# Output Structure Specification

Complete folder structure for pentest engagements. Minimizes clutter, organizes deliverables.

## Root Structure

```
outputs/{engagement-name}/
├── report/                    # Complete deliverable package (3 files + appendix)
│   ├── Penetration-Test-Report.docx     # Main report
│   ├── Penetration-Test-Report.pdf      # Optional PDF
│   ├── pentest-report.json              # Machine-readable export
│   └── appendix/                        # Referenced evidence only
│       └── finding-{id}/
└── processed/                 # All working/testing artifacts
    ├── reconnaissance/        # Phase 2 outputs
    ├── findings/              # Phase 4 raw findings
    ├── activity/              # Phase 4 NDJSON logs
    ├── helpers/               # Testing utilities
    ├── test-frameworks/       # Testing scripts
    └── intermediate-reports/  # Drafts, markdown source, working files
```

## Phase-by-Phase Organization

### Phase 2: Reconnaissance

```
processed/reconnaissance/
├── inventory/
│   ├── domains.json           # Subdomain enumeration results
│   ├── web-apps.json          # Web application inventory
│   ├── apis.json              # API discovery results
│   ├── network.json           # Port scan results
│   └── cloud.json             # Cloud infrastructure (if applicable)
├── analysis/
│   ├── attack-surface.md      # Risk-prioritized attack vectors
│   └── testing-checklist.md   # Executor deployment plan
└── reconnaissance_report.md    # Summary report
```

### Phase 4: Vulnerability Testing

```
processed/findings/
├── {finding-id}/              # One folder per finding
│   ├── description.md         # Finding details (CVSS, CWE, impact)
│   ├── poc.py                 # Proof of concept (if applicable)
│   ├── workflow.md            # Discovery process
│   └── evidence/              # Screenshots, HTTP logs, videos
│       ├── screenshot-1.png
│       └── request.txt

processed/activity/
├── pentester-orchestrator.log # Orchestrator decisions (NDJSON)
└── {executor-name}.log        # Per-executor activity logs (NDJSON)
```

### Phase 6: Final Reporting

```
report/
├── Penetration-Test-Report.docx      # Professional Word document (includes Referenced Files section)
├── Penetration-Test-Report.pdf       # PDF export (if generated)
├── pentest-report.json               # Machine-readable export
└── appendix/                         # Referenced evidence only
    ├── finding-001/                  # Evidence for finding 1
    │   ├── screenshot-exploit.png
    │   └── http-request.txt
    ├── finding-002/                  # Evidence for finding 2
    └── reconnaissance-summary.json   # Tech stack summary

processed/
├── reconnaissance/                   # Phase 2 working files
│   ├── inventory/*.json
│   ├── analysis/*.md
│   └── reconnaissance_report.md
├── findings/                         # Phase 4 raw findings
│   └── {finding-id}/
├── activity/                         # NDJSON logs
│   └── {executor-name}.log
├── helpers/                          # Testing utilities
│   ├── auth_token_extractor.py
│   └── user_id_enumerator.py
├── test-frameworks/                  # Testing scripts
│   ├── payment_api_tester.py
│   └── authorization_tester.py
└── intermediate-reports/             # Drafts, markdown source, working files
    ├── pentest-report-source.md      # Markdown source (before .docx conversion)
    ├── technical-analysis.md
    └── executive-summary-draft.md
```

## File Manifest

**Report (3 files + appendix):**
- `report/Penetration-Test-Report.docx` - Primary deliverable
- `report/Penetration-Test-Report.pdf` - Optional PDF
- `report/pentest-report.json` - Structured data
- `report/appendix/{finding-id}/` - Evidence per finding

**Processed (Working Artifacts):**
- `processed/reconnaissance/` - Phase 2 outputs
- `processed/findings/` - Phase 4 raw findings
- `processed/activity/` - NDJSON logs
- `processed/helpers/` - Testing utilities (optional)
- `processed/test-frameworks/` - Testing scripts (optional)
- `processed/intermediate-reports/` - Drafts, markdown source

## File Organization Rules

### What Goes in /report

**Complete deliverable package (3 files + appendix):**
- Professional Word document (.docx) with Referenced Files section embedded
- PDF export (if generated)
- JSON structured export
- Appendix subfolder with all referenced evidence

**Organization:**
- `report/Penetration-Test-Report.docx` - Main report (includes appendix listing)
- `report/Penetration-Test-Report.pdf` - Optional PDF
- `report/pentest-report.json` - Structured data
- `report/appendix/finding-{id}/` - Evidence per finding
- `report/appendix/reconnaissance-summary.json` - Tech details

**CRITICAL: NO intermediate files in report/ folder**
- No markdown source files
- No draft reports
- No temporary files
- Only final deliverables (.docx, .pdf, .json) + appendix/

**Total: 3 files maximum + appendix/ subfolder, ready for client delivery**

### What Goes in /processed

**All working and testing artifacts:**
- Phase 2 reconnaissance outputs
- Phase 4 raw findings and activity logs
- Testing helper scripts
- Test frameworks requiring authentication
- Intermediate/draft reports
- Markdown source files (before .docx conversion)
- ALL temporary/working files

**Organization:**
- `processed/reconnaissance/` - Phase 2 working files
- `processed/findings/` - Phase 4 raw findings
- `processed/activity/` - NDJSON logs
- `processed/helpers/` - Utility scripts
- `processed/test-frameworks/` - Testing frameworks
- `processed/intermediate-reports/` - Drafts, markdown source, analysis, temporary files

**CRITICAL: ALL intermediate files go here**
- Markdown source before conversion
- Draft reports
- Temporary analysis files
- Any file that is not a final deliverable

**Total files: Unlimited (working directory for testing)**

## Critical Rules

1. **Report folder = 3 files max + appendix/** (no intermediate files allowed)
2. **Report files allowed**: .docx, .pdf (optional), .json, appendix/ subfolder only
3. **NO REFERENCED-FILES.md** - Referenced Files section is embedded in .docx
4. **ALL intermediate files → processed/** (markdown source, drafts, temporary files)
5. **Report/appendix = Referenced evidence only** (organized by finding)
6. **Two-folder structure** (report/ and processed/ only at root level)
7. **Clean separation** (final deliverables vs. working files)
8. **No clutter in report/** - strictly enforced file limit

## Migration (Existing Engagements)

```bash
# Create structure
mkdir -p report/appendix processed/{reconnaissance,findings,activity,helpers,test-frameworks,intermediate-reports}

# Move working artifacts → processed/
mv reconnaissance findings activity processed/ 2>/dev/null
mv *.py processed/helpers/ 2>/dev/null
mv *_tester.py processed/test-frameworks/ 2>/dev/null
mv *SUMMARY*.md *CHECKLIST*.md *.md processed/intermediate-reports/ 2>/dev/null

# Move ONLY final deliverables → report/ (3 files max)
mv Penetration-Test-Report.docx Penetration-Test-Report.pdf pentest-report.json report/ 2>/dev/null

# Delete REFERENCED-FILES.md if exists (no longer used)
rm REFERENCED-FILES.md 2>/dev/null

# Copy referenced evidence → report/appendix/
# (requires reading report to identify referenced files, then cp to report/appendix/)
```
