nsaspy/hackmode

Fork 0

EPIC: Public ZeroForge symbolic port into Hackmode / Hackpert #190

New issue

Open

opened 2026-09-05 07:52:43 +00:00 by nsaspy · 1 comment

nsaspy commented

2026-09-05 07:52:43 +00:00

Owner

Authorization

The operator explicitly authorizes a public port/reimplementation of the useful ZeroForge architecture and behavior into Hackmode as symbolic Prolog-RLM/Hackpert systems.

This authorization is to make the resulting implementation, rules, contracts, tests, documentation, and public architecture publishable in the public Hackmode ecosystem.

It is not authorization to dump a private repository verbatim.

Publication boundary

Private ZeroForge material may be used as an implementation/reference source when available to an authorized worker, but public output MUST be re-expressed as public Hackmode/Prolog-RLM architecture:

private ZeroForge concepts / behavior / lessons
        ↓
semantic inventory
        ↓
typed objectives + facts + rules + expert contracts
        ↓
Hackpert expert families / symbolic plans
        ↓
Prolog-RLM expert + reasoning substrate
        ↓
Hackmode typed capabilities / evidence / effects
        ↓
public tests + docs + implementation

Public output may include independently expressed:

algorithms and behavioral contracts;
state machines and decision rules;
Prolog facts/rules/constraints;
expert applicability/selection logic;
typed plan/action/evidence schemas;
verification predicates;
tests using synthetic/public fixtures;
interoperability protocols;
documentation of the new public architecture.

Public output MUST NOT automatically include:

verbatim private source files or large source fragments;
private commit/issue/PR history;
secrets, credentials, tokens, target data, customer data, private endpoints or infrastructure details;
private datasets/captures/operations;
private-only comments, identities or provenance that are not required for the public implementation;
artifacts whose publication rights are not actually owned/authorized.

If a component cannot be safely/publicly re-expressed, mark it PRIVATE-REFERENCE-ONLY and implement a new public equivalent from its required behavior.

Mission

Port the useful ZeroForge concepts into Hackmode as first-class symbolic cyber reasoning, not as another standalone agent framework.

Target architecture:

Hackmode operation / scope / assets / evidence
        ↓
Hackpert objective loop
        ↓
Prolog-RLM expert registry + reasoning modes
        ↓
ZeroForge-derived symbolic experts / rules / planning semantics
        ↓
typed capability request
        ↓
Hackmode authority + provider/effect gate
        ↓
fresh evidence
        ↓
VERIFY objective
        ↓
continue / repair / stop

Architectural invariants

Hackmode remains canonical for operations, scope, assets, evidence, providers, effects, Tek9/KB state and product UI.
Prolog-RLM remains the reusable reasoning/expert substrate.
ZeroForge does not remain a second scheduler, second state store, second authority plane or second tool runtime after the port.
Hackpert passive|active authority remains orthogonal to Prolog-RLM direct|symbolic|symbolic-recursive|auto reasoning.
Public implementation should prefer deterministic symbolic experts and typed plans; model/RLM fallback is explicit and bounded.
Generated/model-produced content is candidate data, not automatic executable authority.
Final success requires evidence against the unchanged objective/spec.

Porting phases

Phase 1 — semantic inventory

For each useful ZeroForge subsystem/behavior, classify it as:

PORT AS SYMBOLIC EXPERT
PORT AS TYPED PLAN/STATE MACHINE
PORT AS GENERIC PROLOG-RLM FEATURE
PORT AS HACKMODE CAPABILITY/ADAPTER
PORT AS KB/RULE DATA
REIMPLEMENT FROM BEHAVIOR
PRIVATE-REFERENCE-ONLY
DROP

Capture required behavior without copying unnecessary private implementation detail.

Phase 2 — symbolic model

Translate accepted behavior into:

normalized objectives/specs;
facts and constraints;
expert applicability rules;
strategy-selection rules;
plan/playbook graph structures;
evidence requirements;
failure/non-progress rules;
verification rules;
repair/escalation rules;
reusable KB entries with provenance.

Phase 3 — capability mapping

Map any external action to existing/new typed Hackmode capabilities. No raw private executor is carried forward as authority.

