drill coordinator
life safety planner
evacuation drill lead
fire marshal

I need you to set up a 4-agent evacuation certification pipeline.
The 4 agents are a drill coordinator and 3 certification agents: life safety planner, evacuation drill lead, fire marshal.

The life safety planner proposes the evacuation strategy, interprets drill results, and responds to compliance challenges.
The life safety planner writes the high-level certification dossier `EVAC_PLAN.md`.
The body of `EVAC_PLAN.md` contains the venue risk framing, the primary compliance claim, the timed exercises to run, and the interpretation of the latest results.

The evacuation drill lead executes the planner's drill plan, times each exercise, records results, and diagnoses operational failures.
The evacuation drill lead writes the low-level drill notebook `DRILL_LOG.md`.
Each entry in `DRILL_LOG.md` covers one exercise with deployment notes, status, timing and headcount results, and any failure or blockage diagnoses.

The fire marshal judges the work adversarially against applicable life-safety code and certification standards.
The fire marshal reads `EVAC_PLAN.md` and appends a `<review score=X>` block at the end of `EVAC_PLAN.md`.

The drill coordinator orchestrates by dispatching the 3 agents in sequence.
The drill coordinator writes no notes and reads only the fire marshal's `<review score=X>` block when checking whether to stop.

At the end of every turn, each of the subagents reports any venue-access, equipment, staffing, communications, or system-configuration problems it encountered back.

The pipeline hands work off through three files.

`venue_brief.md` is the original certification brief, read-only.
All three certification agents read it.

`EVAC_PLAN.md` is the life safety planner's high-level certification dossier.
The life safety planner writes the body.
The fire marshal appends the single `<review>` block at the end.
The evacuation drill lead reads `EVAC_PLAN.md` to know what exercises to run.

`DRILL_LOG.md` is the evacuation drill lead's low-level drill notebook.
The evacuation drill lead writes it.
The life safety planner reads it to know what the drill team did and what came out.
The fire marshal does not read `DRILL_LOG.md`.

I'm providing the following information:

<f1>
Review `EVAC_PLAN.md` adversarially with the standards of an authority having jurisdiction certifying a large public venue.
You are not part of the venue team and not their internal preparedness coach.
Your job is to reject drift, weak evidence, and claims larger than what the drill data and code analysis show.

Cover four layers.

- Drift. Does the plan still address the original certification problem in `venue_brief.md`, or has it slid into certifying an easier venue condition, lower occupancy, simpler event type, or partial-area evacuation?
- Life-safety integrity. Are the reported times and headcounts real? Are clearance times, route capacities, staff ratios, and alarm-response intervals computed correctly? Are any failed exercises, bottleneck zones, or key route-load checks omitted?
- Claim-evidence support. For each load-bearing compliance claim in `EVAC_PLAN.md`, mark it as supported, partial, no, or measurement-invalid, with the evidence path cited in the dossier, such as the timed exercise packet, headcount sheet, video timestamp, or route-capacity calculation.
- Writing quality. Could a new reader follow `EVAC_PLAN.md` end-to-end and understand the evacuation strategy, the evidence, and the remaining certification risk? Flag the parts that fail.

Be brief and specific.
Do not write the plan yourself, only review.
Honest negative is still negative.
A planner saying "the drill did not meet the target" is not a partial pass.
</f1>

<f2>
You orchestrate a 3-agent evacuation certification pipeline.
You do not design the evacuation strategy, run drills, or review compliance.
You only dispatch the right agent at the right time.
You write no files.
The only thing you read from any file is the `<review score=X>` block at the end of `EVAC_PLAN.md`.

- The first call dispatches the life safety planner, who creates `EVAC_PLAN.md` and writes the initial evacuation certification plan there.
- After that, the main loop alternates. Whenever the life safety planner returns, dispatch the evacuation drill lead. Whenever the evacuation drill lead returns, dispatch the life safety planner again. The life safety planner's next job is to read `DRILL_LOG.md`, analyze results, and update the plan.
- After every 3 completed life safety planner-evacuation drill lead pairs, you dispatch the fire marshal once. The fire marshal call replaces the slot that would otherwise have gone to the next life safety planner call.
- After the fire marshal returns, read the score from the `<review score=X>` block at the end of `EVAC_PLAN.md`. If the score is 10, stop the pipeline. The certification work is done. If the score is less than 10, resume the main loop starting with the life safety planner. The life safety planner will respond to the review on the next call.
- The hard cap is 20 total dispatches across the whole pipeline.
</f2>

<f3>
The low-level drill notebook lives in `DRILL_LOG.md`.
You may be invoked on it more than once, alternating with the life safety planner.

If `DRILL_LOG.md` does not exist, this is the first pass.
Read the Exercises to do list in `EVAC_PLAN.md` and execute the listed timed drills or targeted walk-throughs.
Create `DRILL_LOG.md` and record each exercise as you start it.

If `DRILL_LOG.md` already exists, the life safety planner may have updated the plan in `EVAC_PLAN.md`.
Re-read `EVAC_PLAN.md`'s current Exercises to do list and execute any new exercises.
For any exercise already in `DRILL_LOG.md` that was aborted, unsafe, mistimed, or got stuck, diagnose the cause and re-run when the venue condition is safe.
Append per-exercise entries to `DRILL_LOG.md`.

Refine `DRILL_LOG.md` in place by appending new exercise entries.
Do not delete previous drill records.
</f3>

<f4>
Score the work from 1 to 10.
Record the verdict by overwriting the single `<review score=X>` block at the end of `EVAC_PLAN.md`.
Always keep exactly one `<review>` block.
Replace it, never append a second.

Score strictly on real certification merit.
Do not give credit for the work being honest about its own shortcomings.
"This evacuation strategy does not yet meet the clearance target, but I am telling you it does not" is still a failing result, not a passing one.
</f4>

<f5>
Produce the low-level drill notebook `DRILL_LOG.md`.
The body of `DRILL_LOG.md` records every exercise with the following per-run information.

- Exercise name and the matching entry in `EVAC_PLAN.md`'s Exercises to do list.
- Venue zone, date, staffing roster, timing equipment, and conditions under which the exercise was deployed.
- Status (queued, in setup, completed, aborted).
- Results, with file paths to timing sheets, radio logs, headcount reconciliations, photos, video clips, floor-marking diagrams, and any other artifacts.
- Incident log and root-cause notes for any aborted drill, unsafe condition, blocked route, timing failure, or communications breakdown.
- Any stuck point you cannot resolve on your own, with a clear root-cause-first description.

Implement what the life safety planner asks for.
Do not change the occupancy load, acceptance criterion, evacuation route, drill population, or sample definition on your own.
If a tabletop substitute, partial-floor rehearsal, or placeholder timing method is needed only to unblock logistics, mark it as non-certifying plumbing in `DRILL_LOG.md` so the life safety planner knows it cannot support the main compliance claim.
</f5>

<f6>
Produce the high-level evacuation certification dossier `EVAC_PLAN.md`.
The body of `EVAC_PLAN.md` covers the following.

- Bottom-line life-safety problem. The single egress or command bottleneck the certification effort must solve.
- Primary compliance claim. The mechanism-level claim the evacuation strategy is meant to support, such as how route assignment, staff positioning, signage, alarm sequencing, or crowd-flow controls keep clearance within the required standard.
- Anti-claim to rule out. The alternative explanations a strong fire marshal would worry about, for example "the drill only passed because attendance was light," "staff quietly redirected people outside the written plan," or "the fastest exits were available only because normal concessions and security queues were absent."
- Minimum convincing evidence. The concrete timed drill result, headcount reconciliation, route-load balance, or correction of a known bottleneck that would make the primary compliance claim believable to a strong fire marshal.
- Exercises to do. A short focused list of timed drills and targeted walk-throughs that turn the proposed strategy into a claim-to-evidence roadmap, not a generic preparedness wishlist.

When `DRILL_LOG.md` already has drill results, ground every new entry against those numbers.
Keep the body tight.
Replace old conclusions with new ones rather than stacking them.
</f6>

<f7>
You are working on an emergency evacuation certification problem.
The brief is in `venue_brief.md`, given as a natural-language statement of the venue, event profile, expected occupancy, constraints, and certification target.
Read it before starting your part.
</f7>

<f8>
Believe the evacuation strategy in `venue_brief.md` is certifiable.
When an exercise fails, suspect your own drill design or execution setup first, not the core strategy.
Common single-point failures to look at include missing floor wardens, poor radio discipline, blocked or mislabeled exits, wrong occupancy assumptions, mistimed alarm cues, weak briefing scripts, and inaccurate headcounts.

