Milestone: evidence collection via locked rlm tool calls (OSV/GHSA/KEV) #3

New issue

Open

opened 2026-09-24 23:34:48 +00:00 by lost-rob0t · 0 comments

lost-rob0t commented

2026-09-24 23:34:48 +00:00

(Migrated from github.com)

Source: https://github.com/lost-rob0t/zero-forge/blob/master/docs/discovery.md (advisory-source policy, COLLECT phase) and docs/architecture.md "Workflow-owned argument integrity"
Lineage: port-mapping milestone derived from ZeroForge

Scope

Port ZeroForge evidence collection to prolog-rlm tool/effect plumbing:

Allowlisted registered tools: OSV, GitHub global-advisory (GHSA), CISA KEV,
optional searchsploit local acquisition, bounded web search.
All workflow-supplied arguments are locked arguments: values flow from the
workflow into the prompt and the selected call is rejected on missing or
changed locked values (never executed).
Tool-selection repair loop: one initial attempt plus bounded corrective
attempts; config/provider/tool errors fail immediately, never "repaired".
Network records are context only: stored with provenance, never promoted to
verified findings by collection.

Acceptance criteria

Locked-argument substitution attempts are rejected and logged; test covered.
Allowlist violation (tool outside request allowlist) is rejected; test covered.
Repair budget exhaustion produces a failed terminal state, not a fallback
to an unvalidated answer.
Tools are declared through prolog-rlm public tool/effect APIs, not ad-hoc
process calls inside agent code.

Dependencies

Vulnerability KB subsystem (evidence facts).

Non-goals

No exploit strategy or artifact content decided by the Tool Agent.
No new advisory sources beyond the ZeroForge allowlist.

Implementation approval is not inferred from this issue.

**Source**: https://github.com/lost-rob0t/zero-forge/blob/master/docs/discovery.md (advisory-source policy, COLLECT phase) and docs/architecture.md "Workflow-owned argument integrity" **Lineage**: port-mapping milestone derived from ZeroForge ## Scope Port ZeroForge evidence collection to prolog-rlm tool/effect plumbing: - Allowlisted registered tools: OSV, GitHub global-advisory (GHSA), CISA KEV, optional `searchsploit` local acquisition, bounded web search. - All workflow-supplied arguments are locked arguments: values flow from the workflow into the prompt and the selected call is rejected on missing or changed locked values (never executed). - Tool-selection repair loop: one initial attempt plus bounded corrective attempts; config/provider/tool errors fail immediately, never "repaired". - Network records are context only: stored with provenance, never promoted to verified findings by collection. ## Acceptance criteria - Locked-argument substitution attempts are rejected and logged; test covered. - Allowlist violation (tool outside request allowlist) is rejected; test covered. - Repair budget exhaustion produces a failed terminal state, not a fallback to an unvalidated answer. - Tools are declared through prolog-rlm public tool/effect APIs, not ad-hoc process calls inside agent code. ## Dependencies - Vulnerability KB subsystem (evidence facts). ## Non-goals - No exploit strategy or artifact content decided by the Tool Agent. - No new advisory sources beyond the ZeroForge allowlist. Implementation approval is not inferred from this issue.