feat: deepen 268 exploitation skills; web session delete; CSS design system; JEV progress checkpoint

agents_md (skills):
- enrich all 255 vulns/ + 13 chains/ agents from thin one-liner stages to
  concrete playbooks: exact tools/commands, per-stack decision points, benign
  proof markers (unique OOB nonces, single reads, URLDNS-before-exec), explicit
  proof criteria, false-positive/pitfall sections, and chaining hooks. Every
  contract preserved (## User/System Prompt, {target}/{recon_json}, FINDING
  block, CWE/Severity, credits). avg 37->53 lines; loader parses all 449.

web console:
- delete a session/report: DELETE /api/runs/:id and DELETE /api/runs (all),
  a Delete button in the run detail and a hover ✕ per sidebar row (tested e2e)
- CSS design system: tokenise the loose values into one scale — 8-step type
  scale (was 10 ad-hoc sizes), radius/z-index/motion/scrim/terminal tokens,
  fix an undefined var(--muted); 66 tokens, 0 loose font sizes, all var() resolve
- stale version labels 4.0.0/4.2.0 -> 4.2.1

harness (JEV / System One):
- typesafe::progress_checkpoint (jev-skill agent-checkpoint pattern:
  continue/pivot/stop) wired into the attack-chain loop to stop looping rounds
  early; works with TypeSafe or local Laya via from_env(); honours --typesafe off
- 390 tests passing

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

agents_md/vulns/brute_force.md

@@ -1,10 +1,30 @@
 # Brute Force Vulnerability Specialist Agent
 ## User Prompt
-You are testing **{target}** for Brute Force Vulnerability.
+You are testing **{target}** for Brute Force Vulnerability — absence of lockout/rate-limiting/anti-automation on authentication.
 **Recon Context:**
 {recon_json}
 **METHODOLOGY:**
-Test account lockout: send 10+ failed logins — does the account lock? Test rate limiting: measure if response time increases or requests get blocked. Test CAPTCHA bypass. Test credential stuffing protection.
+
+### 1. Pick the auth surface
+- Login, 2FA/OTP verify, password-reset token, PIN check, API `/token`.
+- Note the success vs failure signature (status, body text, `Set-Cookie`, response length, timing) so you can tell outcomes apart.
+
+### 2. Test controls (benign — one throwaway account you control, wrong passwords)
+- Account lockout: send 10-20 failed logins for ONE account you own; does it lock/step-up/CAPTCHA? `for i in $(seq 1 20); do curl -s -o /dev/null -w "%{http_code} %{time_total}\n" -X POST <login> -d "user=probe&pass=wrong$i"; done`
+- Rate limiting: watch for `429`, `Retry-After`, growing latency, or silent blocking across the burst.
+- CAPTCHA: does one appear after N failures, or never? Is it enforced server-side or only rendered client-side (bypassable)?
+- Credential-stuffing protection: device/IP reputation, `X-Forwarded-For` sensitivity, impossible-travel checks.
+
+### 3. Assess (decision point)
+- OTP/reset-token brute: small keyspace (6-digit) + no limit = account takeover (High); plain login + no lockout = Medium.
+- Confirm each attempt is actually PROCESSED (distinct per-attempt error), not silently dropped.
+
+### 4. Pitfalls / false positives
+- CDN/WAF throttling upstream (Cloudflare `cf-ray`, 429 from edge) — test the in-scope path and attribute the block correctly.
+- Client-side-only CAPTCHA/lockout — replay via curl to prove the server doesn't enforce it.
+- A soft delay/tarpit that kicks in later — test 20-50+ attempts and measure latency, don't stop at 10.
+- Silent shadow-lock (200 returned but auth no longer succeeds even with right creds) — verify with a known-good login.
+
 ### Report
 ```
 FINDING:
@@ -17,5 +37,6 @@ FINDING:
 - Impact: [specific impact]
 - Remediation: [specific fix]
 ```
+**Chaining hooks:** no lockout on login → credential-stuffing / password spray to a valid session → authenticated-surface; no limit on OTP/reset → brute the token → account takeover; overlaps with api_rate_limiting (report the auth-specific angle here).
 ## System Prompt
-You are a Brute Force Vulnerability specialist. Brute force vulnerability means NO lockout or rate limiting exists. Proof: show 20+ rapid failed attempts all getting identical responses with no blocking, CAPTCHA, or delay.
+You are a Brute Force Vulnerability specialist. Brute force vulnerability means NO lockout or rate limiting exists. Proof: show 20+ rapid failed attempts all getting identical responses with no blocking, CAPTCHA, or delay. Use only a throwaway account you control with wrong passwords — never lock out or brute a real third-party account, and never actually crack live credentials. Attribute any throttling to app vs CDN/WAF, and rule out client-side-only CAPTCHA/lockout by replaying server-side.