pentest-alignlisted

## User Input ```text $ARGUMENTS ``` You **MUST** consider the user input before proceeding (if not empty). ## Purpose Detect and fix drift between the pentest test suite and the actual Rockport codebase. The codebase (Terraform, sidecar code, LiteLLM config) is the source of truth; pentest scripts and target YAML must match it. ## Workflow ### Phase 1: Extract Ground Truth (parallel agents) Launch 3 subagents in parallel: **Agent 1 — Infrastructure**: - Read `terraform/waf.tf` → extract all WAF-allowed paths - Read `terraform/tunnel.tf` → extract all tunnel routes (path, service, port) - Read `terraform/access.tf` → extract Access policy configuration **Agent 2 — Application**: - Read `sidecar/video_api.py` → extract all endpoints, auth requirements, validation rules - Read `sidecar/palette_api.py` → extract the palette endpoint, its auth check and validation rules - Read any new sidecar files **Agent 3 — Configuration**: - Read `config/litellm-config.yaml` → extract model definitions, settings, rate limits - Read `terraform/guardrails.tf` → extract optional guardrail configuration Each agent returns a structured summary (not raw file contents). ### Phase 2: Read Pentest State - Read `pentest/targets/rockport.yaml` — current target configuration - Scan `pentest/scripts/*.sh` — extract hardcoded paths, endpoints, expected responses ### Phase 3: Cross-Reference Based on the focus area (or all if not specified): **WAF** (`waf`): - Compare waf.tf allowed paths ↔