Engagement Lifecycle Management

Engagement Initiation

Pre-Flight Checklist

Before starting any engagement, verify:

1. Authorization exists and is valid:

   • plan/roe.json — system-managed scope, exclusions, and restrictions
   • Applicable planning documents, when present, remain inside RoE boundaries
   • Direct Red runs may start from the confirmed RoE and operator instruction without CONOPS or deconfliction

   opplan.json is generated by the orchestrator after intake. It is not a prerequisite for a new engagement, and legacy objective completed status alone does not prove acceptance criteria or evidence verification.

2. Needed capabilities are available:

   • Hosted runs use the engagement's E2B runtime and enabled plugins
   • C2 is provisioned only when an authorized objective requires it, through c2_ensure
   • Missing capabilities are reported instead of replaced by an unrelated local service

3. If the RoE is missing: Request system setup. For optional planning documents, use Plan mode with Soundwave when the operator wants to design or revise them; do not block a direct Red run solely because they are absent.

All paths below are relative to the active engagement workspace. The orchestrator uses filesystem and OPPLAN tools; it has no shell.

Derive the starting objective from the operator's actual instruction and available evidence, not a legacy engagement-type label.

Phase Transitions

Gate Checks (Go/No-Go Decisions)

Before transitioning between phases, verify the gate criteria from the workflow skill:

Planning → Recon:    system-managed RoE valid; OPPLAN built and authorization policy satisfied
Recon → Exploit:     in-scope attack surface observed; required objective dependencies and evidence checked
Exploit → PostExploit: Initial foothold established, access type documented
PostExploit → Report: All OPPLAN objectives resolved (completed, blocked, or cancelled)

Phase Transition Protocol

1. Inspect current objective status and dependencies through the injected OPPLAN workflow.
2. Check prerequisite work and supporting evidence.
3. Verify the system-managed RoE and approval policy for the actual next action.
4. If a prerequisite or scope check fails, record the reason and re-plan through OPPLAN tools.

Handling Cross-Phase Dependencies

Some objectives may uncover new targets or invalidate assumptions:

• New targets discovered during recon → Replan the in-scope work through the injected OPPLAN workflow
• Exploit fails, need more recon → Return to recon phase for that specific target
• PostExploit reveals new network segments → May need additional recon/exploit cycles

Deconfliction

Blue Team Coordination

If roe.json specifies deconfliction contacts:

• Record all major actions with timestamps in timeline.jsonl only when a real event occurs
• If blue team detects and responds, note this as a data point (MTTD measurement)
• Never reveal TTPs to blue team during active engagement unless ROE requires it

Emergency Stop Procedure

If engagement must be halted:

1. Stop dispatching new sub-agent tasks and use the run's stop control for active execution
2. Document current state: which objectives in-progress, what's deployed
3. Record the halt in timeline.jsonl and update the affected OPPLAN objectives
4. Use OPPLAN tools to record current status for potential resumption; they persist the plan

Engagement Metrics

Track these throughout the engagement for the final report:

Engagement Completion

Final Reporting Checklist

When all objectives are resolved:

1. Attack Path Documentation:

   • Every hop from initial recon to final objective
   • Credentials used at each step
   • Privilege levels achieved on each host

2. Findings Synthesis:

   • Read all <engagement>/findings/FIND-*.md entries
   • Group by severity: Critical, High, Medium, Low
   • Map each finding to MITRE ATT&CK technique

3. Remediation Recommendations:

   • For each successful attack path, suggest defensive controls
   • Prioritize by: quick wins vs. strategic improvements
   • Reference where in the kill chain the control would interrupt the attack

4. Evidence Preservation:

   • All scan outputs in <engagement>/recon/
   • All exploit artifacts in <engagement>/exploit/
   • All post-exploit evidence in <engagement>/post-exploit/
   • Credential inventory (encrypted)

5. Cleanup:

   • List all artifacts deployed on target systems
   • Document persistence mechanisms that need removal
   • Verify no active implants remain (if applicable)