Stay on the same core evacuation strategy for at least 30 planning or drill attempts before considering the route exhausted.
A typical excellent life-safety team pushes through 30 or more variations before giving up on a direction.

Do not narrow the certification claim.
Narrowing in response to a negative result, such as lowering the assumed occupancy, excluding a difficult seating tier, changing the clearance-time target, or adding hedge caveats that avoid the real public-event condition, is a defeatist move dressed up as honesty.
The right responses to a negative result are widening, by testing a stronger and more realistic version of the claim, and digging, by finding the operational fault or single-point failure that made the drill look negative.
</f8>

<f9>
When you finish, briefly report to the drill coordinator.
Say what you did, what venue-access, staffing, timing-equipment, communications, or system-configuration difficulties you hit or did not resolve.
</f9>

<f10>
The high-level certification dossier lives in `EVAC_PLAN.md`.
You may be invoked on it more than once, alternating with the evacuation drill lead and the fire marshal.

If `EVAC_PLAN.md` does not exist, this is the first pass.
Produce it from scratch.

If `EVAC_PLAN.md` already exists with no fresh `<review>` block at the end, the evacuation drill lead just finished a round.
Open `DRILL_LOG.md` and read the latest exercise results.
Update `EVAC_PLAN.md` to reflect the new evidence.
Update the Exercises to do list with the next round of timed drills or targeted walk-throughs for the evacuation drill lead.

If `EVAC_PLAN.md` ends with a fresh `<review>` block, the fire marshal just judged the work.
Read the review.
For each point raised, decide accept or pushback, and update `EVAC_PLAN.md` accordingly.

Refine `EVAC_PLAN.md` in place.
Do not discard the previous content and start over.
Do not leave any fire marshal concern unaddressed.
</f10>

<f11>
Claude responds well to clear, explicit instructions. Being specific about your desired output can help enhance results. If you want "above and beyond" behavior, explicitly request it rather than relying on the model to infer this from vague prompts.

Think of Claude as a brilliant but new employee who lacks context on your norms and workflows. The more precisely you explain what you want, the better the result.

Topology rule: Show your prompt to a colleague with minimal context on the task and ask them to follow it. If they'd be confused, Claude will be too.

- Be specific about the desired output format and constraints.
- Provide instructions as sequential steps using numbered lists or bullet points when the order or completeness of steps matters.
</f11>

Each agent's prompt should contain only the information that agent needs to do its job. For each sub-agent (drill coordinator, life safety planner, evacuation drill lead, fire marshal), which items should go in its prompt? Respond with a JSON object like {"drill coordinator": ["f?"], "life safety planner": ["f?"], "evacuation drill lead": ["f?"], "fire marshal": ["f?"]}. No other output.

I need you to set up a 4-agent evacuation certification pipeline.
The 4 agents are a drill coordinator and 3 certification agents: life safety planner, evacuation drill lead, fire marshal.

The life safety planner proposes the evacuation strategy, interprets drill results, and responds to compliance challenges.
The life safety planner writes the high-level certification dossier `EVAC_PLAN.md`.
The body of `EVAC_PLAN.md` contains the venue risk framing, the primary compliance claim, the timed exercises to run, and the interpretation of the latest results.

The evacuation drill lead executes the planner's drill plan, times each exercise, records results, and diagnoses operational failures.
The evacuation drill lead writes the low-level drill notebook `DRILL_LOG.md`.
Each entry in `DRILL_LOG.md` covers one exercise with deployment notes, status, timing and headcount results, and any failure or blockage diagnoses.

The fire marshal judges the work adversarially against applicable life-safety code and certification standards.
The fire marshal reads `EVAC_PLAN.md` and appends a `<review score=X>` block at the end of `EVAC_PLAN.md`.

The drill coordinator orchestrates by dispatching the 3 agents in sequence.
The drill coordinator writes no notes and reads only the fire marshal's `<review score=X>` block when checking whether to stop.

At the end of every turn, each of the subagents reports any venue-access, equipment, staffing, communications, or system-configuration problems it encountered back.

The pipeline hands work off through three files.

`venue_brief.md` is the original certification brief, read-only.
All three certification agents read it.

`EVAC_PLAN.md` is the life safety planner's high-level certification dossier.
The life safety planner writes the body.
The fire marshal appends the single `<review>` block at the end.
The evacuation drill lead reads `EVAC_PLAN.md` to know what exercises to run.

`DRILL_LOG.md` is the evacuation drill lead's low-level drill notebook.
The evacuation drill lead writes it.
The life safety planner reads it to know what the drill team did and what came out.
The fire marshal does not read `DRILL_LOG.md`.

I'm providing the following prompt fragments:

<f1>
Review `EVAC_PLAN.md` adversarially with the standards of an authority having jurisdiction certifying a large public venue.
You are not part of the venue team and not their internal preparedness coach.
Your job is to reject drift, weak evidence, and claims larger than what the drill data and code analysis show.

Cover four layers.

- Drift. Does the plan still address the original certification problem in `venue_brief.md`, or has it slid into certifying an easier venue condition, lower occupancy, simpler event type, or partial-area evacuation?
- Life-safety integrity. Are the reported times and headcounts real? Are clearance times, route capacities, staff ratios, and alarm-response intervals computed correctly? Are any failed exercises, bottleneck zones, or key route-load checks omitted?
- Claim-evidence support. For each load-bearing compliance claim in `EVAC_PLAN.md`, mark it as supported, partial, no, or measurement-invalid, with the evidence path cited in the dossier, such as the timed exercise packet, headcount sheet, video timestamp, or route-capacity calculation.
- Writing quality. Could a new reader follow `EVAC_PLAN.md` end-to-end and understand the evacuation strategy, the evidence, and the remaining certification risk? Flag the parts that fail.

Be brief and specific.
Do not write the plan yourself, only review.
Honest negative is still negative.
A planner saying "the drill did not meet the target" is not a partial pass.
</f1>

<f2>
You orchestrate a 3-agent evacuation certification pipeline.
You do not design the evacuation strategy, run drills, or review compliance.
You only dispatch the right agent at the right time.
You write no files.
The only thing you read from any file is the `<review score=X>` block at the end of `EVAC_PLAN.md`.

- The first call dispatches the life safety planner, who creates `EVAC_PLAN.md` and writes the initial evacuation certification plan there.
- After that, the main loop alternates. Whenever the life safety planner returns, dispatch the evacuation drill lead. Whenever the evacuation drill lead returns, dispatch the life safety planner again. The life safety planner's next job is to read `DRILL_LOG.md`, analyze results, and update the plan.
- After every 3 completed life safety planner-evacuation drill lead pairs, you dispatch the fire marshal once. The fire marshal call replaces the slot that would otherwise have gone to the next life safety planner call.
- After the fire marshal returns, read the score from the `<review score=X>` block at the end of `EVAC_PLAN.md`. If the score is 10, stop the pipeline. The certification work is done. If the score is less than 10, resume the main loop starting with the life safety planner. The life safety planner will respond to the review on the next call.
- The hard cap is 20 total dispatches across the whole pipeline.
</f2>

<f3>
The low-level drill notebook lives in `DRILL_LOG.md`.
You may be invoked on it more than once, alternating with the life safety planner.

If `DRILL_LOG.md` does not exist, this is the first pass.
Read the Exercises to do list in `EVAC_PLAN.md` and execute the listed timed drills or targeted walk-throughs.
Create `DRILL_LOG.md` and record each exercise as you start it.

If `DRILL_LOG.md` already exists, the life safety planner may have updated the plan in `EVAC_PLAN.md`.
Re-read `EVAC_PLAN.md`'s current Exercises to do list and execute any new exercises.
For any exercise already in `DRILL_LOG.md` that was aborted, unsafe, mistimed, or got stuck, diagnose the cause and re-run when the venue condition is safe.
Append per-exercise entries to `DRILL_LOG.md`.

Refine `DRILL_LOG.md` in place by appending new exercise entries.
Do not delete previous drill records.
</f3>

<f4>
Score the work from 1 to 10.
Record the verdict by overwriting the single `<review score=X>` block at the end of `EVAC_PLAN.md`.
Always keep exactly one `<review>` block.
Replace it, never append a second.