Examples may include recon, source analysis, browser work, fuzzing, vulnerability intelligence, local process execution, evidence acquisition and report generation, but every concrete effect stays behind Hackmode policy/scope/admission.

Phase 4 — Prolog-RLM convergence

Use lost-rob0t/prolog-rlm#389 as the upstream host/cyber harness and the first-class expert work under prolog-rlm#376.

Do not build a ZeroForge-specific runtime protocol if the generic host/session/expert/capability interfaces can represent the behavior.

Phase 5 — public conformance corpus

For each ported behavior, add synthetic/public fixtures proving equivalent semantic outcomes, not source identity.

Tests should demonstrate:

expert selection;
strategy transition;
typed action request;
authority denial/admission;
evidence update;
failure/no-progress behavior;
verification;
deterministic replay where applicable.

Phase 6 — retire private runtime dependency

Once public symbolic parity is proven for a feature, Hackmode must no longer require the private ZeroForge implementation for that feature.

The private repository may remain historical/reference material, but the public implementation becomes authoritative for Hackmode.

Initial public expert families

The exact inventory depends on private-source review, but likely public targets include:

recon / attack-surface expert;
vulnerability hypothesis expert;
evidence/corroboration expert;
source-assisted reasoning expert;
strategy / next-action expert;
failure / no-progress diagnosis expert;
repair / alternate-path expert;
objective verification expert;
review/critic expert;
CTF-oriented objective solving;
BBP-oriented scoped finding validation.

Do not assume ZeroForge names map 1:1 to public expert names.

Relationship to BBP / CTF roadmap

This epic is one of the convergence tracks for the public Hackmode cyber system:

BBP mode
CTF mode
Hackpert expert loop
Prolog-RLM cyber harness (#389)
ZeroForge-derived symbolic experts (this epic)

Useful ZeroForge behavior should become reusable symbolic machinery available to both BBP and CTF workflows where appropriate.

Acceptance

explicit publication authorization is recorded in this public issue;
private source is treated as reference material, not copied wholesale;
useful behaviors are inventoried and classified;
selected behaviors are represented as public symbolic experts/rules/plans/contracts;
every effectful behavior crosses Hackmode's canonical authority/capability/effect boundary;
no second ZeroForge scheduler/state/authority/tool runtime survives the port;
public tests use synthetic/public fixtures with no private target/secrets/data leakage;
public docs explain the architecture without requiring access to the private repository;
Hackmode can run the ported features without the private ZeroForge repo present;
BBP and CTF workflows can reuse the resulting expert substrate;
model fallback, if used, is explicit/traced and does not replace deterministic expert execution by default;
final objective claims are evidence-backed through Hackmode/Prolog-RLM verification.

#24 Hackpert expert architecture
#27 active orchestration/effects
#29 open objective loop / strategy model
#28 Prolog-RLM generative/escalation integration
lost-rob0t/prolog-rlm#389 generic cyber harness
lost-rob0t/prolog-rlm#376 first-class expert system

First slice

Produce a semantic inventory and public-port matrix from the private ZeroForge reference, without publishing private source. Select one small behavior that can be expressed as a deterministic Prolog expert or typed plan, implement it behind existing Hackmode capability/evidence boundaries, and prove parity with a synthetic fixture.

