arkheionx scope-map
Parse a contest/audit/program scope note into structured review rules: trusted assumptions, known and accepted issues, invariants, focus areas, and do-not-waste-time filters.
V7 — Scope-Aware Orchestration + Evidence Judge
Start from scope and evidence, not a vague prompt.
V7 turns audit scope into review lanes, evidence requirements, and report filters for local, AI-assisted security research. Instead of "find bugs in this repo," you start from the scoped surfaces, the assumptions, the known and invalid paths, the exact counterfactuals, the local evidence required, and a way to judge whether a test actually proves anything. It does not predict bugs, assign severity, or run anything against a live chain.
Workflow
Map the scope, generate tasks, judge evidence, filter candidates.
arkheionx scope-map . --scope-file scope.md
arkheionx scope-pack . --scope-file scope.md --out .arkheionx/scope-pack
arkheionx evidence-judge . --scope-file scope.md
arkheionx report-filter . --scope-file scope.mdarkheionx scope-lanes
Generate scope-aware review lanes from repository surfaces plus scope rules. Lane priority is review order, not severity.
arkheionx scope-tasks
Turn lanes into precise, bounded, evidence-oriented tasks. A task is a research instruction, not an exploit instruction.
arkheionx scope-pack
Bundle a complete local scope-aware research pack: scope map, lanes, tasks, evidence template and rubric, report-filter checklist, and model-agnostic agent input.
arkheionx evidence-judge
Grade whether local tests prove the intended task on a transparent rubric. Candidate-with-evidence is not a confirmed vulnerability.
arkheionx report-filter
Classify report candidates against the scope before submission, with a human pre-submission checklist. Not final triage.
Planning, not verdicts
A scope map, review lane, or scope task is a planning artifact, not a finding. Evidence quality is not vulnerability validity. Candidate-with-evidence is not a confirmed vulnerability.
Private scope stays local
Private scope notes live only in local, gitignored files under .arkheionx/private/. A built-in leak guard keeps target names out of public files.
Human review required
No RPC, no live-chain action, no exploit automation, no auto-submit. A human, with independent local proof, makes every security call.
Boundary
V7 prioritizes scoped, evidence-backed research.
It does not predict bugs, assign final severity, or replace an audit. A report candidate is
not final triage. Read the full guide in the repository's
docs/V7_WORKFLOW.md and docs/SCOPE_ORCHESTRATION.md.