Workflow Phases

// From src/temporal/workflows.ts:380-387
state.currentPhase = 'vulnerability-exploitation';
state.currentAgent = 'pipelines';
await a.logPhaseTransition(activityInput, 'vulnerability-exploitation', 'start');

const maxConcurrent = input.pipelineConfig?.max_concurrent_pipelines ?? 5;
const pipelineResults = await runWithConcurrencyLimit(pipelineThunks, maxConcurrent);

# In config YAML
pipeline:
  max_concurrent_pipelines: 2  # Run 2 of 5 pipelines at a time

// From src/temporal/workflows.ts:389-416
async function runVulnExploitPipeline(
  vulnType: VulnType,
  runVulnAgent: () => Promise<AgentMetrics>,
  runExploitAgent: () => Promise<AgentMetrics>
): Promise<VulnExploitPipelineResult> {
  // 1. Run vulnerability analysis
  let vulnMetrics = await runVulnAgent();
  
  // 2. Check exploitation queue for actionable findings
  const decision = await a.checkExploitationQueue(activityInput, vulnType);
  
  // 3. Conditionally run exploitation agent
  let exploitMetrics: AgentMetrics | null = null;
  if (decision.shouldExploit) {
    exploitMetrics = await runExploitAgent();
  }
  
  return { vulnType, vulnMetrics, exploitMetrics };
}

# Comprehensive Security Assessment Report

## Executive Summary

**Target Application**: https://app.example.com  
**Assessment Date**: 2025-03-05  
**Total Vulnerabilities Found**: 12  
- Critical: 3
- High: 5
- Medium: 3
- Low: 1

## Critical Findings

### 1. SQL Injection in Search Endpoint

**Severity**: Critical  
**CVSS Score**: 9.8  
**Endpoint**: POST /api/search

**Description**:
The search functionality is vulnerable to SQL injection due to unsafe string concatenation...

**Proof of Concept**:
```bash
curl -X POST https://app.example.com/api/search \
  -d '{"query": "' UNION SELECT * FROM users--"}'

### Duration

Typically **5-10 minutes**.

---

## Phase Timeline

Typical pentest duration breakdown:

```mermaid
gantt
    title Shannon Pentest Timeline
    dateFormat HH:mm
    axisFormat %H:%M
    
    section Sequential Phases
    Pre-Recon           :p1, 00:00, 15min
    Recon              :p2, after p1, 20min
    
    section Parallel Phases
    Vuln Analysis (5x)  :p3, after p2, 40min
    Exploitation (5x)   :p4, after p3, 50min
    
    section Final Phase
    Reporting          :p5, after p4, 10min

// From src/session-manager.ts - Agent prerequisites
export const AGENTS: Readonly<Record<AgentName, AgentDefinition>> = {
  'pre-recon': {
    prerequisites: [],  // Runs first
  },
  'recon': {
    prerequisites: ['pre-recon'],  // Waits for pre-recon
  },
  'injection-vuln': {
    prerequisites: ['recon'],  // All vuln agents wait for recon
  },
  'injection-exploit': {
    prerequisites: ['injection-vuln'],  // Each exploit waits for its vuln
  },
  'report': {
    prerequisites: [
      'injection-exploit',
      'xss-exploit', 
      'auth-exploit',
      'ssrf-exploit',
      'authz-exploit'
    ],  // Waits for all exploits
  },
};