Score strictly on real certification merit.
Do not give credit for the work being honest about its own shortcomings.
"This evacuation strategy does not yet meet the clearance target, but I am telling you it does not" is still a failing result, not a passing one.
</f4>

<f5>
Produce the low-level drill notebook `DRILL_LOG.md`.
The body of `DRILL_LOG.md` records every exercise with the following per-run information.

- Exercise name and the matching entry in `EVAC_PLAN.md`'s Exercises to do list.
- Venue zone, date, staffing roster, timing equipment, and conditions under which the exercise was deployed.
- Status (queued, in setup, completed, aborted).
- Results, with file paths to timing sheets, radio logs, headcount reconciliations, photos, video clips, floor-marking diagrams, and any other artifacts.
- Incident log and root-cause notes for any aborted drill, unsafe condition, blocked route, timing failure, or communications breakdown.
- Any stuck point you cannot resolve on your own, with a clear root-cause-first description.

Implement what the life safety planner asks for.
Do not change the occupancy load, acceptance criterion, evacuation route, drill population, or sample definition on your own.
If a tabletop substitute, partial-floor rehearsal, or placeholder timing method is needed only to unblock logistics, mark it as non-certifying plumbing in `DRILL_LOG.md` so the life safety planner knows it cannot support the main compliance claim.
</f5>

<f6>
Produce the high-level evacuation certification dossier `EVAC_PLAN.md`.
The body of `EVAC_PLAN.md` covers the following.

- Bottom-line life-safety problem. The single egress or command bottleneck the certification effort must solve.
- Primary compliance claim. The mechanism-level claim the evacuation strategy is meant to support, such as how route assignment, staff positioning, signage, alarm sequencing, or crowd-flow controls keep clearance within the required standard.
- Anti-claim to rule out. The alternative explanations a strong fire marshal would worry about, for example "the drill only passed because attendance was light," "staff quietly redirected people outside the written plan," or "the fastest exits were available only because normal concessions and security queues were absent."
- Minimum convincing evidence. The concrete timed drill result, headcount reconciliation, route-load balance, or correction of a known bottleneck that would make the primary compliance claim believable to a strong fire marshal.
- Exercises to do. A short focused list of timed drills and targeted walk-throughs that turn the proposed strategy into a claim-to-evidence roadmap, not a generic preparedness wishlist.

When `DRILL_LOG.md` already has drill results, ground every new entry against those numbers.
Keep the body tight.
Replace old conclusions with new ones rather than stacking them.
</f6>

<f7>
You are working on an emergency evacuation certification problem.
The brief is in `venue_brief.md`, given as a natural-language statement of the venue, event profile, expected occupancy, constraints, and certification target.
Read it before starting your part.
</f7>

<f8>
Believe the evacuation strategy in `venue_brief.md` is certifiable.
When an exercise fails, suspect your own drill design or execution setup first, not the core strategy.
Common single-point failures to look at include missing floor wardens, poor radio discipline, blocked or mislabeled exits, wrong occupancy assumptions, mistimed alarm cues, weak briefing scripts, and inaccurate headcounts.

Stay on the same core evacuation strategy for at least 30 planning or drill attempts before considering the route exhausted.
A typical excellent life-safety team pushes through 30 or more variations before giving up on a direction.

Do not narrow the certification claim.
Narrowing in response to a negative result, such as lowering the assumed occupancy, excluding a difficult seating tier, changing the clearance-time target, or adding hedge caveats that avoid the real public-event condition, is a defeatist move dressed up as honesty.
The right responses to a negative result are widening, by testing a stronger and more realistic version of the claim, and digging, by finding the operational fault or single-point failure that made the drill look negative.
</f8>

<f9>
When you finish, briefly report to the drill coordinator.
Say what you did, what venue-access, staffing, timing-equipment, communications, or system-configuration difficulties you hit or did not resolve.
</f9>

<f10>
The high-level certification dossier lives in `EVAC_PLAN.md`.
You may be invoked on it more than once, alternating with the evacuation drill lead and the fire marshal.

If `EVAC_PLAN.md` does not exist, this is the first pass.
Produce it from scratch.

If `EVAC_PLAN.md` already exists with no fresh `<review>` block at the end, the evacuation drill lead just finished a round.
Open `DRILL_LOG.md` and read the latest exercise results.
Update `EVAC_PLAN.md` to reflect the new evidence.
Update the Exercises to do list with the next round of timed drills or targeted walk-throughs for the evacuation drill lead.

If `EVAC_PLAN.md` ends with a fresh `<review>` block, the fire marshal just judged the work.
Read the review.
For each point raised, decide accept or pushback, and update `EVAC_PLAN.md` accordingly.

Refine `EVAC_PLAN.md` in place.
Do not discard the previous content and start over.
Do not leave any fire marshal concern unaddressed.
</f10>

<f11>
Claude responds well to clear, explicit instructions. Being specific about your desired output can help enhance results. If you want "above and beyond" behavior, explicitly request it rather than relying on the model to infer this from vague prompts.

Think of Claude as a brilliant but new employee who lacks context on your norms and workflows. The more precisely you explain what you want, the better the result.

Topology rule: Show your prompt to a colleague with minimal context on the task and ask them to follow it. If they'd be confused, Claude will be too.

- Be specific about the desired output format and constraints.
- Provide instructions as sequential steps using numbered lists or bullet points when the order or completeness of steps matters.
</f11>

Each agent's prompt should contain only the fragments that agent needs to do its job. When you include a fragment, paste the FULL block verbatim — no paraphrasing, no partial inclusion, no rewriting of fragment content. Brief connective text between fragments (e.g., "Then: ...", "Note: ...") is fine. Format: one markdown section per role, with the role name as an h1 header (e.g. `# drill coordinator`). Output only the headered prompts, no preamble.


I need you to set up a 4-agent evacuation certification pipeline.
The 4 agents are a drill coordinator and 3 certification agents: life safety planner, evacuation drill lead, fire marshal.

The life safety planner proposes the evacuation strategy, interprets drill results, and responds to compliance challenges.
The life safety planner writes the high-level certification dossier `EVAC_PLAN.md`.
The body of `EVAC_PLAN.md` contains the venue risk framing, the primary compliance claim, the timed exercises to run, and the interpretation of the latest results.

The evacuation drill lead executes the planner's drill plan, times each exercise, records results, and diagnoses operational failures.
The evacuation drill lead writes the low-level drill notebook `DRILL_LOG.md`.
Each entry in `DRILL_LOG.md` covers one exercise with deployment notes, status, timing and headcount results, and any failure or blockage diagnoses.

The fire marshal judges the work adversarially against applicable life-safety code and certification standards.
The fire marshal reads `EVAC_PLAN.md` and appends a `<review score=X>` block at the end of `EVAC_PLAN.md`.

The drill coordinator orchestrates by dispatching the 3 agents in sequence.
The drill coordinator writes no notes and reads only the fire marshal's `<review score=X>` block when checking whether to stop.

At the end of every turn, each of the subagents reports any venue-access, equipment, staffing, communications, or system-configuration problems it encountered back.

The pipeline hands work off through three files.

`venue_brief.md` is the original certification brief, read-only.
All three certification agents read it.

`EVAC_PLAN.md` is the life safety planner's high-level certification dossier.
The life safety planner writes the body.
The fire marshal appends the single `<review>` block at the end.
The evacuation drill lead reads `EVAC_PLAN.md` to know what exercises to run.

`DRILL_LOG.md` is the evacuation drill lead's low-level drill notebook.
The evacuation drill lead writes it.
The life safety planner reads it to know what the drill team did and what came out.
The fire marshal does not read `DRILL_LOG.md`.

I'm providing the following information:

<f1>
Score the work from 1 to 10.
Record the verdict by overwriting the single `<review score=X>` block at the end of `EVAC_PLAN.md`.
Always keep exactly one `<review>` block.
Replace it, never append a second.

Score strictly on real certification merit.
Do not give credit for the work being honest about its own shortcomings.
"This evacuation strategy does not yet meet the clearance target, but I am telling you it does not" is still a failing result, not a passing one.
</f1>

<f2>
Produce the high-level evacuation certification dossier `EVAC_PLAN.md`.
The body of `EVAC_PLAN.md` covers the following.

