[{"data":1,"prerenderedAt":473},["ShallowReactive",2],{"docs-nav":3,"docs-\u002Fdocs":78},[4,9,13,16,21,26,30,34,38,42,46,50,53,58,62,66,69,74],{"path":5,"title":6,"navTitle":6,"group":7,"order":8},"\u002Fdocs\u002Fcommands","Other commands","Guide",999,{"path":10,"title":11,"navTitle":12,"group":7,"order":8},"\u002Fdocs\u002Fcompaction","Context and compaction","Context & compaction",{"path":14,"title":15,"navTitle":15,"group":7,"order":8},"\u002Fdocs\u002Fconfiguration","Configuration",{"path":17,"title":18,"navTitle":18,"group":19,"order":20},"\u002Fdocs\u002Fenvironment","Environment variables","Reference",11,{"path":22,"title":23,"navTitle":23,"group":24,"order":25},"\u002Fdocs\u002Fflags","Flag reference","CLI",8,{"path":27,"title":28,"navTitle":28,"group":7,"order":29},"\u002Fdocs","Introduction",1,{"path":31,"title":32,"navTitle":32,"group":7,"order":33},"\u002Fdocs\u002Finstallation","Installation",2,{"path":35,"title":36,"navTitle":36,"group":19,"order":37},"\u002Fdocs\u002Fproviders","Providers",10,{"path":39,"title":40,"navTitle":40,"group":7,"order":41},"\u002Fdocs\u002Fquickstart","Quickstart",3,{"path":43,"title":44,"navTitle":45,"group":7,"order":8},"\u002Fdocs\u002Freleases","Releases and upgrading","Releases",{"path":47,"title":48,"navTitle":49,"group":7,"order":8},"\u002Fdocs\u002Frun","The run command","Running an audit",{"path":51,"title":52,"navTitle":52,"group":7,"order":8},"\u002Fdocs\u002Fsecurity","Security model",{"path":54,"title":55,"navTitle":56,"group":24,"order":57},"\u002Fdocs\u002Fsessions","Sessions and forking","Sessions",6,{"path":59,"title":60,"navTitle":61,"group":7,"order":8},"\u002Fdocs\u002Fskills-roles","Skills and roles","Skills & roles",{"path":63,"title":64,"navTitle":64,"group":19,"order":65},"\u002Fdocs\u002Ftools","Tool reference",12,{"path":67,"title":68,"navTitle":68,"group":7,"order":8},"\u002Fdocs\u002Ftroubleshooting","Troubleshooting",{"path":70,"title":71,"navTitle":72,"group":24,"order":73},"\u002Fdocs\u002Ftui","The interactive TUI","Interactive TUI",9,{"path":75,"title":76,"navTitle":77,"group":7,"order":8},"\u002Fdocs\u002Fweb-eval","Dashboard and evaluation","Dashboard & evaluation",{"id":79,"title":28,"body":80,"description":466,"extension":467,"group":7,"meta":468,"navTitle":28,"navigation":469,"order":29,"path":27,"seo":470,"stem":471,"__hash__":472},"docs\u002Fdocs\u002Findex.md",{"type":81,"value":82,"toc":456},"minimark",[83,87,95,102,107,110,113,117,120,154,158,161,243,247,250,257,355,361,365,387,394,398,418,422],[84,85,28],"h1",{"id":86},"introduction",[88,89,90,94],"p",{},[91,92,93],"strong",{},"locac"," is an autonomous vulnerability-research agent harness. You point it at a repository, give\nit a goal, and it maps the attack surface, traces untrusted input to dangerous sinks, builds a\nproof-of-concept, and reports a small set of cross-verified High\u002FCritical findings.",[88,96,97,98,101],{},"It is a ",[91,99,100],{},"harness",", not a scanner. The deterministic tools do the mechanical work: AST outlines,\nsink scanners, call-graph tracing, a DAST module runner, a crash oracle. The model reasons, triages,\nand proves. Neither half is useful without the other.",[103,104,106],"h2",{"id":105},"what-locac-optimises-for","What locac optimises for",[88,108,109],{},"Most security tooling optimises for recall: emit everything that pattern-matches, let a human sort it\nout. locac optimises for the opposite. A run that produces two findings you can hand to a vendor\nwithout a follow-up question beats a run that produces two hundred you have to triage.",[88,111,112],{},"That trade-off is enforced by the harness, not by prompting. A finding cannot be recorded at High or\nCritical unless it clears the mechanical gate described below, and the gate is code, so the model\ncannot talk its way past it.",[103,114,116],{"id":115},"the-five-invariants","The five invariants",[88,118,119],{},"These are non-negotiable. They are in the system prompt, and the ones that can be checked\nmechanically are also enforced in the tool