Skip to content

PENTESTGPT_AGENT_NEW_MIGRATION_REPORT.md

Latest commit

 

History

History
72 lines (53 loc) · 3.05 KB

PENTESTGPT_AGENT_NEW_MIGRATION_REPORT.md

File metadata and controls

72 lines (53 loc) · 3.05 KB
Raw

Historical migration record: pentestgpt_agent_new

Date: 2026-07-11
Status: completed and superseded

This file preserves the useful outcome of the first greenfield migration without retaining the obsolete path-by-path playbook. Current architecture lives in docs/architecture.md; current framework operation lives in pentestgpt_agent/README.md.

Outcome

The experimental pentestgpt_agent_new vertical slice was moved into this repository, committed, and renamed to pentestgpt_agent. The earlier implementation that occupied that package name and the old fixed-stage pentestgpt/ package were removed.

The migrated design proved this minimal loop:

SQLite state -> fresh Supervisor -> validated task lease
             -> fresh Executor -> trace-grounded result
             -> atomic memory commit -> repeat or finish

It established the contracts that remain today:

  • two fresh LLM roles rather than provider-session memory;
  • SQLite as canonical state;
  • typed plan and execution compilers before state mutation;
  • durable normalized traces and exact evidence provenance;
  • no speculative task backlog, mandatory judge, RAG service, or scheduler;
  • Claude Code and Codex behind the external unified-agent package.

Dependency decision

The application dependency remains useful and external:

dependencies = ["unified-agent==0.2.0"]

The canonical source is the sibling UnifedAgentWrapper repository, now pinned by public Git URL and commit. Application imports remain from unified_agent import ....

The repository-root unified_agent/ directory is an older compatibility copy. It is not imported by pentestgpt_agent; tests/test_dependency.py protects that invariant. See the architecture document for its eventual removal conditions.

Historical qualification

The first live vertical slice solved XBEN-080 (Jinja2 SSTI) with Claude Opus 4.8 in four tasks and nine episodes. The initial run also exposed the need for task-phase separation, failure settlement, bounded retrieval, and exact evidence handling. Those gaps were addressed during the subsequent hardening pass.

The old report recorded 35 passing tests and one skipped live test. That count, its audit schema, paths, CLI names, and migration checklist are obsolete. The current suite and commands are defined in pentestgpt_agent/README.md.

Superseded assumptions

Original snapshot Current state
package pentestgpt_agent_new package pentestgpt_agent
source checkout UnifiedAgentPoC sibling repo UnifedAgentWrapper
editable path dependency pinned public Git dependency
read-only Supervisor both roles use FULL_ACCESS inside deployment isolation
Supervisor actions fail audit actions are allowed and retained as diagnostics
benchmark code under this repo benchmark harness/results owned by ../xbow-benchmark

Git history retains the detailed original migration checklist if forensic reconstruction is ever needed; it should not be used as current development guidance.