ENGINEERING INDEX / ENTRY 12
CASE 12 / DEFENSIVE REPORTING / EVIDENCE SHAPE
A finding needs a readable trail.
Raw scan output alone is hard to review. HackBot converts staged operator findings into an engagement report with target, scope, stage history, severity, and finding details.
How do operator findings become a report a reviewer can actually inspect?
Where the handoffs happen.
The technical view retains stage and finding information; the shorter summary calls out high-severity attention. A synthetic CVE fixture checks that template metadata is carried through.
- 01Operator findings
- 02Typed engagement report
- 03Technical detail
- 04Executive summary
What the record earns.
Finding conversion and two report renderers tested.
- Observed receipt
- On September 25, 2026, HackBot reporting tests passed within a 21-test reporting-and-memory batch, including staged finding conversion and both Markdown renderers.
- Source and scope
- HackBot hackbot/reporting, operator finding models, and tests/test_reporting.py; inspected dirty checkout at HEAD 976d9e7.
What this does not prove.
Synthetic findings test the transformation, not whether a vulnerability is real or whether a client received a report. Severity still needs human review.
Where the work goes next.
Attach a redacted, authorized sample from raw observation to reviewed report and record the human correction step.