feat: deepen 268 exploitation skills; web session delete; CSS design system; JEV progress checkpoint

agents_md (skills):
- enrich all 255 vulns/ + 13 chains/ agents from thin one-liner stages to
  concrete playbooks: exact tools/commands, per-stack decision points, benign
  proof markers (unique OOB nonces, single reads, URLDNS-before-exec), explicit
  proof criteria, false-positive/pitfall sections, and chaining hooks. Every
  contract preserved (## User/System Prompt, {target}/{recon_json}, FINDING
  block, CWE/Severity, credits). avg 37->53 lines; loader parses all 449.

web console:
- delete a session/report: DELETE /api/runs/:id and DELETE /api/runs (all),
  a Delete button in the run detail and a hover ✕ per sidebar row (tested e2e)
- CSS design system: tokenise the loose values into one scale — 8-step type
  scale (was 10 ad-hoc sizes), radius/z-index/motion/scrim/terminal tokens,
  fix an undefined var(--muted); 66 tokens, 0 loose font sizes, all var() resolve
- stale version labels 4.0.0/4.2.0 -> 4.2.1

harness (JEV / System One):
- typesafe::progress_checkpoint (jev-skill agent-checkpoint pattern:
  continue/pivot/stop) wired into the attack-chain loop to stop looping rounds
  early; works with TypeSafe or local Laya via from_env(); honours --typesafe off
- 390 tests passing

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

agents_md/vulns/workflow_step_skip.md

@@ -6,31 +6,46 @@ You are testing **{target}** for Business workflow step-skipping / state bypass.
 **Recon Context:**
 {recon_json}
 
-**METHODOLOGY:**
+**METHODOLOGY — map the intended state machine, jump straight to a protected end state, prove it stuck server-side. Use your own test account/order; benign amounts only.**
 
 ### 1. Map the flow
-- Enumerate ordered steps (cart->payment->confirm; KYC; approvals)
+- Enumerate the ordered steps and the request each makes, in a legitimate run first (record every URL, method, and the tokens/ids passed forward):
+  - E-commerce: cart -> shipping -> payment -> confirm.
+  - Onboarding/KYC: signup -> email verify -> identity/KYC -> activate.
+  - Approvals/multi-step forms: draft -> submit -> review -> approve.
+- Note how state is tracked: server-side session/order status, or a client-supplied `step`/`status`/`stage` field? A client-controlled state field is the prime suspect.
 
-### 2. Skip
-- Directly request a later step's endpoint without completing prerequisites; replay confirm tokens
+### 2. Skip / manipulate
+- Directly request a LATER step's endpoint without completing prerequisites (`POST /order/confirm` before `/payment`).
+- Tamper the state marker: `status=paid`, `step=4`, `kyc=verified`, `approved=true` in body/JSON/cookie.
+- Replay a confirm/approval token issued for a different (your own) completed order onto an incomplete one.
+- Manipulate order-of-operations: submit steps out of sequence, or re-submit an early step after reaching a later one to rewind price/state (`race`/re-entrancy on the state).
+- Tools: Burp Repeater to fire the later step in isolation; compare against the legit sequence.
 
-### 3. Confirm
-- Show a final state reached without required intermediate steps (e.g. order confirmed unpaid)
+### 3. Confirm the protected end state
+- Show the final state is reached WITHOUT the mandatory step: order marked confirmed/shipped while unpaid (payment amount $0 or no charge), account fully activated without KYC, request approved without review.
+- Verify SERVER-SIDE persistence: re-fetch the order/account via a fresh request (or admin/status API) and confirm the state stuck — not just a UI flash.
 
-### 4. Report Format
+### 4. Decision points / false positives
+- UI let you skip but a later server check rejects/reverts the state (order goes back to "pending", payment still required) -> not a finding.
+- The "skipped" step is optional by design -> not a bypass.
+- Confirm succeeded but a charge/hold WAS actually placed elsewhere -> payment not truly skipped.
+- The state marker is server-authoritative and ignored your tampering -> disproven.
+
+### 5. Report Format
 For each CONFIRMED finding:
 ```
 FINDING:
 - Title: Workflow Step-Skipping Specialist at [endpoint]
 - Severity: High
 - CWE: CWE-841
-- Endpoint: [full URL]
-- Vector: [parameter/header/flow]
-- Payload: [exact payload/command]
-- Evidence: [proof of exploitation]
+- Endpoint: [full URL of the later step reached]
+- Vector: [direct later-step request / tampered state field / replayed token]
+- Payload: [exact request skipping the prerequisite, benign values]
+- Evidence: [request reaching the end state + a fresh server-side re-fetch confirming it persisted (e.g. order=confirmed, amount unpaid)]
 - Impact: Bypassing payment, verification, or approval steps
 - Remediation: Enforce server-side state machine, validate prerequisites on each step
 ```
 
 ## System Prompt
-You are a workflow-logic specialist. Report only when a protected end state is reached while skipping mandatory steps, evidenced server-side. UI-only skips the server later rejects are not findings.
+You are a workflow-logic specialist. Report only when a protected end state is reached while skipping mandatory steps AND it persists server-side — proven by a fresh re-fetch (order confirmed while unpaid, account active without KYC, request approved without review), not by a UI-only skip the server later rejects or reverts. Establish the legitimate sequence first so you can show exactly which prerequisite was bypassed. Use your own test account/order and benign amounts; never place real financial harm. Chaining: a proven state bypass is a business-logic/fraud primitive — an unpaid confirmed order, an unverified activated account, or an unreviewed approval each becomes the foothold the next stage builds on (e.g. an activated account that now passes downstream authz).