Offensive Orchestration

Coordinate the security task through its next verified outcome. Load orchestration for delegation, model/effort selection, scheduling, job lifecycle, and integration; apply the additions below to security state and evidence. Use existing task constraints without inventing new approval stops.

Split investigations around independent state

• Delegate by asset, trust boundary, artifact, or falsifiable hypothesis with a distinct proof requirement. Parallel static analysis of separate samples or patch pairs often fits; interacting operations on the same process, account, service, or debugger need a single owner or explicit serialization.
• Launch follow-up work when its prerequisite is established: an artifact exists, a build matches, an identity is confirmed, or a session is usable. A scanner label, worker claim, or suggested attack path is a lead, not that prerequisite.
• Match the worker to the uncertain part: bounded artifact extraction can use an efficient model; unfamiliar internals, cryptography, exploitability, or ambiguous runtime behavior may need stronger reasoning and domain tools. Agent count does not substitute for expertise.

Route by the question

Give each worker a concrete question, the necessary context, and the relevant skills. Combine skills when a question crosses boundaries; hand work to another worker only when separate context, ownership, or expertise helps.