From 6b57c6cc3ff4013e6ae99b6d506a05495cfec0de Mon Sep 17 00:00:00 2001 From: AreteDriver Date: Tue, 2 Jun 2026 14:20:45 -0700 Subject: [PATCH 01/10] docs: consolidate dual roadmaps into ROADMAP.md MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two roadmap files coexisted on main (case-collision on case-insensitive FS): the 5-agent ROADMAP.md (broad product roadmap) and the qwen-audited roadmap.md (#59, Active Chain legal/safety gate). They were complementary, not duplicates. Keep ROADMAP.md as canonical (conventional name, more comprehensive), fold the qwen roadmap's load-bearing piece in as a new 'Priority 0 — Gate' blocking any offensive Active Chain release (legal-boundary review, authorization mechanism, misuse threat model, tested egress enforcement, operator runbook). Remove the redundant lowercase roadmap.md. Co-Authored-By: Claude Opus 4.8 (1M context) --- ROADMAP.md | 16 ++++++++ roadmap.md | 117 ----------------------------------------------------- 2 files changed, 16 insertions(+), 117 deletions(-) delete mode 100644 roadmap.md diff --git a/ROADMAP.md b/ROADMAP.md index 294105b..68711e5 100644 --- a/ROADMAP.md +++ b/ROADMAP.md @@ -14,6 +14,22 @@ --- +## Priority 0 — Gate (blocks any offensive Active Chain release) + +> Folded in from the qwen-audited roadmap (2026-05-30). The Active Chain — wireless +> evil-twin + deauth, subnet recon, CVE check, and an autonomous Ollama agent under +> `modules/active/` + `modules/ai/` — is coded, tested, and committed, but **unreleased +> and undocumented**. It must not ship until this gate clears. Authorization is a review, +> not a code flag. + +- [ ] **Legal-boundary review** — `docs/legal-boundaries.md` + SECURITY.md: jurisdiction, authorized-use definition, explicit will/won't-do list for deauth + evil-twin. +- [ ] **Authorization mechanism** — scope assertion + recorded operator consent that every `modules/active/` module checks before executing (not just a flag). Add a test asserting each active module refuses to run absent an authorized-target assertion. +- [ ] **Misuse threat model** — model RedOPS pointed at an unauthorized network; document the technical controls that make casual misuse hard. +- [ ] **Tested egress enforcement** — a test that attempts cloud egress during an active-chain run and asserts it is blocked (local Ollama only). Enforced, not asserted. +- [ ] **Operator runbook + smoke test** — mock authorized-engagement walkthrough; full-chain smoke test on lab hardware (Alfa AWUS036NHA + Kali) before tagging the release. + +--- + ## Priority 1 — Critical (Do Now) ### Security and Reliability diff --git a/roadmap.md b/roadmap.md deleted file mode 100644 index 8c51d76..0000000 --- a/roadmap.md +++ /dev/null @@ -1,117 +0,0 @@ -# RedOPS Roadmap - -**Current version:** 1.5.0 (released 2026-01-26) -**Last updated:** 2026-05-30 -**Audit:** Baseline drafted from repo state, audited locally by qwen2.5:14b (Ollama), folded back in. - -RedOPS is a modular AI-assisted recon, forensics, and exposure-analysis framework -(Python, FastAPI, ~193K LOC, 5072 tests, 80% coverage gate). This roadmap covers the -path from the current released state through the next two minor releases and a 2.0 -horizon. The through-line: a fully-coded **offensive Active Chain is sitting unreleased**, -and the next releases are about shipping it *safely*, not building more. - ---- - -## Where we are - -- **Shipped (v1.5.0):** recon/OSINT, metadata forensics, threat intel (ThreatFox, - MalwareBazaar, AbuseIPDB), threat modeling, reporting, web dashboard, MCP server, - AI-assisted analysis (OpenAI/Anthropic), compliance/governance. -- **Built but UNRELEASED — the Active Chain:** AI-orchestrated active attack sequence - (wireless evil-twin + deauth, subnet recon, CVE cross-reference, autonomous Ollama - agent). ~1047 LOC under `modules/active/` + `modules/ai/`, with `test_wireless.py`, - `test_network.py`, `test_agent.py` and `config/pipelines/active_chain.json`. Committed - to `main` but **absent from CHANGELOG, README, and every tagged release.** -- **In flight:** PR #58 adds Qwen-uncensored model presets to the ReAct agent. -- **Maintenance:** 10 open dependabot/CI PRs (#48–#57); recent commits are dominated by - bumps. Stale remote branch `fix/ci-permissions` (PR #47, already merged) needs deletion. - ---- - -## Milestone 0 — Legal & Safety Gate (BLOCKS v1.6.0) - -> Added from the qwen audit: the prior draft treated authorization as a code feature and -> omitted the review that must precede shipping deauth/evil-twin capability at all. This -> gate blocks the release; it is not optional polish. - -- [ ] Written legal-boundary review: jurisdiction, authorized-use definition, and the - explicit set of actions RedOPS will and will **not** perform. Lands in `SECURITY.md` - + a new `docs/legal-boundaries.md`. -- [ ] Design the authorization mechanism (not just a flag): scope assertion + recorded - operator consent that every active module checks before executing. -- [ ] Threat-model the misuse case (RedOPS used against an unauthorized network) and - document the technical controls that make casual misuse hard. -- [ ] Operator walkthrough: a mock authorized-engagement runbook proving the consent flow - is understood end-to-end (cheap test for the "everyone understands authorized-use" - assumption). - -## Milestone 1 — Ship the Active Chain (v1.6.0) - -- [ ] **Authorization gating in code:** no active module (`deauth`, `evil_twin`, …) fires - without passing the Milestone-0 scope/consent check. Add a test that asserts each - active module refuses to run absent an authorized-target assertion. -- [ ] **Egress enforcement is tested, not asserted:** add a test that attempts cloud egress - during an active-chain run and asserts it is blocked (local Ollama only). -- [ ] CHANGELOG `[Unreleased]` → enumerate every active/ai module added. -- [ ] README "Active Chain" section + update the `❌ What RedOPS Does NOT Do` boundary to - reflect the new capability and its guardrails. Integrate `mobile-wireless-audit-kit.md` - into the active-chain user guide. -- [ ] **CI for active modules:** split hardware/root-dependent tests (wireless injection) - from CI-safe unit tests; document what runs in CI vs. only on the dedicated lab rig. -- [ ] Full-chain smoke test on lab hardware (Alfa AWUS036NHA + Kali), runbook checked in. -- [ ] Tag v1.6.0. - -## Milestone 2 — Harden the AI agent (v1.6.x → v1.7.0) - -> The agent (`modules/ai/agent.py`, `planner.py`, `tools.py`) exists and is being tuned in -> PR #58. This milestone is rails, not construction — and it follows the active-chain -> release, per the audit's ordering note. - -- [ ] Land/triage PR #58 (Qwen presets) first so hardening builds on the final agent shape. -- [ ] Action allow-list + dry-run mode for the agent's tool registry. -- [ ] Human-in-the-loop confirmation gate for any state-changing/offensive tool call. -- [ ] Bounded reasoning loop (max steps + cost/time budget) to prevent runaway chains. -- [ ] **Replay/audit log:** persist every agent decision (input context, chosen action, - result) to a structured log, with a documented post-engagement review checklist. -- [ ] Agent stress/load test under a long attack-surface summary to confirm it neither - stalls nor destabilizes the host (cheap test for the stability assumption). - -## Maintenance lane (continuous, not a milestone) - -> Per the audit, dependabot churn is operational hygiene, not roadmap work. - -- [ ] Delete stale `fix/ci-permissions` remote branch (PR #47 merged). -- [ ] Triage the 10 open dependabot PRs: admin-merge clean minor bumps, skip major-version - jumps (upload-artifact 4→7, checkout 4→6, action-gh-release 2→3) pending review. -- [ ] Enable grouped dependabot updates to cut PR noise going forward. -- [ ] Re-evaluate the coverage exclusions added to meet the 80% gate — confirm they exclude - only genuinely-untestable infra, not real gaps. - -## Horizon — v2.0 themes (not yet committed) - -- Expanded CVE source beyond the hardcoded home-lab list in `cve_check.py` (audit flags this - as higher-value than the SDK work below). -- Plugin SDK maturity for third-party active/recon modules. -- Multi-tenant hardening for the web dashboard + API key model. -- Post-release compliance audit: periodic check that deployed usage matches documented - authorized-use constraints; security review of dependabot-pulled third-party libraries. - ---- - -## Operating constraints - -- **Authorized use only.** Active offensive modules are home-lab / authorized-network scope. -- **AI layer runs local** (Ollama) for the active chain — no cloud egress (enforced + tested, - not assumed — see Milestone 1). -- Tests before commit; conventional commits; 80% coverage gate. - ---- - -## Open assumptions to validate (exploration carry-overs) - -| Assumption | Cheap test | -|---|---| -| Operators understand authorized-use policy | Mock authorized-engagement walkthrough (Milestone 0) | -| Ollama agent stays stable under load | Stress test with a large attack-surface summary (Milestone 2) | -| 80% coverage is enough for active modules | Manual adversarial test pass against the live chain on lab hardware | -| Cloud-egress prevention is robust | Simulate an unauthorized egress attempt and assert it's blocked (Milestone 1) | From 45ad5d651e43a8471b81e876d5c6fa8c899c38f2 Mon Sep 17 00:00:00 2001 From: AreteDriver Date: Sun, 21 Jun 2026 20:13:55 -0700 Subject: [PATCH 02/10] security: add .env and credential patterns to .gitignore --- .gitignore | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/.gitignore b/.gitignore index 8105358..105c5ac 100644 --- a/.gitignore +++ b/.gitignore @@ -57,3 +57,15 @@ temp/ .env .env.* .env.local + +# Security: prevent secret files from being committed +.env +.env.local +.envrc +*.pem +*.key +id_rsa* +id_ecdsa* +id_ed25519* +*.p12 +secrets.json From a30d43f592b6bf4dde693af6964faccf5655202d Mon Sep 17 00:00:00 2001 From: AreteDriver Date: Mon, 22 Jun 2026 01:41:09 -0700 Subject: [PATCH 03/10] security: pin GitHub Actions to SHA commits --- .github/workflows/ci.yml | 24 ++++++++++++------------ .github/workflows/codeql.yml | 4 ++-- .github/workflows/release.yml | 10 +++++----- .github/workflows/secret-scan.yml | 2 +- .github/workflows/security.yml | 16 ++++++++-------- 5 files changed, 28 insertions(+), 28 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ced60b0..6314040 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -31,10 +31,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6 with: python-version: ${{ env.PYTHON_VERSION }} @@ -52,10 +52,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6 with: python-version: ${{ env.PYTHON_VERSION }} @@ -78,15 +78,15 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v6 + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6 with: python-version: ${{ matrix.python-version }} - name: Cache pip - uses: actions/cache@v5 + uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5 with: path: ~/.cache/pip key: ${{ runner.os }}-pip-${{ matrix.python-version }}-${{ hashFiles('pyproject.toml') }} @@ -154,10 +154,10 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6 with: python-version: ${{ env.PYTHON_VERSION }} @@ -181,10 +181,10 @@ jobs: needs: [test] steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6 with: python-version: ${{ env.PYTHON_VERSION }} @@ -209,7 +209,7 @@ jobs: needs: [lint] steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - name: Set up Docker Buildx uses: docker/setup-buildx-action@v4 diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index f7adade..c63a0a1 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -25,10 +25,10 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6 with: python-version: "3.12" diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 4486396..6fb6907 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -21,7 +21,7 @@ jobs: version: ${{ steps.version.outputs.version }} steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 with: fetch-depth: 0 @@ -30,7 +30,7 @@ jobs: run: echo "version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6 with: python-version: "3.12" @@ -64,10 +64,10 @@ jobs: if: "!contains(github.ref, 'alpha') && !contains(github.ref, 'beta')" steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6 with: python-version: "3.12" @@ -89,7 +89,7 @@ jobs: needs: [release] steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - name: Set up QEMU uses: docker/setup-qemu-action@v4 diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml index 3820ffd..5aca22b 100644 --- a/.github/workflows/secret-scan.yml +++ b/.github/workflows/secret-scan.yml @@ -18,7 +18,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 with: fetch-depth: 0 diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index e04acb3..5d2faec 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -21,10 +21,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6 with: python-version: "3.12" @@ -47,10 +47,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6 with: python-version: "3.12" @@ -84,7 +84,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - name: Build Docker image run: | @@ -119,7 +119,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 with: fetch-depth: 0 @@ -136,10 +136,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6 with: python-version: "3.12" From cbb88933f7227105ca4879ec79a0fdfd239739e3 Mon Sep 17 00:00:00 2001 From: AreteDriver Date: Mon, 22 Jun 2026 01:55:57 -0700 Subject: [PATCH 04/10] =?UTF-8?q?chore:=20freeze=20repo=20=E2=80=94=20see?= =?UTF-8?q?=20portfolio=20triage=202026-04-21?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- README.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/README.md b/README.md index abf9f0d..ad28f41 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,10 @@ +> **STATUS: FROZEN as of 2026-06-22** +> This repository is no longer actively developed. See [AreteDriver/notes/decisions/2026-04-21-portfolio-triage.md](https://github.com/AreteDriver/notes/blob/main/decisions/2026-04-21-portfolio-triage.md) for context. +> Archived for reference. No new deploys or feature work. +> +> --- +> + # RedOPS Framework [![CI Pipeline](https://github.com/AreteDriver/RedOPS/actions/workflows/ci.yml/badge.svg)](https://github.com/AreteDriver/RedOPS/actions/workflows/ci.yml) From 22cbc4023a22cea4952576c14d532e5a42210a54 Mon Sep 17 00:00:00 2001 From: AreteDriver Date: Mon, 20 Jul 2026 12:12:41 -0700 Subject: [PATCH 05/10] =?UTF-8?q?feat:=20priority-1=20production=20readine?= =?UTF-8?q?ss=20=E2=80=94=20mobile=20dashboard,=20charts,=20exceptions,=20?= =?UTF-8?q?tests?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Dashboard: - Mobile responsive modals (w-full max-w-sm), responsive table/card view - 44px touch targets on all buttons and inputs - Wire all 4 Chart.js charts: Severity Distribution, Module Distribution, Risk Score Gauge, Findings Timeline - Accessibility: skip-nav link, ARIA labels, Escape-key modal dismissal Error Handling: - Unified exception hierarchy (RedOpsError → Auth/Network/Pipeline/AI/etc) - Narrow bare 'except Exception' in web layer and core critical paths - Add tenacity>=8.0.0 dependency Security & Infrastructure: - Context checkpoint/rollback in pipeline runner - AI token counting + budget enforcement - Redis session store with in-memory fallback - Active module authorization checks Testing: - Active module tests (52): port scan, ARP scan, wireless, evil twin, deauth - RF module tests (104): parsers, models, session manager, event bus - Security control tests: JWT refresh, API key rotation, SQL injection prevention, credential masking in reports - Dashboard mobile responsiveness tests (28) - Exception hierarchy tests (27) Co-Authored-By: Claude --- .github/workflows/ci.yml | 2 - AreteDriver/RedOPS/pyproject.toml | 14 - SECURITY.md | 29 +- config/pipelines/bug_bounty_recon.json | 82 ++ config/pipelines/compliance_assessment.json | 87 ++ config/pipelines/incident_response.json | 106 ++ config/pipelines/quickstart.json | 43 + config/pipelines/wireless_recon.json | 86 ++ deploy/docker/docker-compose.yml | 2 +- docker-compose.yml | 2 +- docs/legal-boundaries.md | 96 ++ docs/misuse-threat-model.md | 90 ++ docs/operator-runbook.md | 240 ++++ pyproject.toml | 4 + requirements.txt | 8 +- scripts/audit_bare_except.py | 48 + src/redops/cli/commands/scan.py | 168 ++- src/redops/cli/main.py | 21 +- src/redops/core/api_client.py | 2 +- src/redops/core/cache.py | 6 +- src/redops/core/context.py | 51 +- src/redops/core/exceptions.py | 179 +++ src/redops/core/secrets.py | 18 +- src/redops/modules/active/authorization.py | 138 +++ src/redops/modules/active/egress.py | 142 +++ src/redops/modules/active/exceptions.py | 13 + .../modules/active/exploit/cve_check.py | 2 + src/redops/modules/active/network/arp_scan.py | 2 + .../modules/active/network/port_scan.py | 2 + src/redops/modules/active/wireless/deauth.py | 2 + .../modules/active/wireless/evil_twin.py | 2 + src/redops/modules/active/wireless/monitor.py | 3 + src/redops/modules/active/wireless/scan.py | 2 + src/redops/modules/ai/agent.py | 101 +- src/redops/modules/ai/tools.py | 6 + src/redops/modules/ai_assistant.py | 152 ++- .../modules/simulation/mitre_mapping.py | 61 + src/redops/pipelines/runner.py | 6 + src/redops/web/app.py | 376 +++++- src/redops/web/auth.py | 101 +- src/redops/web/websocket.py | 12 +- tests/integration/test_basic_integration.py | 320 +++++ tests/test_active_authorization.py | 217 ++++ tests/test_active_modules.py | 754 ++++++++++++ tests/test_agent.py | 12 + tests/test_ai_assistant.py | 102 ++ tests/test_asn_lookup.py | 4 +- tests/test_cli_commands.py | 247 ++++ tests/test_cli_settings.py | 16 +- tests/test_config.py | 9 +- tests/test_context.py | 86 ++ tests/test_cve_check.py | 6 + tests/test_dashboard_mobile.py | 157 +++ tests/test_egress_enforcement.py | 107 ++ tests/test_exceptions.py | 97 ++ tests/test_mitre_mapping.py | 52 + tests/test_network.py | 6 + tests/test_pipeline.py | 62 + tests/test_pipeline_library.py | 176 +++ tests/test_rf_modules.py | 1044 +++++++++++++++++ tests/test_security_controls.py | 543 +++++++++ tests/test_web_auth.py | 95 ++ tests/test_web_websocket.py | 4 +- tests/test_websocket.py | 2 +- tests/test_wireless.py | 11 + 65 files changed, 6462 insertions(+), 174 deletions(-) delete mode 100644 AreteDriver/RedOPS/pyproject.toml create mode 100644 config/pipelines/bug_bounty_recon.json create mode 100644 config/pipelines/compliance_assessment.json create mode 100644 config/pipelines/incident_response.json create mode 100644 config/pipelines/quickstart.json create mode 100644 config/pipelines/wireless_recon.json create mode 100644 docs/legal-boundaries.md create mode 100644 docs/misuse-threat-model.md create mode 100644 docs/operator-runbook.md create mode 100644 scripts/audit_bare_except.py create mode 100644 src/redops/core/exceptions.py create mode 100644 src/redops/modules/active/authorization.py create mode 100644 src/redops/modules/active/egress.py create mode 100644 src/redops/modules/active/exceptions.py create mode 100644 tests/integration/test_basic_integration.py create mode 100644 tests/test_active_authorization.py create mode 100644 tests/test_active_modules.py create mode 100644 tests/test_cli_commands.py create mode 100644 tests/test_dashboard_mobile.py create mode 100644 tests/test_egress_enforcement.py create mode 100644 tests/test_exceptions.py create mode 100644 tests/test_pipeline_library.py create mode 100644 tests/test_rf_modules.py create mode 100644 tests/test_security_controls.py diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 6314040..397a00d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -66,7 +66,6 @@ jobs: - name: Run mypy run: mypy src/redops --ignore-missing-imports - continue-on-error: true test: name: Test (Python ${{ matrix.python-version }}) @@ -173,7 +172,6 @@ jobs: REDIS_PORT: 6379 run: | python -m pytest tests/integration/ -v --tb=short - continue-on-error: true build: name: Build Package diff --git a/AreteDriver/RedOPS/pyproject.toml b/AreteDriver/RedOPS/pyproject.toml deleted file mode 100644 index 1458e45..0000000 --- a/AreteDriver/RedOPS/pyproject.toml +++ /dev/null @@ -1,14 +0,0 @@ -[build-system] -requires = ["setuptools", "wheel"] -build-backend = "setuptools.build_meta" - -[project] -name = "redops" -version = "1.0.0" -description = "Modular Cybersecurity Tooling with AI-Driven Summarization" -authors = [{name = "AreteDriver"}] -license = {file = "LICENSE"} -dependencies = [ - "openai>=1.0.0", - "pytest>=7.0.0" -] diff --git a/SECURITY.md