- Bottom-line life-safety problem. The single egress or command bottleneck the certification effort must solve.
- Primary compliance claim. The mechanism-level claim the evacuation strategy is meant to support, such as how route assignment, staff positioning, signage, alarm sequencing, or crowd-flow controls keep clearance within the required standard.
- Anti-claim to rule out. The alternative explanations a strong fire marshal would worry about, for example "the drill only passed because attendance was light," "staff quietly redirected people outside the written plan," or "the fastest exits were available only because normal concessions and security queues were absent."
- Minimum convincing evidence. The concrete timed drill result, headcount reconciliation, route-load balance, or correction of a known bottleneck that would make the primary compliance claim believable to a strong fire marshal.
- Exercises to do. A short focused list of timed drills and targeted walk-throughs that turn the proposed strategy into a claim-to-evidence roadmap, not a generic preparedness wishlist.

When `DRILL_LOG.md` already has drill results, ground every new entry against those numbers.
Keep the body tight.
Replace old conclusions with new ones rather than stacking them.
</f2>

<f3>
XML tags help Claude parse complex prompts unambiguously, especially when your prompt mixes instructions, context, examples, and variable inputs. Wrapping each type of content in its own tag (e.g. `<instructions>`, `<context>`, `<input>`) reduces misinterpretation.

Best practices:
- Use consistent, descriptive tag names across your prompts.
- Nest tags when content has a natural hierarchy (documents inside `<documents>`, each inside `<document index="n">`).
</f3>

<f4>
You orchestrate a 3-agent evacuation certification pipeline.
You do not design the evacuation strategy, run drills, or review compliance.
You only dispatch the right agent at the right time.
You write no files.
The only thing you read from any file is the `<review score=X>` block at the end of `EVAC_PLAN.md`.

- The first call dispatches the life safety planner, who creates `EVAC_PLAN.md` and writes the initial evacuation certification plan there.
- After that, the main loop alternates. Whenever the life safety planner returns, dispatch the evacuation drill lead. Whenever the evacuation drill lead returns, dispatch the life safety planner again. The life safety planner's next job is to read `DRILL_LOG.md`, analyze results, and update the plan.
- After every 3 completed life safety planner-evacuation drill lead pairs, you dispatch the fire marshal once. The fire marshal call replaces the slot that would otherwise have gone to the next life safety planner call.
- After the fire marshal returns, read the score from the `<review score=X>` block at the end of `EVAC_PLAN.md`. If the score is 10, stop the pipeline. The certification work is done. If the score is less than 10, resume the main loop starting with the life safety planner. The life safety planner will respond to the review on the next call.
- The hard cap is 20 total dispatches across the whole pipeline.
</f4>

<f5>
Produce the low-level drill notebook `DRILL_LOG.md`.
The body of `DRILL_LOG.md` records every exercise with the following per-run information.

- Exercise name and the matching entry in `EVAC_PLAN.md`'s Exercises to do list.
- Venue zone, date, staffing roster, timing equipment, and conditions under which the exercise was deployed.
- Status (queued, in setup, completed, aborted).
- Results, with file paths to timing sheets, radio logs, headcount reconciliations, photos, video clips, floor-marking diagrams, and any other artifacts.
- Incident log and root-cause notes for any aborted drill, unsafe condition, blocked route, timing failure, or communications breakdown.
- Any stuck point you cannot resolve on your own, with a clear root-cause-first description.

Implement what the life safety planner asks for.
Do not change the occupancy load, acceptance criterion, evacuation route, drill population, or sample definition on your own.
If a tabletop substitute, partial-floor rehearsal, or placeholder timing method is needed only to unblock logistics, mark it as non-certifying plumbing in `DRILL_LOG.md` so the life safety planner knows it cannot support the main compliance claim.
</f5>

<f6>
Review `EVAC_PLAN.md` adversarially with the standards of an authority having jurisdiction certifying a large public venue.
You are not part of the venue team and not their internal preparedness coach.
Your job is to reject drift, weak evidence, and claims larger than what the drill data and code analysis show.

Cover four layers.

- Drift. Does the plan still address the original certification problem in `venue_brief.md`, or has it slid into certifying an easier venue condition, lower occupancy, simpler event type, or partial-area evacuation?
- Life-safety integrity. Are the reported times and headcounts real? Are clearance times, route capacities, staff ratios, and alarm-response intervals computed correctly? Are any failed exercises, bottleneck zones, or key route-load checks omitted?
- Claim-evidence support. For each load-bearing compliance claim in `EVAC_PLAN.md`, mark it as supported, partial, no, or measurement-invalid, with the evidence path cited in the dossier, such as the timed exercise packet, headcount sheet, video timestamp, or route-capacity calculation.
- Writing quality. Could a new reader follow `EVAC_PLAN.md` end-to-end and understand the evacuation strategy, the evidence, and the remaining certification risk? Flag the parts that fail.

Be brief and specific.
Do not write the plan yourself, only review.
Honest negative is still negative.
A planner saying "the drill did not meet the target" is not a partial pass.
</f6>

<f7>
The high-level certification dossier lives in `EVAC_PLAN.md`.
You may be invoked on it more than once, alternating with the evacuation drill lead and the fire marshal.

If `EVAC_PLAN.md` does not exist, this is the first pass.
Produce it from scratch.

If `EVAC_PLAN.md` already exists with no fresh `<review>` block at the end, the evacuation drill lead just finished a round.
Open `DRILL_LOG.md` and read the latest exercise results.
Update `EVAC_PLAN.md` to reflect the new evidence.
Update the Exercises to do list with the next round of timed drills or targeted walk-throughs for the evacuation drill lead.

If `EVAC_PLAN.md` ends with a fresh `<review>` block, the fire marshal just judged the work.
Read the review.
For each point raised, decide accept or pushback, and update `EVAC_PLAN.md` accordingly.

Refine `EVAC_PLAN.md` in place.
Do not discard the previous content and start over.
Do not leave any fire marshal concern unaddressed.
</f7>

<f8>
Believe the evacuation strategy in `venue_brief.md` is certifiable.
When an exercise fails, suspect your own drill design or execution setup first, not the core strategy.
Common single-point failures to look at include missing floor wardens, poor radio discipline, blocked or mislabeled exits, wrong occupancy assumptions, mistimed alarm cues, weak briefing scripts, and inaccurate headcounts.

Stay on the same core evacuation strategy for at least 30 planning or drill attempts before considering the route exhausted.
A typical excellent life-safety team pushes through 30 or more variations before giving up on a direction.

Do not narrow the certification claim.
Narrowing in response to a negative result, such as lowering the assumed occupancy, excluding a difficult seating tier, changing the clearance-time target, or adding hedge caveats that avoid the real public-event condition, is a defeatist move dressed up as honesty.
The right responses to a negative result are widening, by testing a stronger and more realistic version of the claim, and digging, by finding the operational fault or single-point failure that made the drill look negative.
</f8>

<f9>
You are working on an emergency evacuation certification problem.
The brief is in `venue_brief.md`, given as a natural-language statement of the venue, event profile, expected occupancy, constraints, and certification target.
Read it before starting your part.
</f9>

<f10>
When you finish, briefly report to the drill coordinator.
Say what you did, what venue-access, staffing, timing-equipment, communications, or system-configuration difficulties you hit or did not resolve.
</f10>

<f11>
The low-level drill notebook lives in `DRILL_LOG.md`.
You may be invoked on it more than once, alternating with the life safety planner.

If `DRILL_LOG.md` does not exist, this is the first pass.
Read the Exercises to do list in `EVAC_PLAN.md` and execute the listed timed drills or targeted walk-throughs.
Create `DRILL_LOG.md` and record each exercise as you start it.

If `DRILL_LOG.md` already exists, the life safety planner may have updated the plan in `EVAC_PLAN.md`.
Re-read `EVAC_PLAN.md`'s current Exercises to do list and execute any new exercises.
For any exercise already in `DRILL_LOG.md` that was aborted, unsafe, mistimed, or got stuck, diagnose the cause and re-run when the venue condition is safe.
Append per-exercise entries to `DRILL_LOG.md`.

Refine `DRILL_LOG.md` in place by appending new exercise entries.
Do not delete previous drill records.
</f11>

Each agent's prompt should contain only the information that agent needs to do its job. For each sub-agent (drill coordinator, life safety planner, evacuation drill lead, fire marshal), which items should go in its prompt? Respond with a JSON object like {"drill coordinator": ["f?"], "life safety planner": ["f?"], "evacuation drill lead": ["f?"], "fire marshal": ["f?"]}. No other output.

I need you to set up a 4-agent evacuation certification pipeline.
The 4 agents are a drill coordinator and 3 certification agents: life safety planner, evacuation drill lead, fire marshal.

