Multi-Agent Runtime Engineering Skill

"Harness engineering > base-model parameters. MopMonk took MiniMax M3 (smaller base) to 73.1% on CyberGym — beating Claude Opus 4.6 (66.6%) and matching GPT-5.4 (79.0%) within a stone's throw. The harness is the moat." — adapted from 36kr's coverage of MopMonk Agent (Chinese press nickname 扫地僧), 2026-06-30

Summary

This skill is the runtime engineering layer for agent systems. It treats memory schemas, sync protocols, convergence rules, anti-pattern prevention, and topology selection as first-class engineering artifacts — the things that decide whether a multi-agent system actually converges on truth or spirals into hallucinated prose.

This skill solidifies the engineering patterns of validation/scenarios/SCEN-007.md (Shared-Memory Multi-Agent Exploit Dev) and validation/scenarios/SCEN-MEMORY-SCHEMA.md (Structured Memory foundation) into a reusable knowledge base. SCEN-007 is the live scenario that proves the pattern — three parallel agents (patch-diff, harness-entry, sanitizer) converging on CVE-2019-7317 in ~45 minutes wall-clock vs. ~2 hours serially. SCEN-MEMORY-SCHEMA is the underlying schema library. This skill abstracts both into the runtime discipline that kali-claw (or any agent harness) uses whenever it needs to coordinate memory across multiple workers, multiple phases, or multiple independent explorations of the same target.

Why this skill exists as a distinct domain. Three converging trends in 2024-2026 agent engineering make a dedicated runtime-engineering skill necessary. First, MopMonk Agent (Chinese press nickname 扫地僧) demonstrated that a smaller base model (MiniMax M3) with disciplined harness engineering beats larger models with naive harnesses — 73.1% on CyberGym vs. Claude Opus 4.6's 66.6%. The "harness" in question is precisely the three layers this skill codifies: structured memory (招一 / Layer 1), memory-driven convergence (招二 / Layer 2), and shared-memory multi-agent coordination (招三 / Layer 3). Second, Anthropic's multi-agent research system blog series (2024-2026) and the parallel work on LangGraph, AutoGen, and Magentic-One all converged on the same core primitives — atomic state writes, version vectors, convergence detection, and explicit topology choice — but each frames them in vendor-specific terms. Third, kali-claw's own SCEN-007 showed that filesystem-native coordination (POSIX flock + jq + mv) is sufficient for multi-agent exploit dev with no DB, no message broker, and no framework dependency — a deliberately low-tech, high-reliability stack.

What this skill does NOT cover. It is not generic task decomposition (multi-agent-collaboration), not multi-perspective analysis (council), not pentest-framework deployment (agentic-pentest), and not knowledge persistence primitives (continuous-learning, chronicle). It is the engineering substrate underneath all of those — the schema design, sync protocol, and convergence rulebook that any of those higher-level skills may invoke when they need persistent structured memory across parallel workers.

Distinct from adjacent skills:

Skill	Scope	Relationship to this skill
multi-agent-collaboration	Generic task decomposition + coordinator-worker topology	Provides the decomposition logic; this skill provides the runtime substrate (memory, sync, convergence) that decomposition runs on top of
council	Multi-perspective analysis (Attack / Defense / Audit viewpoints)	Council emits judgments; this skill defines how those judgments get written to a shared memory and merged when multiple councils run in parallel
agentic-pentest	Deploying LLM-driven pentest frameworks (PentestGPT, HexStrike, Viper)	Those frameworks have their own internal state; this skill is the external shared-memory layer between multiple framework instances
continuous-learning / chronicle	Knowledge persistence primitives (prose logs, distilled memory)	Those persist prose; this skill persists structured JSON — the two layers compose, they do not compete
verification-loop	Independent re-run of agent claims	Verification reads from the structured memory this skill defines; the memory's evidence_for / evidence_against fields are how verification results land
autonomous-loops	Generic loop constructs (sequential, watch, batch, learning)	Loops are the control flow; this skill is the state layer the loops read and write
engagement-manager	Kill-chain phase orchestration (human-readable)	Engagement manager decides what phase to run; this skill decides how multiple parallel workers inside a phase share state

