wiki: naturalize hardcoded counts (Source of Truth lives in README Hero)
Following the same Single-Source-of-Truth cleanup applied to the main
repo: wiki pages no longer hardcode '67 typed functions / 42 native +
25 SIFT adapters / 10 of 12 MITRE / 55 tests / 1182 lines'. Phrasing
shifts to 'the typed MCP surface', 'native + SIFT adapters', 'broad
MITRE enterprise tactic coverage'.
Phase-1.md historical version table preserves period-specific numbers
(v0.3 = 31 functions, v0.4 = 35 native, v0.5 = 60 functions) because
those are historical facts about what shipped on those dates, not
claims about current state.
The canonical exact name set continues to live in
tests/test_mcp_surface.py — the only place that needs editing when a
function is added or removed.
wiki: sweep stale 35-native / 60-total counts to current 42 / 67
16 wiki pages had pre-v0.6.0 numeric references that survived earlier
QA rounds. Surface count was bumped 60 -> 67 in v0.6.0 (six new
supply-chain IOC functions in dart_mcp._v05_supply_chain), and native
count went 35 -> 42, but a number of wiki pages still showed the old
numbers.
Pages corrected:
About-the-name, Architecture-deep-dive,
Architecture-first-vs-prompt-first, Case-PtH-Timestomp, FAQ,
Glossary, Home, Live-mode, MCP-function-catalog, Phase-1,
Roadmap, SIFT-adapter-layer, The-Memex-Bet, _Sidebar, dart-mcp
Phase-1.md version history table preserves the historical numbers
(v0.4 = 35 native, v0.5 = 60 functions) as those are historical
facts, not current state.
MITRE coverage also corrected from 11/12 -> 10/12 (TA0009 Collection
and TA0011 C2 are Phase 2).
wiki(qa-r5): playbook v3 surface — honest framing + line count + v2/v3 default fixes
Pairs with main repo commit 77f2334. Twelve files touched on the wiki side:
- dart-playbook.md ........... v3 'industrialization' section rewritten
with 'data scaffold; runtime activation post-SANS' framing.
Anatomy section flipped from senior-analyst-v2.yaml to
senior-analyst-v3.yaml with v3-additions vs v2-carry-over grouping.
Bundled-playbooks table line count 1135 → 1182. Forking
instructions now point at v3 as source. Operator-notes citation
moved to v3. 'Six principles every senior analyst remembers'
sourced from v3 (inherited from v2). 'See also' adds v3 link.
- Phase-1.md ................. v3 line count 1135 → 1182. 'Playbook
v3.1' release-history row clarified to 'Playbook v3 patch (no
separate v3.1 file)'.
- Roadmap.md ................. v3 line item rewritten with
'YAML data scaffolds' framing + issue #44 link + line count update.
- SIFT-adapter-layer.md ...... 'playbook v3.1' → 'playbook v3'.
- The-Memex-Bet.md ........... 'Playbook v2' → 'Playbook v3 (default)'.
- Case-IP-KVM.md ............. v1 historical context preserved with
a 'now default in v3' annotation appended.
- Case-PtH-Timestomp.md ...... same v1 historical / v3 current-default
annotation pattern.
- Writing-case-studies.md .... v1 reference → v3 default in the
next_call_decisions tuning instruction.
== Why this matters ==
A SANS judge reading dart-playbook.md and then opening
dart_agent/__init__.py would have found the 'HMM operationalized in
the agent' / 'every run self-classifies' / 'triggered when any phase
exits' claims absent from the runtime path. Round 5 fixes that —
documentation and code now agree, with the runtime activation work
explicitly deferred and tracked at issue #44.
No code changes on the wiki side; pure documentation. Main repo's
77f2334 covers the v3 yaml header and the source tree.
wiki QA pass: synchronize 13 pages to v0.5 reality (60 tools, 22 tests)
Companion to main repo commit 52f975d (v0.5.1 QA pass).
Updated to reflect the v0.5 SIFT adapter layer (35 native + 25 SIFT
= 60 typed read-only MCP tools) and the v0.5 test suite expansion
(20 → 22 cases):
About-the-name.md
'The 35 typed dart-mcp functions cover...' →
'The typed dart-mcp surface (35 native + 25 SIFT Workstation
adapters = 60 functions) covers...'
Test count 20/20 → 22/22 across all references.
