Generates and runs crash reproducers to verify security flaws. Use when viable findings exist and you need to write and execute a script or payload to verify the crash. Don't use for code auditing or patching.

Reproducer (/mantis reproduce) System Goal Integration Test Engineer. Designs crash reproducers or inputs and executes them inside isolated sandbox environments to empirically verify bugs. Command Definition Command: /mantis reproduce [ reattack] [ finding id=<uuid ] [ force] [ target root=<path ] [ state root=<path ] [ snapshot root=<path ] [ snapshot id=<SNAPSHOT ID ] [ snapshot pinned=<true false ] Description: Generates and runs crash reproducers to verify security flaws. Parameters: reattack : When executing as part of patch verification to isolate re attack outcomes. finding id : The specific finding UUID to reproduce. Must be provided and is required when reattack is specified. force : Override/bypass eligibility checks for targeted normal runs. target root : Path to the root of the target codebase under test (defaults to . ). AUTHORITATIVE when supplied — overrides snapshot root (Block A step 1a); the sentinel check is skipped for this tree (e.g. a patched shadow during re attack verification). state root : Path to the root of the Mantis state directory containing workspace/ (defaults to . ). snapshot root : Root of the pinned immutable code snapshot for this pass. Consumed by Block A (Step 0) when target root is not supplied. snapshot id : The SNAPSHOT ID string of the pinned snapshot, consumed by Block A (sentinel) and Block B (snapshot match check) in Step 0. snapshot pinned : When false (set by mantis patch during re attack on a patched shadow), the reproduce sub agent MUST skip the snapshot sentinel/match check for this invocation — the target root tree is authoritative and sentinel exempt (Block A step 1a). Input/Output Contract Reads : state root/workspace/findings/ (viable/conditional findings). target root/ (Repository source files to analyze trigger paths). state root/workspace/archive/.repro attempts.json . state root/workspace/.mantis state.json (to track current loop pass). Writes : PoC reproduction files (e.g. poc [uuid].py or crash [uuid].payload inside state root/workspace/reproducers/ ). If run normally: updates findings in place under state root/workspace/findings/ (sets "repro status" , "repro file path" , "run command" , "repro output" , and appends history). Updates status to "VALID" if provisionally valid. If run with reattack : updates findings in place under state root/workspace/findings/ (sets "reattack status" , "reattack file path" , "reattack run command" , "reattack output" , "reattack variants" , and appends history with stage "reattack" ). Does not modify "repro " fields or "status" . Exception: may atomically downgrade patch status per INV 1 in Step 6 (never persist VERIFIED SECURE alongside a non failed to bypass reattack status ). Updates state root/workspace/archive/.repro attempts.json atomically. Stamps "repro snapshot id" / "reattack snapshot id" on updated findings and stores .repro attempts.json values as {count,last snapshot} objects (bare integers still read correctly). Preconditions : Findings must exist in state root/workspace/findings/ . Sandbox/container runtime environment must be available. Idempotency Guarantee : Updates findings in place. Uses state root/workspace/archive/.repro attempts.lock file locking and atomic temporary file swaps ( os.replace on state root/workspace/archive/.repro attempts.json.tmp ) to guarantee concurrency safety and retry stability. Snapshot aware: regenerates the PoC when the finding's snapshot no longer matches; refuses to emit a negative verdict without reached sink evidence. Re attack verdicts on a snapshot mismatch are governed by the C5 unpatched baseline re run (Step 6), which supersedes the legacy blanket refusal — a failed to bypass verdict is only written after C5 has confirmed the unpatched baseline still triggers on the current snapshot. Instructions Step 0: Locator Resolution + Snapshot Match (run first) [!NOTE] CURRENT PASS CHECK (defensive; the binding guarantee is on the harness per mantis pipeline adapter Scenario 2): if active snapshot is present AND active snapshot.pass != state.pass number , treat the snapshot as STALE for this pass — STOP "stale active snapshot: pass mismatch" or degrade as HALT ( snapshot pinned effectively false: no authoritative verdicts, Block B NOT MATCHED, reproduce not attempted ). This catches a custom harness that preserved active snapshot across the Stage 15 pass increment without re pinning. The reference meta agent re pins every pass, so this check never fires there. Block B itself cannot detect this (it is snapshot id only, not pass aware). Notes: When invoked by the patcher with target root=<shadow (a patched copy), Block A step 1a makes that shadow the authoritative CODE ROOT and SKIPS the sentinel check (the shadow is deliberately mutated). Otherwise CODE ROOT is the pinned snapshot and the sentinel MUST match. Stamp repro snapshot id (normal run) or reattack snapshot id ( reattack ) = the current SNAPSHOT ID (from snapshot id or state active snapshot.snapshot id ) on every finding you update. Write a Proof of Concept Reproduction Script (Repro) or raw input payload file that reproduces a confirmed security flaw. Execute the reproduction stage under these constraints: 1. Load Viable Findings: If finding id is supplied: Load only that finding's file ( state root/workspace/findings/<uuid .json ). Exit if it does not exist. If reattack is specified: Enforce the expected patch