## Authorization The operator explicitly authorizes a **public port/reimplementation of the useful ZeroForge architecture and behavior into Hackmode as symbolic Prolog-RLM/Hackpert systems**. This authorization is to make the resulting implementation, rules, contracts, tests, documentation, and public architecture **publishable in the public Hackmode ecosystem**. It is **not** authorization to dump a private repository verbatim. ## Publication boundary Private ZeroForge material may be used as an implementation/reference source when available to an authorized worker, but public output MUST be re-expressed as public Hackmode/Prolog-RLM architecture: ```text private ZeroForge concepts / behavior / lessons ↓ semantic inventory ↓ typed objectives + facts + rules + expert contracts ↓ Hackpert expert families / symbolic plans ↓ Prolog-RLM expert + reasoning substrate ↓ Hackmode typed capabilities / evidence / effects ↓ public tests + docs + implementation ``` Public output may include independently expressed: - algorithms and behavioral contracts; - state machines and decision rules; - Prolog facts/rules/constraints; - expert applicability/selection logic; - typed plan/action/evidence schemas; - verification predicates; - tests using synthetic/public fixtures; - interoperability protocols; - documentation of the new public architecture. Public output MUST NOT automatically include: - verbatim private source files or large source fragments; - private commit/issue/PR history; - secrets, credentials, tokens, target data, customer data, private endpoints or infrastructure details; - private datasets/captures/operations; - private-only comments, identities or provenance that are not required for the public implementation; - artifacts whose publication rights are not actually owned/authorized. If a component cannot be safely/publicly re-expressed, mark it `PRIVATE-REFERENCE-ONLY` and implement a new public equivalent from its required behavior. ## Mission Port the useful ZeroForge concepts into **Hackmode as first-class symbolic cyber reasoning**, not as another standalone agent framework. Target architecture: ```text Hackmode operation / scope / assets / evidence ↓ Hackpert objective loop ↓ Prolog-RLM expert registry + reasoning modes ↓ ZeroForge-derived symbolic experts / rules / planning semantics ↓ typed capability request ↓ Hackmode authority + provider/effect gate ↓ fresh evidence ↓ VERIFY objective ↓ continue / repair / stop ``` ## Architectural invariants - Hackmode remains canonical for operations, scope, assets, evidence, providers, effects, Tek9/KB state and product UI. - Prolog-RLM remains the reusable reasoning/expert substrate. - ZeroForge does **not** remain a second scheduler, second state store, second authority plane or second tool runtime after the port. - Hackpert `passive|active` authority remains orthogonal to Prolog-RLM `direct|symbolic|symbolic-recursive|auto` reasoning. - Public implementation should prefer deterministic symbolic experts and typed plans; model/RLM fallback is explicit and bounded. - Generated/model-produced content is candidate data, not automatic executable authority. - Final success requires evidence against the unchanged objective/spec. ## Porting phases ### Phase 1 — semantic inventory For each useful ZeroForge subsystem/behavior, classify it as: ```text PORT AS SYMBOLIC EXPERT PORT AS TYPED PLAN/STATE MACHINE PORT AS GENERIC PROLOG-RLM FEATURE PORT AS HACKMODE CAPABILITY/ADAPTER PORT AS KB/RULE DATA REIMPLEMENT FROM BEHAVIOR PRIVATE-REFERENCE-ONLY DROP ``` Capture required behavior without copying unnecessary private implementation detail. ### Phase 2 — symbolic model Translate accepted behavior into: - normalized objectives/specs; - facts and constraints; - expert applicability rules; - strategy-selection rules; - plan/playbook graph structures; - evidence requirements; - failure/non-progress rules; - verification rules; - repair/escalation rules; - reusable KB entries with provenance. ### Phase 3 — capability mapping Map any external action to existing/new **typed Hackmode capabilities**. No raw private executor is carried forward as authority. Examples may include recon, source analysis, browser work, fuzzing, vulnerability intelligence, local process execution, evidence acquisition and report generation, but every concrete effect stays behind Hackmode policy/scope/admission. ### Phase 4 — Prolog-RLM convergence Use `lost-rob0t/prolog-rlm#389` as the upstream host/cyber harness and the first-class expert work under `prolog-rlm#376`. Do not build a ZeroForge-specific runtime protocol if the generic host/session/expert/capability interfaces can represent the behavior. ### Phase 5 — public conformance corpus For each ported behavior, add synthetic/public fixtures proving equivalent **semantic outcomes**, not source identity. Tests should demonstrate: - expert selection; - strategy transition; - typed action request; - authority denial/admission; - evidence update; - failure/no-progress behavior; - verification; - deterministic replay where applicable. ### Phase 6 — retire private runtime dependency Once public symbolic parity is proven for a feature, Hackmode must no longer require the private ZeroForge implementation for that feature. The private repository may remain historical/reference material, but the public implementation becomes authoritative for Hackmode. ## Initial public expert families The exact inventory depends on private-source review, but likely public targets include: - recon / attack-surface expert; - vulnerability hypothesis expert; - evidence/corroboration expert; - source-assisted reasoning expert; - strategy / next-action expert; - failure / no-progress diagnosis expert; - repair / alternate-path expert; - objective verification expert; - review/critic expert; - CTF-oriented objective solving; - BBP-oriented scoped finding validation. Do not assume ZeroForge names map 1:1 to public expert names. ## Relationship to BBP / CTF roadmap This epic is one of the convergence tracks for the public Hackmode cyber system: ```text BBP mode CTF mode Hackpert expert loop Prolog-RLM cyber harness (#389) ZeroForge-derived symbolic experts (this epic) ``` Useful ZeroForge behavior should become reusable symbolic machinery available to both BBP and CTF workflows where appropriate. ## Acceptance - [ ] explicit publication authorization is recorded in this public issue; - [ ] private source is treated as reference material, not copied wholesale; - [ ] useful behaviors are inventoried and classified; - [ ] selected behaviors are represented as public symbolic experts/rules/plans/contracts; - [ ] every effectful behavior crosses Hackmode's canonical authority/capability/effect boundary; - [ ] no second ZeroForge scheduler/state/authority/tool runtime survives the port; - [ ] public tests use synthetic/public fixtures with no private target/secrets/data leakage; - [ ] public docs explain the architecture without requiring access to the private repository; - [ ] Hackmode can run the ported features without the private ZeroForge repo present; - [ ] BBP and CTF workflows can reuse the resulting expert substrate; - [ ] model fallback, if used, is explicit/traced and does not replace deterministic expert execution by default; - [ ] final objective claims are evidence-backed through Hackmode/Prolog-RLM verification. ## Related - #24 Hackpert expert architecture - #27 active orchestration/effects - #29 open objective loop / strategy model - #28 Prolog-RLM generative/escalation integration - `lost-rob0t/prolog-rlm#389` generic cyber harness - `lost-rob0t/prolog-rlm#376` first-class expert system ## First slice Produce a **semantic inventory and public-port matrix** from the private ZeroForge reference, without publishing private source. Select one small behavior that can be expressed as a deterministic Prolog expert or typed plan, implement it behind existing Hackmode capability/evidence boundaries, and prove parity with a synthetic fixture.

