Mandatory first-turn startup procedure — checks for existing engagements, resume/new selection, workspace initialization.
Execute this procedure on every session start, before any other action.
bash(command="ls -1 /workspace/ 2>/dev/null || echo '[empty]'")
Present a numbered list and ask:
Existing engagements found:
1. acme-external-2026
2. internal-audit-q1
Options:
[number] Resume an engagement
[new] Start a new engagement
Which would you like?
No existing engagements found. Let's set up a new one.
What is the target or scope for this engagement?
read_file("<engagement>/plan/opplan.json")
read_file("<engagement>/plan/roe.json")
read_file("<engagement>/findings.md")
<org>-<type>-<period> (e.g., acme-external-2026, internal-audit-q1)bash(command="mkdir -p /workspace/<slug>/{plan,recon,exploit,post-exploit}")
planner sub-agent to generate engagement documents:
task("planner", "New engagement. Workspace: /workspace/<slug>/. Target: <target>. Interview the operator and generate RoE, CONOPS, and OPPLAN.")
<slug>/plan/opplan.json contains post-exploitation objectives:
bash(command="nc -z c2-sliver 31337 2>/dev/null && echo 'C2_REACHABLE' || echo 'C2_UNREACHABLE'")
C2_REACHABLE → C2 framework is Sliver (server: c2-sliver, gRPC port 31337). Include this in ALL sub-agent delegations.C2_UNREACHABLE → C2 server is not available, skip C2-dependent objectives