The life safety planner proposes the evacuation strategy, interprets drill results, and responds to compliance challenges.
The life safety planner writes the high-level certification dossier `EVAC_PLAN.md`.
The body of `EVAC_PLAN.md` contains the venue risk framing, the primary compliance claim, the timed exercises to run, and the interpretation of the latest results.

The evacuation drill lead executes the planner's drill plan, times each exercise, records results, and diagnoses operational failures.
The evacuation drill lead writes the low-level drill notebook `DRILL_LOG.md`.
Each entry in `DRILL_LOG.md` covers one exercise with deployment notes, status, timing and headcount results, and any failure or blockage diagnoses.

The fire marshal judges the work adversarially against applicable life-safety code and certification standards.
The fire marshal reads `EVAC_PLAN.md` and appends a `<review score=X>` block at the end of `EVAC_PLAN.md`.

The drill coordinator orchestrates by dispatching the 3 agents in sequence.
The drill coordinator writes no notes and reads only the fire marshal's `<review score=X>` block when checking whether to stop.

At the end of every turn, each of the subagents reports any venue-access, equipment, staffing, communications, or system-configuration problems it encountered back.

The pipeline hands work off through three files.

`venue_brief.md` is the original certification brief, read-only.
All three certification agents read it.

`EVAC_PLAN.md` is the life safety planner's high-level certification dossier.
The life safety planner writes the body.
The fire marshal appends the single `<review>` block at the end.
The evacuation drill lead reads `EVAC_PLAN.md` to know what exercises to run.

`DRILL_LOG.md` is the evacuation drill lead's low-level drill notebook.
The evacuation drill lead writes it.
The life safety planner reads it to know what the drill team did and what came out.
The fire marshal does not read `DRILL_LOG.md`.

I'm providing the following prompt fragments:

<f1>
Score the work from 1 to 10.
Record the verdict by overwriting the single `<review score=X>` block at the end of `EVAC_PLAN.md`.
Always keep exactly one `<review>` block.
Replace it, never append a second.

Score strictly on real certification merit.
Do not give credit for the work being honest about its own shortcomings.
"This evacuation strategy does not yet meet the clearance target, but I am telling you it does not" is still a failing result, not a passing one.
</f1>

<f2>
Produce the high-level evacuation certification dossier `EVAC_PLAN.md`.
The body of `EVAC_PLAN.md` covers the following.

- Bottom-line life-safety problem. The single egress or command bottleneck the certification effort must solve.
- Primary compliance claim. The mechanism-level claim the evacuation strategy is meant to support, such as how route assignment, staff positioning, signage, alarm sequencing, or crowd-flow controls keep clearance within the required standard.
- Anti-claim to rule out. The alternative explanations a strong fire marshal would worry about, for example "the drill only passed because attendance was light," "staff quietly redirected people outside the written plan," or "the fastest exits were available only because normal concessions and security queues were absent."
- Minimum convincing evidence. The concrete timed drill result, headcount reconciliation, route-load balance, or correction of a known bottleneck that would make the primary compliance claim believable to a strong fire marshal.
- Exercises to do. A short focused list of timed drills and targeted walk-throughs that turn the proposed strategy into a claim-to-evidence roadmap, not a generic preparedness wishlist.

When `DRILL_LOG.md` already has drill results, ground every new entry against those numbers.
Keep the body tight.
Replace old conclusions with new ones rather than stacking them.
</f2>

<f3>
XML tags help Claude parse complex prompts unambiguously, especially when your prompt mixes instructions, context, examples, and variable inputs. Wrapping each type of content in its own tag (e.g. `<instructions>`, `<context>`, `<input>`) reduces misinterpretation.

Best practices:
- Use consistent, descriptive tag names across your prompts.
- Nest tags when content has a natural hierarchy (documents inside `<documents>`, each inside `<document index="n">`).
</f3>

<f4>
You orchestrate a 3-agent evacuation certification pipeline.
You do not design the evacuation strategy, run drills, or review compliance.
You only dispatch the right agent at the right time.
You write no files.
The only thing you read from any file is the `<review score=X>` block at the end of `EVAC_PLAN.md`.

- The first call dispatches the life safety planner, who creates `EVAC_PLAN.md` and writes the initial evacuation certification plan there.
- After that, the main loop alternates. Whenever the life safety planner returns, dispatch the evacuation drill lead. Whenever the evacuation drill lead returns, dispatch the life safety planner again. The life safety planner's next job is to read `DRILL_LOG.md`, analyze results, and update the plan.
- After every 3 completed life safety planner-evacuation drill lead pairs, you dispatch the fire marshal once. The fire marshal call replaces the slot that would otherwise have gone to the next life safety planner call.
- After the fire marshal returns, read the score from the `<review score=X>` block at the end of `EVAC_PLAN.md`. If the score is 10, stop the pipeline. The certification work is done. If the score is less than 10, resume the main loop starting with the life safety planner. The life safety planner will respond to the review on the next call.
- The hard cap is 20 total dispatches across the whole pipeline.
</f4>

<f5>
Produce the low-level drill notebook `DRILL_LOG.md`.
The body of `DRILL_LOG.md` records every exercise with the following per-run information.

- Exercise name and the matching entry in `EVAC_PLAN.md`'s Exercises to do list.
- Venue zone, date, staffing roster, timing equipment, and conditions under which the exercise was deployed.
- Status (queued, in setup, completed, aborted).
- Results, with file paths to timing sheets, radio logs, headcount reconciliations, photos, video clips, floor-marking diagrams, and any other artifacts.
- Incident log and root-cause notes for any aborted drill, unsafe condition, blocked route, timing failure, or communications breakdown.
- Any stuck point you cannot resolve on your own, with a clear root-cause-first description.

Implement what the life safety planner asks for.
Do not change the occupancy load, acceptance criterion, evacuation route, drill population, or sample definition on your own.
If a tabletop substitute, partial-floor rehearsal, or placeholder timing method is needed only to unblock logistics, mark it as non-certifying plumbing in `DRILL_LOG.md` so the life safety planner knows it cannot support the main compliance claim.
</f5>

<f6>
Review `EVAC_PLAN.md` adversarially with the standards of an authority having jurisdiction certifying a large public venue.
You are not part of the venue team and not their internal preparedness coach.
Your job is to reject drift, weak evidence, and claims larger than what the drill data and code analysis show.

Cover four layers.

- Drift. Does the plan still address the original certification problem in `venue_brief.md`, or has it slid into certifying an easier venue condition, lower occupancy, simpler event type, or partial-area evacuation?
- Life-safety integrity. Are the reported times and headcounts real? Are clearance times, route capacities, staff ratios, and alarm-response intervals computed correctly? Are any failed exercises, bottleneck zones, or key route-load checks omitted?
- Claim-evidence support. For each load-bearing compliance claim in `EVAC_PLAN.md`, mark it as supported, partial, no, or measurement-invalid, with the evidence path cited in the dossier, such as the timed exercise packet, headcount sheet, video timestamp, or route-capacity calculation.
- Writing quality. Could a new reader follow `EVAC_PLAN.md` end-to-end and understand the evacuation strategy, the evidence, and the remaining certification risk? Flag the parts that fail.

Be brief and specific.
Do not write the plan yourself, only review.
Honest negative is still negative.
A planner saying "the drill did not meet the target" is not a partial pass.
</f6>

<f7>
The high-level certification dossier lives in `EVAC_PLAN.md`.
You may be invoked on it more than once, alternating with the evacuation drill lead and the fire marshal.

If `EVAC_PLAN.md` does not exist, this is the first pass.
Produce it from scratch.

If `EVAC_PLAN.md` already exists with no fresh `<review>` block at the end, the evacuation drill lead just finished a round.
Open `DRILL_LOG.md` and read the latest exercise results.
Update `EVAC_PLAN.md` to reflect the new evidence.
Update the Exercises to do list with the next round of timed drills or targeted walk-throughs for the evacuation drill lead.

If `EVAC_PLAN.md` ends with a fresh `<review>` block, the fire marshal just judged the work.
Read the review.
For each point raised, decide accept or pushback, and update `EVAC_PLAN.md` accordingly.

Refine `EVAC_PLAN.md` in place.
Do not discard the previous content and start over.
Do not leave any fire marshal concern unaddressed.
</f7>

<f8>
Believe the evacuation strategy in `venue_brief.md` is certifiable.
When an exercise fails, suspect your own drill design or execution setup first, not the core strategy.
Common single-point failures to look at include missing floor wardens, poor radio discipline, blocked or mislabeled exits, wrong occupancy assumptions, mistimed alarm cues, weak briefing scripts, and inaccurate headcounts.