b/SECURITY.md index ec419d2..4753834 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -12,7 +12,8 @@ If you discover a security vulnerability, please report it responsibly: 1. **Do not** open a public issue -2. Email **jamesyng79@gmail.com** with: +2. Use GitHub **Private Vulnerability Reporting** (enabled on this repository) + or email **security@redops.dev** with: - Description of the vulnerability - Steps to reproduce - Potential impact @@ -31,6 +32,28 @@ This project uses: RedOPS is an offensive security tool intended for **authorized security testing only**. The tool itself is designed to find vulnerabilities in target systems — security reports should focus on vulnerabilities in RedOPS's own code, not in its intended functionality. +## Active Chain Authorization Requirements + +The **Active Chain** (`modules/active/`) — wireless deauthentication, evil-twin +access points, ARP scanning, port scanning, and autonomous vulnerability chaining +— is **gated** by the following requirements: + +1. **Recorded operator consent** is mandatory. Every active module calls + `assert_active_authorized(ctx)`, which raises `ActiveAuthorizationError` + if no valid authorization exists. +2. **Explicit target assertion** is required. The operator must name the exact + target(s) they claim to own or have permission to test. +3. **Egress blocking** is enforced. `block_external_egress()` prevents cloud API + calls during active chain execution, ensuring local-only operation. +4. **Legal review** is required before any release containing active modules. + See `docs/legal-boundaries.md` for jurisdiction analysis and authorized-use + definition. +5. **Operator runbook** must be followed. See `docs/operator-runbook.md` for + step-by-step authorized engagement procedures. + +Vulnerabilities in the authorization or egress enforcement mechanisms are +**critical** and in scope for this security policy. + ## Scope The following are in scope for security reports: @@ -38,8 +61,10 @@ The following are in scope for security reports: - Credential exposure or mishandling - Authentication bypasses in the web interface - Dependency vulnerabilities with known exploits +- Bypass of `assert_active_authorized()` or `block_external_egress()` +- Injection or mutation of audit log entries Out of scope: - Functionality that is working as designed (scanning, recon, etc.) -- Denial of service +- Denial of service against the target (by design for active modules) - Social engineering diff --git a/config/pipelines/bug_bounty_recon.json b/config/pipelines/bug_bounty_recon.json new file mode 100644 index 0000000..181eec7 --- /dev/null +++ b/config/pipelines/bug_bounty_recon.json @@ -0,0 +1,82 @@ +{ + "metadata": { + "name": "Bug Bounty Recon", + "description": "Fast reconnaissance pipeline optimized for bug bounty programs: subdomains, tech stack, exposures", + "version": "1.0", + "author": "RedOps", + "tags": ["bug-bounty", "recon", "subdomains", "exposure"] + }, + "steps": [ + { + "name": "Validate Scope", + "module": "compliance.scope_guard.validate_scope", + "params": {}, + "enabled": true, + "continue_on_error": false + }, + { + "name": "Profile Domain", + "module": "recon.domains.profile_domain", + "params": {}, + "enabled": true, + "continue_on_error": true + }, + { + "name": "Enumerate Subdomains", + "module": "recon.subdomain_enum.enumerate_subdomains", + "params": { + "wordlist": "subdomains-top1million-5000.txt" + }, + "enabled": true, + "continue_on_error": true + }, + { + "name": "Certificate Transparency", + "module": "recon.cert_transparency.query_ct_logs", + "params": {}, + "enabled": true, + "continue_on_error": true + }, + { + "name": "Fingerprint Technology Stack", + "module": "recon.tech_stack.fingerprint", + "params": {}, + "enabled": true, + "continue_on_error": true + }, + { + "name": "ASN Lookup", + "module": "recon.asn_lookup.lookup_asn", + "params": {}, + "enabled": true, + "continue_on_error": true + }, + { + "name": "Score Risks", + "module": "intel.risk_scoring.score_risks", + "params": {}, + "enabled": true, + "continue_on_error": true + }, + { + "name": "Generate Markdown Report", + "module": "reporting.markdown_report.generate_technical_report", + "params": {}, + "enabled": true, + "continue_on_error": true + }, + { + "name": "Export JSON Findings", + "module": "reporting.export.export_all", + "params": { + "format": "json" + }, + "enabled": true, + "continue_on_error": true + } + ], + "config": { + "timeout": 300, + "strict_scope": true + } +} diff --git a/config/pipelines/compliance_assessment.json b/config/pipelines/compliance_assessment.json new file mode 100644 index 0000000..95e169d --- /dev/null +++ b/config/pipelines/compliance_assessment.json @@ -0,0 +1,87 @@ +{ + "metadata": { + "name": "Compliance Assessment", + "description": "Compliance-focused pipeline mapping findings to SOC 2, ISO 27001, and PCI DSS controls", + "version": "1.0", + "author": "RedOps", + "tags": ["compliance", "soc2", "iso27001", "pci-dss", "audit"] + }, + "steps": [ + { + "name": "Validate Scope", + "module": "compliance.scope_guard.validate_scope", + "params": {}, + "enabled": true, + "continue_on_error": false + }, + { + "name": "Audit Pipeline Start", + "module": "compliance.audit_log.audit_pipeline_start", + "params": {}, + "enabled": true, + "continue_on_error": true + }, + { + "name": "Corporate Exposure Scan", + "module": "corp_assessment.exposure_scan.scan_exposure", + "params": {}, + "enabled": true, + "continue_on_error": true + }, + { + "name": "Profile Domain", + "module": "recon.domains.profile_domain", + "params": {}, + "enabled": true, + "continue_on_error": true + }, + { + "name": "Fingerprint Technology Stack", + "module": "recon.tech_stack.fingerprint", + "params": {}, + "enabled": true, + "continue_on_error": true + }, + { + "name": "Map Compliance Controls", + "module": "compliance.compliance_map.map_controls", + "params": { + "frameworks": ["soc2", "iso27001", "pci-dss"] + }, + "enabled": true, + "continue_on_error": true + }, + { + "name": "Score Risks", + "module": "intel.risk_scoring.score_risks", + "params": {}, + "enabled": true, + "continue_on_error": true + }, + { + "name": "Generate Compliance Report", + "module": "reporting.oscal_report.generate_oscal", + "params": {}, + "enabled": true, + "continue_on_error": true + }, + { + "name": "Generate Executive Summary", + "module": "reporting.executive_report.generate_executive", + "params": {}, + "enabled": true, + "continue_on_error": true + }, + { + "name": "Audit Pipeline End", + "module": "compliance.audit_log.audit_pipeline_end", + "params": {}, + "enabled": true, + "continue_on_error": true + } + ], + "config": { + "timeout": 600, + "strict_scope": true + } +} diff --git a/config/pipelines/incident_response.json b/config/pipelines/incident_response.json new file mode 100644 index 0000000..1e010c9 --- /dev/null +++ b/config/pipelines/incident_response.json @@ -0,0 +1,106 @@ +{ + "metadata": { + "name": "Incident Response Triage", + "description": "Rapid triage pipeline for incident response: threat intel, artifact analysis, and containment guidance", + "version": "1.0", + "author": "RedOps", + "tags": ["incident-response", "triage", "threat-intel", "artifacts"] + }, + "steps": [ + { + "name": "Validate Scope", + "module": "compliance.scope_guard.validate_scope", + "params": {}, + "enabled": true, + "continue_on_error": false + }, + { + "name": "Audit Pipeline Start", + "module": "compliance.audit_log.audit_pipeline_start", + "params": {}, + "enabled": true, + "continue_on_error": true + }, + { + "name": "Threat Intel Lookup", + "module": "threat_intel.threat_intel.lookup_indicators", + "params": {}, + "enabled": true, + "continue_on_error": true + }, + { + "name": "VirusTotal Enrichment", + "module": "intel.virustotal_intel.query_virustotal", + "params": {}, + "enabled": true, + "continue_on_error": true + }, + { + "name": "AbuseIPDB Check", + "module": "threat_intel.abuseipdb.check_ip", + "params": {}, + "enabled": true, + "continue_on_error": true + }, + { + "name": "GreyNoise Context", + "module": "threat_intel.greynoise.query_greynoise", + "params": {}, + "enabled": true, + "continue_on_error": true + }, + { + "name": "MalwareBazaar Hash Lookup", + "module": "threat_intel.malwarebazaar.query_hash", + "params": {}, + "enabled": true, + "continue_on_error": true + }, + { + "name": "Extract EXIF Metadata", + "module": "metadata.exif.extract_exif", + "params": {}, + "enabled": true, + "continue_on_error": true + }, + { + "name": "Analyze Document Artifacts", + "module": "metadata.documents.extract_metadata", + "params": {}, + "enabled": true, + "continue_on_error": true + }, + { + "name": "Correlate Findings", + "module": "analysis.correlation_engine.correlate_findings", + "params": {}, + "enabled": true, + "continue_on_error": true + }, + { + "name": "Generate Triage Report", + "module": "reporting.markdown_report.generate_technical_report", + "params": {}, + "enabled": true, + "continue_on_error": true + }, + { + "name": "Export STIX Bundle", + "module": "intel.stix_export.export_stix", + "params": {}, + "enabled": true, + "continue_on_error": true + }, + { + "name": "Audit Pipeline End", + "module": "compliance.audit_log.audit_pipeline_end", + "params": {}, + "enabled": true, + "continue_on_error": true + } + ], + "config": { + "timeout": 600, + "strict_scope": false + } +} diff --git a/config/pipelines/quickstart.json b/config/pipelines/quickstart.json new file mode 100644 index 0000000..ebf8a57 --- /dev/null +++ b/config/pipelines/quickstart.json @@ -0,0 +1,43 @@ +{ + "metadata": { + "name": "Quick Start", + "description": "Zero-config quickstart pipeline. Run 'redops scan example.com' and get useful output in under 60 seconds.", + "version": "1.0", + "author": "RedOps", + "tags": ["quickstart", "zero-config", "beginner"] + }, + "steps": [ + { + "name": "Profile Domain", + "module": "recon.domains.profile_domain", + "params": {}, + "enabled": true, + "continue_on_error": true + }, + { + "name": "Fingerprint Technology Stack", + "module": "recon.tech_stack.fingerprint", + "params": {}, + "enabled": true, + "continue_on_error": true + }, + { + "name": "Score Risks", + "module": "intel.risk_scoring.score_risks", + "params": {}, + "enabled": true, + "continue_on_error": true + }, + { + "name": "Generate Quick Report", + "module": "reporting.markdown_report.generate_exec_summary", + "params": {}, + "enabled": true, + "continue_on_error": true + } + ], + "config": { + "timeout": 60, + "strict_scope": false + } +} diff --git a/config/pipelines/wireless_recon.json b/config/pipelines/wireless_recon.json new file mode 100644 index 0000000..b4d4ac0 --- /dev/null +++ b/config/pipelines/wireless_recon.json @@ -0,0 +1,86 @@ +{ + "metadata": { + "name": "Wireless Reconnaissance", + "description": "Authorized wireless reconnaissance: scan access points, analyze RF data, and generate findings", + "version": "1.0", + "author": "RedOps", + "tags": ["wireless", "rf", "wifi", "authorized-only"] + }, + "steps": [ + { + "name": "Validate Scope", + "module": "compliance.scope_guard.validate_scope", + "params": {}, + "enabled": true, + "continue_on_error": false + }, + { + "name": "Record Active Authorization", + "module": "active.authorization.record_authorization", + "params": {}, + "enabled": true, + "continue_on_error": false + }, + { + "name": "Enable Monitor Mode", + "module": "active.wireless.monitor.enable_monitor_mode", + "params": {}, + "enabled": true, + "continue_on_error": false + }, + { + "name": "Scan Access Points", + "module": "active.wireless.scan.scan_access_points", + "params": {}, + "enabled": true, + "continue_on_error": true + }, + { + "name": "Parse Airodump Output", + "module": "rf.parsers.airodump.parse", + "params": {}, + "enabled": true, + "continue_on_error": true + }, + { + "name": "Parse Horst Data", + "module": "rf.parsers.horst.parse", + "params": {}, + "enabled": true, + "continue_on_error": true + }, + { + "name": "Score Risks", + "module": "intel.risk_scoring.score_risks", + "params": {}, + "enabled": true, + "continue_on_error": true + }, + { + "name": "Generate Technical Report", + "module": "reporting.markdown_report.generate_technical_report", + "params": {}, + "enabled": true, + "continue_on_error": true + }, + { + "name": "Disable Monitor Mode", + "module": "active.wireless.monitor.disable_monitor_mode", + "params": {}, + "enabled": true, + "continue_on_error": true + }, + { + "name": "Audit Pipeline End", + "module": "compliance.audit_log.audit_pipeline_end", + "params": {}, + "enabled": true, + "continue_on_error": true + } + ], + "config": { + "timeout": 300, + "strict_scope": true, + "requires_authorization": true + } +} diff --git a/deploy/docker/docker-compose.yml b/deploy/docker/docker-compose.yml index 68148f7..7c7799b 100644 --- a/deploy/docker/docker-compose.yml +++ b/deploy/docker/docker-compose.yml @@ -216,7 +216,7 @@ services: restart: unless-stopped redis-commander: - image: rediscommander/redis-commander:latest + image: rediscommander/redis-commander:0.8.1 container_name: redops-redis-commander environment: - REDIS_HOSTS=local:redis:6379 diff --git a/docker-compose.yml b/docker-compose.yml index fbffcd0..84c7ded 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -3,7 +3,7 @@ services: build: context: . dockerfile: Dockerfile - image: redops:latest + image: redops:1.5.0 container_name: redops volumes: # Mount output directory for reports diff --git a/docs/legal-boundaries.md b/docs/legal-boundaries.md new file mode 100644 index 0000000..223eb02 --- /dev/null +++ b/docs/legal-boundaries.md @@ -0,0 +1,96 @@ +# Legal Boundaries for RedOPS Active Chain + +> **WARNING**: The Active Chain (`modules/active/`) contains offensive security +capabilities including wireless deauthentication, evil-twin access points, ARP +scanning, port scanning, and autonomous vulnerability chaining. These capabilities +can disrupt networks and may violate local laws if used without authorization. + +## Authorized Use Definition + +RedOPS Active Chain modules **may only be used** under one of the following +conditions: + +1. **Your own network or property** — You own the infrastructure being tested. +2. **Designated lab environment** — An isolated network explicitly provisioned + for security research (e.g. a home lab with no production traffic, no guest + access, and no upstream connectivity to third-party networks). +3. **Explicit written permission** — You hold a signed scope agreement, + statement of work, or formal authorization letter from the owner or authorized + representative of the target network. + +Using RedOPS Active Chain capabilities on any network that does not meet one of +the three conditions above is **unauthorized use** and is **strictly prohibited**. + +## What RedOPS Will Do (Active Chain) + +When authorized and executed, the Active Chain can: + +- Passively scan for nearby wireless access points and connected clients. +- Clone a legitimate access point (evil twin) to attract client connections. +- Send 802.11 deauthentication frames to disconnect clients from a legitimate AP. +- Perform ARP scanning on a local subnet to discover live hosts. +- Run nmap service and version scans against discovered hosts. +- Cross-reference discovered services against known CVEs. +- Orchestrate an autonomous ReAct agent that chains the above steps. + +## What RedOPS Will NOT Do + +RedOPS Active Chain **will never**: + +- Attack, scan, or interfere with networks outside the explicitly authorized target. +- Exfiltrate data from captured clients to cloud services (egress is blocked to + non-local endpoints during active execution). +- Operate without recorded operator consent (every active module refuses execution + without a valid `ActiveAuthorization`). +- Run on non-root accounts where root privileges are required for the operation. +- Mask its activity or evade detection — all actions are logged to the audit trail. + +## Jurisdiction + +Laws governing wireless interception, network disruption, and unauthorized access +vary by jurisdiction. The following are examples and not legal advice: + +- **United States**: 18 U.S.C. § 1030 (Computer Fraud and Abuse Act) and + 47 U.S.C. § 605 (Wiretap Act) may apply to unauthorized network access and + interception of communications. Deauthentication attacks may be prosecuted + as denial-of-service or interference with communications. +- **European Union**: Directive 2013/40/EU (Attacks against Information Systems) + and national implementations criminalize unauthorized access and interference. +- **United Kingdom**: Computer Misuse Act 1990 sections 1–3 criminalize + unauthorized access, unauthorized acts with intent, and unauthorized acts + causing damage. + +**You are responsible** for understanding and complying with the laws in your +jurisdiction. The RedOPS maintainers provide this tool for authorized security +professionals and researchers; we do not condone illegal use. + +## Will / Won't Do List + +| Capability | Will Do (Authorized) | Won't Do (Prohibited) | +|---|---|---| +| Deauth flood | On your own AP or lab AP with consent | Coffee shop, airport, neighbor's AP, corporate AP without SOW | +| Evil twin | Your own SSID or isolated lab SSID | Clone a third-party AP to harvest credentials | +| ARP scan | Your own subnet or lab subnet | Scan a corporate subnet you do not own | +| Port scan | Authorized target with written permission | Internet-wide scanning or scanning without scope | +| CVE check | As part of an authorized assessment | Weaponizing findings against unauthorized targets | +| Autonomous agent | Within authorized lab with operator monitoring | Unattended execution on production networks | + +## Enforcement + +The codebase enforces these boundaries through technical controls: + +1. **Authorization gate** — Every `modules/active/` function calls + `assert_active_authorized(ctx)`, which raises `ActiveAuthorizationError` + if no recorded operator consent exists. +2. **Scope guard** — Existing `modules/compliance/scope_guard.py` validates + that targets match allowed domains, IPs, BSSIDs, and subnets. +3. **Egress blocking** — `block_external_egress()` prevents cloud API calls + during active chain execution, ensuring local-only operation. +4. **Audit logging** — Every authorization recording, module execution, and + tool invocation is logged with timestamp, operator, and target. + +## Reporting Misuse + +If you discover RedOPS being used without authorization, or if you find a +vulnerability in the authorization/egress enforcement mechanisms, please report +it responsibly. See `SECURITY.md` for contact details. diff --git a/docs/misuse-threat-model.md b/docs/misuse-threat-model.md new file mode 100644 index 0000000..8706df0 --- /dev/null +++ b/docs/misuse-threat-model.md @@ -0,0 +1,90 @@ +# Misuse Threat Model — RedOPS Active Chain + +**Version**: 1.0.0 +**Date**: 2026-07-20 +**Scope**: Casual misuse of RedOPS `modules/active/` by unauthorized operators + +## Threat Actor Profile + +| Attribute | Description | +|---|---| +| **Actor** | Casual user with limited cybersecurity knowledge | +| **Motivation** | Curiosity, prank, or vague "testing" intent | +| **Skill** | Can clone a GitHub repo and run `pip install` | +| **Access** | Personal laptop, home internet, possibly a USB Wi-Fi adapter | +| **Risk** | Medium — not sophisticated, but the tool automates actions that +are illegal when unauthorized | + +## Threat Scenarios + +### Scenario 1: Coffee Shop Deauth + +**Narrative**: User downloads RedOPS, runs the active chain in a coffee shop to +"see what happens," and deauthenticates patrons from the shop's Wi-Fi. + +**Controls**: +- Root privileges required to put interface in monitor mode and send raw frames. +- `assert_active_authorized()` requires explicit operator consent + target assertion. +- Egress blocking prevents data exfiltration to cloud APIs. +- Audit logs record operator identity and timestamp. + +**Residual Risk**: Determined user can fabricate authorization and run as root. +Mitigated by requiring explicit consent text and target assertion, which creates +psychological friction and legal accountability. + +### Scenario 2: Neighbor Network Scan + +**Narrative**: User points ARP scan and port scan at a neighbor's home network +discovered via wardriving. + +**Controls**: +- `scope_guard.is_subnet_in_scope()` rejects subnets not in the allowed list. +- Strict mode defaults to `True`, so out-of-scope targets are blocked. +- Active authorization requires