Architecture-deep-dive.md
ASCII architecture box: 'dart-mcp 35 typed forensic functions'
→ 'dart-mcp 60 typed forensic functions (35 native + 25 SIFT)'
Architecture-first-vs-prompt-first.md
'The MCP surface is exactly 35 functions, by name' →
'The MCP surface is exactly 60 typed functions, by name (35
native + 25 SIFT Workstation adapters)'
Case-PtH-Timestomp.md (2 references) updated parallel to docs/.
FAQ.md
Question heading: 'Is the MCP surface really exactly 35
functions?' → 'Is the MCP surface really fixed in size?'
Answer body: counts updated to 60 / 22-22.
Glossary.md
dart-mcp definition: 35 → 60.
'For Agentic-DART v0.4: exactly 35' →
'For Agentic-DART v0.5: 60 (35 native + 25 SIFT Workstation
adapters)'
Home.md (TOC)
'the 35 forensic functions, schema, bypass tests' →
'the 60 forensic functions (35 native + 25 SIFT adapters),
schema, bypass tests'
'why the MCP surface is exactly 35 functions, not 28, not 35'
rephrased to avoid count-anchoring.
Live-mode.md (2 references) parallel to docs/.
MCP-function-catalog.md
Page title: '· 35 typed forensic functions'
→ '· 60 typed forensic functions (35 native + 25 SIFT
Workstation adapters)'
Operator-guide.md
'All 20 tests should print OK' → 'All 22 tests should print OK'
Phase-1.md
Body: '35 typed forensic functions' / '20 of 20 tests passing'
counts updated.
Timeline table: ADDED row for 2026-05-02 v0.5 (SIFT Workstation
tool adapter layer → 60 functions, 22 tests passing). v0.4
historic row preserved verbatim.
Roadmap.md
Three references to 35 / 20-20 updated to v0.5 numbers.
Running-on-macOS.md
'Step 3 — Run all 20 tests' → '... 22 tests'
'All 20 tests pass on M1/M2/M3' → 'All 22 tests pass on M1/M2/M3'
The-Memex-Bet.md
'MCP surface (35 typed functions)' →
'MCP surface (60 typed functions: 35 native + 25 SIFT adapters)'
'The 35 functions are not a guideline...' →
'The 60 functions (35 native + 25 SIFT Workstation adapters)
are not a guideline...'
_Sidebar.md
Two TOC labels: '(35 functions)' → '(60 functions: 35 native +
25 SIFT)'
dart-mcp.md
'exposes exactly 35 typed forensic functions' →
'exposes 60 typed forensic functions (35 native + 25 SIFT
Workstation adapters)'
Section heading 'The 35 functions' → 'The 60 functions (35
native + 25 SIFT adapters)'
SIFT-adapter-layer.md
Preserved verbatim — line 18 'its own 35 forensic functions'
is historic context describing the pre-v0.5 state.
wiki: add 'The Memex Bet' concept page + remove dead Project link
== Marketing strengthening (inspired by Karpathy's LLM Wiki gist) ==
New concept page: 'The Memex Bet' (96 lines)
- Frames Agentic-DART within the lineage from Vannevar Bush's 1945
Memex through Karpathy's April 2026 LLM Wiki pattern
- Makes the bet explicit: senior-analyst reasoning IS the durable
compounding artifact, not the report
- Side-by-side mapping of LLM Wiki components to Agentic-DART
components — sources / wiki / schema → evidence / playbook / MCP
- Reading list for judges: Bush 1945, Karpathy 2026, Bianco,
Caltagirone, M-Trends, Lockheed Kill Chain
- Linked from Sidebar (top of Concepts) and Home page (top of
Concepts) with ⭐ marker — first impression for new visitors
== OPSEC / dead links cleanup ==
Removed dead Project link from _Sidebar.md
- https://github.com/users/Juwon1405/projects/4 was never set up
(project board abandoned — issues + milestones cover the work)
- The link 404'd, hurting professional impression
== Why this matters for SANS judging ==
A judge skimming the wiki for 60 seconds now sees:
1. ⭐ The Memex Bet (the philosophical hook)
2. About the name (what DART means)
3. Architecture-first vs prompt-first (the design claim)
4. Architecture deep dive (the implementation)
This trajectory — philosophy → naming → claim → implementation — mirrors
how Karpathy's gist is read in 2026. Putting Agentic-DART in that
intellectual lineage signals seriousness without arrogance.