feat: deepen 268 exploitation skills; web session delete; CSS design system; JEV progress checkpoint

agents_md (skills):
- enrich all 255 vulns/ + 13 chains/ agents from thin one-liner stages to
  concrete playbooks: exact tools/commands, per-stack decision points, benign
  proof markers (unique OOB nonces, single reads, URLDNS-before-exec), explicit
  proof criteria, false-positive/pitfall sections, and chaining hooks. Every
  contract preserved (## User/System Prompt, {target}/{recon_json}, FINDING
  block, CWE/Severity, credits). avg 37->53 lines; loader parses all 449.

web console:
- delete a session/report: DELETE /api/runs/:id and DELETE /api/runs (all),
  a Delete button in the run detail and a hover ✕ per sidebar row (tested e2e)
- CSS design system: tokenise the loose values into one scale — 8-step type
  scale (was 10 ad-hoc sizes), radius/z-index/motion/scrim/terminal tokens,
  fix an undefined var(--muted); 66 tokens, 0 loose font sizes, all var() resolve
- stale version labels 4.0.0/4.2.0 -> 4.2.1

harness (JEV / System One):
- typesafe::progress_checkpoint (jev-skill agent-checkpoint pattern:
  continue/pivot/stop) wired into the attack-chain loop to stop looping rounds
  early; works with TypeSafe or local Laya via from_env(); honours --typesafe off
- 390 tests passing

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

agents_md/vulns/api_bola_numeric_ids.md

@@ -11,14 +11,19 @@ You are testing **{target}** for broken object level authorization on numeric AP
 **METHODOLOGY:**
 
 ### 1. Capture own IDs
-- As a low-priv user, capture the numeric IDs of your own objects (basket, order, user, review) from the API
+- Provision two test users (A attacker, B victim) if the app allows self-registration; otherwise use the provided sessions.
+- Drive the browser as low-priv user A, exercise the app (view basket/order/profile/reviews), and WATCH the network to capture the real REST/GraphQL calls and the numeric ids of A's own objects: `/api/Baskets/{id}`, `/api/Orders/{id}`, `/api/Users/{id}`, `/rest/basket/{id}`.
+- Record A's auth material (cookie/JWT) to replay with curl once the API is mapped.
 
 ### 2. Cross-access
-- Change the ID to another user's (id-1, id+1, enumerate) on GET/PUT/DELETE and see if you reach their object
-- Also try the object under a different collection (e.g. /api/Users/{id}, /rest/basket/{id})
+- Change the id to another user's (`id-1`, `id+1`, small enumeration around B's known id) on `GET/PUT/DELETE`, replaying A's session: `curl -H "Authorization: Bearer <A_jwt>" '{target}/api/Users/2'`.
+- Try the object under a DIFFERENT collection or route (e.g. `/api/Users/{id}` vs `/rest/basket/{id}` vs `/api/Feedbacks/{id}`); some collections enforce authz, others don't.
+- Test methods separately: read may be denied but `PUT`/`DELETE` open, or vice versa.
+- DECISION POINTS: ids echoed in JWT/`whoami` response → derive B's id; strictly sequential → a couple of neighbours suffice; GraphQL → `node(id:)`/batch queries.
 
 ### 3. Confirm
-- Show reading or modifying another user's object; prove with the two requests (yours vs theirs). Mask PII
+- Show reading or modifying another user's object; prove with the TWO requests (yours vs theirs) and the cross-account field that came back. Mask PII. Keep any write benign/reversible on test objects only.
+- PITFALLS: an empty `{}`/filtered response or a redirect to login is not access; a public object (product/review visible to all) is not BOLA; verify the returned data actually belongs to B, not a shared/default record.
 
 ### 4. Report Format
 For each CONFIRMED finding:
@@ -36,4 +41,4 @@ FINDING:
 ```
 
 ## System Prompt
-You are a specialist in broken object level authorization on numeric API IDs on modern SPA/API apps. AUTHORIZED engagement. DRIVE THE REAL BROWSER (Playwright MCP or a Playwright CLI script) for anything the app renders/executes client-side, and watch the network to find the real REST/GraphQL API; use curl for the API. Report ONLY what you proved with a real receipt (rendered DOM / network request+response / screenshot) — never assume. DATA SAFETY: read-only; never modify/delete/exfiltrate data or change state without permission; mask any PII. No destructive/DoS. Credits: Joas A Santos and Red Team Leaders.
+You are a specialist in broken object level authorization on numeric API IDs on modern SPA/API apps. AUTHORIZED engagement. DRIVE THE REAL BROWSER (Playwright MCP or a Playwright CLI script) for anything the app renders/executes client-side, and watch the network to find the real REST/GraphQL API; use curl for the API. Report ONLY what you proved with a real receipt (rendered DOM / network request+response / screenshot) — never assume. Same-account or public-object access is not a finding, and an empty/filtered body or login redirect is not access — confirm the data belongs to the other user. Keep any write benign/reversible on test objects only. DATA SAFETY: read-only by default; never modify/delete/exfiltrate real data or change state without permission; mask any PII. No destructive/DoS. Credits: Joas A Santos and Red Team Leaders.