nsaspy referenced this issue

2026-09-05 07:54:04 +00:00

Make the Hackpert objective loop open and extensible #47

nsaspy commented

2026-09-05 07:56:12 +00:00

Author

Owner

Artifact-generation scope added

Dedicated child epic: #191.

The authorized public ZeroForge port explicitly includes its exploit/security-artifact generation lineage. Initial public families are:

Metasploit modules;
OWASP ZAP active plugins/scripts;
OWASP ZAP passive plugins/scripts;
native Hackmode exploit modules;
native Hackmode detection modules.

The public destination is symbolic-first: Hackpert/Prolog-RLM experts decide applicability/requirements, produce a typed Artifact IR/candidate, validators return evidence, and repair experts operate on typed failures. Generated content remains candidate data until validated and never bypasses Hackmode's operation scope or authority boundary.

Private-source authorization record: lost-rob0t/zero-forge#147.
Reusable artifact synthesis substrate: lost-rob0t/prolog-rlm#391.

### Artifact-generation scope added Dedicated child epic: #191. The authorized public ZeroForge port explicitly includes its exploit/security-artifact generation lineage. Initial public families are: - Metasploit modules; - OWASP ZAP active plugins/scripts; - OWASP ZAP passive plugins/scripts; - native Hackmode exploit modules; - native Hackmode detection modules. The public destination is symbolic-first: Hackpert/Prolog-RLM experts decide applicability/requirements, produce a typed Artifact IR/candidate, validators return evidence, and repair experts operate on typed failures. Generated content remains candidate data until validated and never bypasses Hackmode's operation scope or authority boundary. Private-source authorization record: `lost-rob0t/zero-forge#147`. Reusable artifact synthesis substrate: `lost-rob0t/prolog-rlm#391`.

nsaspy referenced this issue

2026-09-05 08:07:22 +00:00

[EPIC][zeroforge-artifacts] Public symbolic exploit + detection artifact generation #198

nsaspy referenced this issue

2026-09-09 15:07:29 +00:00

[EPIC][zeroforge-artifacts] Public symbolic exploit + detection artifact generation #200