Repository navigation
The closed execution loop is proven end-to-end: the LLM emits source-derived facts, augure decides the technique and proves it, lictor builds and runs against the live lab, and the flag read from the running service is the ground truth. Five of the six lab targets land their own flags (2026-10-29 run, the sixth being the designed handoff).
The GRPO wiring carries the execution-verified flags into the trainer: dataset ingest-trajectories merges the pilot's trajectories by id and the grpo_flags.jsonl sidecar carries the flag the service read. The first GRPO run closed nine steps on the student merged from the SFT best run: the reward curve opened at 1.0, breathed between 0.42 and 1.0 where a generation missed the format, and closed at 1.0.
Companion lictor releases carry the layout and pinning fixes this loop demanded: the shellcode ret slot riding the banner's leak (!10), run --technique pinning the decided technique across attempts (!11), the orw stub's flag path precedence (!12).