# Workflow - rt-scenario-b005

## Purpose

This workflow standardizes how rt-scenario-b005 is executed inside RTExit. It is designed for authorized engagements, evidence-first documentation, and consistent handoff into reporting.

## Authorization Gate

Before execution, confirm:

- SEAD exists and explicitly covers the target asset or activity.
- Rules of Engagement define allowed techniques, rate limits, and stop conditions.
- The operator knows the evidence handling rules.
- Any active or sensitive validation has client approval.

If any item is unclear, pause and invoke rt-create-sead, rt-scope-definition, or rt-rules-of-engagement.

## Required Inputs

| Input | Source | Notes |
|---|---|---|
| Engagement reference | _rtexit/config.toml or SEAD | Used in output names. |
| Target asset(s) | Scope document | Must be explicitly approved. |
| Operator name | Config/user context | Used in timeline entries. |
| Evidence directory | _rtexit-output/docs/evidence/ | Store logs, screenshots, and artifacts. |
| Finding tracker | _rtexit-output/docs/findings/ | Create/update findings when confirmed. |

## Execution Steps

1. Load current engagement configuration from `_rtexit/config.user.toml`.
2. Read engagement-context.json and confirm current phase permits this skill.
3. Build a small test plan: target, expected control, evidence type.
4. Run the lowest-risk validation first.
5. Capture baseline behavior before proof behavior.
6. Record exact timestamp, account/role used, and affected asset.
7. Stop when evidence is sufficient; avoid unnecessary data access.
8. Create or update findings through the RTExit finding tracker.
9. Map remediation owner and recommended timeline.
10. Update engagement-context.json with findings and phase status.
11. Add a timeline entry and evidence chain entry.

## Evidence Requirements

| Evidence | Required? | Notes |
|---|---|---|
| Command or action summary | Yes | Redact secrets and tokens. |
| Screenshot or transcript | If useful | Store under evidence folder. |
| Request/response pair | For web/API | Redact cookies and bearer tokens. |
| Config excerpt | For cloud/infra | Include only relevant lines. |
| Business impact note | Yes | Explain why it matters. |

## Autodoc Commands

```bash
python _rtexit/scripts/autodoc_engine.py log --skill rt-scenario-b005 --phase auto --cmd "workflow execution" --output "summary"
python _rtexit/scripts/finding_tracker.py list
```

## Completion Criteria

- Scope and authorization are referenced.
- Evidence is stored and redacted.
- Findings are added or explicitly marked as not found.
- Remediation guidance is actionable.
- Timeline and chain of custody are updated where applicable.
- engagement-context.json updated with results.

## Handoff

Send confirmed findings to rt-finding-document, severity scoring to rt-cvss-calculator, mapping to rt-mitre-map, and final reporting to rt-technical-report / rt-executive-report.
