blitzstrike 2.4.188 → 2.4.190

package/CHANGELOG.md

@@ -5,6 +5,28 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.190] — 2026-11-03
+
+### Added — 4 anti-false-positive doctrine rules (PentestGPT + xalgorix + Dark-Moon + airecon)
+
+- `evidence_grounding` (evidence must be a byte-exact verbatim substring of real tool
+  output — never paraphrased or repaired), `proof_standard` (class-matches-mechanism:
+  SSRF = server-origin request, XSS = executed not reflected, SQLi = differential delay/
+  DB error, IDOR = data returned; a 200/echo/tool-says-vuln is never a confirmed finding;
+  reproducibility ≥2/3), `positive_artifact_dispatch` (a fingerprint/plane dispatch needs
+  a POSITIVE tell, never the absence of other markers), `never_replay_actionful` (only
+  retry no-action failures — never replay a side-effecting attempt).
+
+## [2.4.189] — 2026-11-03
+
+### Added — 3 doctrine rules (swarm FP filter + red-team gates)
+
+- `fails_open_fp_filter` (FP filters must fail OPEN — error/timeout keeps every
+  finding, never silently discard a real bug), `single_choke_point` (a rule enforced
+  on one path only is no rule — constraints must gate EVERY dispatch path including
+  background jobs), `phase_ordering` (informational → exploitation → post-exploitation;
+  refuse a later-phase tool while an earlier phase is incomplete).
+
 ## [2.4.188] — 2026-11-03
 
 ### Added — 2 doctrine rules (swarm verification + stigmergic priority)

package/dist/index.js

@@ -63839,6 +63839,41 @@ var HUNTING_DOCTRINE = [
     id: "stigmergic_priority",
     title: "Stigmergic Priority — Attention Decays; Durable Discoveries Outlast Volatile State",
     rule: "Treat every finding/state item as carrying a time-decaying attention weight (like a pheromone trail). VOLATILE state — session tokens, one-shot probe results, transient errors — should decay FAST (minutes) so you stop paying attention to it once it is stale. DURABLE discoveries — open ports, tech fingerprints, CVE matches, confirmed vulns — should persist for hours so the engagement keeps them in focus across a long campaign. When deciding what to act on next, prefer what is still 'hot' (fresh + high-weight): a just-confirmed vuln or a just-opened port outranks an old, cold probe result. Never let a stale volatile token masquerade as a current fact — check its age before relying on it."
+  },
+  {
+    id: "fails_open_fp_filter",
+    title: "False-Positive Filters Must Fail OPEN — Never Silently Discard",
+    rule: "Any automated false-positive filter or second-opinion scorer must FAIL OPEN: if it errors, times out, or is unreachable, keep EVERY finding and skip the filter — a transient failure must never silently discard a real bug. A dropped finding is an irreversible loss (the bug goes unreported); a kept false-positive is cheap to dismiss in triage. Only drop a finding when the filter returns a CONFIDENT negative verdict; on uncertainty or failure, keep it. This is the one asymmetry in detection that must always favor recall over precision."
+  },
+  {
+    id: "single_choke_point",
+    title: "A Rule Enforced on One Path Only Is No Rule — One Choke Point",
+    rule: "Every operation constraint / red-line / scope check must sit at a SINGLE pre-dispatch choke point that EVERY execution path passes through — the direct tool call, the planned batch, the sub-agent, AND the background/spawned job. A rule enforced on only one path is no rule: the agent simply routes the forbidden action through an un-gated path. Before adding a guard, enumerate every path that can dispatch work and confirm the guard sits on all of them, or the guard is cosmetic. When a spawned/background job would run a tool, gate the SPAWN, not just the tool."
+  },
+  {
+    id: "phase_ordering",
+    title: "Phase Ordering — Informational → Exploitation → Post-Exploitation",
+    rule: "Enforce phase ordering so the engagement cannot jump ahead: INFORMATIONAL (recon/discovery) must precede EXPLOITATION (weaponization/impact), which precedes POST-EXPLOITATION (persistence/pivot/lateral). A tool or action from a later phase must be refused while an earlier phase is incomplete — you cannot exploit before you have enumerated, and you cannot pivot before you have a foothold. This is not bureaucracy: it prevents the agent from burning a Metasploit module or a brute-force campaign against a target it has not yet fingerprinted, which is both noisy and self-defeating."
+  },
+  {
+    id: "evidence_grounding",
+    title: "Evidence Must Be a Byte-Exact Quote From Real Tool Output",
+    rule: "Every finding's evidence must be a VERBATIM, contiguous substring of an actual tool receipt — copied byte-for-byte, never invented, paraphrased, or 'repaired'. Before a claim can be confirmed, locate the exact quote in the real command/output/response; if the quote cannot be found in a genuine receipt, downgrade the claim to a hypothesis (progress) or reject it — never let a paraphrased or truncated reconstruction carry a finding. Truncated output can never complete a finding. This is the single strongest anti-hallucination rule: it forces every conclusion to be traceable to a byte that actually appeared."
+  },
+  {
+    id: "proof_standard",
+    title: "A Confirmed Finding Needs a Concrete Outcome — Not a 200, Not a Tool Saying 'Vuln'",
+    rule: "Confirm a finding only when ALL hold: (1) CLASS MATCHES MECHANISM — SSRF means the target's own server made the outbound request; XSS means the script actually EXECUTED, not just reflected; SQLi means extracted data or a DB error or a repeated differential delay; IDOR means protected data was returned or state changed, not a 200 with an empty body. (2) PROOF IS A CONCRETE OUTCOME — a 200/echo/reflection/version-string is NOT an outcome. (3) CVSS MATCHES IMPACT — claim C:H only if you actually obtained sensitive data. (4) NOT BY-DESIGN / NOT ATTACKER-SUPPLIED — a token you yourself placed in the URL cannot be 'stolen'. NEVER a confirmed finding: the endpoint merely exists, a scanner/tool said 'vulnerability', an error message alone, a response-size difference alone, or something observed only once. Reproducibility is required: confirm ≥2 of 3 attempts."
+  },
+  {
+    id: "positive_artifact_dispatch",
+    title: "Positive-Artifact Dispatch — Absence of Markers Is Not a Signal",
+    rule: "When fingerprinting or dispatching a technique/tool based on a signal, require a POSITIVE tell before acting: dispatch the Go-recon path only on a concrete Go marker (a `404 page not found` body, a `/debug/pprof` 200), never on the ABSENCE of other frameworks' markers. Dispatch a cloud/identity/CI-CD/secret plane only on a concrete, VERIFIED artifact (an AKIA key that actually authenticates via `sts get-caller-identity`), never on inference or 'this looks like it could be'. Absence of evidence is not evidence — the negative space is infinite, and routing on it sends the agent chasing ghosts."
+  },
+  {
+    id: "never_replay_actionful",
+    title: "Never Replay an Actionful Attempt — Retry Only What Never Ran",
+    rule: "When retrying a failed step, first determine whether it had SIDE EFFECTS: if a tool/command/request actually executed (an action receipt exists), NEVER replay it — a re-run would duplicate the exploit, burn a brute-force budget, or re-trigger a state change. Only retry a NO-ACTION failure (provider error, timeout before any side-effecting call, interrupted before execution) with a fresh attempt. If an actionful attempt must be revisited, require NEW basis evidence that justifies a different action — not the same command again. This is the one rule that keeps automatic retry from becoming automatic double-tap."
   }
 ];
 var DOMAIN_EXHAUSTION_CHECKLIST = [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.188",
+  "version": "2.4.190",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {