# Evidence-first bug hunting orchestration

This runbook coordinates humans and agents on one authorized program without duplicating work or inflating weak signals.

## Phase 0: authorization lock

The coordinator records the current policy URL, retrieval time, in-scope assets, exclusions, rate limits, test-account rules, data restrictions, and stop conditions. No active task starts before this record exists.

## Phase 1: surface map

The mapper inventories live assets and technology evidence. The client analyst inventories JavaScript and browser trust edges. The identity analyst maps roles and state transitions. All findings update the same surface map.

Exit when each reachable surface has an owner, source, last-seen time, and technology fingerprint.

## Phase 2: ranked hypotheses

Agents create lead records, then rank them by:

```text
priority = reachability + business impact + chain potential + evidence strength - test cost - safety risk
```

The formula is a queueing aid, not proof or severity.

Exit when the top leads each have one owner, one negative control, and one cheapest discriminator.

## Phase 3: decisive testing

One owner runs one bounded test. The skeptic reviews the result for confounders. Supported leads advance; rejected leads enter the dead-end ledger with enough evidence to prevent repetition.

Exit when every tested lead has a supported or rejected status.

## Phase 4: chain expansion

The chain analyst turns a supported primitive into a prerequisite graph:

```text
[observed primitive] -> [required capability] -> [trust boundary] -> [business impact]
```

Each edge receives a confidence level and a safe discriminator. Stop expanding when the next prerequisite cannot be tested inside scope or would create unnecessary impact.

Exit when the proven path and untested branches are visually distinct.

## Phase 5: independent validation

The validator reproduces the smallest claim from a clean state, checks that the control fails safely, confirms the live scope source, and verifies redactions.

Exit when a third party can follow the numbered steps without relying on hidden context.

## Phase 6: report and learn

The reporter writes observed facts, expected behavior, steps, evidence, minimal impact, remediation direction, and clearly labeled untested escalation. The coordinator feeds new endpoints, trust boundaries, and dead ends back into the surface map.

## Coordinator loop

Run this loop after every material result:

1. Deduplicate the new observation.
2. Update technology and trust-boundary tags.
3. Re-rank affected leads.
4. Stop redundant tasks.
5. Assign the next cheapest decisive test.
6. Preserve evidence and negative results.

## Handoff and completion record

Every owner leaves a structured handoff when responsibility changes. It includes the stable lead ID, factual observation, artifact references, negative control, confounders checked, one next discriminator, explicit stop condition, new owner, and current status.

The run is complete when every approved surface has been mapped or marked unreachable, every queued lead is supported, rejected, reported, or assigned to a named owner, every chain separates proven edges from hypotheses, and all reusable evidence and dead ends are present in the shared knowledge base.

## Quality checks

- No lead without an owner.
- No test without a stop condition.
- No vulnerability claim without a negative control.
- No chain claim without proven prerequisites.
- No scope decision without a current source URL.
- No evidence packet containing unnecessary credentials or personal data.