Violin v2.0.0

Violin v2.0.0

Violin v2.0.0 is a major release of the supervised Hermes penetration-testing profile. It introduces a Hermes-native guarded execution boundary, improves engagement continuity and auditability, and reorganises specialised testing guidance into routed skills.

Highlights

Hermes-native guarded execution

• Makes violin_exec, violin_exec_burst, and typed adapters the canonical path for target-touching commands.
• Supports any installed non-interactive Kali or Parrot CLI tool without a fragile binary allowlist.
• Adds guarded listener execution and asynchronous execution status and cancellation.
• Audits Hermes execute_code calls using engagement metadata, saved source, completion status, and SHA-256 evidence digests.
• Keeps raw-terminal detection as a best-effort safety boundary while enforcing scope through typed execution.

Stronger scope and target enforcement

• Requires an explicit primary target at the command boundary.
• Replaces regex-heavy target extraction with shell, URL, hostname, IP/CIDR, and MIME-aware parsing.
• Supports approved callback and public-research hosts without allowing them to become assessment targets.
• Improves handling of wildcard hosts, virtual hosts, URL and port-qualified targets, UNC-style paths, dotted filenames, and Bash /dev/tcp and /dev/udp endpoints.
• Keeps unknown or ambiguous target-like values reviewable instead of silently treating them as safe.

Phase-aware engagement workflow

• Adds violin_status diagnostics showing the active task, phase requirements, pending work, blockers, and recommended next actions.
• Introduces reviewed command windows:
  • 10 commands during reconnaissance and vulnerability research.
  • 20 commands during exploitation-heavy phases.
• Adds atomic violin_review_batch reconciliation for evidence review, optional finding creation, PTT progression, and batch-lock clearing.
• Removes the initial active-task deadlock while retaining fail-closed post-batch review.
• Raises the Hermes profile budget to 350 iterations for realistic engagement continuity.
• Removes message-count heartbeat locks while retaining phase-aware executed-command checks.

Evidence and findings

• Keeps command history executor-owned and engagement-local.
• Adds receipt-backed finding creation to prevent unsupported findings from being recorded.
• Creates engagement-local exploits/ and phase evidence directories.
• Directs local scripts and output away from host /tmp.
• Improves hypothesis parsing, canonicalises IDs such as H-001, and repairs malformed board content.
• Preserves scope, PTT, hypothesis, history, and pending-batch state across context compression.

Routed skills

• Keeps pentest as the engagement methodology and workflow orchestrator.
• Adds the web-attacks skill for injection and web-application testing.
• Adds the access-control skill for authentication and authorisation testing.
• Updates the nine-question scoping workflow.
• Synchronises the README, Hermes instructions, playbooks, templates, security policy, contribution guidance, and release metadata.

Reliability and maintainability

• Reorganises plugins/violin_guard/ into focused execution, state, target, history, phase, PTT, result, and service modules.
• Adds file locking for serialized state transitions and more reliable Windows concurrency.
• Improves isolated plugin imports, tool registration, manifest validation, and cross-platform smoke testing.
• Aligns the distribution, project, plugin, dependency lock, documentation, and tests with the v2.0.0 runtime surface.

Upgrade notes

• Requires Hermes Agent >=0.18.0.
• Requires Python >=3.11.
• Adds filelock>=3.13,<4 as a runtime dependency.
• Target-touching commands should use Violin’s typed execution tools.
• Raw terminal should be limited to host-local preparation and administration.
• Start Violin with hermes chat --skills pentest when supported.
• Existing engagements should confirm their scope, primary target, session marker, active PTT task, hypotheses, and pending batch before resuming.
• Web-attack and access-control playbooks are now loaded through their routed skills.

Validation

The release is validated through:

• Distribution and plugin version checks.
• Isolated Hermes-style plugin import.
• Registered tool-surface validation.
• Ruff linting and formatting.
• Full Python test suite across supported platforms.
• Skill and documentation consistency checks.
• Clean release diff validation.

For the complete change history, see CHANGELOG.md.