Use Cases

Schema Design

1. Design a structured memory JSON for a multi-phase pentest engagement (recon → intrusion → privilege escalation → lateral → exfil) where each phase reads the prior phase's structured findings and writes a delta
2. Define an exploit-attempt memory schema for parallel-exploit dev — multiple agents writing hypotheses, evidence, failed attempts, and candidate PoCs to one shared file
3. Define a patch-diff reproduction memory schema — schema for "given a patch, reproduce the underlying bug and generate a differentially-verified PoC" (CyberGym-style)
4. Retrofit a prose-only memory system with structured fields — convert legacy MEMORY.md Chinese prose-only into a JSON companion without losing the curated distilled knowledge
5. Federate engagement memory with long-term knowledge — schema design where per-engagement JSON distills back into the root MEMORY.md at engagement close, same pattern kali-claw's daily logs follow

Atomic-Write Sync

6. Coordinate 3 parallel exploit-dev agents against one shared memory file (SCEN-007 case: patch-diff + harness-entry + sanitizer)
7. Prevent lost-update when two agents write different fields simultaneously — version-vector guard detects conflict and retries
8. Implement path-claim coordination — agents claim a unique exploration path (no duplicate active_paths values) using flock + atomic write
9. Detect and recover from path-claim deadlock — schema validation rejects any write where active_paths has duplicates
10. Build a coordinator script that bootstraps memory, dispatches agents, and aggregates final state — the literal harness from SCEN-007 Phase 0
11. Tolerate agent crash mid-write — mktemp + mv pattern ensures the memory file is never half-written; the temp file is GC'd on next coordinator pass

Convergence Detection

12. Detect when 2+ agents independently arrive at the same hypothesis — same path field, different claimed_by → promote both to CONFIRMED and emit convergence event
13. Promote a hypothesis from LIKELY to CONFIRMED on third independent evidence vector (triangulation principle)
14. Demote a hypothesis to INVALIDATED after 3 failed attempts with no new evidence — path-switch trigger fires
15. Run a periodic sync-point convergence sweep — every N iterations, an external observer scans the memory for convergence events and emits decisions
16. Detect premature stop — agent tried to mark stop_condition_met = true without filling verification_results; schema validation blocks the write
17. Generate a convergence timeline for post-engagement analysis — "at t=25min, agents A∩B converged on path X; at t=40min, differential verification passed"

Anti-Pattern Prevention

18. Detect free-form exploration — agent ran commands without reading memory first; memory_lock.last_read_at is null when write attempted
19. Detect memory drift — agent wrote prose to decision_log that references a finding not present in findings[]
20. Detect repeat-without-delta — same hypothesis tested 3+ times with no new evidence in evidence_for or evidence_against
21. Detect path-claim deadlock — two agents both wrote the same value to active_paths
22. Detect premature stop — stop condition claimed without differential verification
23. Build a checker script that runs after every memory write — schema validation + anti-pattern checks in one jq pipeline

Topology Selection

24. Choose between parallel-explorers / pipeline / council / hierarchical topology based on task shape (bug-class exploration vs. phase-sequential vs. multi-perspective judgment vs. coordinator-fanout)
25. Decide when NOT to use multi-agent — single-target linear attack chains (use autonomous-loops Sequential Pipeline instead)
26. Decide when to use council-style multi-perspective analysis (one question, three lenses) vs. parallel-explorers (one target, three directions)
27. Mix topologies within one engagement — parallel-explorers for recon, pipeline for exploit chain, council for the final risk judgment
28. Decide coordinator-vs-peer protocol — coordinator simplifies reasoning but adds a bottleneck; peer-to-peer is robust but harder to reason about

Core Tools

jq Patterns for Memory Operations

Pattern	Use
jq '.memory_lock.version' mem.json	Read current version (for optimistic concurrency)
`jq --arg agent "$A" --arg path "$P" '.active_paths[$agent] = $path	...' mem.json`
`jq '.active_paths	(group_by(.)
`jq '[.vulnerability_hypotheses[]	select(.status != "INVALIDATED")
jq -e '.convergence_state.stop_condition_met == true and .verification_results.vulnerable != null' mem.json	Premature-stop check
`jq --argjson now "$(date -u +%FT%TZ	jq -R .)" '.decision_log += [{"at": $now, ...}]' mem.json`
`jq '.failed_attempts	group_by(.hypothesis)
`jq -e '.findings	length > 0 and (.decision_log

POSIX flock Patterns

Pattern	Use
`( flock -x 9
`( flock -s 9
`flock -x -w 30 9
`flock -n 9

Atomic Write Pattern (canonical)