Stay on the same core evacuation strategy for at least 30 planning or drill attempts before considering the route exhausted.
A typical excellent life-safety team pushes through 30 or more variations before giving up on a direction.

Do not narrow the certification claim.
Narrowing in response to a negative result, such as lowering the assumed occupancy, excluding a difficult seating tier, changing the clearance-time target, or adding hedge caveats that avoid the real public-event condition, is a defeatist move dressed up as honesty.
The right responses to a negative result are widening, by testing a stronger and more realistic version of the claim, and digging, by finding the operational fault or single-point failure that made the drill look negative.
</f8>

<f9>
You are working on an emergency evacuation certification problem.
The brief is in `venue_brief.md`, given as a natural-language statement of the venue, event profile, expected occupancy, constraints, and certification target.
Read it before starting your part.
</f9>

<f10>
When you finish, briefly report to the drill coordinator.
Say what you did, what venue-access, staffing, timing-equipment, communications, or system-configuration difficulties you hit or did not resolve.
</f10>

<f11>
The low-level drill notebook lives in `DRILL_LOG.md`.
You may be invoked on it more than once, alternating with the life safety planner.

If `DRILL_LOG.md` does not exist, this is the first pass.
Read the Exercises to do list in `EVAC_PLAN.md` and execute the listed timed drills or targeted walk-throughs.
Create `DRILL_LOG.md` and record each exercise as you start it.

If `DRILL_LOG.md` already exists, the life safety planner may have updated the plan in `EVAC_PLAN.md`.
Re-read `EVAC_PLAN.md`'s current Exercises to do list and execute any new exercises.
For any exercise already in `DRILL_LOG.md` that was aborted, unsafe, mistimed, or got stuck, diagnose the cause and re-run when the venue condition is safe.
Append per-exercise entries to `DRILL_LOG.md`.

Refine `DRILL_LOG.md` in place by appending new exercise entries.
Do not delete previous drill records.
</f11>

Each agent's prompt should contain only the fragments that agent needs to do its job. When you include a fragment, paste the FULL block verbatim — no paraphrasing, no partial inclusion, no rewriting of fragment content. Brief connective text between fragments (e.g., "Then: ...", "Note: ...") is fine. Format: one markdown section per role, with the role name as an h1 header (e.g. `# drill coordinator`). Output only the headered prompts, no preamble.


secops-director threat-modeler security-architect red-teamer vulnerability-analyst

I need you to set up a 5-agent cybersecurity pipeline that assesses target systems by developing abstract threat models and concrete red-team exploitation scripts in parallel, with each side informing the other. A system assessment request arrives as a natural-language description in `problem.md`. The pipeline alternates between revising the threat model (attack vectors, invariants, structural vulnerabilities) and revising the exploit scripts (a concrete implementation that tests those defenses).

The five agents:

- **secops-director** orchestrates the run by alternating one threat model step with one exploit step and tracking progress. It does no modeling, scripting, or reviewing itself.
- **threat modeling loop** — the **threat-modeler** writes the abstract threat model to `THEORY.md`; the **security-architect** judges it. The threat-modeler reads `SOLUTION.md` on each revision pass to incorporate empirical execution results from the red team.
- **exploit loop** — the **red-teamer** writes exploit scripts and execution results to `SOLUTION.md`; the **vulnerability-analyst** judges them. The red-teamer reads `THEORY.md` on each revision pass to align the attack paths with the latest theoretical vulnerabilities.

At the end of every turn, each of the subagents briefly reports back what they did, what difficulties they hit, and any open questions.

The pipeline hands work off through three files:

- `problem.md` — the original target system description, read-only. All four domain agents read it.
- `THEORY.md` — the abstract threat model. Threat-modeler writes; security-architect reviews; red-teamer and vulnerability-analyst read it to know which security invariants and attack paths the scripts must evaluate.
- `SOLUTION.md` — the exploit scripts and their results. Red-teamer writes; vulnerability-analyst reviews; threat-modeler and security-architect read it to ground the theoretical model in observed execution data.

Each reviewer records its score as a `<review score=X>` block inside the file it reviewed, overwriting any previous block. The secops-director reads those scores to drive the loops.

Unlike a linear assessment pipeline where the model must converge before exploitation starts, here neither side ever finishes first. Both loops alternate forever, capped at a fixed iteration count. The threat model may tighten after seeing the exploit's empirical hurdles; the exploit script may pivot after seeing the threat model's refined attack surfaces.

I'm providing the following information:

<f1>
Keep `SOLUTION.md` lean. Its body — everything except the `<review>` block — must stay under 3000 words (~20KB), about a four-page note; record only the final exploitation state and move iteration-by-iteration history into a separate `CHANGELOG.md`. Bold text must not exceed 5% of the file: if everything is bold, nothing is.
</f1>

<f2>
You orchestrate the run; you never model, script, or review yourself — you only dispatch the right agent at the right time.

- **Init** — create `STATE.md` with `iter: 0` and `last_side: none`. Dispatch the threat-modeler for the first threat model step (threat-modeler, then security-architect), then the red-teamer for the first exploit step (red-teamer, then vulnerability-analyst).
- **Alternation loop** — alternate one threat model step with one exploit step. Neither side terminates early on its own score; even a perfect-looking threat model may need to revise once the exploit script reports actual execution outcomes.
- Cap the total at 20 iterations (10 threat model steps + 10 exploit steps). After the cap, stop and summarize.
- Keep the current iteration count, last side, and the two latest scores in `STATE.md`, accurate after each dispatch. Read each score from the reviewer's `<review score=X>` block. Commit progress after each step.
- Read each agent's brief narrative reply on return. If an agent reports an unresolved error, append it to `error-log.txt` (timestamp + agent name + content) and continue with the next step.
</f2>

<f3>
You are working on a cybersecurity assessment for a target system, which may be web infrastructure, compiled binaries, network architecture, or a combination. The original system description is given as a natural-language statement in `problem.md`; read it before starting your part.
</f3>

<f4>
Score the work from 1 to 10, and record your verdict by overwriting the single `<review score=X>` block at the end of the document you reviewed — overwrite the existing one, never append a second.

Score strictly on real merit. Do not give any credit for a piece of work merely being honest about its own shortcomings — "this exploit script fails, but I'm telling you it fails" is still a failing result, not a passing one.
</f4>

<f5>
Produce the abstract threat model for the target system and write it to `THEORY.md`. A complete model covers four kinds of claim, each justified with an architectural proof sketch or a vulnerability citation.

- **Attack Surface & Vectors** — exposed APIs, network ingress points, user trust boundaries, and specific entry parameters.
- **Security Properties** — privilege separation, encryption guarantees, sanitization structural claims, and trust models. State what defenses hold, where they exist, and under which assumptions.
- **Security Invariants** — conditions that the system must maintain (e.g., unauthorized users cannot read protected files, sessions must isolate state, memory boundaries hold). The exploit's output should test these limits; the vulnerability-analyst will check with `verify.py`.
- **Impact & Complexity** — worst-case impact (RCE, data exfiltration, DoS), prerequisite complexity, expected execution time for brute-force methods, or CVSS estimations.

Ground your claims against `SOLUTION.md` if it has reported numbers or execution traces. A predicted attack vector that completely fails to produce a viable exploit means either the threat model needs revision or the script has a bug — diagnose which side has the issue and state it. Be concrete. "The authentication mechanism is vulnerable to a timing attack, succeeding in ~200ms" is fine; "the system has some weaknesses that may help" is not.
</f5>

<f6>
When you finish, briefly report to the secops-director: what you did, what difficulties you hit (or didn't resolve), and any open questions.
</f6>

<f7>
Match the tool to the target system's architecture; do not force an ill-suited one. The list below is useful in threat modeling and vulnerability analysis.

| Tool | Suitable for |
|---|---|
| Data Flow Analysis | Web/Network architectures; tracing untrusted input to sensitive sinks |
| Attack Trees | Complex systems; modeling multi-step kill chains and prerequisite paths |
| STRIDE Threat Categorization | System architecture; systematic identification of spoofing, tampering, etc. |
| Privilege Escalation Matrices | IAM / RBAC; identifying lateral movement and vertical escalation routes |
| Cryptographic Protocol Analysis | Auth/Encryption; verifying key exchange and secrecy properties |
| Fuzzing Heuristic Modeling | Memory-unsafe code; predicting boundary conditions and crash patterns |
| Taint Analysis | AppSec/Binaries; tracking malicious payload propagation through memory |
| Exploit Mitigation Bypass Analysis | Defended environments; structuring payloads around ASLR/DEP/WAF |
</f7>

<f8>
Read `problem.md` and `THEORY.md`, then implement the red-team exploit scripts:

- Include every import. Create each payload with the correct encoding, define the network targets and memory offsets exactly as the threat model outlines. Execute the script, check the response status, and print both the execution trace and the extracted/compromised data.
- Make the implementation testable against `THEORY.md`. If the model states an attack path requires administrative access, your script should demonstrate acquiring it. If the model defines a security invariant, your script should attempt to bypass or violate it.
- Run the code yourself and watch it through to completion — do not stop while it is still running. If it errors, find and fix the root cause; do not bury errors under try/except.
- Sanity-check the result against `THEORY.md`. A vulnerability that is supposed to yield a root shell should not just return a low-privilege token; a memory leak the threat model says is accessible should actually be readable.