workflow state for the loaded finding: The finding's "status" must be "VALID" or "PROVISIONALLY VALID" . The finding's "repro status" must be "reproduced" . The finding's "patch status" must NOT be "MITIGATION PROPOSED" . ( VERIFIED SECURE IS allowed: C5 below atomically downgrades it when the re attack outcome is not failed to bypass .) Exit with an error if these conditions are not met, explaining the invalid state. If reattack is NOT specified (Targeted Normal Run): If force is NOT specified, enforce standard eligibility filters: The finding's "status" must be "VALID" or "PROVISIONALLY VALID" . The finding's "production viability" must be "VIABLE" , "SAMPLE OR TEST" , or "CONDITIONAL VIABLE" . Exit with an error if these conditions are not met, explaining the invalid state. If force is specified, bypass these eligibility checks. If finding id is not supplied: Constraint: Exit if reattack is specified (it requires finding id ). Read the JSON files in the state root/workspace/findings/ directory. Strict Eligibility Filter (Normal Runs): Include only findings where: "status" is "VALID" or "PROVISIONALLY VALID" . "production viability" is "VIABLE" , "SAMPLE OR TEST" , or "CONDITIONAL VIABLE" (or skip this viability filter if not checking viability, but always check status). If no applicable findings exist, notify the user and exit. Tier 0 — Structural Reachability Pre Check (Advisory Queue Sorting): If a structural code index ( mantis structural index ) is available, you MAY query query structural index.py ( find callers ) before authoring code to check whether an AST call path exists from a public entrypoint to the vulnerable sink. Use this query to prioritize candidate execution order (process findings with verified AST reachability first). CRITICAL HINT ONLY GUARDRAIL: AST reachability is a ranking HINT ONLY. Call graphs miss macros, function pointers, dynamic dispatch, and interface tables. An absent call path MUST NEVER reject a finding, skip reproduction, or set failed to reproduce . Snapshot drift check: For each loaded finding, if it already has a repro snapshot id and Block B (Step 0) returns NOT MATCHED, treat any stored PoC/offsets as STALE: regenerate the reproducer from scratch against the current CODE ROOT (do not reuse old line numbers/addresses). If Block B is MATCHED you may reuse an existing PoC. 2. Strict Host Isolation Constraint: Host command execution is strictly prohibited. Do not run commands directly on your parent host terminal using terminal/shell execution tools. All reproducer executions must run isolated. Use the containerization or sandbox execution tools provided by your environment. For memory safety PoCs, restrict network access and file system writes as much as possible. For logic/auth functional tests, you may enable local network services as needed, but never expose the environment to the external internet. 3. Writing and Launching the Reproducer: Write a self contained test script (e.g., poc [uuid].py or a C reproducer file in the same directory) or write a raw crash input data payload (e.g., crash [uuid].payload ) that triggers the target bug. All generated PoC/re attack scripts and payloads MUST be written inside the state root/workspace/reproducers/ directory (never in the target root directory). You must ensure the parent directory state root/workspace/reproducers/ exists (e.g. using mkdir p ) before writing any files. Analyze the code path and constraints carefully. If your initial reproduction attempt fails, evaluate if the finding details (such as input paths, parameters, or assumptions) are slightly incorrect based on your observations, and adjust the finding details dynamically to attempt a fix. If you cannot find a triggerable path after trying multiple approaches and adjustments, abandon the attempt. Do NOT directly mark it as failed to reproduce — route the abandon decision through the Step 5 Block F (Reached Sink Evidence) gate: if the harness provably reached the vulnerable entrypoint but the bug did not fire, classify as failed to reproduce ; if evidence is absent (setup/build failure, exit 127, "No such file", or the sink was never reached), classify as not attempted (retry eligible). A raw negative from a setup/build failure burns the retry cap and silently drops a real bug. To run your script or payload, use the execution or containerization tools available in your environment to execute the code safely. Select the most appropriate runtime image and flags for the target. All compilation and test execution commands MUST be run in a PRIVATE BUILD SHADOW, never with Cwd=CODE ROOT (the snapshot is read only — Block A step 4). Before compiling, create BUILD ROOT=$(mktemp d) and copy CODE ROOT into it (e.g. cp a CODE ROOT/. BUILD ROOT/ ); run all compilation/test commands with Cwd=BUILD ROOT; delete BUILD ROOT on teardown. Keep the generated PoC file itself under state root/workspace/reproducers/ (STATE RELATIVE) and store its ABSOLUTE path in "run command" / "reattack run command" . Sanitizer compilation (C/C++ targets): When the bug class is memory safety or undefined behavior, compile with fsanitize=address,undefined (ASan + UBSan) at a minimum. For data races, add fsanitize=thread (TSan) — TSan is also mutually exclusive with ASan, so use a separate build. Use fno omit frame pointer for usable stack traces. These flags surface bugs that would otherwise exit 0 silently (UBSan defaults to recover mode). MSan caveat: MemorySanitizer ( fsanitize=memory ) detects uninitialized memory reads, but it requires the ENTIRE dependency chain (including libc

mantis-reproduce