Cortex 2.0 steps 1–3: audit, foundation fixes, shared investigation context, manual workflow

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,61 @@
+name: Bug report
+description: Something in Cortex does not work as documented.
+labels: [bug]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Security problems go through SECURITY.md, not here.
+        Only report problems seen on software you own or are authorized to analyze.
+  - type: input
+    id: version
+    attributes:
+      label: Cortex version or commit
+      placeholder: v1.0.1, or the commit / CI artifact
+    validations:
+      required: true
+  - type: input
+    id: platform
+    attributes:
+      label: Windows version and target architecture
+      placeholder: Windows 11 24H2, target x86
+    validations:
+      required: true
+  - type: dropdown
+    id: area
+    attributes:
+      label: Area
+      options:
+        - Desktop (scan, addresses, memory viewer)
+        - Debugger / breakpoints / traces
+        - Static analysis (inspect, artifacts)
+        - External engines (Ghidra, ILSpy, Vineflower)
+        - Live providers (CDP, debugpy, netcoredbg, JDWP)
+        - MCP server / agents
+        - Evidence, investigations, projects
+        - Install / portable bundle
+        - Other
+    validations:
+      required: true
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      description: Ideally against the repository's test target or fixtures.
+      placeholder: |
+        1. cortex.exe mcp --pid ...
+        2. call ...
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected and actual behaviour
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs
+      description: Status line, MCP replies, cortex_denied_mutations.jsonl, cortex_debugger_events.jsonl. Remove private data first.
+      render: text

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/PdB333/cortex/security/advisories/new
+    about: Report vulnerabilities privately, not in a public issue.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,27 @@
+name: Feature request
+description: Propose a capability or an improvement.
+labels: [enhancement]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Requests to bypass anti-cheat, DRM, licence checks or access controls are out of scope and will be closed.
+  - type: textarea
+    id: problem
+    attributes:
+      label: What are you trying to do?
+      description: The investigation or workflow, and where Cortex gets in the way.
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposal
+      description: What Cortex should do. Say whether it only reads or also changes the target.
+    validations:
+      required: true
+  - type: textarea
+    id: validation
+    attributes:
+      label: How could it be validated?
+      description: A fixture, an owned program or a reference tool to compare against.

.github/pull_request_template.md

@@ -0,0 +1,21 @@
+## Summary
+
+<!-- What changed and why. -->
+
+## Validation
+
+<!-- Commands you ran and their result. Name the fixture or the owned program. -->
+
+- [ ] `ctest` for the affected build(s)
+- [ ] End-to-end suites for the touched area (see CONTRIBUTING.md)
+- [ ] Windows x64 and x86 targets (CI)
+
+## Safety
+
+- [ ] Read-only paths still work without write authority
+- [ ] Every change to a target needs the operator's authority and `mutation_permission`
+- [ ] No test was skipped, disabled or loosened
+
+## Limitations
+
+<!-- What is not validated or not handled yet. Also recorded in the docs. -->

.github/workflows/contracts.yml

@@ -114,39 +114,10 @@ jobs:
         shell: msys2 {0}
         run: cmake --build build/p1-${{ matrix.arch }} --parallel 2
 
-      - name: Run existing CTest suite
+      - name: Run CTest suite (includes the action transaction and semantic plan tests)
         shell: msys2 {0}
         run: ctest --test-dir build/p1-${{ matrix.arch }} --output-on-failure
 
-      - name: Build action transaction tests
-        shell: msys2 {0}
-        run: >-
-          c++ -std=c++17 -O2
-          tests/action_transaction_tests.cpp
-          core/action/action.cpp
-          core/events/events.cpp
-          -Icore
-          -o build/p1-${{ matrix.arch }}/cortex_action_transaction_tests.exe
-          -static -static-libgcc -static-libstdc++
-
-      - name: Run action transaction tests
-        shell: msys2 {0}
-        run: build/p1-${{ matrix.arch }}/cortex_action_transaction_tests.exe
-
-      - name: Build semantic plan tests
-        shell: msys2 {0}
-        run: >-
-          c++ -std=c++17 -O2 tests/semantic_tools_tests.cpp
-          -Ibuild/p1-${{ matrix.arch }}/_deps/json-src/include
-          -o build/p1-${{ matrix.arch }}/cortex_semantic_tools_tests.exe
-          -static -static-libgcc -static-libstdc++
-
-      - name: Run semantic plan tests
-        shell: msys2 {0}
-        run: >-
-          build/p1-${{ matrix.arch }}/cortex_semantic_tools_tests.exe
-          core/api/routes_status.cpp
-
   # ---- P2 Contracts (was .github/workflows/p2-contracts.yml)
   p2-contracts:
     name: p2-${{ matrix.arch }}
@@ -202,86 +173,10 @@ jobs:
           path: build/p2-${{ matrix.arch }}/compile.log
           if-no-files-found: warn
 