Write the code and its execution results up in `SOLUTION.md`.
</f8>

<f9>
Review `SOLUTION.md` against `problem.md` and against `THEORY.md`.

- Inspect the reported execution result for anomalies, failed network connections, or missed targets stated directly in `problem.md`.
- Open `THEORY.md`. For every security invariant the threat model claims, write a check into a separate `verify.py`: does the red-team script's output demonstrably break the invariant, bypass the predicted control, or achieve the modeled impact? Run it. Name any mechanism or state that violates the threat model's expectations.
- Read the exploit code and spot-check it for bugs — unused payloads, dead logic, or mechanisms that contradict the chosen attack vector. A script bug that silently fails to deliver the payload is worse than one that crashes.
- Treat the result as finished only when every targeted access constraint is tested, every threat-model-claimed invariant is evaluated, and the impact is consistent with the model's predictions — not merely when the script runs without error.
- Check the length of `SOLUTION.md`: if it exceeds 20KB, give a warning, but do not deduct points for it.
- Check the bold ratio of `SOLUTION.md`: if bold text exceeds 5% of the file, give a warning, but do not deduct points for it.
</f9>

<f10>
Claude responds well to clear, explicit instructions. Being specific about your desired output can help enhance results. If you want "above and beyond" behavior, explicitly request it rather than relying on the model to infer this from vague prompts.

Think of Claude as a brilliant but new employee who lacks context on your norms and workflows. The more precisely you explain what you want, the better the result.

Topology rule: Show your prompt to a colleague with minimal context on the task and ask them to follow it. If they'd be confused, Claude will be too.

- Be specific about the desired output format and constraints.
- Provide instructions as sequential steps using numbered lists or bullet points when the order or completeness of steps matters.
</f10>

<f11>
The abstract threat model lives in `THEORY.md`, and you may be invoked on it more than once — the pipeline runs you and the security-architect as a loop, alternating with the exploit loop.

- If `THEORY.md` does not exist yet, this is the first pass: produce the threat model from scratch based on `problem.md`.
- If `THEORY.md` already exists, it carries the security-architect's `<review>` block. Read that feedback. Then open `SOLUTION.md` and look at the latest reported execution traces — they may invalidate, sharpen, or motivate revisions to your attack paths. Revise `THEORY.md` in place to address every reviewer point raised and to incorporate any empirical execution data that changes your model. Don't discard the previous model and start over, and don't leave a flagged issue unaddressed.
</f11>

<f12>
Review `THEORY.md` against `problem.md` and against the execution traces reported in `SOLUTION.md` (if any).

- **Faithfulness** — does the threat model correctly describe the architecture stated in `problem.md`? Check component definitions, trust boundaries, and network topologies.
- **Soundness** — for each attack path, walk through the logic. Flag hand-waving steps. Verify cited vulnerabilities apply under the stated system versions and configurations.
- **Empirical grounding** — open `SOLUTION.md`. If the script reports execution outcomes, do they align with the threat model's predicted impact and complexity? An estimated attack complexity that is orders of magnitude off from actual execution time is a signal the model's assumptions are flawed; correct them, or note explicitly that the theoretical complexity is only illustrative.

Be brief and specific. Do not write the threat model yourself — only review. If an attack vector is fundamentally unworkable, say which one and why.
</f12>

<f13>
The exploit scripts and their results live in `SOLUTION.md`, and you may be invoked on it more than once — the pipeline runs you and the vulnerability-analyst as a loop, alternating with the threat modeling loop.

- If `SOLUTION.md` does not exist yet, this is the first pass: produce the exploit script from scratch based on `problem.md`.
- If `SOLUTION.md` already exists, it carries the vulnerability-analyst's `<review>` block. Read that feedback. Then open `THEORY.md` and check whether the latest threat model introduces attack surfaces, invariants, or structural vulnerabilities your current script doesn't yet test — for example a new API endpoint your payload is missing, or an invariant your output hasn't attempted to break. Revise `SOLUTION.md` in place to address every reviewer point and to align with the latest threat model. Don't discard the previous script and start over, and don't leave a flagged issue unaddressed.
</f13>

Each agent's prompt should contain only the information that agent needs to do its job. For each sub-agent (secops-director, threat-modeler, security-architect, red-teamer, vulnerability-analyst), which items should go in its prompt? Respond with a JSON object like {"secops-director": ["f?"], "threat-modeler": ["f?"], "security-architect": ["f?"], "red-teamer": ["f?"], "vulnerability-analyst": ["f?"]}. No other output.

I need you to set up a 5-agent cybersecurity pipeline that assesses target systems by developing abstract threat models and concrete red-team exploitation scripts in parallel, with each side informing the other. A system assessment request arrives as a natural-language description in `problem.md`. The pipeline alternates between revising the threat model (attack vectors, invariants, structural vulnerabilities) and revising the exploit scripts (a concrete implementation that tests those defenses).

The five agents:

- **secops-director** orchestrates the run by alternating one threat model step with one exploit step and tracking progress. It does no modeling, scripting, or reviewing itself.
- **threat modeling loop** — the **threat-modeler** writes the abstract threat model to `THEORY.md`; the **security-architect** judges it. The threat-modeler reads `SOLUTION.md` on each revision pass to incorporate empirical execution results from the red team.
- **exploit loop** — the **red-teamer** writes exploit scripts and execution results to `SOLUTION.md`; the **vulnerability-analyst** judges them. The red-teamer reads `THEORY.md` on each revision pass to align the attack paths with the latest theoretical vulnerabilities.

At the end of every turn, each of the subagents briefly reports back what they did, what difficulties they hit, and any open questions.

The pipeline hands work off through three files:

- `problem.md` — the original target system description, read-only. All four domain agents read it.
- `THEORY.md` — the abstract threat model. Threat-modeler writes; security-architect reviews; red-teamer and vulnerability-analyst read it to know which security invariants and attack paths the scripts must evaluate.
- `SOLUTION.md` — the exploit scripts and their results. Red-teamer writes; vulnerability-analyst reviews; threat-modeler and security-architect read it to ground the theoretical model in observed execution data.

Each reviewer records its score as a `<review score=X>` block inside the file it reviewed, overwriting any previous block. The secops-director reads those scores to drive the loops.

Unlike a linear assessment pipeline where the model must converge before exploitation starts, here neither side ever finishes first. Both loops alternate forever, capped at a fixed iteration count. The threat model may tighten after seeing the exploit's empirical hurdles; the exploit script may pivot after seeing the threat model's refined attack surfaces.

I'm providing the following prompt fragments:

<f1>
Keep `SOLUTION.md` lean. Its body — everything except the `<review>` block — must stay under 3000 words (~20KB), about a four-page note; record only the final exploitation state and move iteration-by-iteration history into a separate `CHANGELOG.md`. Bold text must not exceed 5% of the file: if everything is bold, nothing is.
</f1>

<f2>
You orchestrate the run; you never model, script, or review yourself — you only dispatch the right agent at the right time.