target assertion, forcing the operator to name + the exact subnet they claim to own. + +**Residual Risk**: User can add neighbor's subnet to scope config. Mitigated by +making scope config editable only via file (not CLI flag) and logging changes. + +### Scenario 3: Autonomous Agent Runaway + +**Narrative**: User starts the ReAct agent on a university network and it +chains from the lab subnet to the campus-wide VLAN. + +**Controls**: +- `block_external_egress()` blocks cloud API calls, keeping the agent local-only. +- Scope guard checks every tool invocation's target against allowed subnets. +- Agent logs every thought/action/observation for post-hoc review. +- Maximum iteration limit (default 10) prevents infinite runaway. + +**Residual Risk**: Agent could pivot within the allowed scope to sensitive systems. +Mitigated by requiring narrow scope assertions and operator monitoring. + +## Technical Control Summary + +| Control | Implementation | Effectiveness | +|---|---|---| +| **Authorization gate** | `assert_active_authorized(ctx)` in every active module | High — blocks accidental execution | +| **Scope guard** | `modules/compliance/scope_guard.py` | High — prevents out-of-scope targeting | +| **Egress blocking** | `modules/active/egress.py` thread-local patches | High — prevents cloud exfiltration | +| **Root requirement** | Subprocess `sudo` calls in wireless/network modules | Medium — OS-level deterrent | +| **Audit logging** | JSONL audit trail with operator + timestamp | Medium — accountability after the fact | +| **Consent text** | Explicit acknowledgment required | Medium — psychological friction | + +## What This Threat Model Does NOT Cover + +- **Insider threat**: A malicious authorized operator with valid credentials. + This requires organizational controls (background checks, dual-control) outside + the scope of the codebase. +- **Supply-chain attack**: Compromised dependency injecting malicious active + modules. This requires dependency pinning and SBOM tracking. +- **Physical security**: Theft of the laptop running RedOPS. This requires + full-disk encryption and screen locks. + +## Recommendations for Operators + +1. Run RedOPS Active Chain **only** on air-gapped or physically isolated networks. +2. Document every authorization in a signed scope agreement stored separately + from the tool. +3. Review audit logs after every session. +4. Report any bypass of authorization/egress controls as a security vulnerability. diff --git a/docs/operator-runbook.md b/docs/operator-runbook.md new file mode 100644 index 0000000..7fe86ea --- /dev/null +++ b/docs/operator-runbook.md @@ -0,0 +1,240 @@ +# RedOPS Active Chain Operator Runbook + +> **Purpose**: Step-by-step guide for authorized operators executing the +> RedOPS Active Chain on a home lab or explicitly authorized target network. + +## Pre-Flight Checklist + +Before running any active module, verify every item below: + +- [ ] I have **written authorization** for the target network, or the network + is my own property / a designated isolated lab. +- [ ] The target network is **physically isolated** from production systems, + guest networks, and internet-facing infrastructure. +- [ ] I have the required **hardware**: + - Alfa AWUS036NHA or compatible monitor-mode-capable USB Wi-Fi adapter + - A second Wi-Fi interface (built-in or USB) for control/management + - Kali Linux or a distribution with `aircrack-ng`, `hostapd`, `dnsmasq`, `nmap`, + `arp-scan`, and Python 3.12+ +- [ ] I have **backups** of any data on the target network. +- [ ] I have informed any **other users** of the lab network that testing is + scheduled and they may experience brief disconnections. +- [ ] I have reviewed `docs/legal-boundaries.md` and confirmed my use case + falls within the authorized-use definition. + +## Environment Setup + +### 1. Hardware Verification + +```bash +# Verify adapter is recognized +lsusb | grep -i rtl8187 + +# Verify monitor mode support +sudo airmon-ng check kill +sudo airmon-ng start wlan1 +iwconfig | grep -i monitor +``` + +Expected output: `Mode:Monitor` for `wlan1mon`. + +### 2. Software Verification + +```bash +# Verify required tools +which airodump-ng hostapd dnsmasq nmap arp-scan +python -c "import scapy.all; print('scapy OK')" +``` + +### 3. Network Isolation Check + +```bash +# Confirm no routes to external networks +ip route | grep default +# Should show only your management interface, not the lab interface +``` + +## Authorization Recording + +The Active Chain **will not execute** without a recorded authorization. Create +one programmatically or via the API: + +```python +from redops.core.context import Context +from redops.modules.active.authorization import record_authorization + +ctx = Context(target="192.168.99.0/24") +record_authorization( + ctx, + operator="your-name", + target_assertion="192.168.99.0/24 (home lab VLAN 99)", + consent_text=( + "I am authorized to perform active security testing on the stated target. " + "This is my own network..." + ), + duration_hours=4, +) +``` + +**Mandatory fields**: +- `operator`: Your identity (name, employee ID, or operator handle). +- `target_assertion`: The exact target(s) you are authorized to test. +- `consent_text`: The full consent text you acknowledge. +- `duration_hours`: How long the authorization remains valid (default 24h). + +## Execution Walkthrough + +### Phase 1: Passive Reconnaissance + +```python +from redops.modules.active.wireless.scan import scan_access_points + +ctx = scan_access_points(ctx, {"duration": 30}) +aps = ctx.get("access_points", []) +print(f"Discovered {len(aps)} access points") +``` + +**Expected behavior**: Passive scan only; no frames are injected. + +### Phase 2: Target Selection + +Select a target AP that you **own or have explicit permission to test**. +Record the BSSID, ESSID, and channel. + +```python +target = aps[0] # Example: select first AP +ctx.add("target_bssid", target["bssid"]) +ctx.add("target_essid", target["essid"]) +ctx.add("target_channel", target["channel"]) +``` + +### Phase 3: Evil Twin Deployment + +```python +from redops.modules.active.wireless.evil_twin import start_evil_twin + +ctx = start_evil_twin(ctx, { + "target_bssid": target["bssid"], + "ap_interface": "wlan0", +}) +``` + +**Warning**: This creates a functional rogue AP. Ensure it is on an isolated +channel and does not interfere with neighboring networks. + +### Phase 4: Deauthentication (Optional) + +```python +from redops.modules.active.wireless.deauth import deauth_flood + +ctx = deauth_flood(ctx, {"duration": 30, "count": 64}) +``` + +**Warning**: This actively disconnects clients from the legitimate AP. Only +run if you have explicit authorization and have warned any legitimate users. + +### Phase 5: Host Discovery + +```python +from redops.modules.active.network.arp_scan import discover_hosts + +ctx = discover_hosts(ctx, {"wait": 15}) +hosts = ctx.get("live_hosts", []) +print(f"Discovered {len(hosts)} live hosts") +``` + +### Phase 6: Port Scanning + +```python +from redops.modules.active.network.port_scan import scan_ports + +ctx = scan_ports(ctx, {"ports": "T:1-1024", "timing": "T4"}) +results = ctx.get("port_scan_results", []) +``` + +### Phase 7: CVE Cross-Reference + +```python +from redops.modules.active.exploit.cve_check import check_cves + +ctx = check_cves(ctx) +findings = ctx.get("cve_findings", []) +``` + +## Teardown + +### 1. Disable Monitor Mode + +```python +from redops.modules.active.wireless.monitor import disable_monitor_mode + +ctx = disable_monitor_mode(ctx) +``` + +### 2. Stop Rogue AP Processes + +```python +import subprocess +subprocess.run(["sudo", "killall", "hostapd", "dnsmasq"], capture_output=True) +``` + +### 3. Restore Network Manager + +```bash +sudo systemctl restart NetworkManager +``` + +### 4. Verify Cleanup + +```bash +# Confirm no monitor interfaces remain +iwconfig | grep -i monitor || echo "No monitor interfaces" +# Confirm no hostapd/dnsmasq processes +pgrep -a hostapd || echo "hostapd not running" +pgrep -a dnsmasq || echo "dnsmasq not running" +``` + +## Lab Hardware Smoke Test + +Before trusting RedOPS on a live engagement, validate the full chain in a +controlled lab: + +| Step | Check | Pass Criteria | +|---|---|---| +| 1 | Adapter in monitor mode | `iwconfig` shows `Mode:Monitor` | +| 2 | AP scan | Discovers ≥1 test AP | +| 3 | Evil twin start | Client can see cloned SSID | +| 4 | Deauth flood | Clients disconnected from original AP within 10s | +| 5 | ARP scan | Discovers all expected lab hosts | +| 6 | Port scan | nmap completes without errors | +| 7 | CVE check | Returns findings for known vulnerable services | +| 8 | Authorization enforcement | `assert_active_authorized` raises without auth | +| 9 | Egress blocking | Cloud API call raises `EgressBlockedError` | +| 10 | Audit log | JSONL file contains all actions with timestamps | + +## Post-Session Review + +1. Export the audit log: + ```bash + cat output/audit.log | jq 'select(.action | startswith("active"))' + ``` +2. Review findings for false positives. +3. Document any deviations from the authorized scope. +4. Archive the session context and authorization record for compliance. + +## Emergency Stop + +If at any point you need to abort: + +```bash +sudo airmon-ng stop wlan1mon +sudo killall -9 hostapd dnsmasq airodump-ng +sudo systemctl restart NetworkManager +``` + +## Support + +For questions about authorized use, scope validation, or authorization +recording, open a discussion (not an issue) in the RedOPS GitHub repository. +For security vulnerabilities in the authorization mechanism itself, see +`SECURITY.md`. diff --git a/pyproject.toml b/pyproject.toml index 948fd4b..1d13bd6 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -51,6 +51,7 @@ full = [ "jinja2>=3.1.0", "fpdf2>=2.7.0", "reportlab>=4.0.0", + "tenacity>=8.0.0", "shodan>=1.31.0", "censys>=2.2.0", "click>=8.0.0", @@ -78,6 +79,7 @@ web = [ "sqlalchemy>=2.0.0", "alembic>=1.18.4", "redis>=5.0.0", + "sse-starlette>=2.0.0", ] dev = [ "pytest>=7.0.0", @@ -85,6 +87,8 @@ dev = [ "pytest-asyncio>=0.23.0", "ruff==0.15.15", "mypy>=1.20.0", + "email-validator>=2.0.0", + "reportlab>=4.0.0", ] docs = [ "sphinx>=7.0.0", diff --git a/requirements.txt b/requirements.txt index b294d6e..e902dfa 100644 --- a/requirements.txt +++ b/requirements.txt @@ -6,7 +6,7 @@ # # For development: # pip install -r requirements.txt -# pip install pytest pytest-cov black flake8 mypy +# pip install pytest pytest-cov ruff mypy # ============================================================================ # Core Dependencies (Required) @@ -19,7 +19,6 @@ pydantic>=2.0.0,<3.0.0 # For EXIF extraction from images Pillow>=10.2.0,<13.0.0 -exifread>=3.0.0,<4.0.0 # For document metadata analysis (PDF, Office documents) pypdf>=5.0.0,<7.0.0 @@ -52,10 +51,9 @@ networkx>=3.1,<4.0.0 # ============================================================================ # Development Dependencies (Optional) # ============================================================================ -# Install separately with: pip install pytest pytest-cov black flake8 mypy +# Install separately with: pip install pytest pytest-cov ruff mypy # # pytest>=7.4.0 # Testing framework # pytest-cov>=4.1.0 # Coverage reports -# black>=23.0.0 # Code formatting -# flake8>=6.0.0 # Linting +# ruff>=0.15.0 # Linting and formatting # mypy>=1.5.0 # Type checking diff --git a/scripts/audit_bare_except.py b/scripts/audit_bare_except.py new file mode 100644 index 0000000..eb0238f --- /dev/null +++ b/scripts/audit_bare_except.py @@ -0,0 +1,48 @@ +#!/usr/bin/env python3 +"""Audit script for bare 'except Exception' blocks in RedOPS source. + +Run: python scripts/audit_bare_except.py +""" + +import ast +import sys +from pathlib import Path + + +def find_bare_except(filepath: Path) -> list[tuple[int, str]]: + """Find 'except Exception' blocks in a Python file.""" + results = [] + source = filepath.read_text() + tree = ast.parse(source) + + for node in ast.walk(tree): + if isinstance(node, ast.ExceptHandler): + if isinstance(node.type, ast.Name) and node.type.id == "Exception": + line = source.splitlines()[node.lineno - 1] + results.append((node.lineno, line.strip())) + + return results + + +def main() -> int: + src_dir = Path(__file__).parent.parent / "src" / "redops" + total = 0 + files = 0 + + for pyfile in sorted(src_dir.rglob("*.py")): + findings = find_bare_except(pyfile) + if findings: + files += 1 + total += len(findings) + print(f"\n{pyfile.relative_to(src_dir.parent.parent)} ({len(findings)})") + for lineno, line in findings: + print(f" {lineno:4d}: {line}") + + print(f"\n{'=' * 60}") + print(f"Total: {total} bare 'except Exception' blocks in {files} files") + print(f"{'=' * 60}") + return 0 + + +if __name__ == "__main__": + sys.exit(main()) diff --git a/src/redops/cli/commands/scan.py b/src/redops/cli/commands/scan.py index 079ea05..965c129 100644 --- a/src/redops/cli/commands/scan.py +++ b/src/redops/cli/commands/scan.py @@ -20,6 +20,120 @@ ) +# --------------------------------------------------------------------------- +# Local execution helpers (zero-config quickstart) +# --------------------------------------------------------------------------- + +def _resolve_pipeline_file(pipeline_name: str) -> Path | None: + """Resolve a pipeline name to a JSON file in config/pipelines/.""" + if pipeline_name == "default": + pipeline_name = "quickstart" + + pipelines_dir = Path(__file__).parents[3] / "config" / "pipelines" + if not pipelines_dir.exists(): + return None + + # Exact match first + exact = pipelines_dir / f"{pipeline_name}.json" + if exact.exists(): + return exact + + # Suffix match + for path in pipelines_dir.glob("*.json"): + if path.stem == pipeline_name or pipeline_name in path.stem: + return path + + return None + + +def _run_local_scan( + target: str, + pipeline_name: str = "quickstart", + output: str | None = None, + timeout: int = 60, +) -> int: + """Run a scan locally using PipelineRunner (no API server required). + + Returns: + Exit code (0 for success, 1 for failure) + """ + from redops.pipelines.loader import PipelineLoader + from redops.pipelines.runner import PipelineRunner + from redops.core.config import RedOpsConfig + from redops.core.context import Context + + pipeline_path = _resolve_pipeline_file(pipeline_name) + if pipeline_path is None: + print_error(f"Pipeline '{pipeline_name}' not found in config/pipelines/") + console.print( + "[dim]Run 'redops scan list-pipelines' to see available pipelines.[/dim]" + ) + return 1 + + try: + config = RedOpsConfig.from_env() + except Exception: + config = RedOpsConfig() + + console.print(f"[bold]Starting local scan on {target}[/bold]") + console.print(f" Pipeline: {pipeline_name} ({pipeline_path.name})") + console.print(f" Timeout: {timeout}s") + console.print() + + try: + pipeline = PipelineLoader.load(pipeline_path) + runner = PipelineRunner(pipeline, config=config) + + console.print(f"[dim]Executing {len(pipeline.enabled_steps)} steps...[/dim]") + console.print() + + start_time = time.time() + ctx = runner.run(target=target) + elapsed = time.time() - start_time + + # Build a result dict compatible with print_scan_result + result = { + "scan_id": "local", + "target": target, + "pipeline": pipeline.metadata.name, + "status": "completed", + "started_at": datetime.fromtimestamp(start_time).isoformat(), + "completed_at": datetime.now().isoformat(), + "findings": _extract_findings_from_context(ctx), + "logs": ctx.logs, + "data_keys": list(ctx.data.keys()), + } + + print_scan_result(result, verbose=False) + console.print(f"\n[dim]Completed in {format_duration(elapsed)}[/dim]") + + if output: + output_path = Path(output) + output_path.write_text(json.dumps(result, indent=2, default=str)) + print_success(f"Results saved to {output}") + + return 0 + + except Exception as e: + print_error(f"Local scan failed: {e}") + return 1 + + +def _extract_findings_from_context(ctx) -> list[dict]: + """Extract findings from pipeline context for display.""" + findings = [] + for key, value in ctx.data.items(): + if isinstance(value, list): + for item in value: + if isinstance(item, dict) and "severity" in item: + findings.append(item) + elif isinstance(item, dict) and "title" in item: + findings.append(item) + elif isinstance(value, dict) and "severity" in value: + findings.append(value) + return findings + + @click.group() def scan(): """Scan management commands. @@ -45,9 +159,24 @@ def scan(): @click.option( "--tag", multiple=True, help="Tags to add to scan (can be used multiple times)" ) +@click.option( + "--local", + "local_mode", + is_flag=True, + help="Run scan locally without an API server (zero-config mode)", +) @click.pass_context def run_cmd( - ctx, target, pipeline, output, async_mode, timeout, modules, exclude_modules, tag + ctx, + target, + pipeline, + output, + async_mode, + timeout, + modules, + exclude_modules, + tag, + local_mode, ): """Run a security scan on a target. @@ -57,8 +186,18 @@ def run_cmd( Examples: redops scan run https://example.com redops scan run -p web_full example.com - redops scan run --modules port_scan,ssl_check 192.168.1.1 + redops scan run --local example.com """ + if local_mode: + sys.exit( + _run_local_scan( + target=target, + pipeline_name=pipeline, + output=output, + timeout=timeout, + ) + ) + run_scan( ctx=ctx.obj, target=target, @@ -311,6 +450,31 @@ def get_status(): console.print("\n[dim]Stopped watching[/dim]") +@scan.command("list-pipelines") +def list_pipelines_cmd(): + """List available pipeline definitions.""" + pipelines_dir = Path(__file__).parents[3] / "config" / "pipelines" + if not pipelines_dir.exists(): + console.print("[yellow]Pipeline directory not found.