# Post-Exploitation Stage — Execution

## Per-unit baton (`post-exploit-analyst → impact-assessor → verifier`)

Each unit walks the three hats in order. The baton is the unit's accumulated body content:

1. **`post-exploit-analyst` (plan):** from the established foothold (cited from upstream `ACCESS-LOG.md`), maps the reachable surface — lateral targets, privilege-escalation paths, credential-access surfaces, data-access surfaces — using strictly observation-class techniques. Hands off with `## Access Graph`. Distinguishes observed from inferred.
2. **`impact-assessor` (do):** translates the access-graph into business-impact analysis — data classification, regulatory implications, blast radius, severity per the engagement's rubric. Distinguishes demonstrated from theoretical impact. Hands off with `## Impact Assessment`.
3. **`verifier` (verify):** body-only validation — access chain documented end-to-end, impact translated to business terms, demonstrated-vs-theoretical marked, severity tied to rubric, cleanup confirmed. Advances on pass, rejects on fail.

## After execute completes

When every unit's hat chain has terminal-advanced:

1. **Spec review** — universal hard gate.
2. **Quality review** — the stage's `impact-accuracy` review agent fires; files feedback if impact claims drift from access-graph evidence, demonstrated/theoretical labeling slips, severity derivation is missing, or regulatory citations aren't grounded.
3. **Fix loop** — `[classifier, impact-assessor, feedback-assessor]` dispatches per finding. `impact-assessor` is the implementer because most findings here are rating disputes, missing evidence at a chain step, or business-context errors.
4. **Gate** — `ask`. Severity calls drive the deliverable's executive summary and the customer's remediation prioritization; human review of these calls is load-bearing.
