# Knowledge change log

Append dated entries; preserve superseded evidence in Git history.

| Date | Change | Evidence |
|---|---|---|
| 2026-10-22 | Initial DASF 3.0 compendium extraction and linked risk/control wiki; original audit method and MCP implementation | sources/manifest.json; source row citations; docs/validation.md |
| 2026-10-23 | Add six research guides/templates for PentAGI, Cloudflare security-audit-skill and Red Blue Field; expose through MCP and website search without changing the DASF graph | sources/research.json; pinned source links; 20 local tests; docs/validation.md |

## 2026-10-23 — Practitioner research and attack-surface skill

Prepared a 78-repository triage of jhaddix, selected source readings, attribution-aware study guide and map-attack-surface skill. The skill uses public TBHM/HUNT practices with explicit AI adaptations. No active reconnaissance, new MCP capability or change to the DASF catalog. See the dedicated [validation note](https://mathborgess.github.io/ai-security-wiki/docs/jhaddix-study-validation.md).

## 2026-10-23 — Independent mapping evaluation

Evaluated map-attack-surface in fresh Codex CLI sessions against a no-package baseline and native discovery prompts. Version 0.1.1 narrows selection and makes sanitized/private evidence handling explicit. Final 4/4 practical cases and 4/4 discovery prompts passed the recorded checks; earlier failures and comparison limits remain in the [validation note](https://mathborgess.github.io/ai-security-wiki/docs/jhaddix-study-validation.md). No target testing or MCP capability change.

## 2026-10-23 — Pocket specialist and AI evaluation studies

Added ask-cyber-specialist, an original domain profile informed by public methods, with optional study interviews, falsifiable hypotheses and paired defenses/retests. Added a Jason Haddix post/media reading path and a pinned upstream spikee evaluation guide. Native Codex discovery and practical outputs were evaluated separately from installation and real-system efficacy; see [validation](https://mathborgess.github.io/ai-security-wiki/docs/cyber-specialist-validation.md). No active scanning, new MCP capability or DASF record change.