Violin
3f4c67bdfc
Clean release pytest basetemps
2026-07-22 11:25:26 +01:00
Violin
5fc876367d
Release Violin 3.0.0 profile
2026-07-22 11:18:53 +01:00
Violin
d3f3a587db
Remove obsolete skill marker contracts
2026-07-22 11:09:40 +01:00
Violin
5c40c33a1d
Merge master into dev before Violin 3.0 consolidation
2026-07-22 11:02:14 +01:00
Violin
b80acd2887
chore: v2.0.7+2.0.8 changelog, version bumps, lint fixes
2026-07-19 16:55:00 +01:00
Violin
3f8eb5371f
Add semantic anti-stuck enforcement
2026-07-19 01:28:01 +01:00
Violin
dd557974a3
Require proof-backed finding self-review
2026-07-19 01:24:04 +01:00
Violin
e625eb051c
Enforce skill receipts in hooks and browsers
2026-07-19 01:18:13 +01:00
Violin
7ed3898dff
gate execution on skill receipts
2026-07-19 01:08:16 +01:00
Violin
a2837c6377
require skill delivery for PTT updates
2026-07-19 00:58:58 +01:00
Violin
ae52d86e5a
add automatic Kali backend selection
2026-07-19 00:44:08 +01:00
Violin
2332c48a64
add skill delivery receipts
2026-07-19 00:38:34 +01:00
Violin
5cf16544a7
add v3 skill selection policy
2026-07-19 00:31:20 +01:00
Violin
5873cf9ddd
fix CodeQL quality findings (v2.0.6)
2026-07-19 00:03:08 +01:00
Violin
6e8ba6e77c
fix exact repeat history parsing ( #3 )
2026-07-18 23:31:16 +01:00
Violin
22560d57b4
block secondary-only primary targets ( #2 )
2026-07-18 23:19:50 +01:00
Violin
a7dffbd191
fix compound terminal command policy ( #1 )
2026-07-18 23:01:48 +01:00
Violin
e2be6759a5
restrict workflow token permissions
2026-07-18 22:54:16 +01:00
Violin
28c72446fa
upgrade pytest for CVE-2025-71176
2026-07-18 22:42:57 +01:00
Violin
dc53bbb08a
consolidate guard batch collaboration
2026-07-18 08:02:50 +01:00
Violin
f461945394
Remove iteration cap and extend heartbeat cadence
2026-07-17 21:36:20 +01:00
Violin
2926beb3a7
Fix heartbeat command threshold
2026-07-17 21:06:51 +01:00
Violin
1a86fc7916
Fix release check in clean CI checkout
2026-07-17 20:44:06 +01:00
Violin
909b66cd52
feat: implement violin_guard plugin registration and command execution hooks
2026-07-17 20:35:43 +01:00
Violin
f65b70871d
feat: add violin_guard plugin with tool registration and execution hooks
2026-07-17 20:34:06 +01:00
Violin
dc6d9a41a8
Allow arbitrary Kali CLI tools through guarded execution
2026-07-17 20:31:28 +01:00
Violin
698edc0a45
chore: bump version to v2.0.0 and update docs
2026-07-17 20:26:47 +01:00
Violin
5870509fdb
feat: implement violin_guard plugin for centralized command execution auditing, terminal policy enforcement, and history tracking.
2026-07-17 20:14:20 +01:00
Violin
1c5bfb9ba2
fix: increase file lock acquisition timeout to prevent flaky concurrent lock test timeouts on Windows
2026-07-16 18:24:57 +01:00
Violin
b02d8eb68f
refactor: reorganize violin guard core, unify locking and json storage, optimize facades
2026-07-16 18:23:46 +01:00
Violin
56387e2577
perf: optimize PTT lookup in handle_exec_burst
2026-07-16 18:17:54 +01:00
Violin
c816bcd6a9
feat: implement target resolution for handle_target in violin_guard
2026-07-16 18:12:44 +01:00
Violin
681450278d
feat: implement engagement directory bootstrap and auto-repair functionality for violin_guard
2026-07-16 18:09:06 +01:00
Violin
b739e0ff9e
Refactor target extraction logic to simplify candidate identification and enhance test for explicit targets handling
2026-07-16 17:34:39 +01:00
Violin
0075850b61
Add playbooks for SQL Injection, SSRF, and XSS vulnerabilities; enhance testing suite
...