[/yellow]") + return + + console.print("[bold]Available Pipelines[/bold]\n") + from redops.pipelines.loader import PipelineLoader + + for path in sorted(pipelines_dir.glob("*.json")): + try: + pipeline = PipelineLoader.load(path) + console.print(f" [cyan]{path.stem}[/cyan]") + console.print(f" {pipeline.metadata.name}") + if pipeline.metadata.description: + console.print(f" [dim]{pipeline.metadata.description}[/dim]") + console.print(f" Steps: {len(pipeline.steps)} | Tags: {', '.join(pipeline.metadata.tags)}") + console.print() + except Exception as e: + console.print(f" [red]{path.name}[/red] — error: {e}") + console.print() + + @scan.command("cancel") @click.argument("scan_id") @click.option("--force", "-f", is_flag=True, help="Force cancel without confirmation") diff --git a/src/redops/cli/main.py b/src/redops/cli/main.py index 162c52f..c295e4d 100644 --- a/src/redops/cli/main.py +++ b/src/redops/cli/main.py @@ -101,8 +101,14 @@ def status(ctx): @click.option("-o", "--output", type=click.Path(), help="Output file path") @click.option("--async", "async_mode", is_flag=True, help="Run scan asynchronously") @click.option("--timeout", type=int, default=3600, help="Scan timeout in seconds") +@click.option( + "--local", + "local_mode", + is_flag=True, + help="Run scan locally without an API server (zero-config mode)", +) @pass_context -def quick_scan(ctx, target, pipeline, output, async_mode, timeout): +def quick_scan(ctx, target, pipeline, output, async_mode, timeout, local_mode): """Run a quick scan on a target. This is a shortcut for 'redops scan run'. @@ -111,8 +117,19 @@ def quick_scan(ctx, target, pipeline, output, async_mode, timeout): Examples: redops quick-scan https://example.com redops quick-scan -p web_full example.com -o results.json + redops quick-scan --local example.com """ - from .commands.scan import run_scan + from .commands.scan import run_scan, _run_local_scan + + if local_mode: + sys.exit( + _run_local_scan( + target=target, + pipeline_name=pipeline, + output=output, + timeout=timeout, + ) + ) run_scan( ctx=ctx, diff --git a/src/redops/core/api_client.py b/src/redops/core/api_client.py index df56559..94341de 100644 --- a/src/redops/core/api_client.py +++ b/src/redops/core/api_client.py @@ -753,7 +753,7 @@ def _execute_with_retry(self, request: HttpRequest, retry: bool) -> HttpResponse return response - except Exception as e: + except (OSError, RuntimeError, ConnectionError, TimeoutError, HttpError) as e: last_exception = e if self._circuit_breaker: diff --git a/src/redops/core/cache.py b/src/redops/core/cache.py index b23ba24..509dd5e 100644 --- a/src/redops/core/cache.py +++ b/src/redops/core/cache.py @@ -243,7 +243,7 @@ def get(self, key: str) -> CacheEntry | None: size_bytes=data.get("size_bytes", 0), tags=data.get("tags", []), ) - except Exception: + except (OSError, json.JSONDecodeError, KeyError, TypeError): return None def set(self, entry: CacheEntry) -> None: @@ -262,7 +262,7 @@ def set(self, entry: CacheEntry) -> None: } with open(path, "w") as f: json.dump(data, f) - except Exception as e: + except (OSError, TypeError, ValueError) as e: raise CacheStorageError(f"Failed to write cache: {e}") def delete(self, key: str) -> bool: @@ -407,7 +407,7 @@ def _estimate_size(self, value: Any) -> int: """Estimate size of a value in bytes.""" try: return sys.getsizeof(value) - except Exception: + except (TypeError, ValueError, AttributeError): return 0 def get(self, key: str, default: T = None) -> T | Any: diff --git a/src/redops/core/context.py b/src/redops/core/context.py index 3bafa57..583cd8a 100644 --- a/src/redops/core/context.py +++ b/src/redops/core/context.py @@ -21,22 +21,71 @@ class Context: all intermediate outputs. """ - def __init__(self, target: str | None = None, config: "RedOpsConfig | None" = None): + def __init__( + self, + target: str | None = None, + config: "RedOpsConfig | None" = None, + *, + authorization: Any | None = None, + ): """ Initialize a new Context. Args: target: The target of the pipeline execution (e.g., domain, directory) config: RedOps configuration (scope, output settings, etc.) + authorization: ActiveAuthorization instance for active/offensive modules. """ self.target = target self.config = config + self.authorization = authorization self.data: dict[str, Any] = {} self.logs: list[dict[str, Any]] = [] self.metadata: dict[str, Any] = { "created_at": datetime.now(timezone.utc).isoformat(), "target": target, } + self._checkpoints: list[dict[str, Any]] = [] + + def save(self) -> None: + """ + Save a checkpoint of the current context state. + + Checkpoints are stored in a stack; call rollback() to restore + the most recent checkpoint. + """ + import copy + + checkpoint = { + "data": copy.deepcopy(self.data), + "logs": copy.deepcopy(self.logs), + "metadata": copy.deepcopy(self.metadata), + } + self._checkpoints.append(checkpoint) + self.log("Context checkpoint saved", level="DEBUG") + + def rollback(self) -> None: + """ + Restore the context data and metadata to the last checkpoint. + + Logs are intentionally preserved (append-only audit trail). + + Raises: + RuntimeError: If no checkpoints exist. + """ + if not self._checkpoints: + raise RuntimeError("No checkpoints available to rollback") + + checkpoint = self._checkpoints.pop() + self.data = checkpoint["data"] + self.metadata = checkpoint["metadata"] + # Logs are NOT rolled back — they form an immutable audit trail + self.log("Context rolled back to previous checkpoint", level="WARNING") + + def clear_checkpoints(self) -> None: + """Remove all stored checkpoints.""" + self._checkpoints.clear() + self.log("All checkpoints cleared", level="DEBUG") def add(self, key: str, value: Any) -> None: """ diff --git a/src/redops/core/exceptions.py b/src/redops/core/exceptions.py new file mode 100644 index 0000000..af5d874 --- /dev/null +++ b/src/redops/core/exceptions.py @@ -0,0 +1,179 @@ +"""RedOPS domain-specific exceptions. + +Provides a unified exception hierarchy so callers can distinguish between +configuration errors, network failures, auth problems, and validation issues +instead of catching bare ``Exception``. +""" + + +class RedOpsError(Exception): + """Base exception for all RedOPS errors.""" + + pass + + +# --------------------------------------------------------------------------- +# Configuration / environment +# --------------------------------------------------------------------------- + + +class ConfigurationError(RedOpsError): + """Missing or invalid configuration.""" + + pass + + +class SecretNotFoundError(ConfigurationError): + """Required secret or environment variable is missing.""" + + pass + + +# --------------------------------------------------------------------------- +# Network / I/O +# --------------------------------------------------------------------------- + + +class NetworkError(RedOpsError): + """Transient or permanent network failure.""" + + pass + + +class APIClientError(NetworkError): + """Error while communicating with an external API.""" + + pass + + +class RateLimitError(NetworkError): + """Request blocked by rate limiting.""" + + pass + + +class CircuitOpenError(NetworkError): + """Circuit breaker is open; requests are not being sent.""" + + pass + + +# --------------------------------------------------------------------------- +# Authentication / authorization +# --------------------------------------------------------------------------- + + +class AuthError(RedOpsError): + """Base for authentication and authorization failures.""" + + pass + + +class AuthenticationError(AuthError): + """Invalid credentials or missing authentication.""" + + pass + + +class AuthorizationError(AuthError): + """Authenticated user lacks permission.""" + + pass + + +class TokenExpiredError(AuthenticationError): + """Token has expired.""" + + pass + + +class TokenInvalidError(AuthenticationError): + """Token is malformed or signature verification failed.""" + + pass + + +class SessionNotFoundError(AuthenticationError): + """Session does not exist or has been invalidated.""" + + pass + + +# --------------------------------------------------------------------------- +# Validation / data quality +# --------------------------------------------------------------------------- + + +class ValidationError(RedOpsError): + """Input data failed validation.""" + + pass + + +class SchemaError(ValidationError): + """Data does not conform to expected schema.""" + + pass + + +# --------------------------------------------------------------------------- +# Pipeline / module execution +# --------------------------------------------------------------------------- + + +class PipelineError(RedOpsError): + """Error during pipeline execution.""" + + pass + + +class ModuleError(PipelineError): + """Error in a specific pipeline module.""" + + pass + + +class ModuleNotFoundError(ModuleError): + """Requested module could not be resolved.""" + + pass + + +# --------------------------------------------------------------------------- +# Storage / caching +# --------------------------------------------------------------------------- + + +class StorageError(RedOpsError): + """Database, file-system, or cache operation failed.""" + + pass + + +class CacheError(StorageError): + """Cache read/write failed.""" + + pass + + +# --------------------------------------------------------------------------- +# AI / LLM +# --------------------------------------------------------------------------- + + +class AIError(RedOpsError): + """Error during AI model interaction.""" + + pass + + +class AIBudgetExceededError(AIError): + """Cost or token budget has been exceeded.""" + + pass + + +class AIPromptError(AIError): + """Prompt generation or validation failed.""" + + pass diff --git a/src/redops/core/secrets.py b/src/redops/core/secrets.py index 55d50bf..989cc22 100644 --- a/src/redops/core/secrets.py +++ b/src/redops/core/secrets.py @@ -198,12 +198,17 @@ def encrypt(self, plaintext: str) -> str: def decrypt(self, ciphertext: str) -> str: """Decrypt ciphertext using Fernet.""" - token = base64.urlsafe_b64decode(ciphertext.encode()) + from cryptography.fernet import InvalidToken + + try: + token = base64.urlsafe_b64decode(ciphertext.encode()) + except (ValueError, TypeError) as exc: + raise ValueError("Unable to decrypt: invalid ciphertext encoding") from exc # Try current key first try: return self._fernet.decrypt(token).decode() - except Exception: + except InvalidToken: pass # Try previous keys for rotation @@ -211,7 +216,7 @@ def decrypt(self, ciphertext: str) -> str: try: prev_fernet = self._fernet_class(prev_key) return prev_fernet.decrypt(token).decode() - except Exception: + except InvalidToken: continue raise ValueError("Unable to decrypt: invalid key or corrupted data") @@ -339,7 +344,7 @@ def _load(self) -> None: encrypted=False, ) self._loaded = True - except Exception as e: + except (OSError, ValueError, json.JSONDecodeError) as e: logger.error(f"Failed to load secrets: {e}") self._loaded = True @@ -850,11 +855,12 @@ def get_secret(self, name: str) -> Secret | None: encrypted=False, ) - # Notify callbacks + # Notify callbacks — broad guard is intentional: user-provided callbacks must + # not break secret retrieval regardless of what they raise. for callback in self._access_callbacks: try: callback(name, result) - except Exception as e: + except Exception as e: # noqa: BLE001 logger.warning(f"Access callback failed: {e}") self._audit.log("get", name) diff --git a/src/redops/modules/active/authorization.py b/src/redops/modules/active/authorization.py new file mode 100644 index 0000000..2d814f4 --- /dev/null +++ b/src/redops/modules/active/authorization.py @@ -0,0 +1,138 @@ +"""Authorization gate for active/offensive modules. + +Requires recorded operator consent + authorized-target assertion before +any module under ``modules/active/`` can execute. +""" + +from __future__ import annotations + +import uuid +from datetime import datetime, timedelta, timezone +from typing import TYPE_CHECKING + +from pydantic import BaseModel, Field + +from redops.modules.active.exceptions import ActiveAuthorizationError + +if TYPE_CHECKING: + from redops.core.context import Context + + +class ActiveAuthorization(BaseModel): + """Recorded operator consent for active/offensive operations. + + Attributes: + authorization_id: Unique identifier for this authorization. + operator: Identity of the operator giving consent. + target_assertion: The specific target(s) this authorization covers. + consent_text: The exact text the operator agreed to. + consent_timestamp: When consent was recorded. + expires_at: When this authorization expires. + """ + + authorization_id: str = Field(default_factory=lambda: str(uuid.uuid4())) + operator: str + target_assertion: str + consent_text: str + consent_timestamp: datetime = Field( + default_factory=lambda: datetime.now(timezone.utc) + ) + expires_at: datetime = Field( + default_factory=lambda: datetime.now(timezone.utc) + timedelta(hours=24) + ) + + def is_expired(self) -> bool: + """Return True if this authorization has expired.""" + return datetime.now(timezone.utc) > self.expires_at + + def is_valid(self) -> bool: + """Return True if authorization is present and not expired.""" + return not self.is_expired() + + +DEFAULT_CONSENT_TEXT = ( + "I am authorized to perform active security testing on the stated target. " + "This is my own network, a designated lab environment, or a system for which " + "I have explicit written permission. I understand that active modules can " + "disrupt network services and may violate laws if used without authorization." +) + + +def record_authorization( + ctx: Context, + operator: str, + target_assertion: str, + consent_text: str = DEFAULT_CONSENT_TEXT, + duration_hours: float = 24, +) -> ActiveAuthorization: + """Record operator consent in the pipeline context. + + Args: + ctx: Pipeline context to store authorization in. + operator: Identity of the operator (e.g. name, employee ID). + target_assertion: Specific target this authorization covers + (e.g. "192.168.99.0/24", "my-home-lab"). + consent_text: The consent text the operator acknowledged. + duration_hours: How long the authorization remains valid. + + Returns: + The created ActiveAuthorization instance. + """ + auth = ActiveAuthorization( + operator=operator, + target_assertion=target_assertion, + consent_text=consent_text, + expires_at=datetime.now(timezone.utc) + timedelta(hours=duration_hours), + ) + ctx.authorization = auth + ctx.log( + f"Active authorization recorded: {auth.authorization_id} " + f"for operator={operator} target={target_assertion}", + level="AUDIT", + ) + return auth + + +def is_active_authorized(ctx: Context) -> bool: + """Check whether the context carries a valid active authorization. + + Args: + ctx: Pipeline context. + + Returns: + True if a non-expired authorization is present, False otherwise. + """ + auth = getattr(ctx, "authorization", None) + if auth is None: + return False + if isinstance(auth, ActiveAuthorization): + return auth.is_valid() + return False + + +def assert_active_authorized(ctx: Context) -> None: + """Raise ActiveAuthorizationError if the context lacks valid authorization. + + Every function under ``modules/active/`` must call this at entry. + + Args: + ctx: Pipeline context. + + Raises: + ActiveAuthorizationError: If no valid authorization is present. + """ + auth = getattr(ctx, "authorization", None) + if auth is None: + raise ActiveAuthorizationError( + "Active module refused: no operator authorization recorded. " + "Call record_authorization() before executing active modules." + ) + if isinstance(auth, ActiveAuthorization) and auth.is_expired(): + raise ActiveAuthorizationError( + f"Active module refused: authorization {auth.authorization_id} " + f"expired at {auth.expires_at.isoformat()}." + ) + if not isinstance(auth, ActiveAuthorization): + raise ActiveAuthorizationError( + "Active module refused: authorization object is malformed." + ) diff --git a/src/redops/modules/active/egress.py b/src/redops/modules/active/egress.py new file mode 100644 index 0000000..7a2783e --- /dev/null +++ b/src/redops/modules/active/egress.py @@ -0,0 +1,142 @@ +"""Egress enforcement for active chain execution. + +Blocks HTTP/HTTPS requests to non-local destinations while active +authorization is in scope. Ensures active modules can only reach +localhost services (e.g. Ollama) and cannot leak data to cloud APIs. +""" + +from __future__ import annotations + +import ipaddress +import threading +from contextlib import contextmanager +from typing import Any, Callable +from urllib.parse import urlparse + +from redops.modules.active.exceptions import EgressBlockedError + +# Thread-local flag indicating whether egress blocking is active +_egress_local = threading.local() + +# Hostnames and IPs considered "local" — always allowed +_LOCAL_HOSTS = {"localhost", "127.0.0.1", "::1", "0.0.0.0"} + + +def _is_local_url(url: str) -> bool: + """Return True if the URL points to a local/loopback destination.""" + parsed = urlparse(url) + hostname = parsed.hostname or "" + if hostname in _LOCAL_HOSTS: + return True + try: + addr = ipaddress.ip_address(hostname) + return addr.is_loopback + except ValueError: + # Not an IP — could be a local domain like my-service.local + return hostname.endswith(".local") or hostname.endswith(".localhost") + + +def _is_egress_blocked() -> bool: + """Return True if egress blocking is currently active in this thread.""" + return getattr(_egress_local, "depth", 0) > 0 + + +def _assert_local_url(url: str) -> None: + """Raise EgressBlockedError if url is non-local while blocking is active.""" + if _is_egress_blocked() and not _is_local_url(url): + raise EgressBlockedError( + f"Egress blocked: active chain execution prevented external request to {url}. " + "Only localhost/loopback endpoints are permitted during active operations." + ) + + +# Storage for original references so we can restore precisely +_request_patches: dict[str, Any] = {} # type: ignore[name-defined] + + +def _wrap_requests() -> None: + """Monkey-patch requests to enforce egress policy (idempotent).""" + try: + import requests + except ImportError: + return + + if _request_patches: + return # Already patched + + _request_patches["Session.request"] = requests.Session.request + + def _patched_request( + self, + method: str, + url: str, + *args, + **kwargs, + ): + _assert_local_url(url) + return _request_patches["Session.request"](self, method, url, *args, **kwargs) + + requests.Session.request = _patched_request # type: ignore[method-assign] + + _request_patches["get"] = requests.get + _request_patches["post"] = requests.post + + def _patched_get(url, **kwargs): + _assert_local_url(url) + return _request_patches["get"](url, **kwargs) + + def _patched_post(url, **kwargs): + _assert_local_url(url) + return _request_patches["post"](url, **kwargs) + + requests.get = _patched_get # type: ignore[method-assign] + requests.post = _patched_post # type: ignore[method-assign] + + +def _unwrap_requests() -> None: + """Remove monkey-patches from requests.""" + global _request_patches + try: + import requests + except ImportError: + return + + if not _request_patches: + return + + requests.Session.request = _request_patches["Session.request"] # type: ignore[method-assign] + requests.get = _request_patches["get"] # type: ignore[method-assign] + requests.post = _request_patches["post"] # type: ignore[method-assign] + _request_patches.clear() + + +@contextmanager +def block_external_egress(): + """Context manager that blocks external HTTP egress for the active chain. + + Supports nested usage via a thread-local reference count. + + Usage:: + + with block_external_egress(): + # Any non-local requests here will raise EgressBlockedError + requests.post("http://localhost:11434/api/generate") # OK + requests.get("https://api.openai.com/v1/chat") # Raises + + Yields: + None + + Raises: + EgressBlockedError: If a non-local HTTP request is attempted. + """ + # Track nesting depth per thread + depth = getattr(_egress_local, "depth", 0) + if depth == 0: + _wrap_requests() + _egress_local.depth = depth + 1 + try: + yield + finally: + _egress_local.depth = max(0, getattr(_egress_local, "depth", 1) - 1) + if getattr(_egress_local, "depth", 0) == 0: + _unwrap_requests() diff --git a/src/redops/modules/active/exceptions.py b/src/redops/modules/active/exceptions.py new file mode 100644 index 0000000..e73138d --- /dev/null +++ b/src/redops/modules/active/exceptions.py @@ -0,0 +1,13 @@ +"""Exceptions for the active/offensive module gate.""" + + +class ActiveAuthorizationError(Exception): + """Raised when an active/offensive module runs without recorded operator consent.""" + + pass + + +class EgressBlockedError(Exception): + """Raised when an active module attempts external egress to a non-local URL.""" + + pass diff --git a/src/redops/modules/active/exploit/cve_check.py b/src/redops/modules/active/exploit/cve_check.py index c9eb979..3a0eccf 100644 --- a/src/redops/modules/active/exploit/cve_check.py +++ b/src/redops/modules/active/exploit/cve_check.py @@ -7,6 +7,7 @@ from typing import Any from redops.core.context import Context +from redops.modules.active.authorization import assert_active_authorized CVSS_HIGH_VALUE_THRESHOLD = 9.0 @@ -32,6 +33,7 @@ def check_cves(ctx: Context, params: dict[str, Any] | None = None) -> Context: cve_findings: list of dicts with ip, port, cve_id, cvss, description high_value_targets: hosts with CVSS >= 9.0 """ + assert_active_authorized(ctx) params = params or {} scan_results = ctx.get("port_scan_results", []) cve_findings: list[dict] = [] diff --git a/src/redops/modules/active/network/arp_scan.py b/src/redops/modules/active/network/arp_scan.py index 610c966..ff30756 100644 --- a/src/redops/modules/active/network/arp_scan.py +++ b/src/redops/modules/active/network/arp_scan.py @@ -10,6 +10,7 @@ from typing import Any from redops.core.context import Context +from redops.modules.active.authorization import assert_active_authorized def discover_hosts(ctx: Context, params: dict[str, Any] | None = None) -> Context: @@ -23,6 +24,7 @@ def discover_hosts(ctx: Context, params: dict[str, Any] | None = None) -> Contex Adds to context: live_hosts: list of dicts with ip, mac, vendor """ + assert_active_authorized(ctx) params = params or {} subnet = params.get("subnet") or ctx.get("ap_subnet", "192.168.99.0/24") wait = params.get("wait", 15) diff --git a/src/redops/modules/active/network/port_scan.py b/src/redops/modules/active/network/port_scan.py index 7d8716c..2722f2d 100644 --- a/src/redops/modules/active/network/port_scan.py +++ b/src/redops/modules/active/network/port_scan.py @@ -7,6 +7,7 @@ from typing import Any from redops.core.context import Context +from redops.modules.active.authorization import assert_active_authorized NMAP_TIMEOUT = 120 @@ -22,6 +23,7 @@ def scan_ports(ctx: Context, params: dict[str, Any] | None = None) -> Context: Adds to context: port_scan_results: list of dicts with ip, open_ports """ + assert_active_authorized(ctx) params = params or {} ports = params.get("ports", "T:1-1024,U:23,2323") timing = params.get("timing", "T4") diff --git a/src/redops/modules/active/wireless/deauth.py b/src/redops/modules/active/wireless/deauth.py index 0981e2e..dc53c30 100644 --- a/src/redops/modules/active/wireless/deauth.py +++ b/src/redops/modules/active/wireless/deauth.py @@ -10,6 +10,7 @@ from typing import Any from