SanMuzZzZz/LuaN1aoAgent

What it is

The GitHub README for LuaN1aoAgent v2, a TypeScript-on-Pi-SDK rewrite of an autonomous security-research agent. The catalog summary covers the Planner/Executor/Observer split and the evidence-backed causal graph; the page adds operational detail and two caveats that change how you should evaluate it.

How it works

Beyond the three-role framing, the page specifies that the Observer is actually two independent modes, not one component:

• Supervisor (hot-path): inspects recent Executor actions and decides continue / checkpoint / stop / return-to-Planner.
• Projector (asynchronous): converts normalized observations into reasoning- and operation-graph deltas without blocking the Executor loop.

Each role terminates through a schema-validated structured tool — planner_submit, task_result_submit, control_submit, graph_delta_submit — and every Supervisor/Projector invocation uses a fresh Pi session with no shared hidden model history. The Planner's language is a fixed set of graph operations (create_tasks, patch_task, replace_dependencies, set_task_status, set_node_status); new evidence patches existing tasks rather than regenerating the plan. Large tool outputs spill to content-addressed artifacts with preview + provenance instead of inflating context, and only "ready" tasks enter a deterministic admitted wave (independent tasks may run concurrently).

Preconditions / Affected

Executors run Pi coding tools (read, grep, find, ls, …) inside a configured sandbox boundary. Runs are bounded by per-task turn budgets and a global run-time budget; provider failures are classified as retryable with bounded fresh-session retries. Intended for authorized security research/pentesting only.

Caveats

Two are stated explicitly on the page and matter for anyone deciding whether to adopt or trust it:

• v2 is not an in-place refactor of the Python v1 runtime. It is a new implementation with different configuration, persistence, Agent lifecycle, and observability contracts — migrating from v1 is not a version bump.
• No v2 benchmark numbers exist yet. v1's reported benchmarks are explicitly not attributed to v2; v2 results will be published only after reproducible reruns on a frozen release. Treat any performance expectation carried over from v1 as unsupported.

Provenance enforcement (confirmed Vulnerability and successful Exploit nodes cannot be written without evidence references) is a design guarantee described in the README, not an independently verified property.