# Canonical atomic write — every memory update goes through this
write_memory() {
  local mem="$1" agent="$2" jq_expr="$3"
  (
    flock -x -w 30 9 || { echo "[fatal] lock timeout"; exit 1; }
    local pre; pre=$(jq '.memory_lock.version' "$mem")
    local tmp; tmp=$(mktemp)
    jq --arg agent "$agent" --argjson pre "$pre" "$jq_expr" "$mem" > "$tmp" || { rm "$tmp"; exit 2; }
    local post; post=$(jq '.memory_lock.version' "$tmp")
    [ "$post" -eq "$((pre + 1))" ] || { echo "[conflict] $agent version mismatch"; rm "$tmp"; exit 3; }
    # anti-pattern sanity: no duplicate active_paths
    jq -e '.active_paths | (group_by(.) | map(length) | max // 0) <= 1' "$tmp" >/dev/null \
      || { echo "[deadlock] $agent duplicate path"; rm "$tmp"; exit 4; }
    # premature-stop guard
    jq -e '.convergence_state.stop_condition_met // false | not or (.verification_results.vulnerable != null and .verification_results.patched != null)' "$tmp" >/dev/null \
      || { echo "[premature-stop] $agent"; rm "$tmp"; exit 5; }
    mv "$tmp" "$mem"
  ) 9>"$mem.lock"
}

Python Helpers

Helper	Purpose
python3 validate_schema.py mem.json	Schema validation (required fields, types, confidence-level taxonomy)
python3 detect_convergence.py mem.json	Scan for hypotheses pointing at same .path from different claimed_by
python3 detect_anti_patterns.py mem.json	All 5 anti-pattern checks in one pass
python3 timeline.py mem.json	Render decision_log as a wall-clock timeline
python3 federation_distill.py engagement.json >> MEMORY.md	Engagement-close: distill JSON memory back into prose MEMORY.md

Shell Idioms

Idiom	Use
tmp=$(mktemp); jq ... mem > "$tmp"; mv "$tmp" mem	Atomic write without lock (single-agent case)
grep -c '"decision":' mem.json	Quick decision-log length check
`git diff --no-index mem.json.old mem.json	jq -R '...'`
sha256sum evidence/*.txt > evidence_index.sha256	Evidence integrity (paired with evidence_index in schema)

Methodology — The 5-Layer Runtime Stack

This skill organizes agent runtime engineering into five layers, each building on the one below. A mature harness implements all five; a naive harness may only implement the first one or two (and pays for it in hallucination, deadlock, and lost work).

+------------------------------------------------------------------+
| Layer 5 — Topology Selection                                     |
|   parallel-explorers / pipeline / council / hierarchical         |
|   choose the right shape per task                                |
+------------------------------------------------------------------+
| Layer 4 — Anti-Pattern Prevention                                |
|   5 forbidden patterns detected before write commits             |
|   free-form / drift / repeat / deadlock / premature-stop         |
+------------------------------------------------------------------+
| Layer 3 — Convergence Detection                                  |
|   multi-agent independent arrival → CONFIRMED promotion          |
|   failed-attempt accounting → path-switch                        |
+------------------------------------------------------------------+
| Layer 2 — Atomic Sync                                            |
|   POSIX flock + mktemp+mv + version vector                       |
|   no DB, no broker, filesystem-native                            |
+------------------------------------------------------------------+
| Layer 1 — Structured Memory                                      |
|   JSON schema with required fields, confidence taxonomy          |
|   machine-queryable (no prose)                                |
+------------------------------------------------------------------+

Layer 1 — Structured Memory (MopMonk 招一 / Layer-1)

Every engagement maintains a machine-queryable memory JSON. No prose memory. The agent must be able to query "what did we learn about X?" and get a deterministic answer. Every phase MUST: read the current memory file, execute its phase task, write a delta (fields added / updated / invalidated), and update next_constraints so downstream phases know the boundaries.

This skill ships three canonical schemas: Pentest Engagement Memory (Schema 1 — for cross-phase engagements), Exploit Attempt Memory (Schema 2 — for parallel exploit dev), and Patch-Diff Reproduction Memory (Schema 3 — for CyberGym-style PoC generation). Full templates are in payloads.md.

Layer 2 — Atomic Sync (MopMonk 招三 / Layer-3 foundation)

When multiple agents read/write the same memory file, every update goes through the canonical atomic-write pattern: take flock advisory lock on a sidecar .lock file → read current memory → apply jq transform to a mktemp temp file → validate (version-vector guard + anti-pattern checks) → mv temp to real path (POSIX atomic). No agent ever edits the JSON in place. Conflict resolution is optimistic concurrency: each write must increment memory_lock.version by exactly 1; a version mismatch aborts the write and the agent retries.