- Created a comprehensive playbook for SQL Injection (SQLi) detailing types, detection methods, tools, and remediation strategies.
- Added a playbook for Server-Side Request Forgery (SSRF) covering classification, detection payloads, and remediation guidance.
- Introduced a playbook for Cross-Site Scripting (XSS) including types, detection techniques, and safe proof of concept examples.
- Expanded the test suite with new tests for command history deduplication, scope authorization, and structured argument handling.
- Improved existing tests for engagement and execution tracking, ensuring robust coverage of functionality.
2026-07-16 17:20:00 +01:00
Violin
a51aa00d06
Refactor playbooks and templates for improved evidence handling and research documentation
...
- Updated various playbooks to use `$ENG_DIR` for storing evidence files instead of hardcoded paths.
- Enhanced documentation in playbooks to include mandatory CVE and exploit research fields in hypotheses.
- Introduced a new `pty-safe-delivery.md` reference for safe file delivery practices over PTY.
- Added a `shell_ctrl.py` template for PTY shell control with safeguards against long commands and file transfers.
- Improved tests to validate new hypothesis fields and ensure compliance with updated playbook requirements.
- General cleanup and consistency improvements across playbooks and templates.
2026-07-13 21:10:43 +01:00
Violin
a9130fe02c
Harden plugin release checks and CI
2026-07-13 08:53:57 +01:00
Violin
e84de38943
Serialise concurrent guard state transitions
2026-07-13 08:49:36 +01:00
Violin
98b4d8ed7d
Bind sync batches to captured PTT tasks
2026-07-13 08:45:44 +01:00
Violin
ac5848a85a
Enforce PTT phase and hypothesis relevance
2026-07-13 08:41:03 +01:00
Violin
cdae366bdc
Enforce scope authorization and exclusions
2026-07-13 08:36:02 +01:00
Violin
a2c551ef59
Fix bounded sync credit enforcement
2026-07-13 08:30:07 +01:00
Violin
8884e6956f
P1-hyp: enforce out-of-scope target rejection on hypothesis write
...
update_hypothesis silently skipped the scope check because it called
validate_hypothesis_record without forwarding in_scope_hosts, so an
out-of-scope target was written to the board. Thread in_scope_hosts
through so both the direct API and handle_record_hypothesis reject
out-of-scope targets fail-closed (verified ad-hoc, 7/7).
2026-07-12 21:05:53 +01:00
Violin
ea7e094528
Remediate audit P0/P1 findings; migrate tests to green
...
- state.py: fcntl/msvcrt file locking, reservation+finalization, history
verification, remove dead subprocess bridges (p1-lock)
- hypotheses.py: enforce canonical status, phase/host/service/port match,
reject unrelated hypotheses (p1-hyp)
- tools.py/__init__.py: retain kwargs (task_id), lifecycle hooks wired
(REGISTERED_TOOLS + no-op-then-active hooks) (p1-life)
- Migrate tests from tests/*.py to tests/guard + tests/pentest_docs; align
to actual API (handle_target returns ips[0], handle_exec_burst fail-closed,
PTT self-certify uses real batch_id, post-exploitation requires hypothesis)
- scoping.md: add checkpoint.json continuity-artifact drift note
- pyproject.toml: v1.2.0, per-file-ignores for tests/scripts (E402/S101)
- Add .pytest-tmp-plugin/ to .gitignore
64 passed; ruff clean.
2026-07-12 20:57:55 +01:00
Violin
48b8abd292
Audit pentest skill docs against guard surface
2026-07-12 17:18:49 +01:00
Violin
eae934bd5b
Add CTF bootstrap and repair guard CLI docs
2026-07-12 17:09:00 +01:00
Violin
56aec13ff1
Remove stale history tool references
2026-07-12 16:47:32 +01:00
Violin
426e7c4817
Align guard tests with plugin contract
2026-07-12 16:35:29 +01:00
Violin
8d8fb81ffb
Consolidate Violin Guard into Hermes plugin
2026-07-12 16:00:16 +01:00
Violin
283f2683a9
feat: improve guard and workflow reliability
2026-07-12 09:39:55 +01:00
Violin