-      - name: Run core tests
+      - name: Run CTest suite (includes the MCP protocol, authority, pipe, schema, scheduler, bridge policy, request id and pagination tests)
         shell: msys2 {0}
         run: ctest --test-dir build/p2-${{ matrix.arch }} --output-on-failure
 
-      - name: Build and run MCP protocol tests
-        shell: msys2 {0}
-        run: >-
-          c++ -std=c++17 -O2 tests/mcp_protocol_tests.cpp
-          -Ibuild/p2-${{ matrix.arch }}/_deps/json-src/include
-          -o build/p2-${{ matrix.arch }}/mcp_protocol_tests.exe
-          -static -static-libgcc -static-libstdc++
-          && build/p2-${{ matrix.arch }}/mcp_protocol_tests.exe
-
-      - name: Build and run MCP write-authority tests
-        shell: msys2 {0}
-        run: >-
-          c++ -std=c++17 -O2 -Icore tests/mcp_authority_tests.cpp
-          -Ibuild/p2-${{ matrix.arch }}/_deps/json-src/include
-          -o build/p2-${{ matrix.arch }}/mcp_authority_tests.exe
-          -static -static-libgcc -static-libstdc++
-          && build/p2-${{ matrix.arch }}/mcp_authority_tests.exe
-
-      - name: Build and run native pipe contract tests
-        shell: msys2 {0}
-        run: >-
-          c++ -std=c++17 -O2 tests/mcp_pipe_protocol_tests.cpp
-          -o build/p2-${{ matrix.arch }}/mcp_pipe_protocol_tests.exe
-          -static -static-libgcc -static-libstdc++
-          && build/p2-${{ matrix.arch }}/mcp_pipe_protocol_tests.exe
-
-      - name: Build and run semantic execution contract tests
-        shell: msys2 {0}
-        run: >-
-          c++ -std=c++17 -O2 tests/semantic_tools_tests.cpp
-          -Ibuild/p2-${{ matrix.arch }}/_deps/json-src/include
-          -o build/p2-${{ matrix.arch }}/semantic_tools_tests.exe
-          -static -static-libgcc -static-libstdc++
-          && build/p2-${{ matrix.arch }}/semantic_tools_tests.exe core/api/routes_status.cpp
-
-      - name: Build and run MCP schema tests
-        shell: msys2 {0}
-        run: >-
-          c++ -std=c++17 -O2 tests/mcp_schema_tests.cpp
-          -Ibuild/p2-${{ matrix.arch }}/_deps/json-src/include
-          -o build/p2-${{ matrix.arch }}/mcp_schema_tests.exe
-          -static -static-libgcc -static-libstdc++
-          && build/p2-${{ matrix.arch }}/mcp_schema_tests.exe
-          && c++ -std=c++17 -O2 tests/mcp_query_schema_tests.cpp
-          -Ibuild/p2-${{ matrix.arch }}/_deps/json-src/include
-          -o build/p2-${{ matrix.arch }}/mcp_query_schema_tests.exe
-          -static -static-libgcc -static-libstdc++
-          && build/p2-${{ matrix.arch }}/mcp_query_schema_tests.exe
-
-      - name: Build and run game-thread call scheduler tests
-        shell: msys2 {0}
-        run: >-
-          c++ -std=c++17 -O2 tests/call_scheduler_tests.cpp core/call/call.cpp
-          -o build/p2-${{ matrix.arch }}/call_scheduler_tests.exe
-          -static -static-libgcc -static-libstdc++ -luser32
-          && build/p2-${{ matrix.arch }}/call_scheduler_tests.exe
-      - name: Build and run MCP bridge policy tests
-        shell: msys2 {0}
-        run: >-
-          c++ -std=c++17 -O2 tests/mcp_bridge_policy_tests.cpp
-          -o build/p2-${{ matrix.arch }}/mcp_bridge_policy_tests.exe
-          -static -static-libgcc -static-libstdc++
-          && build/p2-${{ matrix.arch }}/mcp_bridge_policy_tests.exe
-
-      - name: Build and run inherited request tests
-        shell: msys2 {0}
-        run: >-
-          c++ -std=c++17 -O2 tests/request_id_tests.cpp
-          -o build/p2-${{ matrix.arch }}/request_id_tests.exe
-          -static -static-libgcc -static-libstdc++
-          && build/p2-${{ matrix.arch }}/request_id_tests.exe
-          && c++ -std=c++17 -O2 tests/pagination_tests.cpp
-          -o build/p2-${{ matrix.arch }}/pagination_tests.exe
-          -static -static-libgcc -static-libstdc++
-          && build/p2-${{ matrix.arch }}/pagination_tests.exe
-
   # ---- P3 Probe Build (was .github/workflows/p3-probe-build.yml)
   p3-probe-build:
     name: probe-build-${{ matrix.arch }}
@@ -399,6 +294,73 @@ jobs:
       - name: Run portable target model test
         run: ./target_model_portable_tests
 