Layer 3 — Convergence Detection (MopMonk 招二 / Layer-2)

Open-ended trial-and-error is forbidden. Every action must either produce new evidence (update an evidence_for / evidence_against field, bump confidence) or be aborted and trigger a path switch. The rule is encoded in convergence_state.failed_attempts_on_active_path — when it hits path_switch_threshold (typically 3), the agent releases its current path and picks a new one from candidate_paths. Convergence events fire when 2+ hypotheses point at the same path field with different claimed_by — those get promoted to CONFIRMED and merged into a canonical hypothesis.

Layer 4 — Anti-Pattern Prevention

Five forbidden behaviors, each with a machine-checkable detection rule. The atomic-write pattern (Layer 2) runs the checks before mv; if any check fails, the write is rejected and the agent must fix its state. The five anti-patterns: free-form exploration (write without prior read), memory drift (decision log references finding not in findings[]), repeat-without-delta (3+ failed attempts on same hypothesis with no new evidence), path-claim deadlock (two agents grab same path), premature stop (stop claimed without differential verification). Detection rules in payloads.md §17-§21.

Layer 5 — Topology Selection

Not every task benefits from the same agent topology. Parallel-explorers (SCEN-007) fits bug-class exploration where multiple independent directions increase the chance of convergence. Pipeline fits phase-sequential work (recon → exploit → report). Council fits questions where the same input needs three analytical lenses (Attack / Defense / Audit). Hierarchical coordinator-worker fits dynamic engagements where task dependencies shift. The topology matrix in payloads.md §22 guides selection; the rule of thumb is "as parallel as possible, as coordinated as necessary."

MopMonk Three-招 (Three-Layer) Mapping

The MopMonk Agent (Chinese press nickname 扫地僧) three-招 (three layers) map directly onto this skill's 5-layer stack:

MopMonk 招 (layer)	kali-claw Layer	Implementation
招一 (Layer 1 — Structured Vulnerability Memory)	Layer 1 — Structured Memory	Three canonical JSON schemas (engagement / exploit-attempt / patch-diff-repro) with required fields, confidence taxonomy, evidence index, decision log
招二 (Layer 2 — Memory-Driven Convergence)	Layer 3 — Convergence Detection	Every action yields a delta or triggers path switch; failed_attempts_on_active_path threshold drives path switches; convergence events promote hypotheses to CONFIRMED
招三 (Layer 3 — Shared-Memory Multi-Agent)	Layers 2 + 5 — Atomic Sync + Topology	POSIX flock + atomic write + version vector across N parallel agents; topology choice (parallel-explorers for bug-class, pipeline for phase-sequential)

The fourth implicit 招 (layer) — the meta-principle — is "Harness > Parameters": the same base model with a disciplined harness dramatically outperforms the same model with a naive harness. MopMonk's MiniMax M3 (smaller base) at 73.1% beats Claude Opus 4.6 (larger base) at 66.6% — the gap is harness engineering, not model capacity.

Practical Steps

Step A — Bootstrap an Exploit Attempt Memory (Schema 2)

mkdir -p /runs/SCEN-007/mem
cat > /runs/SCEN-007/mem/exploit-attempt-memory.json <<'JSON'
{
  "schema_version": "1.0",
  "target": {
    "binary": "/targets/libpng-1.6.37/build/libpng.so",
    "patched_binary": "/targets/libpng-1.6.38/build/libpng.so",
    "type": "ELF x86-64 shared object",
    "source_available": true,
    "patch_diff": "/targets/patches/libpng-1.6.37_to_1.6.38.patch",
    "sanitizer_enabled": "ASan+UBSan",
    "cve": "CVE-2019-7317"
  },
  "memory_lock": {
    "version": 0,
    "owner_agents": [],
    "last_write_at": null,
    "last_write_by": null
  },
  "vulnerability_hypotheses": [],
  "candidate_pocs": [],
  "failed_attempts": [],
  "active_paths": {},
  "convergence_state": {
    "iterations": 0,
    "confirmed_poc": null,
    "stop_condition_met": false,
    "stop_reason": null,
    "sync_points_executed": 0
  },
  "decision_log": []
}
JSON

Step B — Path Claim (3 agents, race-safe)

AGENT_ID=A
CLAIM_PATH=patch-diff
MEM=/runs/SCEN-007/mem/exploit-attempt-memory.json

