Phase 1 — schema additions (no behavior change yet, all 78 tests still pass):
- execute_tool() now returns 5-tuple (output, new_hosts, new_ports, reward, revealed_targets)
with backward-compat: 4-tuple handlers get padded to 5-tuple at the engine boundary
- env tracks _attack_surface (grows during episode), _revealed_targets log,
_active_subagents dict, _subagent_outcomes log
- New action_types accepted: spawn_subagent / return_to_parent (stubs, real impl in Phase 3)
- Tests updated: 3 test_generator.py unpack sites bumped to 5-tuple
Phase 2 — tools emit revealed_targets when they hit gateway vulns:
- New _revelations_for_vulns helper in tools_engine/testing.py: when a tool finds a
vulnerability whose ID gates a hidden host (via scenario hosts.hidden_until chain),
emit a {scope: host, target: <ip>, context: ...} revelation
- handle_test_injection / handle_test_xss / handle_test_auth surface revelations both
in their textual output ("[REVEALED] Sub-agent delegation candidates…