redops.core.context import Context +from redops.modules.active.authorization import assert_active_authorized try: from scapy.all import Dot11, Dot11Deauth, RadioTap, sendp @@ -34,6 +35,7 @@ def deauth_flood(ctx: Context, params: dict[str, Any] | None = None) -> Context: deauth_active: bool deauth_thread: thread handle """ + assert_active_authorized(ctx) if not HAS_SCAPY: ctx.log("Scapy not installed, cannot run deauth", level="ERROR") ctx.add("deauth_active", False) diff --git a/src/redops/modules/active/wireless/evil_twin.py b/src/redops/modules/active/wireless/evil_twin.py index 6bc0a1c..4cb7100 100644 --- a/src/redops/modules/active/wireless/evil_twin.py +++ b/src/redops/modules/active/wireless/evil_twin.py @@ -11,6 +11,7 @@ from typing import Any from redops.core.context import Context +from redops.modules.active.authorization import assert_active_authorized HOSTAPD_CONF_TEMPLATE = """\ interface={ap_interface} @@ -51,6 +52,7 @@ def start_evil_twin(ctx: Context, params: dict[str, Any] | None = None) -> Conte evil_twin_bssid, ap_subnet, captured_clients, hostapd_proc, dnsmasq_proc """ + assert_active_authorized(ctx) params = params or {} ap_interface = params.get("ap_interface", "wlan0") ap_ip = params.get("ap_ip", "192.168.99.1") diff --git a/src/redops/modules/active/wireless/monitor.py b/src/redops/modules/active/wireless/monitor.py index 47b1161..5ae1aa2 100644 --- a/src/redops/modules/active/wireless/monitor.py +++ b/src/redops/modules/active/wireless/monitor.py @@ -10,6 +10,7 @@ from typing import Any from redops.core.context import Context +from redops.modules.active.authorization import assert_active_authorized def get_wireless_interfaces() -> list[str]: @@ -33,6 +34,7 @@ def enable_monitor_mode(ctx: Context, params: dict[str, Any] | None = None) -> C monitor_interface: Monitor mode interface name (e.g. wlan1mon) monitor_ready: True if mode switch succeeded """ + assert_active_authorized(ctx) params = params or {} interface = params.get("interface", "wlan1") @@ -74,6 +76,7 @@ def disable_monitor_mode(ctx: Context, params: dict[str, Any] | None = None) -> Params: interface: Monitor interface to stop. Default: reads from context. """ + assert_active_authorized(ctx) params = params or {} monitor_iface = params.get("interface") or ctx.get("monitor_interface", "wlan1mon") diff --git a/src/redops/modules/active/wireless/scan.py b/src/redops/modules/active/wireless/scan.py index 3046fac..e771631 100644 --- a/src/redops/modules/active/wireless/scan.py +++ b/src/redops/modules/active/wireless/scan.py @@ -13,6 +13,7 @@ from typing import Any from redops.core.context import Context +from redops.modules.active.authorization import assert_active_authorized def scan_access_points(ctx: Context, params: dict[str, Any] | None = None) -> Context: @@ -28,6 +29,7 @@ def scan_access_points(ctx: Context, params: dict[str, Any] | None = None) -> Co clients: list of dicts with mac, associated_bssid, signal scan_complete: bool """ + assert_active_authorized(ctx) params = params or {} duration = params.get("duration", 30) channel = params.get("channel") diff --git a/src/redops/modules/ai/agent.py b/src/redops/modules/ai/agent.py index f98d4c2..46494ad 100644 --- a/src/redops/modules/ai/agent.py +++ b/src/redops/modules/ai/agent.py @@ -11,6 +11,8 @@ from typing import Any from redops.core.context import Context +from redops.modules.active.authorization import assert_active_authorized +from redops.modules.active.egress import block_external_egress from redops.modules.ai.planner import build_attack_surface_summary from redops.modules.ai.tools import TOOL_REGISTRY, get_tool_descriptions @@ -78,6 +80,8 @@ def run_agent(ctx: Context, params: dict[str, Any] | None = None) -> Context: agent_complete: bool agent_summary: str """ + assert_active_authorized(ctx) + if not HAS_REQUESTS: ctx.log("requests library not installed", level="ERROR") ctx.add("agent_complete", False) @@ -121,58 +125,59 @@ def run_agent(ctx: Context, params: dict[str, Any] | None = None) -> Context: level="INFO", ) - for iteration in range(max_iterations): - attack_surface = build_attack_surface_summary(ctx) - user_message = f"Iteration {iteration + 1}/{max_iterations}\n\n{attack_surface}" - - ctx.log(f"Agent iteration {iteration + 1}", level="INFO") + with block_external_egress(): + for iteration in range(max_iterations): + attack_surface = build_attack_surface_summary(ctx) + user_message = f"Iteration {iteration + 1}/{max_iterations}\n\n{attack_surface}" - response = _call_ollama( - model, system, user_message, temperature=temperature, options=options - ) - if not response: - ctx.log("Ollama returned empty response", level="ERROR") - break + ctx.log(f"Agent iteration {iteration + 1}", level="INFO") - parsed = _parse_agent_response(response) - if not parsed: - ctx.log( - f"Could not parse agent response: {response[:200]}", - level="ERROR", + response = _call_ollama( + model, system, user_message, temperature=temperature, options=options ) - break - - thought = parsed.get("thought", "") - action = parsed.get("action", "") - action_params = parsed.get("params", {}) - - ctx.log(f"Agent thought: {thought}", level="INFO") - ctx.log(f"Agent action: {action} | params: {action_params}", level="INFO") - - agent_log.append( - { - "iteration": iteration + 1, - "thought": thought, - "action": action, - "params": action_params, - } - ) - - if action == "COMPLETE": - ctx.add("agent_complete", True) - ctx.add( - "agent_summary", - parsed.get("summary", "Agent completed chain."), + if not response: + ctx.log("Ollama returned empty response", level="ERROR") + break + + parsed = _parse_agent_response(response) + if not parsed: + ctx.log( + f"Could not parse agent response: {response[:200]}", + level="ERROR", + ) + break + + thought = parsed.get("thought", "") + action = parsed.get("action", "") + action_params = parsed.get("params", {}) + + ctx.log(f"Agent thought: {thought}", level="INFO") + ctx.log(f"Agent action: {action} | params: {action_params}", level="INFO") + + agent_log.append( + { + "iteration": iteration + 1, + "thought": thought, + "action": action, + "params": action_params, + } ) - ctx.log(f"Agent complete: {parsed.get('summary')}", level="INFO") - break - - if action in TOOL_REGISTRY: - tool_fn = TOOL_REGISTRY[action]["fn"] - ctx = tool_fn(ctx, action_params) - ctx.log(f"Tool {action} executed", level="INFO") - else: - ctx.log(f"Unknown tool: {action}", level="WARNING") + + if action == "COMPLETE": + ctx.add("agent_complete", True) + ctx.add( + "agent_summary", + parsed.get("summary", "Agent completed chain."), + ) + ctx.log(f"Agent complete: {parsed.get('summary')}", level="INFO") + break + + if action in TOOL_REGISTRY: + tool_fn = TOOL_REGISTRY[action]["fn"] + ctx = tool_fn(ctx, action_params) + ctx.log(f"Tool {action} executed", level="INFO") + else: + ctx.log(f"Unknown tool: {action}", level="WARNING") ctx.add("agent_log", agent_log) if not ctx.get("agent_complete"): diff --git a/src/redops/modules/ai/tools.py b/src/redops/modules/ai/tools.py index d2de924..204eb18 100644 --- a/src/redops/modules/ai/tools.py +++ b/src/redops/modules/ai/tools.py @@ -17,31 +17,37 @@ "fn": scan_access_points, "description": "Passive WiFi scan. Returns list of APs and clients.", "params": ["duration (int, seconds)", "channel (optional, int)"], + "requires_authorization": True, }, "start_evil_twin": { "fn": start_evil_twin, "description": "Clone target AP and start rogue access point.", "params": ["target_bssid (optional)", "ap_interface (str)"], + "requires_authorization": True, }, "deauth_flood": { "fn": deauth_flood, "description": "Deauth flood target AP clients.", "params": ["duration (int, seconds)", "count (int, frames per burst)"], + "requires_authorization": True, }, "discover_hosts": { "fn": discover_hosts, "description": "ARP scan evil twin subnet for live hosts.", "params": ["wait (int, seconds before scan)"], + "requires_authorization": True, }, "scan_ports": { "fn": scan_ports, "description": "nmap service scan on live hosts.", "params": ["ports (str, range)", "timing (str, T1-T5)"], + "requires_authorization": True, }, "check_cves": { "fn": check_cves, "description": "Cross-reference discovered services against known CVEs.", "params": [], + "requires_authorization": True, }, } diff --git a/src/redops/modules/ai_assistant.py b/src/redops/modules/ai_assistant.py index cdbe196..40c9062 100644 --- a/src/redops/modules/ai_assistant.py +++ b/src/redops/modules/ai_assistant.py @@ -37,16 +37,44 @@ def get_api_key(provider: str) -> str | None: return config.get("api_keys", {}).get(provider) +# Approximate pricing per 1K tokens (input / output) in USD +# Used for budget enforcement. Prices are conservative estimates. +_PROVIDER_PRICING: dict[str, tuple[float, float]] = { + "openai": (0.005, 0.015), + "anthropic": (0.008, 0.024), + "gemini": (0.0005, 0.0015), + "groq": (0.0005, 0.0005), + "ollama": (0.0, 0.0), +} + + +def _approximate_tokens(text: str) -> int: + """Rough token count fallback when tiktoken is unavailable.""" + return max(1, len(text) // 4) + + +def _count_openai_tokens(text: str, model: str = "gpt-4o") -> int: + """Count tokens for OpenAI models.""" + try: + import tiktoken + + encoding = tiktoken.encoding_for_model(model) + return len(encoding.encode(text)) + except Exception: + return _approximate_tokens(text) + + class AIAssistant: """AI-powered assistant for security analysis.""" - def __init__(self, provider: str = None, model: str = None): + def __init__(self, provider: str = None, model: str = None, budget_limit: float | None = None): """ Initialize the AI assistant. Args: provider: AI provider (openai, anthropic). Defaults to config. model: Model to use. Defaults to config. + budget_limit: Maximum estimated spend in USD for this instance. """ config = load_config() ai_config = config.get("ai", {}) @@ -55,6 +83,15 @@ def __init__(self, provider: str = None, model: str = None): self.model = model or ai_config.get("model", "gpt-4o-mini") self.max_tokens = ai_config.get("max_tokens", 2048) self.temperature = ai_config.get("temperature", 0.7) + self.budget_limit = budget_limit or ai_config.get("budget_limit") + + # Cost tracking (accumulates across calls on this instance) + self._cost_tracker = { + "calls": 0, + "input_tokens": 0, + "output_tokens": 0, + "estimated_cost_usd": 0.0, + } # Get API key (not required for Ollama) self.api_key = get_api_key(self.provider) @@ -125,21 +162,6 @@ def _init_client(self): else: raise ValueError(f"Unsupported provider: {self.provider}") - def _call_api(self, prompt: str, system_prompt: str = None) -> str: - """Call the AI API with the given prompt.""" - if self.provider == "openai": - return self._call_openai(prompt, system_prompt) - elif self.provider == "anthropic": - return self._call_anthropic(prompt, system_prompt) - elif self.provider == "gemini": - return self._call_gemini(prompt, system_prompt) - elif self.provider == "ollama": - return self._call_ollama(prompt, system_prompt) - elif self.provider == "groq": - return self._call_groq(prompt, system_prompt) - else: - raise ValueError(f"Unsupported provider: {self.provider}") - def _call_openai(self, prompt: str, system_prompt: str = None) -> str: """Call OpenAI API.""" messages = [] @@ -220,6 +242,89 @@ def _call_groq(self, prompt: str, system_prompt: str = None) -> str: return response.choices[0].message.content + # ------------------------------------------------------------------ + # Cost management + # ------------------------------------------------------------------ + + def _count_tokens(self, text: str) -> int: + """Estimate token count for a text string.""" + if self.provider == "openai": + return _count_openai_tokens(text, self.model) + return _approximate_tokens(text) + + def _estimate_cost(self, input_tokens: int, output_tokens: int) -> float: + """Estimate API cost in USD based on token counts.""" + input_price, output_price = _PROVIDER_PRICING.get( + self.provider, (0.005, 0.015) + ) + return (input_tokens / 1000.0) * input_price + (output_tokens / 1000.0) * output_price + + def _check_budget(self, estimated_cost: float) -> None: + """Raise if the estimated cost would exceed the budget.""" + if self.budget_limit is None: + return + current = self._cost_tracker["estimated_cost_usd"] + if current + estimated_cost > self.budget_limit: + raise RuntimeError( + f"AI budget exceeded: ${current:.4f} spent + ${estimated_cost:.4f} estimated " + f"> ${self.budget_limit:.4f} limit. " + f"Increase budget_limit or switch to local provider (ollama)." + ) + + def _record_usage(self, prompt: str, response_text: str) -> None: + """Record token usage and cost for a completed API call.""" + input_tokens = self._count_tokens(prompt) + output_tokens = self._count_tokens(response_text) + cost = self._estimate_cost(input_tokens, output_tokens) + + self._cost_tracker["calls"] += 1 + self._cost_tracker["input_tokens"] += input_tokens + self._cost_tracker["output_tokens"] += output_tokens + self._cost_tracker["estimated_cost_usd"] += cost + + def get_cost_metrics(self) -> dict[str, Any]: + """Return current cost metrics for this assistant instance.""" + return { + "provider": self.provider, + "model": self.model, + **self._cost_tracker, + "budget_limit_usd": self.budget_limit, + "budget_remaining_usd": ( + self.budget_limit - self._cost_tracker["estimated_cost_usd"] + if self.budget_limit is not None + else None + ), + } + + # ------------------------------------------------------------------ + # API call wrappers with cost tracking + # ------------------------------------------------------------------ + + def _call_api(self, prompt: str, system_prompt: str = None) -> str: + """Call the AI API with the given prompt (budget-aware).""" + # Build full prompt text for token estimation + full_prompt = f"{system_prompt or ''}\n\n{prompt}" + estimated_input = self._count_tokens(full_prompt) + estimated_output = self.max_tokens # worst-case + estimated_cost = self._estimate_cost(estimated_input, estimated_output) + self._check_budget(estimated_cost) + + if self.provider == "openai": + result = self._call_openai(prompt, system_prompt) + elif self.provider == "anthropic": + result = self._call_anthropic(prompt, system_prompt) + elif self.provider == "gemini": + result = self._call_gemini(prompt, system_prompt) + elif self.provider == "ollama": + result = self._call_ollama(prompt, system_prompt) + elif self.provider == "groq": + result = self._call_groq(prompt, system_prompt) + else: + raise ValueError(f"Unsupported provider: {self.provider}") + + self._record_usage(full_prompt, result) + return result + def analyze_findings(self, scan_data: dict[str, Any]) -> str: """ Analyze security scan findings and provide insights. @@ -478,9 +583,9 @@ def _extract_findings_summary(self, scan_data: dict[str, Any]) -> dict[str, Any] # Convenience functions for module integration def ai_analyze(ctx, params: dict[str, Any] | None = None): """Module wrapper for AI analysis.""" - + params = params or {} try: - assistant = AIAssistant() + assistant = AIAssistant(budget_limit=params.get("budget_limit")) analysis = assistant.analyze_findings(ctx.data) ctx.add( "ai_analysis", @@ -488,6 +593,7 @@ def ai_analyze(ctx, params: dict[str, Any] | None = None): "analysis": analysis, "provider": assistant.provider, "model": assistant.model, + "cost": assistant.get_cost_metrics(), }, ) except Exception as e: @@ -498,9 +604,9 @@ def ai_analyze(ctx, params: dict[str, Any] | None = None): def ai_summarize(ctx, params: dict[str, Any] | None = None): """Module wrapper for AI summarization.""" - + params = params or {} try: - assistant = AIAssistant() + assistant = AIAssistant(budget_limit=params.get("budget_limit")) summary = assistant.summarize(ctx.data) ctx.add( "ai_summary", @@ -508,6 +614,7 @@ def ai_summarize(ctx, params: dict[str, Any] | None = None): "summary": summary, "provider": assistant.provider, "model": assistant.model, + "cost": assistant.get_cost_metrics(), }, ) except Exception as e: @@ -518,9 +625,9 @@ def ai_summarize(ctx, params: dict[str, Any] | None = None): def ai_recommend(ctx, params: dict[str, Any] | None = None): """Module wrapper for AI recommendations.""" - + params = params or {} try: - assistant = AIAssistant() + assistant = AIAssistant(budget_limit=params.get("budget_limit")) recommendations = assistant.suggest_remediations(ctx.data) ctx.add( "ai_recommendations", @@ -528,6 +635,7 @@ def ai_recommend(ctx, params: dict[str, Any] | None = None): "recommendations": recommendations, "provider": assistant.provider, "model": assistant.model, + "cost": assistant.get_cost_metrics(), }, ) except Exception as e: diff --git a/src/redops/modules/simulation/mitre_mapping.py b/src/redops/modules/simulation/mitre_mapping.py index 5f675be..66534f7 100644 --- a/src/redops/modules/simulation/mitre_mapping.py +++ b/src/redops/modules/simulation/mitre_mapping.py @@ -762,3 +762,64 @@ def generate_attack_matrix_view(techniques: set[str]) -> dict[str, list[str]]: matrix[tactic] = sorted(matrix[tactic]) return matrix + + +def generate_navigator_layer( + techniques: set[str], + name: str = "RedOPS Scan Results", + description: str = "MITRE ATT&CK coverage generated by RedOPS", +) -> dict[str, Any]: + """ + Generate a MITRE ATT&CK Navigator layer JSON. + + Output is compatible with MITRE ATT&CK Navigator (https://mitre-attack.github.io/attack-navigator/). + + Args: + techniques: Set of technique IDs to highlight + name: Layer name + description: Layer description + + Returns: + Navigator layer dictionary + """ + layer_techniques = [] + for technique_id in sorted(techniques): + if technique_id not in MITRE_TECHNIQUES: + continue + technique = MITRE_TECHNIQUES[technique_id] + layer_techniques.append( + { + "techniqueID": technique_id, + "tactic": technique.tactic.lower().replace(" ", "-"), + "score": 1, + "comment": f"{technique.name}: {technique.description}", + "enabled": True, + } + ) + + return { + "name": name, + "versions": { + "attack": "14", + "navigator": "4.9.1", + "layer": "4.5", + }, + "domain": "enterprise-attack", + "description": description, + "techniques": layer_techniques, + "gradient": { + "colors": ["#ffffff", "#dc3545"], + "minValue": 0, + "maxValue": 100, + }, + "legendItems": [ + { + "label": "Technique detected by RedOPS", + "color": "#dc3545", + } + ], + "showTacticRowBackground": True, + "tacticRowBackground": "#eeeeee", + "selectTechniquesAcrossTactics": True, + "selectSubtechniquesWithParent": True, + } diff --git a/src/redops/pipelines/runner.py b/src/redops/pipelines/runner.py index 388a9d9..e81e1d9 100644 --- a/src/redops/pipelines/runner.py +++ b/src/redops/pipelines/runner.py @@ -106,6 +106,9 @@ def _execute_step(self, step: PipelineStep, ctx: Context) -> Context: """ ctx.log(f"Executing step: {step.name}", level="INFO", step=step.name) + # Save checkpoint before executing the step so we can rollback on failure + ctx.save() + # Execute BEFORE_MODULE hooks self.plugins.execute_hooks( HookPoint.BEFORE_MODULE, @@ -164,6 +167,8 @@ def _execute_step(self, step: PipelineStep, ctx: Context) -> Context: if not step.continue_on_error: raise RuntimeError(error_msg) from e + # Rollback context to preserve data integrity + ctx.rollback() return ctx def _get_plugin_module(self, module_path: str) -> ModulePlugin | None: @@ -374,4 +379,5 @@ def run( self.plugins.execute_hooks(HookPoint.AFTER_PIPELINE, ctx) ctx.log(f"Pipeline completed: {self.pipeline.metadata.name}", level="INFO") + ctx.clear_checkpoints() return ctx diff --git a/src/redops/web/app.py b/src/redops/web/app.py index 03f2945..6c85c06 100644 --- a/src/redops/web/app.py +++ b/src/redops/web/app.py @@ -42,6 +42,7 @@ generate_api_key, ) +from redops.core.exceptions import RedOpsError, ModuleError from redops.main import __version__ @@ -553,7 +554,7 @@ async def run_scan_task(scan_id: str, request: ScanRequest): success = True try: ctx = module_fn(ctx) - except Exception as e: + except (RedOpsError, RuntimeError, ImportError, TypeError, ValueError) as e: ctx.log(f"Module {name} failed: {e}", level="ERROR") success = False @@ -572,7 +573,7 @@ async def run_scan_task(scan_id: str, request: ScanRequest): # Emit completion await emit_scan_completed(scan_id, len(ctx.data)) - except Exception as e: + except Exception as e: # Worker safety net — prevents unhandled exceptions from killing the background task _scans[scan_id].status = "failed" _scans[scan_id].error = str(e) await emit_scan_failed(scan_id, str(e)) @@ -588,25 +589,27 @@ def get_dashboard_html() -> str: RedOPS Dashboard + -
+ Skip to main content +
-
+
-
+
-

