Purple Team

The combined red+blue loop — the outer orchestration the red-team skill says "lives outside it." The artifact is a target system (frozen within a phase, patched between phases); the feedback signal is how many new failure classes a fresh attack pass finds against the patched target. Each cycle runs three strictly separated phases — find (red-team), fix (blue-team), re-verify (a fresh red-team pass) — and you repeat until a fresh find stays dry (zero new classes), meaning the target is hardened. Red and blue run as independent agents so the attacker that wrote a catalogue never grades its own patch. On stop it opens a pull request with the cycle history and the patch set.

When to use

Use to harden a guardrail/classifier/filter/prompt/API the user owns or is authorized to test, when the goal is an actually-hardened target plus a reviewable patch — not just a catalogue (that is red-team alone) and not just closing a pre-existing catalogue (that is blue-team alone). It needs a runnable oracle for the objective signal, and the two sibling skills installed.

Default: spawn red and blue as separate subagents per phase. Escape hatch: on hosts without subagent dispatch, run each phase inline (serial) per the role files — still correct, but the same context plays both sides, so be deliberate about not letting the fix bias the re-verify. Not for unauthorized targets.