- **Init** — create `STATE.md` with `iter: 0` and `last_side: none`. Dispatch the threat-modeler for the first threat model step (threat-modeler, then security-architect), then the red-teamer for the first exploit step (red-teamer, then vulnerability-analyst).
- **Alternation loop** — alternate one threat model step with one exploit step. Neither side terminates early on its own score; even a perfect-looking threat model may need to revise once the exploit script reports actual execution outcomes.
- Cap the total at 20 iterations (10 threat model steps + 10 exploit steps). After the cap, stop and summarize.
- Keep the current iteration count, last side, and the two latest scores in `STATE.md`, accurate after each dispatch. Read each score from the reviewer's `<review score=X>` block. Commit progress after each step.
- Read each agent's brief narrative reply on return. If an agent reports an unresolved error, append it to `error-log.txt` (timestamp + agent name + content) and continue with the next step.
</f2>

<f3>
You are working on a cybersecurity assessment for a target system, which may be web infrastructure, compiled binaries, network architecture, or a combination. The original system description is given as a natural-language statement in `problem.md`; read it before starting your part.
</f3>

<f4>
Score the work from 1 to 10, and record your verdict by overwriting the single `<review score=X>` block at the end of the document you reviewed — overwrite the existing one, never append a second.

Score strictly on real merit. Do not give any credit for a piece of work merely being honest about its own shortcomings — "this exploit script fails, but I'm telling you it fails" is still a failing result, not a passing one.
</f4>

<f5>
Produce the abstract threat model for the target system and write it to `THEORY.md`. A complete model covers four kinds of claim, each justified with an architectural proof sketch or a vulnerability citation.

- **Attack Surface & Vectors** — exposed APIs, network ingress points, user trust boundaries, and specific entry parameters.
- **Security Properties** — privilege separation, encryption guarantees, sanitization structural claims, and trust models. State what defenses hold, where they exist, and under which assumptions.
- **Security Invariants** — conditions that the system must maintain (e.g., unauthorized users cannot read protected files, sessions must isolate state, memory boundaries hold). The exploit's output should test these limits; the vulnerability-analyst will check with `verify.py`.
- **Impact & Complexity** — worst-case impact (RCE, data exfiltration, DoS), prerequisite complexity, expected execution time for brute-force methods, or CVSS estimations.

Ground your claims against `SOLUTION.md` if it has reported numbers or execution traces. A predicted attack vector that completely fails to produce a viable exploit means either the threat model needs revision or the script has a bug — diagnose which side has the issue and state it. Be concrete. "The authentication mechanism is vulnerable to a timing attack, succeeding in ~200ms" is fine; "the system has some weaknesses that may help" is not.
</f5>

<f6>
When you finish, briefly report to the secops-director: what you did, what difficulties you hit (or didn't resolve), and any open questions.
</f6>

<f7>
Match the tool to the target system's architecture; do not force an ill-suited one. The list below is useful in threat modeling and vulnerability analysis.

| Tool | Suitable for |
|---|---|
| Data Flow Analysis | Web/Network architectures; tracing untrusted input to sensitive sinks |
| Attack Trees | Complex systems; modeling multi-step kill chains and prerequisite paths |
| STRIDE Threat Categorization | System architecture; systematic identification of spoofing, tampering, etc. |
| Privilege Escalation Matrices | IAM / RBAC; identifying lateral movement and vertical escalation routes |
| Cryptographic Protocol Analysis | Auth/Encryption; verifying key exchange and secrecy properties |
| Fuzzing Heuristic Modeling | Memory-unsafe code; predicting boundary conditions and crash patterns |
| Taint Analysis | AppSec/Binaries; tracking malicious payload propagation through memory |
| Exploit Mitigation Bypass Analysis | Defended environments; structuring payloads around ASLR/DEP/WAF |
</f7>

<f8>
Read `problem.md` and `THEORY.md`, then implement the red-team exploit scripts:

- Include every import. Create each payload with the correct encoding, define the network targets and memory offsets exactly as the threat model outlines. Execute the script, check the response status, and print both the execution trace and the extracted/compromised data.
- Make the implementation testable against `THEORY.md`. If the model states an attack path requires administrative access, your script should demonstrate acquiring it. If the model defines a security invariant, your script should attempt to bypass or violate it.
- Run the code yourself and watch it through to completion — do not stop while it is still running. If it errors, find and fix the root cause; do not bury errors under try/except.
- Sanity-check the result against `THEORY.md`. A vulnerability that is supposed to yield a root shell should not just return a low-privilege token; a memory leak the threat model says is accessible should actually be readable.

Write the code and its execution results up in `SOLUTION.md`.
</f8>

<f9>
Review `SOLUTION.md` against `problem.md` and against `THEORY.md`.

- Inspect the reported execution result for anomalies, failed network connections, or missed targets stated directly in `problem.md`.
- Open `THEORY.md`. For every security invariant the threat model claims, write a check into a separate `verify.py`: does the red-team script's output demonstrably break the invariant, bypass the predicted control, or achieve the modeled impact? Run it. Name any mechanism or state that violates the threat model's expectations.
- Read the exploit code and spot-check it for bugs — unused payloads, dead logic, or mechanisms that contradict the chosen attack vector. A script bug that silently fails to deliver the payload is worse than one that crashes.
- Treat the result as finished only when every targeted access constraint is tested, every threat-model-claimed invariant is evaluated, and the impact is consistent with the model's predictions — not merely when the script runs without error.
- Check the length of `SOLUTION.md`: if it exceeds 20KB, give a warning, but do not deduct points for it.
- Check the bold ratio of `SOLUTION.md`: if bold text exceeds 5% of the file, give a warning, but do not deduct points for it.
</f9>

<f10>
Claude responds well to clear, explicit instructions. Being specific about your desired output can help enhance results. If you want "above and beyond" behavior, explicitly request it rather than relying on the model to infer this from vague prompts.

Think of Claude as a brilliant but new employee who lacks context on your norms and workflows. The more precisely you explain what you want, the better the result.

Topology rule: Show your prompt to a colleague with minimal context on the task and ask them to follow it. If they'd be confused, Claude will be too.

- Be specific about the desired output format and constraints.
- Provide instructions as sequential steps using numbered lists or bullet points when the order or completeness of steps matters.
</f10>

<f11>
The abstract threat model lives in `THEORY.md`, and you may be invoked on it more than once — the pipeline runs you and the security-architect as a loop, alternating with the exploit loop.

- If `THEORY.md` does not exist yet, this is the first pass: produce the threat model from scratch based on `problem.md`.
- If `THEORY.md` already exists, it carries the security-architect's `<review>` block. Read that feedback. Then open `SOLUTION.md` and look at the latest reported execution traces — they may invalidate, sharpen, or motivate revisions to your attack paths. Revise `THEORY.md` in place to address every reviewer point raised and to incorporate any empirical execution data that changes your model. Don't discard the previous model and start over, and don't leave a flagged issue unaddressed.
</f11>

<f12>
Review `THEORY.md` against `problem.md` and against the execution traces reported in `SOLUTION.md` (if any).

- **Faithfulness** — does the threat model correctly describe the architecture stated in `problem.md`? Check component definitions, trust boundaries, and network topologies.
- **Soundness** — for each attack path, walk through the logic. Flag hand-waving steps. Verify cited vulnerabilities apply under the stated system versions and configurations.
- **Empirical grounding** — open `SOLUTION.md`. If the script reports execution outcomes, do they align with the threat model's predicted impact and complexity? An estimated attack complexity that is orders of magnitude off from actual execution time is a signal the model's assumptions are flawed; correct them, or note explicitly that the theoretical complexity is only illustrative.

Be brief and specific. Do not write the threat model yourself — only review. If an attack vector is fundamentally unworkable, say which one and why.
</f12>

<f13>
The exploit scripts and their results live in `SOLUTION.md`, and you may be invoked on it more than once — the pipeline runs you and the vulnerability-analyst as a loop, alternating with the threat modeling loop.

- If `SOLUTION.md` does not exist yet, this is the first pass: produce the exploit script from scratch based on `problem.md`.
- If `SOLUTION.md` already exists, it carries the vulnerability-analyst's `<review>` block. Read that feedback. Then open `THEORY.md` and check whether the latest threat model introduces attack surfaces, invariants, or structural vulnerabilities your current script doesn't yet test — for example a new API endpoint your payload is missing, or an invariant your output hasn't attempted to break. Revise `SOLUTION.md` in place to address every reviewer point and to align with the latest threat model. Don't discard the previous script and start over, and don't leave a flagged issue unaddressed.
</f13>

Each agent's prompt should contain only the fragments that agent needs to do its job. When you include a fragment, paste the FULL block verbatim — no paraphrasing, no partial inclusion, no rewriting of fragment content. Brief connective text between fragments (e.g., "Then: ...", "Note: ...") is fine. Format: one markdown section per role, with the role name as an h1 header (e.g. `# secops-director`). Output only the headered prompts, no preamble.