Scan Results:

- +

Scan Results:

+ +
+ +
+

Severity Distribution

+
+ +
+
+ +
+

Findings by Module

+
+ +
+
+ +
+

Risk Score

+
+ +
+
+ +
+

Findings Timeline

+
+ + 

             

@@ -938,11 +1001,238 @@ def get_dashboard_html() -> str:
                         const res = await fetch(`/api/scans/${scanId}/results`);
                         this.results = await res.json();
                         this.selectedScan = scanId;
+                        // Allow DOM to update before rendering charts
+                        setTimeout(() => {
+                            this.renderSeverityChart();
+                            this.renderModuleChart();
+                            this.renderRiskGauge();
+                            this.renderTimelineChart();
+                        }, 50);
                     } catch (e) {
                         console.error('Failed to load results:', e);
                     }
                 },
 
+                renderSeverityChart() {
+                    const canvas = document.getElementById('severityChart');
+                    if (!canvas || !this.results || !this.results.findings) return;
+
+                    const ctx = canvas.getContext('2d');
+                    if (window._severityChart) {
+                        window._severityChart.destroy();
+                    }
+
+                    // Count findings by severity
+                    const counts = {};
+                    const colors = {
+                        critical: '#dc3545',
+                        high: '#fd7e14',
+                        medium: '#ffc107',
+                        low: '#28a745',
+                        info: '#17a2b8',
+                        unknown: '#6c757d'
+                    };
+                    const order = ['critical', 'high', 'medium', 'low', 'info'];
+
+                    for (const f of this.results.findings) {
+                        const sev = (f.severity || 'unknown').toLowerCase();
+                        counts[sev] = (counts[sev] || 0) + 1;
+                    }
+
+                    const labels = [];
+                    const data = [];
+                    const bgColors = [];
+                    for (const sev of order) {
+                        if (counts[sev]) {
+                            labels.push(sev.charAt(0).toUpperCase() + sev.slice(1));
+                            data.push(counts[sev]);
+                            bgColors.push(colors[sev] || colors.unknown);
+                        }
+                    }
+                    if (counts.unknown) {
+                        labels.push('Unknown');
+                        data.push(counts.unknown);
+                        bgColors.push(colors.unknown);
+                    }
+
+                    if (labels.length === 0) return;
+
+                    window._severityChart = new Chart(ctx, {
+                        type: 'doughnut',
+                        data: {
+                            labels: labels,
+                            datasets: [{
+                                data: data,
+                                backgroundColor: bgColors,
+                                borderWidth: 1
+                            }]
+                        },
+                        options: {
+                            responsive: true,
+                            maintainAspectRatio: false,
+                            plugins: {
+                                legend: { position: 'right' },
+                                title: { display: true, text: 'Findings by Severity' }
+                            }
+                        }
+                    });
+                },
+
+                renderModuleChart() {
+                    const canvas = document.getElementById('moduleChart');
+                    if (!canvas || !this.results || !this.results.findings) return;
+
+                    const ctx = canvas.getContext('2d');
+                    if (window._moduleChart) {
+                        window._moduleChart.destroy();
+                    }
+
+                    const counts = {};
+                    for (const f of this.results.findings) {
+                        const mod = (f.module || 'unknown').split('.').pop();
+                        counts[mod] = (counts[mod] || 0) + 1;
+                    }
+
+                    const labels = Object.keys(counts);
+                    const data = Object.values(counts);
+
+                    if (labels.length === 0) return;
+
+                    window._moduleChart = new Chart(ctx, {
+                        type: 'bar',
+                        data: {
+                            labels: labels,
+                            datasets: [{
+                                label: 'Findings',
+                                data: data,
+                                backgroundColor: '#dc3545',
+                                borderWidth: 1
+                            }]
+                        },
+                        options: {
+                            responsive: true,
+                            maintainAspectRatio: false,
+                            plugins: {
+                                legend: { display: false },
+                                title: { display: true, text: 'Findings by Module' }
+                            },
+                            scales: {
+                                y: { beginAtZero: true, ticks: { color: '#9ca3af' } },
+                                x: { ticks: { color: '#9ca3af' } }
+                            }
+                        }
+                    });
+                },
+
+                renderRiskGauge() {
+                    const canvas = document.getElementById('riskGauge');
+                    if (!canvas || !this.results || !this.results.findings) return;
+
+                    const ctx = canvas.getContext('2d');
+                    if (window._riskGauge) {
+                        window._riskGauge.destroy();
+                    }
+
+                    const weights = { critical: 40, high: 25, medium: 15, low: 5, info: 1 };
+                    let score = 0;
+                    for (const f of this.results.findings) {
+                        score += weights[f.severity?.toLowerCase()] || 1;
+                    }
+                    score = Math.min(100, score);
+
+                    const colors = ['#17a2b8', '#28a745', '#ffc107', '#fd7e14', '#dc3545'];
+                    const zoneLabels = ['Minimal', 'Low', 'Medium', 'High', 'Critical'];
+
+                    window._riskGauge = new Chart(ctx, {
+                        type: 'doughnut',
+                        data: {
+                            labels: zoneLabels,
+                            datasets: [{
+                                data: [20, 20, 20, 20, 20],
+                                backgroundColor: colors,
+                                borderWidth: 0,
+                                circumference: 180,
+                                rotation: 270,
+                            }]
+                        },
+                        options: {
+                            responsive: true,
+                            maintainAspectRatio: false,
+                            cutout: '75%',
+                            plugins: {
+                                legend: { display: false },
+                                tooltip: { enabled: false },
+                            }
+                        },
+                        plugins: [{
+                            id: 'gaugeText',
+                            beforeDraw: (chart) => {
+                                const { ctx, chartArea: { top, bottom, left, right } } = chart;
+                                const cx = (left + right) / 2;
+                                const cy = (top + bottom) / 2;
+                                ctx.save();
+                                ctx.fillStyle = '#f3f4f6';
+                                ctx.font = 'bold 24px sans-serif';
+                                ctx.textAlign = 'center';
+                                ctx.textBaseline = 'middle';
+                                ctx.fillText(score.toString(), cx, cy);
+                                ctx.restore();
+                            }
+                        }]
+                    });
+                },
+
+                renderTimelineChart() {
+                    const canvas = document.getElementById('timelineChart');
+                    if (!canvas || !this.results || !this.results.findings) return;
+
+                    const ctx = canvas.getContext('2d');
+                    if (window._timelineChart) {
+                        window._timelineChart.destroy();
+                    }
+
+                    const bucketCounts = {};
+                    for (const f of this.results.findings) {
+                        const ts = f.timestamp || f.created_at || f.discovered_at;
+                        if (!ts) continue;
+                        const date = new Date(ts).toLocaleDateString();
+                        bucketCounts[date] = (bucketCounts[date] || 0) + 1;
+                    }
+
+                    const labels = Object.keys(bucketCounts).sort((a, b) => new Date(a) - new Date(b));
+                    const data = labels.map(d => bucketCounts[d]);
+
+                    if (labels.length === 0) return;
+
+                    window._timelineChart = new Chart(ctx, {
+                        type: 'line',
+                        data: {
+                            labels: labels,
+                            datasets: [{
+                                label: 'Findings',
+                                data: data,
+                                borderColor: '#dc3545',
+                                backgroundColor: 'rgba(220, 53, 69, 0.2)',
+                                fill: true,
+                                tension: 0.3,
+                                borderWidth: 2
+                            }]
+                        },
+                        options: {
+                            responsive: true,
+                            maintainAspectRatio: false,
+                            plugins: {
+                                legend: { display: false },
+                                title: { display: true, text: 'Findings Over Time' }
+                            },
+                            scales: {
+                                y: { beginAtZero: true, ticks: { color: '#9ca3af' } },
+                                x: { ticks: { color: '#9ca3af' } }
+                            }
+                        }
+                    });
+                },
+
                 statusClass(status) {
                     return {
                         'pending': 'bg-yellow-500/20 text-yellow-400',
diff --git a/src/redops/web/auth.py b/src/redops/web/auth.py
index e2088a9..b5ad6f9 100644
--- a/src/redops/web/auth.py
+++ b/src/redops/web/auth.py
@@ -142,6 +142,91 @@ def _hash_token(self, token: str) -> str:
         ).hexdigest()
 
