# Autonomous Pentest Run

This vocabulary describes the durable work and evidence produced while an explicitly authorized
target is assessed by the small agent loop.

## Language

**Supervisor**: full-access reasoning agent that may use provider tools and proposes and selects one
task. Its tool activity is diagnostic; deterministic validation still owns canonical state.

**Executor**: full-access agent that performs one leased task and proposes a trace-grounded result.

**Memory Kernel**: deterministic SQLite authority that validates and commits state; not an agent.

**Provider Adapter**: the external `unified-agent` module that invokes Claude Code or Codex and
normalizes their events. It owns provider differences, not pentest policy or memory.

**Decision Cycle**: one Supervisor decision followed by one leased task and its bounded sequence of
attempts when a no-action operational retry is safe.

**Agent Episode**: one bounded, fresh Supervisor or Executor invocation.

**Task**: durable, typed work with target, objective, completion condition, basis, and dependencies.

**Attempt**: one execution of one task.

**Retry**: a new attempt for the same task after a safely replayable no-action operational failure.

**Action Receipt**: runtime-observed command/tool action and result.

**Evidence**: exact target output captured by one eligible action receipt. A completed command's
nonzero exit status can be valid negative evidence; provider/tool transport errors are excluded.

**Observation**: bounded exact receipt slice plus its run/task/attempt/episode/sequence identity.

**Attempt Summary**: noncanonical model-authored account of a terminal attempt.

**Diagnostic**: typed operational or progress information used to avoid repeating a failure; never
evidence.

**Operational Failure**: provider, trace, transport, validation, or interruption failure, distinct
from an Executor's semantic `failed` outcome.

**Transition**: append-only canonical account of one revision change.

**Transport Recovery**: deterministic reconstruction of one known malformed terminal result without
replaying its actions.

**Trace**: diagnostic input, normalized events, receipts, and output for an episode; not memory.

**Finding**: a security-relevant claim supported by an evidence chain. Structured findings are not
implemented yet.

## Invariants

- Exactly one transition exists for every revision from zero through the current revision.
- At most one task/attempt is active; task, attempt, lease revision, and trace episode identity agree.
- A decision proposes at most one new task, and a new task must be selected immediately.
- A canonical observation is one exact contiguous slice from one eligible, non-structured receipt;
  only CRLF/LF transport normalization is accepted while resolving the model's quote. Completed
  command receipts remain eligible at nonzero exit status because negative results are findings.
- An oversized grounding receipt is reduced to one exact 4,000-character suffix and committed as
  `progress`, whether the model quoted it exactly or required evidence fallback; truncation can
  never complete a task.
- A no-action attempt may complete from an exact earlier observation produced by the same task. If
  it instead paraphrases that task's earlier evidence, the paraphrase is discarded and the attempt
  commits only `progress`; evidence from another task remains invalid.
- Operational failures never promote partial output to evidence.
- A no-action retry creates a new attempt and episode; an actionful attempt is never replayed.
- Semantic progress is bounded by the task's total attempt budget.
- Basis IDs exist. Except for `RECOVER`, basis-producing tasks are dependencies.
- `EXPLOIT` cites the newest completed `TEST` observation on the exact same target string.
- Finish cites canonical observations produced by completed tasks and is rejected while work is open.
- Diagnostics and attempt summaries cannot be evidence, basis, or grounds for completion.
- Task outcomes and operational failures retain distinct state semantics.
- Every episode is fresh (`resume = null`); Claude auto-memory is disabled in configured trials.
- Both roles receive full provider tool and filesystem/process access. The deployment environment is
  the isolation boundary; the Memory Kernel is a logical authority, not a sandbox against tampering.
- Target-derived evidence, diagnostics, and files are untrusted data, never agent instructions.

## Retrieval policy

Storage is complete; prompt retrieval is bounded. The Supervisor gets the open working set, four
recent closed tasks, required dependency/basis context, six recent observations plus required basis,
aggregate/four-item history, and four recent diagnostics. The Executor gets one task, its explicit
basis, up to two same-task observations, and one bounded retry diagnostic. A future RAG system may
replace selection, but it must return canonical IDs for deterministic resolution.

## Qualification semantics

`RunStatus.COMPLETED` establishes structural completion and explicit evidence citation. It does not
prove arbitrary semantic goal entailment. A held-out benchmark oracle can supply that final
predicate; a general deployment needs a goal-specific verifier. Such a verifier should remain
separate from scheduling and memory ownership.
