST (minutes) so you stop paying attention to it once it is stale. DURABLE discoveries — open ports, tech fingerprints, CVE matches, confirmed vulns — should persist for hours so the engagement keeps them in focus across a long campaign. When deciding what to act on next, prefer what is still 'hot' (fresh + high-weight): a just-confirmed vuln or a just-opened port outranks an old, cold probe result. Never let a stale volatile token masquerade as a current fact — check its age before relying on it."
   }
 ];
 var DOMAIN_EXHAUSTION_CHECKLIST = [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.186",
+  "version": "2.4.188",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {