feat: add redis server role, improve impacket handling, and update dev workflow

.claude/agents/ares-operator.md

@@ -66,6 +66,7 @@ IMPORTANT: After code changes, ALWAYS deploy before testing. Use `task remote:ch
 ## Red Team Operations
 
 ### Start an operation
+
 ```bash
 # via Taskfile (convenience wrappers)
 task red:multi TARGET=dreadgoad DOMAIN=sevenkingdoms.local
@@ -80,6 +81,7 @@ task ec2:launch DOMAIN=sevenkingdoms.local TARGETS=192.168.58.10
 ```
 
 ### Monitor
+
 ```bash
 # Direct CLI with transport (preferred)
 ares-cli --k8s ares-red ops status --latest
@@ -95,6 +97,7 @@ task red:multi:tasks:list LATEST=true STATUS=failed
 ```
 
 ### State injection (unblock stuck operations)
+
 When natural progression stalls, inject state to skip past blockers:
 
 ```bash
@@ -114,13 +117,15 @@ ares-cli --k8s ares-red ops inject-vulnerability op-xxx constrained_delegation 1
 ```
 
 ### Reports & Playbooks
+
 ```bash
 ares-cli --k8s ares-red ops report --latest --regenerate
 ares-cli --k8s ares-red ops export-detection --latest     # Export markdown/JSON detection playbook
 ares-cli --k8s ares-red ops offload-cost --latest         # Sync token costs to Postgres
 ```
 
 ### Maintenance
+
 ```bash
 ares-cli --k8s ares-red ops backfill-domains op-xxx       # Re-scan state to populate domain list
 ares-cli --k8s ares-red ops kill --all                    # Kill all running ops
@@ -130,6 +135,7 @@ ares-cli --k8s ares-red ops cleanup --max-age-hours 24    # Delete old checkpoin
 ## Blue Team Operations
 
 ### Submit investigations
+
 ```bash
 # From red team operation
 ares-cli --k8s ares-blue blue from-operation --latest
@@ -142,6 +148,7 @@ ares-cli --k8s ares-blue blue watch --poll-interval 30
 ```
 
 ### Monitor & Reports
+
 ```bash
 ares-cli --k8s ares-blue blue status --latest
 ares-cli --k8s ares-blue blue evidence --latest --json
@@ -183,6 +190,7 @@ task config:set-model -- orchestrator gpt-5.2
 ## Infrastructure & Debugging
 
 ### Health Checks
+
 ```bash
 task ares:config:check                     # Check 1Password access and API keys
 task remote:status                         # K8s pod health
@@ -191,6 +199,7 @@ task remote:logs ROLE=orchestrator         # Read logs
 ```
 
 ### Debugging Stuck Operations
+
 1. **Check Grafana** (`grafana.dev.plundr.ai`) for token usage and Loki errors.
 2. **Check failed tasks**: `ares-cli --k8s ares-red ops tasks --latest --status failed`.
 3. **Verify binary sync**: `task remote:check`.

.claude/agents/python-ares-expert.md

@@ -10,6 +10,7 @@ You are an expert on the **Python ares codebase** located at `/Users/l/dreadnode
 ## Project Overview
 
 Ares is an autonomous security operations multi-agent system with:
+
 - **Red Team**: LLM-powered penetration testing with coordinator/worker architecture
 - **Blue Team**: SOC alert investigation and threat hunting
 

.claude/agents/rust-ares-expert.md

@@ -10,6 +10,7 @@ You are an expert on the **Rust ares codebase** located at `/Users/l/dreadnode/a
 ## Project Overview
 
 Ares is an autonomous security operations multi-agent system ported from Python to Rust. It has:
+
 - **Red Team**: LLM-powered penetration testing with coordinator/worker architecture
 - **Blue Team**: SOC alert investigation and threat hunting
 - **Correlation**: Red-blue activity matching and gap analysis
@@ -32,12 +33,14 @@ Ares is an autonomous security operations multi-agent system ported from Python
 ### ares-core — Models, State, Config
 
