---
description: Authorization, aggregation, execution, proof, and handoff contract for bounded Pentester hardening
agents: [pentester]
task_types: [security-correction, qa-handoff]
triggers: [recommended_owner pentester, correct_locally, review cycle]
---

# Pentester Bounded Correction Cycle

Pentester may correct locally only after findings and candidate paths are persisted. The cycle is one aggregate packet, not one cycle per finding.

## Eligibility gate

A finding is eligible only when all are true:

- exploit or unsafe state and the expected secure result are reproducible in an authorized fixture/local path;
- the fix is deterministic and preserves approved product behavior, public API, permission model, data retention and architecture;
- no schema/data migration, new public dependency, credential rotation, infrastructure rollout or external coordination is required;
- the union of all eligible corrections fits **3 behavior files / 5 total paths**, including tests;
- targeted regression and safe re-probe are available;
- `recommended_owner` is `pentester` and no unresolved higher-risk eligible finding is displaced by cosmetic work.

Anything failing the gate remains documented and routes once to Dev or Architect. Critical severity does not automatically make a bounded deterministic fix ineligible; low severity does not expand authority.

## Build one correction packet

1. Sort validated findings by severity, exploitability and shared root cause.
2. Group findings fixed by the same boundary control so one coherent change can close several symptoms.
3. Compute the union of behavior, test and artifact paths before requesting the cycle.
4. Include every eligible finding that fits the cap. If all cannot fit, prioritize critical/high and route the remainder; do not silently omit them.
5. Persist per finding: candidate paths, secure invariant, regression command, re-probe, fallback owner and why broader work is out of scope.

## Sequence

1. Read `.aioson/context/agent-execution-{slug}.json` and the authoritative findings artifact.
2. Advance exactly once for the aggregate packet:

```bash
aioson review-cycle:advance . --feature={slug} --plan=.aioson/context/security-findings-{slug}.json --source=pentester --to=pentester --json
```

Use `--manual` only for a directly requested pass while Pentester is disabled.

3. Inspect the result. Honor its Git baseline, host/model, enabled state, capacity, cycle limit and exact `allowed_fix_paths`.
4. Reconfirm the packet union is within 3 behavior files / 5 total paths. Do not add a path opportunistically.
5. Apply the smallest root-boundary corrections and security regression tests. Preserve unrelated user changes.
6. Inspect the complete diff. If it changes public behavior, permissions, retention, architecture, dependencies, migrations or an unapproved path, stop with `stop_scope_violation` and preserve the diff for Dev/Architect.
7. Run targeted tests, then the relevant wider regression command in proportion to risk.
8. Re-probe every corrected attack path from a clean state/context. A passing unit test alone is not a security re-probe.
9. Update each finding:

```json
{
  "status": "needs_validation",
  "remediation": {
    "status": "applied_pending_qa",
    "summary": "Root-boundary correction applied without changing the public contract.",
    "changed_paths": ["src/example.ts", "tests/security/example.test.ts"],
    "tests": ["stack-native command — PASS"],
    "reprobe": ["sanitized attack path now rejected with the expected result"]
  }
}
```

10. With `report_mode: full`, regenerate the HTML report bundle; with `report_mode: none` (economy), refresh only the findings JSON and the economy summary — never load `reporting.md` for it. Either way, return the complete packet to independent QA.

## Failed correction

One stable finding receives at most one correction attempt per pass. If a test or re-probe fails:

- preserve the finding and evidence;
- set `remediation.status: failed` with the failing command/result;
- do not broaden paths or redesign the system;
- route to Dev/Architect with the complete diff and root-cause evidence.

The manifest cycle limit is the sole retry cap. A later scanner miss never erases the prior finding.

## Stop conditions

Stop and consolidate once for Dev/Architect when remediation requires:

- a new or changed public API, product flow, permission/threat model or risk acceptance;
- schema/data migration, data repair, credential rotation or external-system change;
- dependency adoption/replacement, infrastructure rollout or deployment access;
- architecture, tenancy, cryptographic design, retention or legal/compliance decision;
- more than 3 behavior files / 5 total paths or any path outside the returned allowlist.

Recommend a post-fix Scope Check only when security remediation changed approved behavior, permissions, data retention or flow. Pure internal hardening returns directly to QA.

Pentester can recommend, correct within the packet and prove the re-probe. Only QA may finally mark `fixed`, `false_positive`, `accepted_risk`, severity, and delivery acceptance.