mcpField
R
replay-regression

replay-regression

github.com/trailofbitsTesting & quality7.9k162 installsUpdated today
Repository

About replay-regression

replay-regression is a skill for independently replaying an existing PoC against actual S0 and S1 systems. It is intended for a fresh verifier who can use the sealed reproduction package, without altering the PoC or reusing another attempt's build outputs.

Key features

  1. 01Verify the sealed reproduction package
  2. 02Build and run S0 and S1 independently
  3. 03Replay the unchanged PoC and input
  4. 04Check reachability through real interfaces
  5. 05Seal replay results and record blockers

Use cases

  1. 01Independently verify a completed reproduction
  2. 02Compare PoC behavior across two revisions
  3. 03Document divergence or setup blockers for review

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/trailofbits/skills --skill replay-regression

After installing, type/replay-regressionin Claude Code to confirm it loaded.

Details

From the project README

Independently replay a PoC

When to Use

Input: candidate, frozen source records, complete sealed reproduction package and registry assignment. Use a fresh context distinct from the reproducer. Follow project guidance before target work.

When NOT to Use

Authoring or repairing the PoC. Return changes to the caller for reproduction; changed PoCs require new reproduction and replay.

Replay

  1. Read the standard and file contract. Verify the package; read setup and security guidance. Stop execution if prerequisites fail.
  2. Independently build and run actual S0/S1 only inside your attempt directory; never reuse another attempt's build output. List every build directory in build_dirs. Execute the unchanged PoC with the same input against both. Record whether S0 behaves correctly and S1 exhibits the claimed failure.
  3. Check real interface reachability using only the claimed user's/attacker's access. Save setup, versions, commands, observations and separate logs.
  4. Write and seal replay.json, referencing the reproduction record and original PoC/input. Record divergence or blockers; uncertainty stays unresolved. Release temporary resources without deleting evidence.

Report Back

Keep detailed evidence in the sealed package. Return only:

  • Status: complete or blocked, matching the record.
  • Record: sealed replay.json path, or why none was produced.
  • Result: one sentence describing observed agreement or divergence.
  • Blocker: missing prerequisite or required caller action, if blocked.

Completion means the replay attempt finished, not that the regression is confirmed.

Rationalizations to Reject

  • “The previous logs look right”: replay requires your own execution.

Comments

Markdown supported