samugit83/redamon/add-partial-recon

When to Use

• Making an existing recon tool runnable as a single on-demand phase from the graph.

For adding the tool to the full pipeline, use recon-tool-integration. For the graph write itself, use graph-db-writes. This skill is the partial-recon path: graph-sourced inputs, the modal, and the single-phase re-run.

Critical Rules

• NEVER let partial-recon results create duplicate nodes. Partial runs merge

into the existing graph and must dedup via MERGE on the tenant triple - see graph-db-writes. Partial and full share the same graph.

• NEVER expose a graph-only input type as a manual textarea. SECTION_INPUT_MAP

in nodeMapping.ts lists what the tool reads from the graph, but only the types that make sense for manual entry get a user field. Types like Port and Endpoint come from the graph only and must not be hand-entered.

• **ALWAYS wire the shared entry so it works in BOTH the full pipeline AND partial

recon. Partial recon is spawned as a separate** container from the full pipeline (recon_orchestrator/container_manager.py); hook the shared entry function once so both inherit (see recon-ai-enrichment for the same rule).

• ALWAYS mirror the reference impl matching your tool's input shape, not an

arbitrary one: Naabu (Subdomain + IP), Masscan (IP only), Nmap (IP + Port), Katana (URL). The input-node shape drives the whole wiring.

• **ALWAYS read the run's roots through scope_roots(config), NEVER

config["domain"].** A Domain-batch run covers every root in config["domains"]; config["domain"] is only the first, so a tool reading it silently skips the rest. test_partial_scope_guard.py fails the gate on a direct read. Pass domain_groups=config.get("domain_groups") (built from the container's SCOPE_GROUPS) to the graph builders so each root keeps its group's scope: an EXACT group, a single-domain prefix list included, scans only its listed hosts. Attach each typed host to the org Domain of its scan root, attach_org(root_for_host(host, roots)): the graph has one Domain per registrable domain, never one per scan root.

• NEVER re-implement the typed-input scope check in a module. The orchestrator

and _prepare_scope (filter_partial_user_input) already dropped every typed host, URL host, over-wide CIDR and out-of-scope attach target, and a typed URL's host joins the writer's scope only through _scope_partial_urls. The run is also refused before your module runs while the graph holds an older scope model's Domain (_legacy_graph_refusal, fails closed).

• ALWAYS loop an API that takes one domain per call through `run_per_root`,

never a bare for. It fails only the root that raised or called sys.exit, retries a rate-limited root once, and returns the {root: status} the run report and exit code read. Mirror Urlscan (a 429 returns STATUS_RATE_LIMITED) or Shodan.

• A writer attaches a host through `attach_for_host(host, recon_data)`

(graph_db/mixins/recon/scope.py): the scope is the longest scan root among attach_roots(recon_data) (every project root, from all_project_roots, so a host found under another group's root joins it instead of becoming an ExternalDomain), and the Domain is that root's org (org_for_scan_root). A partial run's recon dicts carry no scope_groups; _prepare_scope sets the run's default (set_project_scope -> set_run_scope_groups), and a dict's own scope_groups always wins.

Input-node shape -> reference impl

Commands

# recon/*.py is spawned fresh per job (volume-mounted) - no rebuild
./redamon.sh test unit                    # recon + root-recon sections

Resources

• docs/readmes/coding_agent_prompts/PROMPT.ADD_PARTIAL_RECON.md - full walkthrough, modal UI, input validation, reference impls
• Related skills: recon-tool-integration, graph-db-writes, recon-ai-enrichment