Files
CyberStrikeAI/docs
Sycun 3d2dfdac36 feat: verify attack-chain nodes against real tool calls
A node claiming something ran must cite a tool_call_id the host issued in
the trajectory. A citation absent from the trajectory is invented, so the
node is dropped along with its edges; a missing citation counts as invented
only when every real ID survived budget fitting, so a trimmed payload cannot
silently empty a graph. Judging is skipped where the evidence cannot be
enumerated: the process-detail supplement dumps raw event JSON and the
messages-table fallback carries no call IDs. Verified citations land in node
metadata rather than tool_execution_id, which is foreign-keyed to
tool_executions.

Also close two smaller holes: fact text can no longer carry the host index
delimiters, which would close the block early and spill the remaining index
into the system prompt; and the console fact endpoints reject the reserved
note/context-* prefix, matching the MCP tool layer.
2026-10-13 00:10:33 +08:00
..
2026-07-21 21:04:53 +08:00

CyberStrikeAI Documentation

中文 | English

CyberStrikeAI documentation is organized by user journey. Start with deployment, then move to the topic that matches your task.

中文文档

按目标开始

核心概念与编排

功能指南

开发与发布

English Documentation

Choose a path

Concepts and orchestration

Feature guides

Development and release

Documentation conventions

  • Commands assume the repository root unless stated otherwise.
  • Examples use placeholders; never commit real credentials or target systems without explicit authorization.
  • Runtime behavior and configuration defaults are authoritative in config.example.yaml and the source code. If a document differs, report it as documentation drift.