Reconnaissance
Named by 5 kept items in this workspace.
Search every workspace for Reconnaissance. It matches the name as written, so it can find other things that share it.
The items that name it 5
Maps architecture, trust boundaries, input surfaces, prior evidence, and deterministic coverage into architecture.md and coverage-ledger.json (Phase 1 of the audit)
Threat actor gathers information about the environment, e.g. listing S3 buckets (ListBuckets API call) or browsing available resources before acting
Agent enumerated filesystems, processes, network interfaces, environment variables, mount points and available tools on day one
All techniques in this workspace.