 **models/** — Core data types:
+
 - `core.rs`: Target, Host, User, Credential, Hash, Share
 - `task.rs`: AgentRole, TaskStatus, TaskInfo, TaskResult, VulnerabilityInfo, AgentInfo
 - `operation.rs`: OperationMeta
 - `blue.rs`: Evidence, TimelineEvent, BlueTaskInfo, PyramidLevel, InvestigationStage, TriageDecision
 
 **state/** — Redis state management:
+
 - `reader.rs`: RedisStateReader — loads all state from Redis
 - `operations.rs`: State write operations
 - `blue_reader.rs` / `blue_writer.rs`: Blue team state
@@ -47,11 +50,13 @@ Ares is an autonomous security operations multi-agent system ported from Python
 - `keys.rs`: Redis key pattern constants (ares:op:{id}:credentials, etc.)
 
 **config/** — YAML config:
+
 - `mod.rs`: AresConfig (loads from ARES_CONFIG env or default paths)
 - `sections.rs`: Agent roles, timeouts, recovery, phase detection, vuln priorities
 - `defaults.rs`: Default values
 
 **parsing/** — Tool output parsers:
+
 - `secretsdump.rs`, `kerberos.rs`, `ntlm.rs`, `delegation.rs`, `shares.rs`, `domain_sid.rs`, `hosts.rs`
 
 **reports/**: `redteam.rs`, `blueteam.rs`, `mitre.rs`, `dedup.rs`
@@ -64,12 +69,14 @@ Ares is an autonomous security operations multi-agent system ported from Python
 ### ares-llm — LLM Integration
 
 **provider/** — Multi-provider abstraction:
+
 - `mod.rs`: LlmProvider trait, ChatMessage, ToolCall, ToolDefinition, Role, StopReason, TokenUsage
 - `anthropic.rs`: Anthropic Messages API
 - `openai.rs`: OpenAI Chat Completions API
 - `ollama.rs`: Local Ollama
 
 **agent_loop.rs** — Multi-step agent execution:
+
 - AgentLoopConfig: max_steps, max_tokens, temperature, retry, context management
 - ContextConfig: max_context_tokens (180k default), max_tool_output_chars (30k)
 - RetryConfig: exponential backoff with jitter
@@ -78,18 +85,21 @@ Ares is an autonomous security operations multi-agent system ported from Python
 - `run_agent_loop()`: Main loop (prompt → LLM → tool_use → accumulate → repeat)
 
 **tool_registry/** — Tool definitions per role:
+
 - `mod.rs`: tools_for_role(), is_callback_tool()
 - `recon.rs`, `credential_access/`, `lateral/`, `privesc/`, `cracker.rs`, `coercion.rs`, `acl.rs`, `blue.rs`
 - Each tool has JSON Schema for LLM tool_use
 
 **prompt/** — Task-specific prompt generation:
+
 - `mod.rs`: StateSnapshot, generate_task_prompt()
 - Role-specific modules + Tera templates
 - `state_context.rs`: Format state for prompts
 - `helpers.rs`: Common prompt builders
 - `templates.rs`: Tera template loading
 
 **routing/** — Task payload enrichment:
+
 - `domain.rs`: Domain normalization, NetBIOS→FQDN
 - `dc_discovery.rs`: Multi-tier DC discovery (DcTier)
 - `credentials.rs`: Find credentials for domain
@@ -100,6 +110,7 @@ Ares is an autonomous security operations multi-agent system ported from Python
 **lib.rs**: `dispatch()` — routes tool name to implementation (100+ tools)
 
 **Tool modules**:
+
 - `recon.rs`: nmap_scan, smb_sweep, ldap_search, bloodhound, dig_query, adidnsdump
 - `credential_access/`: kerberoast, secretsdump, lsassy, asrep_roast, spray, laps_dump, misc.rs, netexec_tools.rs
 - `cracker.rs`: hashcat, john
@@ -124,18 +135,21 @@ Ares is an autonomous security operations multi-agent system ported from Python
 **config.rs**: OrchestratorConfig from env vars (ARES_OPERATION_ID, ARES_REDIS_URL, ARES_LLM_MODEL, etc.)
 
