feat(vuln-scanner): introduce Riva research kernel - #70
Open
Svector-anu wants to merge 19 commits into
Open
Conversation
…rking slop.cash pays for merged contributions across several tracked projects, and the same effort is worth wildly different amounts depending on which lane it lands in. two mechanics drive it (both read from leaderboard.ts, not assumed): merge points diminish within a project-month as max(1, ceil(10/sqrt(ordinal))) and reset each UTC month, and the caps are per project. so "which lane, and what is my ordinal there" is the whole question, and it changes week to week. this skill answers it each morning. discovery only: it never opens, edits, comments on, reviews or merges a PR. the only write is its own state file. three things it does that came directly from getting them wrong by hand first: - resolves tracked projects live from SlopDotCash/slopdotcash rather than hardcoding repo paths. elizaOS/asi was transferred to SlopDotCash/asi (same repo id 1332593244) and a hardcoded path would have tracked a redirect or nothing at all, silently. - gates every recommendation on liveness, never on point value alone. delta-star looked like a 4x opportunity on the scoring formula while sitting at a 36% merge rate with nothing merged in 12 days. a lane that is not merging is not an opportunity. - always passes --limit 200 to gh. the default page size of 30 silently truncates and every count then reads low. it also surfaces the two genuinely time-sensitive things: CHANGES_REQUESTED waiting on an open PR (a near-merged PR beats a new one), and any dormant lane waking back up (a fresh uncapped lane is the best thing the scoring allows). skill-scan flagged the first draft MEDIUM for `base64 -d` while decoding the manifest — the same pattern it catches in aeon-update. replaced with `-H "Accept: application/vnd.github.raw"`, which returns the decoded file directly. verified working, now PASS. lockfile note: `eyebrow scan` also refreshed the hashes for `feature` and `vuln-scanner`. that is pre-existing drift from recent commits to those skills that did not regenerate the lockfile — not a change from this PR. both files are byte-identical to origin/main here, so the refreshed hashes record committed content. called out explicitly because silently moving vuln-scanner's integrity hash is exactly what this lockfile exists to catch. Claude-Session: https://claude.ai/code/session_01SbipDt7VmuDvosRPS8AfEx
adding a skill updates both catalog manifests; the first commit only regenerated skills.json, so ci-packs-json failed with "packs.json is stale". verified locally against the same normalize-and-diff the check runs (timestamp ignored). Claude-Session: https://claude.ai/code/session_01SbipDt7VmuDvosRPS8AfEx
ci-readme-catalog and its test both failed: the catalog caption said "all 80 skills" while the regenerated catalog has 81. adding a skill means updating the README-facing catalog too, not just the json. - docs/skill-packs.md: heading 80 -> 81, and slop-watch added to the Productivity row (11 -> 12). listed without an icon, matching the existing pattern for skills that have none (rightstack, x402-monitor). - .github/README.md: link text AND the #full-catalog-... anchor, since the anchor derives from the heading — changing only one breaks the link. validate-readme-catalog now reports OK, 6 packs / 81 skills. Claude-Session: https://claude.ai/code/session_01SbipDt7VmuDvosRPS8AfEx
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Introduce Riva as a focused, scan-time vulnerability-research kernel while preserving vuln-scanner's existing mission and operational authority.
Changes
skills/vuln-scanner/riva.mdwith threat-model, invariant, slice, bounded exploration, and evidence contractsSafety
Verification
bash scripts/tests/test_vuln_poc_gate.shbash scripts/tests/test_riva_context.shgit diff --check