layer.",[121,122,123,130,136,142,148],"ol",{},[124,125,126,129],"li",{},[91,127,128],{},"Default deployment only."," A bug that needs debug flags, example credentials, or an\nadministrator mistake to fire is not a finding.",[124,131,132,135],{},[91,133,134],{},"No app sink."," The bug must live in official, supported code. Never build or wrap a deliberately\nvulnerable app around the target to demonstrate one.",[124,137,138,141],{},[91,139,140],{},"High\u002FCritical only."," Informational, low, medium, hardening and version-disclosure issues are\nout of scope by construction.",[124,143,144,147],{},[91,145,146],{},"Cross-verify."," A finding is accepted only after independent agents reproduce it and\nfalse-positive elimination fails to break it.",[124,149,150,153],{},[91,151,152],{},"Resume from memory."," Prior findings and the scratchpad are read before any expensive tool runs\nagain. A run picks up where the last one stopped instead of restarting.",[103,155,157],{"id":156},"how-a-run-works","How a run works",[88,159,160],{},"Every run drives the same four-phase loop:",[121,162,163,184,209,224],{},[124,164,165,168,169,173,174,173,177,173,180,183],{},[91,166,167],{},"Orient."," ",[170,171,172],"code",{},"outline",", ",[170,175,176],{},"ls",[170,178,179],{},"glob",[170,181,182],{},"code_search"," map entry points, routes, parsers, config, and\ntrust boundaries.",[124,185,186,168,189,192,193,196,197,200,201,204,205,208],{},[91,187,188],{},"Hunt.",[170,190,191],{},"grok_sink"," and ",[170,194,195],{},"scan_sinks"," locate candidates for a vulnerability class, then\n",[170,198,199],{},"trace_callers"," follows the flow from an untrusted ",[91,202,203],{},"source"," (request params, body, headers, env,\nfile reads, deserialization) to a dangerous ",[91,206,207],{},"sink",".",[124,210,211,214,215,219,220,223],{},[91,212,213],{},"Verify."," A tool hit is a ",[216,217,218],"em",{},"candidate",", not a finding. Five conditions must all hold: reachable\nfrom an untrusted entry point in the default deployment; the attacker controls the tainted value;\nnothing on the path sanitises it; no debug flag or example credential is required; and a concrete\nPoC reproduces it. Then the agent tries to ",[216,221,222],{},"refute"," the path.",[124,225,226,168,229,232,233,232,236,239,240,208],{},[91,227,228],{},"Report.",[170,230,231],{},"record_finding",", then ",[170,234,235],{},"cross_verify",[170,237,238],{},"score_finding",", which computes CVSS and\napplies the severity gate so that severity is never guessed, then ",[170,241,242],{},"report_findings",[103,244,246],{"id":245},"the-evidence-gate","The evidence gate",[88,248,249],{},"This is locac's actual differentiator, so it is worth being precise about.",[88,251,252,253,256],{},"To record a finding at ",[91,254,255],{},"High or Critical",", two independent conditions must both be satisfied:",[258,259,260,321],"ul",{},[124,261,262,265,266,269,270,273,274,277,278,281,282,285,286,289,290,293,294,297,298,208,301,304,305,308,309,312,313,316,317,320],{},[91,263,264],{},"Semantic proof, bound to this finding."," The finding must cite, via ",[170,267,268],{},"artifact_ref",", an artifact\nthat carries a ",[91,271,272],{},"structured vulnerability claim"," (location, line, class, the security effect to\nobserve) ",[216,275,276],{},"and"," a ",[91,279,280],{},"machine-checked assertion that passed",". Three tools mint one: ",[170,283,284],{},"reproduce",", when\nits oracle actually triggered; ",[170,287,288],{},"run_module",", per confirmed detection; and ",[170,291,292],{},"replay_request",", when a\nmarker appears in the mutated response and is absent from the benign baseline. The claim's location\nmust match the finding's, which is why a High\u002FCritical finding must carry a ",[170,295,296],{},"file"," (or an exact\nDAST URL) and, for a source finding, a ",[170,299,300],{},"line",[302,303],"br",{},"Running something is not enough. A ",[170,306,307],{},"execute"," script that exits zero, a plain replay, a scan that\nconfirmed nothing, and a ",[91,310,311],{},"coverage"," report are all recorded and auditable, but they