systematic-attacking

Systematic Attacking

Overview

Offensive work fails in two characteristic ways: it strays outside authorized scope (the act of testing is itself potentially harmful), and it submits claims that were never really proven — reachability dressed as impact, a pile of lows dressed as a high, a known composite dressed as novel. This skill is the one method that blocks both failures.

This is the only offensive lifecycle skill. It alone owns scope, severity, lead→finding promotion, and submission authority. systematic-bug-hunting is a subordinate, zero-authority bench-craft layer nested inside Phases 2–5: it generates candidates, holds no scope or severity, and refuses to start without a Phase 0 scope lock. Experimental / novel-vector work is a phase inside it (Phase 3b), not a sibling skill — a second file would duplicate this safety lifecycle, and the looser copy would become the bypass path. systematic-debugging guards the fix; this skill guards the claim — and adds a scope law because attacking, unlike debugging, can hurt a real system.

Violating the letter of this process is violating the spirit of it. An empty gate is a skipped gate; a skipped gate is lab noise, not a finding.

When a packet contradicts this skill

Say so; do not resolve it silently. The dispatching packet still wins — that is the design. But if a packet instruction contradicts this skill, emit a ## PACKET OVERRODE SKILL section in your response naming both sides.

This is not hypothetical. H2 below states that a primitive carries capability, not severity, and that an inert primitive is labelled, never deleted. For five consecutive audits Chrono's Phase-3 packets instead demanded an impact-bar verdict per idea. Lanes obeyed the packet, killed their own primitives, and the Chaining phase starved for want of a pool — silently, because nothing made the contradiction visible.

No gate is added here. A reporting duty is enough: the failure was invisibility, not permissiveness.