 
+class RedisSessionStore(SessionStore):
+    """Redis-backed distributed session store.
+
+    Shares sessions across workers and survives process restarts.
+    Falls back to in-memory behavior if Redis is unreachable.
+    """
+
+    def __init__(
+        self,
+        secret: str,
+        expiry_hours: int = 24,
+        redis_url: str | None = None,
+    ):
+        super().__init__(secret, expiry_hours)
+        self._redis_url = redis_url or os.environ.get("REDIS_URL", "redis://localhost:6379/0")
+        self._redis = None
+        self._fallback = False
+        self._connect()
+
+    def _connect(self) -> None:
+        """Attempt to connect to Redis."""
+        try:
+            import redis as redis_lib
+
+            self._redis = redis_lib.from_url(self._redis_url, decode_responses=True)
+            self._redis.ping()
+        except (ConnectionError, ImportError, OSError, RuntimeError):
+            self._redis = None
+            self._fallback = True
+
+    def _redis_key(self, session_id: str) -> str:
+        return f"redops:session:{session_id}"
+
+    def create_session(self, username: str) -> str:
+        if self._fallback or not self._redis:
+            return super().create_session(username)
+
+        token = secrets.token_urlsafe(32)
+        session_id = self._hash_token(token)
+        expires_at = datetime.now(timezone.utc) + self._expiry
+
+        self._redis.hset(
+            self._redis_key(session_id),
+            mapping={
+                "username": username,
+                "created_at": datetime.now(timezone.utc).isoformat(),
+                "expires_at": expires_at.isoformat(),
+            },
+        )
+        self._redis.expire(self._redis_key(session_id), int(self._expiry.total_seconds()))
+        return token
+
+    def validate_session(self, token: str) -> str | None:
+        if self._fallback or not self._redis:
+            return super().validate_session(token)
+
+        session_id = self._hash_token(token)
+        key = self._redis_key(session_id)
+        data = self._redis.hgetall(key)
+
+        if not data:
+            return None
+
+        expires_at = datetime.fromisoformat(data["expires_at"])
+        if datetime.now(timezone.utc) > expires_at:
+            self._redis.delete(key)
+            return None
+
+        return data["username"]
+
+    def invalidate_session(self, token: str) -> bool:
+        if self._fallback or not self._redis:
+            return super().invalidate_session(token)
+
+        session_id = self._hash_token(token)
+        deleted = self._redis.delete(self._redis_key(session_id))
+        return deleted > 0
+
+    def cleanup_expired(self) -> int:
+        """Redis handles TTL expiry automatically; this is a no-op."""
+        if self._fallback or not self._redis:
+            return super().cleanup_expired()
+        return 0
+
+
 class AuthManager:
     """
     Manages authentication for the RedOPS web interface.
@@ -154,10 +239,18 @@ class AuthManager:
 
     def __init__(self, config: AuthConfig | None = None):
         self.config = config or AuthConfig.from_env()
-        self.sessions = SessionStore(
-            self.config.session_secret,
-            self.config.session_expiry_hours,
-        )
+        redis_url = os.environ.get("REDIS_URL")
+        if redis_url:
+            self.sessions = RedisSessionStore(
+                self.config.session_secret,
+                self.config.session_expiry_hours,
+                redis_url=redis_url,
+            )
+        else:
+            self.sessions = SessionStore(
+                self.config.session_secret,
+                self.config.session_expiry_hours,
+            )
 
         if not self.config.enabled:
             import logging
diff --git a/src/redops/web/websocket.py b/src/redops/web/websocket.py
index a8b5422..54f3e62 100644
--- a/src/redops/web/websocket.py
+++ b/src/redops/web/websocket.py
@@ -9,6 +9,12 @@
 from dataclasses import dataclass, asdict
 from enum import Enum
 
+try:
+    from starlette.websockets import WebSocketDisconnect
+except ImportError:  # pragma: no cover
+    class WebSocketDisconnect(Exception):  # type: ignore[no-redef]
+        pass
+
 
 class EventType(Enum):
     """WebSocket event types."""
@@ -122,7 +128,7 @@ async def send_personal(self, websocket, event: WSEvent) -> None:
         """
         try:
             await websocket.send_text(event.to_json())
-        except Exception:
+        except (WebSocketDisconnect, RuntimeError, OSError, ConnectionError):
             self.disconnect(websocket)
 
     async def broadcast(self, event: WSEvent) -> None:
@@ -136,7 +142,7 @@ async def broadcast(self, event: WSEvent) -> None:
         for websocket in self.active_connections:
             try:
                 await websocket.send_text(event.to_json())
-            except Exception:
+            except (WebSocketDisconnect, RuntimeError, OSError, ConnectionError):
                 disconnected.add(websocket)
 
         # Clean up disconnected clients
@@ -158,7 +164,7 @@ async def broadcast_to_scan(self, scan_id: str, event: WSEvent) -> None:
         for websocket in self.scan_subscriptions[scan_id]:
             try:
                 await websocket.send_text(event.to_json())
-            except Exception:
+            except (WebSocketDisconnect, RuntimeError, OSError, ConnectionError):
                 disconnected.add(websocket)
 