+      # The desktop frame loop, its workers and the debugger backend share one
+      # SessionManager; ThreadSanitizer fails this step on any data race.
+      - name: Session manager under ThreadSanitizer
+        run: >-
+          g++ -std=c++17 -g -O1 -Wall -Wextra -Werror -fsanitize=thread -pthread
+          -Icore tests/session_manager_tests.cpp core/target/session_manager.cpp
+          -o session_manager_tsan
+          && setarch "$(uname -m)" -R env TSAN_OPTIONS=halt_on_error=1 ./session_manager_tsan
+
+      # The shared investigation context is written by pipe workers serving
+      # the desktop and agents at once.
+      - name: Investigation context under ThreadSanitizer
+        run: >-
+          sudo apt-get update -qq && sudo apt-get install -y --no-install-recommends nlohmann-json3-dev
+          && g++ -std=c++17 -g -O1 -Wall -Wextra -Werror -fsanitize=thread -pthread
+          -Icore tests/investigation_context_tests.cpp
+          core/context/investigation_context.cpp core/context/context_api.cpp
+          -o investigation_context_tsan
+          && setarch "$(uname -m)" -R env TSAN_OPTIONS=halt_on_error=1 ./investigation_context_tsan
+
+  # ---- Fuzzing of the file parsers (step 9). Inputs are untrusted: every
+  # parser must survive malformed files without a crash, an out-of-bounds
+  # access or undefined behaviour (ASan + UBSan).
+  fuzz-parsers:
+    name: Fuzz file parsers
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install clang and its sanitizer runtimes
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y --no-install-recommends clang-18 libclang-rt-18-dev ninja-build
+          # ASan needs fewer random mmap bits than recent runner kernels use.
+          sudo sysctl -w vm.mmap_rnd_bits=28
+
+      - name: Build the fuzzers (libFuzzer, ASan, UBSan)
+        run: |
+          cmake -S tests/fuzz -B build/fuzz -G Ninja -DCMAKE_C_COMPILER=clang-18 -DCMAKE_CXX_COMPILER=clang++-18
+          cmake --build build/fuzz --parallel
+
+      - name: Replay the kept crash inputs and the seeds
+        run: |
+          cmake -S tests/fuzz -B build/fuzz-replay -G Ninja -DCMAKE_C_COMPILER=clang-18 -DCMAKE_CXX_COMPILER=clang++-18 -DCORTEX_FUZZ_REPLAY=ON
+          cmake --build build/fuzz-replay --parallel
+          ctest --test-dir build/fuzz-replay --output-on-failure
+          python3 tests/fuzz/make_seeds.py build/fuzz-seeds
+          for harness in artifact pe_code text protocols stores; do build/fuzz-replay/fuzz_$harness build/fuzz-seeds/$harness; done
+
+      - name: Fuzz each harness for 60 s
+        run: |
+          mkdir -p build/fuzz-findings
+          for harness in artifact pe_code text protocols stores; do
+            mkdir -p build/fuzz-work/$harness
+            build/fuzz/fuzz_$harness -max_total_time=60 -max_len=65536 -timeout=10 -rss_limit_mb=2048 \
+              -artifact_prefix=build/fuzz-findings/$harness- build/fuzz-work/$harness build/fuzz-seeds/$harness
+          done
+
+      - name: Upload crashing inputs
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: fuzz-findings
+          path: build/fuzz-findings
+          if-no-files-found: ignore
+
   # ---- P4 Target Model (was .github/workflows/p4-target-model.yml)
   p4-target-model:
     name: target-model-${{ matrix.arch }}