(
  flock -x -w 30 9 || exit 1
  tmp=$(mktemp)
  jq --arg agent "$AGENT_ID" --arg path "$CLAIM_PATH" \
    '.active_paths[$agent] = $path
     | .memory_lock.owner_agents = (.active_paths | keys)
     | .memory_lock.version += 1
     | .memory_lock.last_write_at = (now | todateiso8601)
     | .memory_lock.last_write_by = $agent
     | .decision_log += [{"at": (now | todateiso8601), "by": $agent,
                          "decision": ("claimed path " + $path)}]' \
    "$MEM" > "$tmp"
  # anti-pattern check: no duplicate paths
  jq -e '.active_paths | (group_by(.) | map(length) | max // 0) <= 1' "$tmp" >/dev/null \
    || { echo "[deadlock] $AGENT_ID"; rm "$tmp"; exit 2; }
  mv "$tmp" "$MEM"
) 9>"$MEM.lock"

Step C — Hypothesis Write (with version-vector guard)

AGENT_ID=A
HYP_ID=H-A-001
HYP_TEXT="heap-buffer-overflow in png_read_row() row-processing loop"
HYP_PATH="pngpread.c:412"
EVIDENCE='["BinDiff: function png_read_row changed in 1.6.38", "patch adds row_bytes guard at line 408"]'
MEM=/runs/SCEN-007/mem/exploit-attempt-memory.json

(
  flock -x -w 30 9 || exit 1
  BEFORE=$(jq '.memory_lock.version' "$MEM")
  tmp=$(mktemp)
  jq --arg agent "$AGENT_ID" --arg hid "$HYP_ID" --arg htext "$HYP_TEXT" \
     --arg hpath "$HYP_PATH" --argjson ev "$EVIDENCE" --argjson prever "$BEFORE" \
    '.vulnerability_hypotheses += [{
        "id": $hid, "hypothesis": $htext, "path": $hpath,
        "evidence_for": $ev, "evidence_against": [],
        "status": "LIKELY", "confidence": 0.55,
        "claimed_by": $agent, "created_at": (now | todateiso8601)
      }]
     | .memory_lock.version = ($prever + 1)
     | .memory_lock.last_write_at = (now | todateiso8601)
     | .memory_lock.last_write_by = $agent
     | .convergence_state.iterations += 1
     | .decision_log += [{"at": (now | todateiso8601), "by": $agent,
                          "decision": ("added hypothesis " + $hid)}]' \
    "$MEM" > "$tmp"
  AFTER=$(jq '.memory_lock.version' "$tmp")
  [ "$AFTER" -eq "$((BEFORE + 1))" ] || { echo "[conflict] $AGENT_ID"; rm "$tmp"; exit 2; }
  mv "$tmp" "$MEM"
) 9>"$MEM.lock"

Step D — Convergence Detection (run at each sync point)

# Detect: 2+ hypotheses pointing at the same path with different claimed_by
MEM=/runs/SCEN-007/mem/exploit-attempt-memory.json

jq -r '
  [.vulnerability_hypotheses[] | select(.status != "INVALIDATED")] as $h
  | ($h | group_by(.path) | map(select(length >= 2)) | map(map(.claimed_by) | unique | length >= 2) | any) as $converged
  | if $converged then
      "CONVERGENCE: " + (
        $h | group_by(.path) | map(select(length >= 2)) | map(
          .[0].path + " (agents: " + (map(.claimed_by) | unique | join(",")) + ")"
        ) | join("; ")
      )
    else "no convergence yet" end
' "$MEM"

Step E — Anti-Pattern Checker (run after every write)

MEM=/runs/SCEN-007/mem/exploit-attempt-memory.json
python3 - <<'PY' "$MEM"
import json, sys, datetime
mem = json.load(open(sys.argv[1]))
violations = []

# AP-1 free-form exploration: write attempted without prior read
if mem.get("memory_lock", {}).get("last_write_at") and not mem.get("memory_lock", {}).get("last_read_at"):
    violations.append("AP-1 free-form exploration")

# AP-3 repeat-without-delta: 3+ failed attempts on same hypothesis with no new evidence
from collections import Counter
fails = Counter(f.get("hypothesis") for f in mem.get("failed_attempts", []))
for hyp, n in fails.items():
    if n >= 3:
        violations.append(f"AP-3 repeat-without-delta on {hyp}: {n} failed attempts")

# AP-4 path-claim deadlock: duplicate active_paths values
paths = list(mem.get("active_paths", {}).values())
if len(paths) != len(set(paths)):
    violations.append(f"AP-4 path-claim deadlock: {paths}")