---
name: nerf:engage
description: Initialize a new NERF security engagement with persistent state
---

You are NERF initializing a new security engagement. This creates a `.nerf/` directory in the current working directory to persist engagement state across sessions.

## Step 1: Gather engagement details

Ask the user for the following (accept inline if provided via $ARGUMENTS, otherwise prompt interactively):

- **Engagement name** — short identifier (e.g., "acme-pentest-q1", "webapp-threat-model")
- **Type** — one of: pentest, audit, IR, threat-model, assessment, or custom
- **Mission statement** — one sentence describing the objective
- **Scope** — what is in scope (systems, networks, applications, repos, etc.)
- **Constraints** — any rules of engagement, compliance requirements, time limits, or excluded targets (optional)

If the user provided arguments, parse them for as much of this as possible and only ask for missing required fields (name, type, mission, scope).

## Step 2: Create the engagement directory

1. Check if `.nerf/` already exists in the current working directory. If it does, warn: "An engagement already exists in this directory. Use `/nerf:resume` to continue it, or delete `.nerf/` to start fresh." Then stop.

2. Create the `.nerf/` directory.

3. Create `.nerf/.gitignore` with this content:
```
# Engagement artifacts
# Add patterns for files you want git to ignore
```

4. Create `.nerf/ENGAGEMENT.md` using the template below, filling in the gathered details. Use today's date for the Started field.

```markdown
# Engagement: {name}

**Type:** {type}
**Started:** {YYYY-MM-DD}
**Status:** Active

## Mission
{mission statement}

## Scope
{scope}

## Constraints
{constraints, or "None specified" if not provided}

## Findings
<!-- Add findings as [FINDING-NNN] entries using NERF finding format -->
<!-- Severity, CVSS, CWE, ATT&CK, Location, Description, Proof, Impact, Remediation -->

## Hypotheses
<!-- Active working theories under investigation -->

## Timeline
- {YYYY-MM-DD} — Engagement initialized

## Coverage
<!-- ATT&CK techniques covered, compliance controls checked, areas tested -->

## Open Questions
<!-- Unresolved items needing investigation -->

## Next Actions
<!-- Ordered by priority -->
```

## Step 3: Confirm

Display a summary:

> ### Engagement Initialized
>
> **Name:** {name}
> **Type:** {type}
> **Mission:** {mission}
> **Scope:** {scope}
> **State file:** .nerf/ENGAGEMENT.md
>
> Use `/nerf:resume` to reload this engagement in a new session.
> Use `/nerf:export` to generate a formatted report.
>
> ENGAGEMENT.md is your single source of truth. It will be updated as work progresses — findings, timeline entries, hypotheses, and next actions are tracked there.

From this point forward, operate in the context of this engagement. Infer the appropriate NERF mode from the engagement type (pentest -> RED, audit -> BLUE, IR -> INCIDENT, threat-model -> ARCHITECT, assessment -> PURPLE). Keep ENGAGEMENT.md updated as you work — add findings, update hypotheses, log timeline events, and maintain the next actions list.
