Pentest Mode

🎯 Pentest Mode — Operating Standard

Pentest Mode is the harness's professional operating standard for authorized engagements: a permission posture, tool policy, and documentation habit that make a session behave like a professional engagement, not a loose terminal.

The posture

Layer	Setting
Sandbox	read-only for recon, workspace-write for scoped work — see Sandbox & Safety Rails
Tools	Only what the engagement needs; hide the rest per profile
Approvals	On — mutating calls surface a card, nothing auto-escalates
Secrets	Credential references only; the store never leaks literals into logs

The engagement flow

1. workspace   → one directory per engagement (reports, notes, evidence)
2. read-only   → recon, enumeration, discovery sweeps
3. escalate    → workspace-write when you start writing reports/payloads
4. subagents   → parallel scoped hunts (recon / JS secrets / API surface)
5. background  → long scans as jobs; schedule re-checks with schedule_create
6. report      → findings into the workspace; sessions replay for evidence

Every step is a durable session event — the transcript is the evidence trail.

Multi-agent engagement pattern

One lead, several scoped hunters:

• Lead: spawn_teammate (or subagent) with a complete standalone prompt per hunter.
• Each hunter owns one surface: subdomains, JavaScript secrets, API endpoints.
• Long-running probes run as background jobs; the lead polls job_output.
• Coordination via send_message; the Lead's journal keeps delivery durable.
• Findings land on the shared task board (team_task_* with compare-and-set updates).

Workflow discipline

• Scope first. Name the target, the authorization basis, and the allowed techniques before the first tool call.
• One surface per agent. A scoped child beats a omniscient one — cleaner context, cheaper tokens, replayable findings.
• Checkpoints over vibes. create_goal for the campaign; todo_write for the current phase; schedules for time-boxed follow-ups.
• Denials are answers. [sandbox: … denied] is the policy speaking, not a bug — escalate through the approval path, never by disabling containment mid-hunt.

What Pentest Mode is NOT

• It does not authorize targets for you — authorization comes from you and the program you're working with.
• It is not a evasion toolkit: the harness stays transparent in what it runs, and the approval layer records who approved what.
• It is not a substitute for report writing — it makes the evidence durable so writing the report is fast.

Quick profile sketch

# $DSH_HOME/cordis.patch.yml — engagement seat
# tools: keep bash, fs, web, subagent, jobs
# sandbox default: workspace-write, workspaceRoot = the engagement directory

Start conservative. Escalate on evidence, with a human on every approval.