# Diagrams — SDD-02: RedTeamLLM

---

## Diagram 1 — The Summarize-Reason-Act Pipeline (the Three-Step Decomposition)

```mermaid
flowchart TB
    OBJ([pentest objective]) --> S
    subgraph LOOP["Per-Iteration Pipeline (3 LLM calls)"]
        S["STEP 1: SUMMARIZE<br/>compress goal + accumulated context<br/>→ fits the reasoning window"]
        R["STEP 2: REASON (PLAN)<br/>over summarized state → next action<br/>→ plan correction if prior action failed"]
        A["STEP 3: ACT<br/>execute selected action on target"]
        S --> R --> A
    end
    MEM[(Persistent Finding Memory<br/>separate from context)]
    A --> MEM
    A -.result.-> S
    MEM -.read/write.-> R

    style S fill:#0d1b2a,stroke:#5eead4,color:#5eead4
    style R fill:#0d1b2a,stroke:#5eead4,color:#5eead4
    style A fill:#0d1b2a,stroke:#5eead4,color:#5eead4
    style MEM fill:#1a1015,stroke:#5eead4,color:#e4e4e8
```

**Reading**: Each iteration is three separate LLM calls with distinct jobs. Summarize compresses (context management). Reason plans with correction (error handling). Act executes. The persistent finding memory is separate from context — findings survive compression. This decomposition is why RedTeamLLM stays coherent on long engagements where a monolithic loop drifts.

---

## Diagram 2 — Monolithic Loop vs Summarize-Reason-Act (the Failure Modes)

```mermaid
flowchart LR
    subgraph MONO["Monolithic ReAct Loop"]
        M1[model.complete<br/>plan + act in one call]
        M2[tool result appended<br/>to ever-growing context]
        M3{context overflow?<br/>plan drift?}
        M1 --> M2 --> M3
        M3 -.no.-> M1
        M3 -.yes: FAIL.-> MFAIL[truncation loses info<br/>plan buried in noise<br/>early findings lost]
    end
    subgraph SRA["Summarize-Reason-Act"]
        S1[summarize:<br/>compress before reasoning]
        S2[reason:<br/>plan over compressed state]
        S3[act:<br/>execute]
        S4{coherent?<br/>finding in memory?}
        S1 --> S2 --> S3 --> S4
        S4 -.no.-> S1
        S4 -.yes: SUCCEED.-> SOK[stays coherent<br/>plan corrected on failure<br/>findings persist]
    end

    style MFAIL fill:#2a0d0d,stroke:#5eead4,color:#f08080
    style SOK fill:#0d1b2a,stroke:#5eead4,color:#5eead4
```

**Reading**: A monolithic loop has three failure modes on long engagements: context overflow (truncation loses info), plan drift (objective buried in noise), and memory loss (early findings truncated away). RedTeamLLM addresses all three: summarize prevents overflow, reason-on-compressed-state prevents drift, persistent memory prevents loss. The cost is 3x the LLM calls per iteration.

---

## Diagram 3 — RedTeamLLM vs CAI (Generality vs Specialization)

```mermaid
flowchart LR
    subgraph RT["RedTeamLLM — DEPTH"]
        RT1[Single-agent<br/>pentest scope]
        RT2[Summarize-reason-act<br/>plan correction]
        RT3[Persistent finding memory]
        RT4[Active context mgmt]
    end
    subgraph CAI["CAI — BREADTH"]
        C1[CSI meta-harness<br/>6 domains + bug bounty]
        C2[Per-domain reactive loops<br/>narrow contexts]
        C3[Evidence buffer<br/>submission-ready]
        C4[Hard-wired scope<br/>autonomy levels]
    end
    RT -.strongest hybrid: RT loop + CAI routing/scope.-> CAI

    style RT fill:#0d1b2a,stroke:#5eead4,color:#5eead4
    style CAI fill:#0d1b2a,stroke:#5eead4,color:#5eead4
```

**Reading**: RedTeamLLM and CAI are different answers to the same problem (long-offensive-engagement coherence). RedTeamLLM goes deep on plan correction, memory, and context management for a single agent. CAI goes broad across six domains with a meta-harness and explicit scope enforcement. The strongest architecture in this roster is the hybrid: RedTeamLLM's summarize-reason-act loop inside each of CAI's domain specialists, wrapped by CAI's CSI routing and hard-wired scope validator.

---

## Diagram 4 — The Summarize-Step Injection Surface (the Novel Risk)

```mermaid
flowchart TB
    TARGET[target serves<br/>adversarial content] --> TOOL[tool output]
    TOOL --> SUMMARIZE[STEP 1: SUMMARIZE]
    SUMMARIZE --> Q{does injected content<br/>survive compression?}
    Q -->|no| SAFE[reasoner plans on clean state<br/>SAFE]
    Q -->|yes| REASONER[STEP 2: REASON]
    REASONER --> MANIPULATED[planner manipulated<br/>by injected content<br/>NOVEL SURFACE]
    MANIPULATED --> MEMORY[(persistent finding memory)]
    MEMORY --> POISONED[memory poisoned<br/>false finding persists]

    style Q fill:#0d1b2a,stroke:#5eead4,color:#5eead4
    style MANIPULATED fill:#2a0d0d,stroke:#5eead4,color:#f08080
    style POISONED fill:#2a0d0d,stroke:#5eead4,color:#f08080
```

**Reading**: RedTeamLLM's three-step architecture introduces a novel injection surface that a monolithic loop does not have. Adversarial tool output enters the summarize step; if it survives compression, it reaches the reasoner and can manipulate the plan. Worse, a manipulated plan can write a false finding into persistent memory, poisoning the engagement's conclusions. The audit target: the summarizer's handling of untrusted content. This is the tradeoff of decomposition — more structure, more surfaces.