The Autonomous Attack Swarm

The swarm is not a parallel scanner or a repeated pentest. It is a coordination layer over real targets: N specialized agents attack N live targets at once, collaborate by capability, and prove with an observed postcondition. Every finding crosses the same membrane as everything else before it is counted, and whatever is not proven stays UNKNOWN.

The coordinator orchestrates; it does not run security logic. It owns the agent pool, the scheduler, a shared world, the capability router, the validation queue and the trace emitter — and it wires every result to the one authority, the membrane. The central invariant: every reported finding crossed the same membrane; verification is called, never modified.

A campaign is declarative: its scope and Rules of Engagement, its targets, the swarm definition, an explicit budget (where "unlimited" must be stated, not defaulted), and its stop conditions. A mismatch between the declared scope and the target fails at construction — because that mismatch is exactly how an action-authority hole would open.

• ▸The unit of work is the mission instance, not an agent slot, with a stable identifier. An agent claims an unclaimed instance atomically; if its own is taken, it steals a free in-scope instance from another target — dynamic reassignment, so an exhausted target lends its spare capacity to one with work. Two agents never run the same instance.
• ▸Agents deliberate over one shared world, and disagreement is kept as an explicit contradiction — never resolved by majority vote. An agent sees that a peer already failed, non-retryably, on the same work before repeating it.
• ▸A structural scope gate runs before any action: an out-of-scope agent is blocked, it does not "yield".
• ▸A strict-batch scheduler uses leases and recovers dead agents; a retry keeps the mission-instance identity and advances the attempt, so a stolen-then-recovered claim is never double-counted.
• ▸Optional seams are inert by default, so a run is byte-identical when they are off: learning only reorders agents (it never adds, removes or mints a finding), and the budget heuristic can only discard already-deduplicated spare capacity, never drop below the seed, never mint a finding.

Agents are not listed by hand. Each agent declares which frontier it belongs to, and the swarm mission plus any agent declaring that frontier compose the swarm. For the shape the control plane triggers today — N live targets from one order — the runner seeds one RAVEN drone per target, with active Rules of Engagement and the targets as scope, handed out round-robin.

While it runs, the swarm emits a stream of trace events on its own topic to paint progress live. Each event carries the campaign, distributed-tracing ids, the agent, the state transition, a severity and references. The vocabulary is closed, down to finding states — candidate, verified, unknown — and UNKNOWN is never read as clean.

Built and wired end-to-end: the full coordinator — mission-instance dedup, dynamic reassignment, the shared world with contradictions, the structural scope gate, the strict-batch scheduler with lease recovery, and the trace emitter — and "N RAVEN drones over N live targets" from one order, verified end-to-end, with evidence-backed findings that cross the membrane.

• ▸Diverse per-agent priors are not wired yet: today the swarm splits territory by target, not by hypothesis or vulnerability class.
• ▸Correlating a campaign to its tenant over a signed channel is not done yet; a fragile derived fallback is used, and an unmatched trace is dropped rather than written to a random tenant.
• ▸Multi-target fan-out from a single order still needs multi-input ingest wiring; today each target in the order runs the swarm over that target.
• ▸The swarm-walk report currently collapses the targets to the first one, so its graph comes out nearly empty — a diagnosed engine gap.
• ▸The live view in the control-plane interface still consumes sample data; wiring the real stream to the render is pending.