 **state/**:
+
 - `shared.rs`: SharedState — Arc<RwLock<StateInner>>
 - `inner.rs`: StateInner (credentials, hashes, hosts, users, shares, domains, vulns, dedup sets)
 - `persistence.rs`: Load/save from/to Redis
 - `publishing.rs`: Update Redis on state changes
 - `dedup.rs`: Deduplication
 
 **dispatcher/**:
+
 - `mod.rs`: Dispatcher (queue + tracker + throttler + state)
 - `submission.rs`: throttled_submit()
 - `task_builders.rs`: request_recon(), request_crack(), etc.
 
 **automation/** — 16 background tasks:
+
 - `crack.rs`, `credential_access.rs`, `credential_expansion.rs`, `secretsdump.rs`
 - `coercion.rs`, `delegation.rs`, `adcs.rs`, `privesc/acl.rs`, `s4u.rs`
 - `trust.rs`, `gmsa.rs`, `golden_ticket.rs`, `mssql.rs`, `bloodhound.rs`, `shares.rs`

.gemini/agents/ares-operator.md

@@ -73,6 +73,7 @@ IMPORTANT: After code changes, ALWAYS deploy before testing. Use `task remote:ch
 ## Red Team Operations
 
 ### Start an operation
+
 ```bash
 # via Taskfile (convenience wrappers)
 task red:multi TARGET=dreadgoad DOMAIN=sevenkingdoms.local
@@ -87,6 +88,7 @@ task ec2:launch DOMAIN=sevenkingdoms.local TARGETS=192.168.58.10
 ```
 
 ### Monitor
+
 ```bash
 # Direct CLI with transport (preferred)
 ares-cli --k8s ares-red ops status --latest
@@ -102,6 +104,7 @@ task red:multi:tasks:list LATEST=true STATUS=failed
 ```
 
 ### State injection (unblock stuck operations)
+
 When natural progression stalls, inject state to skip past blockers:
 
 ```bash
@@ -121,13 +124,15 @@ ares-cli --k8s ares-red ops inject-vulnerability op-xxx constrained_delegation 1
 ```
 
 ### Reports & Playbooks
+
 ```bash
 ares-cli --k8s ares-red ops report --latest --regenerate
 ares-cli --k8s ares-red ops export-detection --latest     # Export markdown/JSON detection playbook
 ares-cli --k8s ares-red ops offload-cost --latest         # Sync token costs to Postgres
 ```
 
 ### Maintenance
+
 ```bash
 ares-cli --k8s ares-red ops backfill-domains op-xxx       # Re-scan state to populate domain list
 ares-cli --k8s ares-red ops kill --all                    # Kill all running ops
@@ -137,6 +142,7 @@ ares-cli --k8s ares-red ops cleanup --max-age-hours 24    # Delete old checkpoin
 ## Blue Team Operations
 
 ### Submit investigations
+
 ```bash
 # From red team operation
 ares-cli --k8s ares-blue blue from-operation --latest
@@ -149,6 +155,7 @@ ares-cli --k8s ares-blue blue watch --poll-interval 30
 ```
 
 ### Monitor & Reports
+
 ```bash
 ares-cli --k8s ares-blue blue status --latest
 ares-cli --k8s ares-blue blue evidence --latest --json
@@ -190,6 +197,7 @@ task config:set-model -- orchestrator gpt-5.2
 ## Infrastructure & Debugging
 
 ### Health Checks
+
 ```bash
 task ares:config:check                     # Check 1Password access and API keys
 task remote:status                         # K8s pod health
@@ -198,6 +206,7 @@ task remote:logs ROLE=orchestrator         # Read logs
 ```
 
 ### Debugging Stuck Operations
+
 1. **Check Grafana** (`grafana.dev.plundr.ai`) for token usage and Loki errors.
 2. **Check failed tasks**: `ares-cli --k8s ares-red ops tasks --latest --status failed`.
 3. **Verify binary sync**: `task remote:check`.

.github/workflows/meta-labeler.yaml

@@ -1,14 +1,15 @@
 ---
 name: "Labeler"
+# SECURITY: This workflow uses pull_request_target and has access to secrets.
+# NEVER add an actions/checkout step here or run any code from the PR.
+# See: CVE-2025-30066, CVE-2025-30154, CVE-2026-33634
 on:
   pull_request_target:
     branches: ["main"]
     types: ["opened", "synchronize"]
 
 permissions:
-  actions: read
   contents: read
-  issues: write
   pull-requests: write
 
 jobs: