Violin v1.1.0

Violin v1.1.0 — Public Release

A supervised, agentic Hermes Agent pentest profile for authorised reconnaissance, exploit validation, and reporting. This release hardens the guard layer, adds multi-layer freshness gates, and ships a thorough README/docs accuracy pass so the public repo matches the code.

Highlights

• violin-guard plugin (Hermes plugin, not just a script) — registers typed guard tools (violin_check_command, violin_record_ptt, violin_record_history, violin_record_hypothesis, violin_exec, violin_sync_done, violin_heartbeat_done, violin_message_tick) that delegate to scripts/guard/ and enforce the skill-load, PTT, history, and hypothesis freshness gates. There is no way to bypass the gate.
• Freshness / drift guards — check-command (with --eng-dir) enforces PTT staleness, command-history duplicate detection, and hypothesis-board coverage per target. Omitting --eng-dir is blocked.
• Heartbeat gate — every 5 approved target commands (and every 10 messages via violin_message_tick) forces a re-read of SKILL.md + engagement-file review before the next command releases.
• Engagement bootstrap — init-engagement auto-creates a guard-clean engagement tree; self-healing --auto-repair rescues orphaned sync locks and resolves engagement dirs to a single absolute root.
• Doc accuracy pass — fixed repo links (Strategic-Automation), corrected plugin/toolset/template counts, aligned version metadata (distribution.yaml, SKILL.md) to 1.1.0, and removed a stray local working directory.

Guard capabilities

Subcommand	Purpose
validate-scope	Validate an engagement scope.yaml (exit 0 = approved)
check-command	Gate every target-touching command (0 allow / 1 block / 2 review)
check-bootstrap	Verify engagement bootstrap is complete before any target interaction
check-skill-loaded	Skill-load gate — marks SKILL.md read for the current work-block
init-engagement	Auto-create a complete, guard-clean engagement directory
record-ptt / record-history / record-hypothesis	Engagement artifact tracking (enforced)
sync-done / heartbeat-done / message-tick	Doc-sync and periodic-review gates
closeout	Tier close-out artifacts as hard gates
check-release	Validate release readiness (YAML, 31 playbooks, markdown refs)

Engagement workflow

1. SCOPING → 2. RECON → 3. VULN RESEARCH → 4. EXPLOITATION → 5. REPORTING → 6. RETROSPECTIVE — every phase gated by clarify approval + guard checks.

Contents

• 31 playbooks — 7 methodology (6 phase + 1 tools catalog) + 24 per-vulnerability-class (OWASP Top 10, OWASP API Top 10, LLM Top 10, and beyond)
• 8 references — methodology, standards, tool catalog, tool discovery, CVE APIs, Kali/Parrot paths, retrospective, coverage matrix
• 6 templates — PTT, hypothesis board, scope, report, methodology gates, transparency boilerplate
• 11 toolsets — 10 built-in Hermes toolsets + the violin_guard plugin toolset

Install

hermes profile install https://github.com/Strategic-Automation/violin
hermes -p violin

Notes

• Engagement workspaces (engagements/) and local promotion material (PROMOTION.md) are git-ignored and excluded from distribution — no client data, tokens, or credentials are committed.
• Safety policy and forbidden-behaviour rules are in SECURITY.md, skills/pentest/references/standards.md, and .hermes.md. Authorised testing only.