are\n",[91,314,315],{},"diagnostics",": none of them evaluated an exploit assertion, so none can promote a severity. A\nreal artifact minted for a ",[216,318,319],{},"different"," finding cannot either.",[124,322,323,168,326,329,330,332,333,335,336,339,340,343,344,350,351,354],{},[91,324,325],{},"A 2-of-3 cross-verify quorum.",[170,327,328],{},"cross_verify(finding_id)"," spawns three verifiers with different\nlenses: ",[216,331,284],{}," (build the PoC from scratch and run it), ",[216,334,222],{}," (find the sanitiser that\nmakes this a false positive), and ",[216,337,338],{},"boundary"," (confirm it fires in the default deployment). A vote\ncounts only if that verifier minted its artifact ",[91,341,342],{},"during this round",", named the ",[91,345,346,347],{},"exact existing\n",[170,348,349],{},"finding_id",", matched its location, and used an artifact ",[91,352,353],{},"distinct"," from the other two lenses'.\nRe-citing the candidate's own artifact is not independent evidence. Two of the three must promote.",[88,356,357,358,360],{},"Fail either condition and ",[170,359,238],{}," will not let the severity through. The finding can still be\nrecorded. It just cannot claim a severity it has not earned.",[103,362,364],{"id":363},"trust-model-in-one-paragraph","Trust model in one paragraph",[88,366,367,370,371,374,375,378,379,382,383,386],{},[91,368,369],{},"The target repository is untrusted input."," It is treated as attacker-authored, including its\ncomments, its README, and any output its code produces. Every tool result carrying target-derived\nbytes is wrapped in ",[170,372,373],{},"⟦untrusted-output \u003Cnonce>⟧"," fences, and the agent is instructed, in the harness\ninvariants that survive every prompt override, to read fenced text strictly as evidence and never as\nan instruction. Configuration, skills, roles and keybindings are read only from ",[170,376,377],{},"LOCAC_HOME","\n(",[170,380,381],{},"~\u002F.locac"," by default), ",[91,384,385],{},"never"," from the repository under audit. The session database also lives\noutside the target root, because sandboxed target code has write access to that root.",[88,388,389,390,393],{},"The ",[391,392,52],"a",{"href":51}," page covers the full picture, including the OS sandbox and\napproval modes.",[103,395,397],{"id":396},"what-locac-is-not","What locac is not",[258,399,400,406,412],{},[124,401,402,405],{},[91,403,404],{},"Not a CI linter."," It is expensive, it runs commands, and it is designed for a research session\nrather than a per-commit hook.",[124,407,408,411],{},[91,409,410],{},"Not a fuzzer."," It drives a fuzzer or a PoC when one is warranted; it does not replace one.",[124,413,414,417],{},[91,415,416],{},"Not a hosted service."," It is a single binary that runs on your machine, talks to whichever model\nprovider you configure, and stores everything locally.",[103,419,421],{"id":420},"where-to-go-next","Where to go next",[258,423,424,429,434,442,451],{},[124,425,426,428],{},[391,427,32],{"href":31},": install a verified release or build your own, then check the runtime assets survived.",[124,430,431,433],{},[391,432,40],{"href":39},": configure a provider and run a first audit.",[124,435,436,438,439,208],{},[391,437,15],{"href":14},": every field of ",[170,440,441],{},"~\u002F.locac\u002Fconfig.json",[124,443,444,446,447,450],{},[391,445,49],{"href":47},": the ",[170,448,449],{},"run"," command, flag by flag.",[124,452,453,455],{},[391,454,23],{"href":22},": every flag, default, and exit code in one place.",{"title":457,"searchDepth":41,"depth":41,"links":458},"",[459,460,461,462,463,464,465],{"id":105,"depth":33,"text":106},{"id":115,"depth":33,"text":116},{"id":156,"depth":33,"text":157},{"id":245,"depth":33,"text":246},{"id":363,"depth":33,"text":364},{"id":396,"depth":33,"text":397},{"id":420,"depth":33,"text":421},"What locac is, how a run works, and the evidence gate that decides whether a finding is allowed to be called High or Critical.","md",{},true,{"title":28,"description":466},"docs\u002Findex","rGx9ngNGFNQrcD16AJmB4ch49zGK1HgnfcOsMa7eWgc",1786794386950]