# Workflow - rt-party-mode

## Purpose

This workflow standardizes how $skill is executed inside RTExit. It is designed for authorized engagements, evidence-first documentation, and consistent handoff into reporting.

## Authorization Gate

Before execution, confirm:

- SEAD exists and explicitly covers the target asset or activity.
- Rules of Engagement define allowed techniques, rate limits, and stop conditions.
- The operator knows the evidence handling rules.
- Any active or sensitive validation has client approval.

If any item is unclear, pause and invoke 
t-create-sead, 
t-scope-definition, or 
t-rules-of-engagement.

## Required Inputs

| Input | Source | Notes |
|---|---|---|
| Engagement reference | _rtexit/config.toml or SEAD | Used in output names. |
| Target asset(s) | Scope document | Must be explicitly approved. |
| Operator name | Config/user context | Used in timeline entries. |
| Evidence directory | _rtexit-output/docs/evidence/ | Store logs, screenshots, and artifacts. |
| Finding tracker | _rtexit-output/docs/findings/ | Create/update findings when confirmed. |

## Execution Steps

1. Load current engagement configuration.
2. Read scope, exclusions, and current findings.
3. Build a small test plan for this skill with target, expected control, and evidence type.
4. Run the lowest-risk validation first.
5. Capture baseline behavior before proof behavior.
6. Record exact timestamp, account/role used, and affected asset.
7. Stop when evidence is sufficient; avoid unnecessary data access.
8. Create or update findings through the RTExit finding tracker.
9. Map remediation owner and recommended timeline.
10. Add a timeline entry and evidence chain entry.

## Evidence Requirements

| Evidence | Required? | Notes |
|---|---|---|
| Command or action summary | Yes | Redact secrets and tokens. |
| Screenshot or transcript | If useful | Store under evidence folder. |
| Request/response pair | For web/API | Redact cookies and bearer tokens. |
| Config excerpt | For cloud/infra | Include only relevant lines. |
| Business impact note | Yes | Explain why it matters. |

## Autodoc Commands

`ash
python _rtexit/scripts/autodoc_engine.py log --skill rt-party-mode --phase auto --cmd "workflow execution" --output "summary"
python _rtexit/scripts/finding_tracker.py list
`

## Completion Criteria

- Scope and authorization are referenced.
- Evidence is stored and redacted.
- Findings are added or explicitly marked as not found.
- Remediation guidance is actionable.
- Timeline and chain of custody are updated where applicable.

## Handoff

Send confirmed findings to 
t-finding-document, severity scoring to 
t-cvss-calculator, mapping to 
t-mitre-map, and final reporting to 
t-technical-report / 
t-executive-report.
