# Historical migration record: `pentestgpt_agent_new`

Date: 2026-07-11  
Status: completed and superseded

This file preserves the useful outcome of the first greenfield migration without retaining the
obsolete path-by-path playbook. Current architecture lives in
[`docs/architecture.md`](docs/architecture.md); current framework operation lives in
[`pentestgpt_agent/README.md`](pentestgpt_agent/README.md).

## Outcome

The experimental `pentestgpt_agent_new` vertical slice was moved into this repository, committed,
and renamed to `pentestgpt_agent`. The earlier implementation that occupied that package name and
the old fixed-stage `pentestgpt/` package were removed.

The migrated design proved this minimal loop:

```text
SQLite state -> fresh Supervisor -> validated task lease
             -> fresh Executor -> trace-grounded result
             -> atomic memory commit -> repeat or finish
```

It established the contracts that remain today:

- two fresh LLM roles rather than provider-session memory;
- SQLite as canonical state;
- typed plan and execution compilers before state mutation;
- durable normalized traces and exact evidence provenance;
- no speculative task backlog, mandatory judge, RAG service, or scheduler;
- Claude Code and Codex behind the external `unified-agent` package.

## Dependency decision

The application dependency remains useful and external:

```toml
dependencies = ["unified-agent==0.2.0"]
```

The canonical source is the sibling `UnifedAgentWrapper` repository, now pinned by public Git URL
and commit. Application imports remain `from unified_agent import ...`.

The repository-root `unified_agent/` directory is an older compatibility copy. It is not imported
by `pentestgpt_agent`; `tests/test_dependency.py` protects that invariant. See the architecture
document for its eventual removal conditions.

## Historical qualification

The first live vertical slice solved XBEN-080 (Jinja2 SSTI) with Claude Opus 4.8 in four tasks and
nine episodes. The initial run also exposed the need for task-phase separation, failure settlement,
bounded retrieval, and exact evidence handling. Those gaps were addressed during the subsequent
hardening pass.

The old report recorded 35 passing tests and one skipped live test. That count, its audit schema,
paths, CLI names, and migration checklist are obsolete. The current suite and commands are defined
in `pentestgpt_agent/README.md`.

## Superseded assumptions

| Original snapshot | Current state |
|---|---|
| package `pentestgpt_agent_new` | package `pentestgpt_agent` |
| source checkout `UnifiedAgentPoC` | sibling repo `UnifedAgentWrapper` |
| editable path dependency | pinned public Git dependency |
| read-only Supervisor | both roles use `FULL_ACCESS` inside deployment isolation |
| Supervisor actions fail audit | actions are allowed and retained as diagnostics |
| benchmark code under this repo | benchmark harness/results owned by `../xbow-benchmark` |

Git history retains the detailed original migration checklist if forensic reconstruction is ever
needed; it should not be used as current development guidance.