         # Clean up disconnected clients
diff --git a/tests/integration/test_basic_integration.py b/tests/integration/test_basic_integration.py
new file mode 100644
index 0000000..31b8172
--- /dev/null
+++ b/tests/integration/test_basic_integration.py
@@ -0,0 +1,320 @@
+"""Integration tests for RedOPS database, cache, and pipeline subsystems.
+
+These tests verify end-to-end behavior that spans multiple subsystems.
+They may require services (Postgres, Redis) when run in CI.
+"""
+
+import json
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+
+class TestCLIIntegration:
+    """Integration tests for the CLI entry point."""
+
+    def test_version_command(self):
+        """Verify redops version returns successfully."""
+        result = subprocess.run(
+            [sys.executable, "-m", "redops.main", "version"],
+            capture_output=True,
+            text=True,
+        )
+        assert result.returncode == 0
+        assert "1.5.0" in result.stdout
+
+
+class TestPipelineIntegration:
+    """Integration tests for pipeline loading and validation."""
+
+    def test_all_pipelines_are_valid_json(self):
+        """Verify every pipeline JSON file loads without errors."""
+        pipeline_dir = Path("config/pipelines")
+        if not pipeline_dir.exists():
+            pytest.skip("Pipeline directory not found")
+
+        pipeline_files = list(pipeline_dir.glob("*.json"))
+        assert len(pipeline_files) > 0, "No pipeline files found"
+
+        for pipeline_file in pipeline_files:
+            with open(pipeline_file, "r") as f:
+                data = json.load(f)
+            assert "metadata" in data
+            assert "steps" in data
+            assert isinstance(data["steps"], list)
+
+
+class TestConfigIntegration:
+    """Integration tests for configuration loading."""
+
+    def test_config_from_file(self, tmp_path):
+        """Verify RedOpsConfig can be loaded from a JSON file."""
+        from redops.core.config import RedOpsConfig
+
+        config_path = tmp_path / "test_config.json"
+        config_data = {
+            "scope": {
+                "allowed_domains": ["example.com"],
+                "strict_mode": True,
+            },
+            "output": {
+                "output_dir": str(tmp_path / "output"),
+                "format": "json",
+            },
+        }
+        config_path.write_text(json.dumps(config_data))
+
+        config = RedOpsConfig.from_file(config_path)
+        assert config.scope.allowed_domains == ["example.com"]
+        assert config.scope.strict_mode is True
+        assert config.output.format == "json"
+
+    def test_config_from_env(self):
+        """Verify RedOpsConfig respects environment variables."""
+        from redops.core.config import RedOpsConfig
+
+        original_output_dir = os.environ.get("REDOPS_OUTPUT_DIR")
+        original_verbose = os.environ.get("REDOPS_VERBOSE")
+
+        try:
+            os.environ["REDOPS_OUTPUT_DIR"] = "/tmp/redops_test"
+            os.environ["REDOPS_VERBOSE"] = "true"
+
+            config = RedOpsConfig.from_env()
+            assert config.output.output_dir == "/tmp/redops_test"
+            assert config.output.verbose is True
+        finally:
+            if original_output_dir is not None:
+                os.environ["REDOPS_OUTPUT_DIR"] = original_output_dir
+            else:
+                os.environ.pop("REDOPS_OUTPUT_DIR", None)
+
+            if original_verbose is not None:
+                os.environ["REDOPS_VERBOSE"] = original_verbose
+            else:
+                os.environ.pop("REDOPS_VERBOSE", None)
+
+
+@pytest.mark.skipif(
+    not os.environ.get("DATABASE_URL"),
+    reason="DATABASE_URL not set (Postgres unavailable)",
+)
+class TestDatabaseIntegration:
+    """Integration tests requiring a live Postgres database."""
+
+    @pytest.fixture(autouse=True)
+    def reset_database(self):
+        """Drop and recreate tables before each test."""
+        from redops.db.connection import DatabaseConfig, Database
+        from redops.db.models import Base
+
+        config = DatabaseConfig.from_env()
+        db = Database(config)
+        Base.metadata.drop_all(db.engine)
+        Base.metadata.create_all(db.engine)
+        yield
+        db.dispose()
+
+    def test_database_connection(self):
+        """Verify database connection works."""
+        from redops.db.connection import DatabaseConfig, Database
+
+        config = DatabaseConfig.from_env()
+        db = Database(config)
+        assert db.check_connection() is True
+        db.dispose()
+
+    def test_create_and_get_user(self):
+        """Verify user CRUD through the database session."""
+        from redops.db.connection import DatabaseConfig, Database
+        from redops.db.models import User
+
+        config = DatabaseConfig.from_env()
+        db = Database(config)
+
+        with db.session_scope() as session:
+            user = User(
+                username="integration_test",
+                email="test@example.com",
+                password_hash="$2b$12$fakehash",
+                role="user",
+            )
+            session.add(user)
+
+        with db.session_scope() as session:
+            fetched = session.query(User).filter_by(username="integration_test").first()
+            assert fetched is not None
+            assert fetched.email == "test@example.com"
+            assert fetched.role == "user"
+
+        db.dispose()
+
+    def test_create_scan_and_findings(self):
+        """Verify scan and finding creation with relationships."""
+        from datetime import datetime, timezone
+        from redops.db.connection import DatabaseConfig, Database
+        from redops.db.models import Scan, Finding
+
+        config = DatabaseConfig.from_env()
+        db = Database(config)
+
+        with db.session_scope() as session:
+            scan = Scan(
+                target="https://example.com",
+                pipeline="web_security",
+                status="completed",
+                started_at=datetime.now(timezone.utc),
+                completed_at=datetime.now(timezone.utc),
+            )
+            session.add(scan)
+            session.flush()
+
+            finding = Finding(
+                scan_id=scan.id,
+                title="Test Finding",
+                severity="high",
+                description="Integration test finding",
+                status="open",
+            )
+            session.add(finding)
+
+        with db.session_scope() as session:
+            fetched_scan = session.query(Scan).filter_by(target="https://example.com").first()
+            assert fetched_scan is not None
+            assert len(fetched_scan.findings) == 1
+            assert fetched_scan.findings[0].title == "Test Finding"
+
+        db.dispose()
+
+
+@pytest.mark.skipif(
+    not os.environ.get("REDIS_HOST"),
+    reason="REDIS_HOST not set (Redis unavailable)",
+)
+class TestRedisCacheIntegration:
+    """Integration tests requiring a live Redis instance."""
+
+    @pytest.fixture
+    def redis_cache(self):
+        """Create a Redis-backed cache instance."""
+        from redops.cache.cache import Cache, CacheConfig
+
+        config = CacheConfig(
+            backend="redis",
+            redis_host=os.environ.get("REDIS_HOST", "localhost"),
+            redis_port=int(os.environ.get("REDIS_PORT", "6379")),
+            redis_db=int(os.environ.get("REDIS_DB", "0")),
+            default_ttl_seconds=60,
+        )
+        cache = Cache(config)
+        yield cache
+        # Cleanup — remove test keys
+        cache._backend.flush()
+
+    def test_redis_set_and_get(self, redis_cache):
+        """Verify Redis-backed cache stores and retrieves values."""
+        redis_cache.set("test_key", {"foo": "bar"})
+        result = redis_cache.get("test_key")
+        assert result == {"foo": "bar"}
+
+    def test_redis_ttl_expiry(self, redis_cache):
+        """Verify values expire after TTL."""
+        import time
+
+        redis_cache.set("ttl_key", "value", ttl_seconds=1)
+        assert redis_cache.get("ttl_key") == "value"
+        time.sleep(2)
+        assert redis_cache.get("ttl_key") is None
+
+    def test_redis_delete(self, redis_cache):
+        """Verify delete removes values."""
+        redis_cache.set("delete_key", "value")
+        assert redis_cache.get("delete_key") == "value"
+        redis_cache.delete("delete_key")
+        assert redis_cache.get("delete_key") is None
+
+
+class TestPipelineRunnerIntegration:
+    """Integration tests for the pipeline runner end-to-end."""
+
+    def test_run_pipeline_with_mock_modules(self, tmp_path):
+        """Run a minimal pipeline with mock modules."""
+        from redops.core.context import Context
+        from redops.pipelines.runner import PipelineRunner
+        from redops.pipelines.schemas import Pipeline, PipelineStep
+
+        pipeline = Pipeline(
+            metadata={"name": "test-pipeline", "version": "1.0.0"},
+            steps=[
+                PipelineStep(
+                    name="mock-step",
+                    module="recon.domains.profile_domain",
+                    params={"target": "example.com"},
+                ),
+            ],
+        )
+
+        ctx = Context(target="example.com")
+        runner = PipelineRunner(pipeline=pipeline)
+        # PipelineRunner.validate checks schema correctness without running modules.
+        result = runner.pipeline.validate_pipeline()
+        assert result is True
+
+    def test_context_authorization_lifecycle(self):
+        """Verify Context authorization is recorded and checked end-to-end."""
+        from redops.core.context import Context
+        from redops.modules.active.authorization import record_authorization, assert_active_authorized
+        from redops.modules.active.exceptions import ActiveAuthorizationError
+
+        ctx = Context(target="home-lab")
+
+        # Should fail without authorization
+        with pytest.raises(ActiveAuthorizationError):
+            assert_active_authorized(ctx)
+
+        # Record authorization
+        record_authorization(ctx, operator="test-operator", target_assertion="home-lab")
+
+        # Should succeed now
+        assert_active_authorized(ctx)  # no exception
+
+    def test_context_data_add_and_retrieve(self):
+        """Verify Context data storage and retrieval."""
+        from redops.core.context import Context
+
+        ctx = Context(target="example.com")
+        ctx.add("findings", [{"id": "f1", "severity": "high"}])
+
+        findings = ctx.get("findings")
+        assert len(findings) == 1
+        assert findings[0]["id"] == "f1"
+
+        # add() replaces the value; verify overwrite behavior
+        ctx.add("findings", [{"id": "f2", "severity": "medium"}])
+        findings = ctx.get("findings")
+        assert len(findings) == 1
+        assert findings[0]["id"] == "f2"
+
+    def test_egress_blocking_external_requests(self):
+        """Verify external egress is blocked during active execution."""
+        import requests
+        from redops.modules.active.egress import block_external_egress
+        from redops.modules.active.exceptions import EgressBlockedError
+
+        with block_external_egress():
+            with pytest.raises(EgressBlockedError):
+                requests.get("https://example.com", timeout=1)
+
+    def test_egress_allows_localhost(self):
+        """Verify localhost requests are not blocked."""
+        import requests
+        from redops.modules.active.egress import block_external_egress
+
+        # This test does not start a server; it relies on connection refused
+        # being an expected outcome, not an egress block.
+        with block_external_egress():
+            with pytest.raises(requests.ConnectionError):
+                requests.get("http://127.0.0.1:59999/nonexistent", timeout=1)
diff --git a/tests/test_active_authorization.py b/tests/test_active_authorization.py
new file mode 100644
index 0000000..3758723
--- /dev/null
+++ b/tests/test_active_authorization.py
@@ -0,0 +1,217 @@
+"""Tests for the active module authorization gate.
+
+Enforces that every module under ``modules/active/`` refuses to execute
+without recorded operator consent.
+"""
+
+from datetime import datetime, timedelta, timezone
+
+import pytest
+
+from redops.core.context import Context
+from redops.modules.active.authorization import (
+    ActiveAuthorization,
+    assert_active_authorized,
+    is_active_authorized,
+    record_authorization,
+)
+from redops.modules.active.exceptions import ActiveAuthorizationError
+from redops.modules.active.exploit.cve_check import check_cves
+from redops.modules.active.network.arp_scan import discover_hosts
+from redops.modules.active.network.port_scan import scan_ports
+from redops.modules.active.wireless.deauth import deauth_flood
+from redops.modules.active.wireless.evil_twin import start_evil_twin
+from redops.modules.active.wireless.monitor import disable_monitor_mode, enable_monitor_mode
+from redops.modules.active.wireless.scan import scan_access_points
+
+
+@pytest.fixture
+def authorized_context():
+    """A context with a valid active authorization."""
+    ctx = Context(target="192.168.99.0/24")
+    ctx.authorization = ActiveAuthorization(
+        operator="test-operator",
+        target_assertion="192.168.99.0/24",
+        consent_text="I consent to testing my own lab network.",
+    )
+    return ctx
+
+
+@pytest.fixture
+def expired_context():
+    """A context with an expired active authorization."""
+    ctx = Context(target="192.168.99.0/24")
+    ctx.authorization = ActiveAuthorization(
+        operator="test-operator",
+        target_assertion="192.168.99.0/24",
+        consent_text="I consent to testing my own lab network.",
+        expires_at=datetime.now(timezone.utc) - timedelta(hours=1),
+    )
+    return ctx
+
+
+class TestActiveAuthorizationModel:
+    """Unit tests for ActiveAuthorization data model."""
+
+    def test_is_valid_when_not_expired(self):
+        auth = ActiveAuthorization(
+            operator="alice",
+            target_assertion="10.0.0.0/24",
+            consent_text="I consent.",
+        )
+        assert auth.is_valid() is True
+        assert auth.is_expired() is False
+
+    def test_is_expired_when_past_expiry(self):
+        auth = ActiveAuthorization(
+            operator="alice",
+            target_assertion="10.0.0.0/24",
+            consent_text="I consent.",
+            expires_at=datetime.now(timezone.utc) - timedelta(seconds=1),
+        )
+        assert auth.is_expired() is True
+        assert auth.is_valid() is False
+
+    def test_authorization_id_is_uuid(self):
+        auth = ActiveAuthorization(
+            operator="alice",
+            target_assertion="10.0.0.0/24",
+            consent_text="I consent.",
+        )
+        assert len(auth.authorization_id) == 36
+
+
+class TestAssertActiveAuthorized:
+    """Tests for the authorization assertion helper."""
+
+    def test_raises_when_no_authorization(self):
+        ctx = Context(target="example.com")
+        with pytest.raises(ActiveAuthorizationError, match="no operator authorization"):
+            assert_active_authorized(ctx)
+
+    def test_raises_when_expired(self, expired_context):
+        with pytest.raises(ActiveAuthorizationError, match="expired"):
+            assert_active_authorized(expired_context)
+
+    def test_raises_when_malformed_authorization(self):
+        ctx = Context(target="example.com")
+        ctx.authorization = "not-an-authorization-object"
+        with pytest.raises(ActiveAuthorizationError, match="malformed"):
+            assert_active_authorized(ctx)
+
+    def test_passes_with_valid_authorization(self, authorized_context):
+        # Should not raise
+        assert_active_authorized(authorized_context)
+
+
+class TestIsActiveAuthorized:
+    """Tests for the boolean check helper."""
+
+    def test_false_when_no_authorization(self):
+        ctx = Context(target="example.com")
+        assert is_active_authorized(ctx) is False
+
+    def test_false_when_expired(self, expired_context):
+        assert is_active_authorized(expired_context) is False
+
+    def test_true_when_valid(self, authorized_context):
+        assert is_active_authorized(authorized_context) is True
+
+
+class TestRecordAuthorization:
+    """Tests for recording authorization in context."""
+
+    def test_records_in_context(self):
+        ctx = Context(target="192.168.99.0/24")
+        auth = record_authorization(
+            ctx,
+            operator="alice",
+            target_assertion="192.168.99.0/24",
+            consent_text="I consent.",
+            duration_hours=2,
+        )
+        assert ctx.authorization == auth
+        assert auth.operator == "alice"
+        assert auth.is_valid() is True
+        # Should expire roughly 2 hours from now
+        assert auth.expires_at > datetime.now(timezone.utc) + timedelta(hours=1)
+
+    def test_default_duration_24h(self):
+        ctx = Context(target="192.168.99.0/24")
+        auth = record_authorization(
+            ctx,
+            operator="alice",
+            target_assertion="192.168.99.0/24",
+        )
+        assert auth.expires_at > datetime.now(timezone.utc) + timedelta(hours=23)
+
+
+class TestActiveModuleAuthorizationRefusal:
+    """Tests that every active module refuses to run without authorization."""
+
+    def _assert_refused(self, fn, ctx, params=None):
+        """Helper: call fn with unauth context and assert it refuses."""
+        with pytest.raises(ActiveAuthorizationError, match="refused"):
+            fn(ctx, params or {})
+
+    def test_deauth_flood_refuses(self):
+        self._assert_refused(deauth_flood, Context(target="00:11:22:33:44:55"))
+
+    def test_start_evil_twin_refuses(self):
+        self._assert_refused(start_evil_twin, Context(target="TestAP"))
+
+    def test_scan_access_points_refuses(self):
+        self._assert_refused(scan_access_points, Context(target="wlan1mon"))
+
+    def test_enable_monitor_mode_refuses(self):
+        self._assert_refused(enable_monitor_mode, Context(target="wlan1"))
+
+    def test_disable_monitor_mode_refuses(self):
+        self._assert_refused(disable_monitor_mode, Context(target="wlan1mon"))
+
+    def test_discover_hosts_refuses(self):
+        self._assert_refused(discover_hosts, Context(target="192.168.99.0/24"))
+
+    def test_scan_ports_refuses(self):
+        self._assert_refused(scan_ports, Context(target="192.168.99.1"))
+
+    def test_check_cves_refuses(self):
+        self._assert_refused(check_cves, Context(target="192.168.99.1"))
+
+
+class TestActiveModuleRunsWithAuthorization:
+    """Tests that active modules proceed when authorization is present.
+
+    These tests verify that the authorization check is the only gate; actual
+    hardware-dependent behavior is not exercised.
+    """
+
+    def test_deauth_flood_returns_early_with_auth(self, authorized_context):
+        # Scapy is likely not installed in test env; function returns early
+        result = deauth_flood(authorized_context, {"duration": 1})
+        assert result.get("deauth_active") is False  # Scapy not available
+
+    def test_evil_twin_returns_early_with_auth(self, authorized_context):
+        authorized_context.add("access_points", [])
+        result = start_evil_twin(authorized_context)
+        # No access points means early return
+        assert result is authorized_context
+
+    def test_scan_access_points_returns_with_auth(self, authorized_context):
+        # Will fail because airodump-ng is not available, but authorization passes
+        authorized_context.add("monitor_interface", "wlan1mon")
+        result = scan_access_points(authorized_context, {"duration": 1})
+        assert result is authorized_context
+
+    def test_port_scan_no_hosts_with_auth(self, authorized_context):
+        # No live_hosts in context → early return
+        result = scan_ports(authorized_context)
+        assert result is authorized_context
+
+    def test_arp_scan_no_hosts_with_auth(self, authorized_context):
+        result = discover_hosts(authorized_context, {"wait": 0})
+        assert result is authorized_context
+
+    def test_cve_check_no_results_with_auth(self, authorized_context):
+        result = check_cves(authorized_context)
+        assert result is authorized_context
diff --git a/tests/test_active_modules.py b/tests/test_active_modules.py
new file mode 100644
index 0000000..32bde85
--- /dev/null
+++ b/tests/test_active_modules.py
@@ -0,0 +1,754 @@
+"""Tests for active module business logic.
+
+Covers parsing, subprocess interaction mocking, parameter validation,
+and context data flows for all modules under ``modules/active/``.
+Authorization gating is tested in ``test_active_authorization.py``.
+"""
+
+import subprocess
+import threading
+import time
+import xml.etree.ElementTree as ET
+from datetime import datetime, timedelta, timezone
+from pathlib import Path
+from unittest.mock import MagicMock, Mock, patch
+
+import pytest
+
+from redops.core.context import Context
+from redops.modules.active.authorization import (
+    ActiveAuthorization,
+    record_authorization,
+)
+from redops.modules.active.network.arp_scan import discover_hosts
+from redops.modules.active.network.port_scan import _parse_nmap_xml, scan_ports
+from redops.modules.active.wireless.deauth import deauth_flood
+from redops.modules.active.wireless.evil_twin import (
+    _select_target,
+    start_evil_twin,
+    stop_evil_twin,
+)
+from redops.modules.active.wireless.monitor import (
+    disable_monitor_mode,
+    enable_monitor_mode,
+    get_wireless_interfaces,
+)
+from redops.modules.active.wireless.scan import _parse_airodump_csv, scan_access_points
+
+
+@pytest.fixture
+def authorized_context():
+    """A context with a valid active authorization."""
+    ctx = Context(target="192.168.99.0/24")
+    ctx.authorization = ActiveAuthorization(
+        operator="test-operator",
+        target_assertion="192.168.99.0/24",
+        consent_text="I consent to testing my own lab network.",
+    )
+    return ctx
+
+
+# ───────────────────────────────
+# Port Scan
+# ───────────────────────────────
+
+class TestParseNmapXml:
+    """Tests for nmap XML output parser."""
+
+    def test_empty_xml_returns_empty_list(self):
+        assert _parse_nmap_xml("") == []
+
+    def test_no_open_ports_returns_empty_list(self):
+        xml = """
+            
+                
+                    
+                
+            """
+        assert _parse_nmap_xml(xml) == []
+
+    def test_open_port_with_service(self):
+        xml = """
+            
+                
+                    
+                    
+                
+            """
+        result = _parse_nmap_xml(xml)
+        assert len(result) == 1
+        assert result[0]["port"] == "22"
+        assert result[0]["protocol"] == "tcp"
+        assert result[0]["service"] == "ssh"
+        assert result[0]["product"] == "OpenSSH"
+        assert result[0]["version"] == "8.9"
+
+    def test_open_port_without_service(self):
+        xml = """
+            
+                
+                    
+                
+            """
+        result = _parse_nmap_xml(xml)
+        assert result[0]["service"] == ""
+        assert result[0]["version"] == ""
+        assert result[0]["product"] == ""
+
+    def test_multiple_open_ports(self):
+        xml = """
+            
+                
+                    
+                    
+                
+                
+                    
+                    
+                
+            """
+        result = _parse_nmap_xml(xml)
+        assert len(result) == 2
+        assert result[0]["port"] == "22"
+        assert result[1]["port"] == "443"
+
+    def test_malformed_xml_is_graceful(self):
+        assert _parse_nmap_xml("") == []
+
+
+class TestScanPorts:
+    """Tests for port scan module execution."""
+
+    def test_no_live_hosts_early_return(self, authorized_context):
+        result = scan_ports(authorized_context)
+        assert result is authorized_context
+        assert result.get("port_scan_results") is None
+        assert any("No live hosts" in str(m) for m in authorized_context.logs)
+
+    def test_default_parameters(self, authorized_context):
+        authorized_context.add("live_hosts", [{"ip": "192.168.99.5"}])
+        with patch("redops.modules.active.network.port_scan.subprocess.run") as mock_run:
+            mock_run.return_value = Mock(stdout="", stderr="")
+            scan_ports(authorized_context)
+            call = mock_run.call_args
+            cmd = call[0][0]
+            assert "-sV" in cmd
+            assert "-sU" in cmd
+            assert "-T4" in cmd
+            assert "T:1-1024,U:23,2323" in cmd
+            assert "192.168.99.5" in cmd
+
+    def test_custom_parameters(self, authorized_context):
+        authorized_context.add("live_hosts", [{"ip": "10.0.0.1"}])
+        with patch("redops.modules.active.network.port_scan.subprocess.run") as mock_run:
+            mock_run.return_value = Mock(stdout="", stderr="")
+            scan_ports(
+                authorized_context,
+                {"ports": "22,80,443", "timing": "T5"},
+            )
+            call = mock_run.call_args
+            cmd = call[0][0]
+            assert "22,80,443" in cmd
+            assert "-T5" in cmd
+
+    def test_parsed_results_stored(self, authorized_context):
+        authorized_context.add("live_hosts", [{"ip": "192.168.99.5"}])
+        xml = """
+            
+                
+                    
+                    
+                
+            """
+        with patch("redops.modules.active.network.port_scan.subprocess.run") as mock_run:
+            mock_run.return_value = Mock(stdout=xml, stderr="")
+            scan_ports(authorized_context)
+        results = authorized_context.get("port_scan_results")
+        assert len(results) == 1
+        assert results[0]["ip"] == "192.168.99.5"
+        assert results[0]["open_ports"][0]["port"] == "22"
+
+    def test_multiple_hosts_scanned_sequentially(self, authorized_context):
+        authorized_context.add(
+            "live_hosts",
+            [{"ip": "192.168.99.1"}, {"ip": "192.168.99.2"}],
+        )
+        with patch("redops.modules.active.network.port_scan.subprocess.run") as mock_run:
+            mock_run.return_value = Mock(stdout="", stderr="")
+            scan_ports(authorized_context)
+            assert mock_run.call_count == 2
+
+
+# ───────────────────────────────
+# ARP Scan
+# ───────────────────────────────
+
+class TestDiscoverHosts:
+    """Tests for ARP host discovery."""
+
+    def test_default_subnet_from_context(self, authorized_context):
+        authorized_context.add("ap_subnet", "10.0.0.0/24")
+        with patch("redops.modules.active.network.arp_scan.subprocess.run") as mock_run:
+            mock_run.return_value = Mock(stdout="", stderr="")
+            with patch("redops.modules.active.network.arp_scan.time.sleep"):
+                discover_hosts(authorized_context, {"wait": 0})
+            cmd = mock_run.call_args[0][0]
+            assert "10.0.0.0/24" in cmd
+
+    def test_default_subnet_fallback(self, authorized_context):
+        with patch("redops.modules.active.network.arp_scan.subprocess.run") as mock_run:
+            mock_run.return_value = Mock(stdout="", stderr="")
+            with patch("redops.modules.active.network.arp_scan.time.sleep"):
+                discover_hosts(authorized_context, {"wait": 0})
+            cmd = mock_run.call_args[0][0]
+            assert "192.168.99.0/24" in cmd
+
+    def test_parses_arp_scan_output(self, authorized_context):
+        stdout = """192.168.99.1\t00:11:22:33:44:55\tVendor A
+192.168.99.2\taa:bb:cc:dd:ee:ff\tVendor B"""
+        with patch("redops.modules.active.network.arp_scan.subprocess.run") as mock_run:
+            mock_run.return_value = Mock(stdout=stdout, stderr="")
+            with patch("redops.modules.active.network.arp_scan.time.sleep"):
+                discover_hosts(authorized_context, {"wait": 0})
+        hosts = authorized_context.get("live_hosts")
+        assert len(hosts) == 2
+        assert hosts[0]["ip"] == "192.168.99.1"
+        assert hosts[0]["mac"] == "00:11:22:33:44:55"
+        assert hosts[0]["vendor"] == "Vendor A"
+
+    def test_ignores_malformed_lines(self, authorized_context):
+        stdout = """192.168.99.1\t00:11:22:33:44:55\tVendor A
+not a valid line
+192.168.99.2\taa:bb:cc:dd:ee:ff\tVendor B"""
+        with patch("redops.modules.active.network.arp_scan.subprocess.run") as mock_run:
+            mock_run.return_value = Mock(stdout=stdout, stderr="")
+            with patch("redops.modules.active.network.arp_scan.time.sleep"):
+                discover_hosts(authorized_context, {"wait": 0})
+        hosts = authorized_context.get("live_hosts")
+        assert len(hosts) == 2
+
+    def test_wait_parameter(self, authorized_context):
+        with patch("redops.modules.active.network.arp_scan.subprocess.run") as mock_run:
+            mock_run.return_value = Mock(stdout="", stderr="")
+            with patch("redops.modules.active.network.arp_scan.time.sleep") as mock_sleep:
+                discover_hosts(authorized_context, {"wait": 42})
+                mock_sleep.assert_called_once_with(42)
+
+
+# ───────────────────────────────
+# Wireless Scan (airodump)
+# ───────────────────────────────
+
+class TestParseAirodumpCsv:
+    """Tests for airodump-ng CSV parser."""
+
+    def test_empty_file_returns_empty(self, tmp_path):
+        f = tmp_path / "scan-01.csv"
+        f.write_text("")
+        aps, clients = _parse_airodump_csv(str(f))
+        assert aps == []
+        assert clients == []
+
+    def test_missing_file_returns_empty(self, tmp_path):
+        aps, clients = _parse_airodump_csv(str(tmp_path / "nonexistent.csv"))
+        assert aps == []
+        assert clients == []
+
+    def test_parses_access_points(self, tmp_path):
+        csv = (
+            "BSSID, First time seen, Last time seen, channel, Speed, Privacy, "
+            "Cipher, Authentication, Power, # beacons, # IV, LAN IP, ID-length, ESSID, Key\n"
+            "00:11:22:33:44:55, 2024-01-01 00:00:00, 2024-01-01 00:01:00, 6, 54, WPA2, "
+            "CCMP, PSK, -42, 100, 0, 0.0.0.0, 6, TestAP, \n"
+            "aa:bb:cc:dd:ee:ff, 2024-01-01 00:00:00, 2024-01-01 00:01:00, 11, 54, WPA3, "
+            "CCMP, SAE, -55, 50, 0, 0.0.0.0, 7, TestAP2, \n\n"
+            "Station MAC, First time seen, Last time seen, Power, # packets, BSSID, Probed ESSIDs\n"
+            "11:22:33:44:55:66, 2024-01-01 00:00:00, 2024-01-01 00:01:00, -60, 10, "
+            "00:11:22:33:44:55, TestAP\n"
+        )
+        f = tmp_path / "scan-01.csv"
+        f.write_text(csv)
+        aps, clients = _parse_airodump_csv(str(f))
+        assert len(aps) == 2
+        assert aps[0]["bssid"] == "00:11:22:33:44:55"
+        assert aps[0]["essid"] == "TestAP"
+        assert aps[0]["channel"] == "6"
+        assert aps[0]["signal"] == "-42"
+        assert aps[0]["encryption"] == "WPA2"
+        assert len(clients) == 1
+        assert clients[0]["mac"] == "11:22:33:44:55:66"
+        assert clients[0]["associated_bssid"] == "00:11:22:33:44:55"
+
+    def test_crlf_line_endings(self, tmp_path):
+        csv = (
+            "BSSID, First time seen\r\n"
+            "00:11:22:33:44:55, 2024-01-01\r\n\r\n"
+            "Station MAC, First time seen\r\n"
+            "11:22:33:44:55:66, 2024-01-01\r\n"
+        )
+        f = tmp_path / "scan-01.csv"
+        f.write_text(csv)
+        aps, clients = _parse_airodump_csv(str(f))
+        assert len(aps) == 1
+        assert len(clients) == 1
+
+    def test_skips_invalid_bssid_length(self, tmp_path):
+        csv = (
+            "BSSID, First time seen\n"
+            "short, 2024-01-01\n\n"
+            "Station MAC, First time seen\n"
+            "also-short, 2024-01-01\n"
+        )
+        f = tmp_path / "scan-01.csv"
+        f.write_text(csv)
+        aps, clients = _parse_airodump_csv(str(f))
+        assert aps == []
+        assert clients == []
+
+
+class TestScanAccessPoints:
+    """Tests for wireless AP scan execution."""
+
+    def test_default_duration_and_interface(self, authorized_context):
+        authorized_context.add("monitor_interface", "wlan1mon")
+        with patch("redops.modules.active.wireless.scan.subprocess.Popen") as mock_popen:
+            proc = Mock()
+            mock_popen.return_value = proc
+            with patch("redops.modules.active.wireless.scan.time.sleep") as mock_sleep:
+                with patch.object(
+                    Path,
+                    "exists",
+                    return_value=False,
+                ):
+                    scan_access_points(authorized_context)
+                mock_sleep.assert_called_once_with(30)
+            cmd = mock_popen.call_args[0][0]
+            assert "wlan1mon" in cmd
+            assert "airodump-ng" in cmd
+
+    def test_custom_channel(self, authorized_context):
+        authorized_context.add("monitor_interface", "wlan0mon")
+        with patch("redops.modules.active.wireless.scan.subprocess.Popen") as mock_popen:
+            proc = Mock()
+            mock_popen.return_value = proc
+            with patch("redops.modules.active.wireless.scan.time.sleep"):
+                with patch.object(Path, "exists", return_value=False):
+                    scan_access_points(authorized_context, {"channel": 6})
+            cmd = mock_popen.call_args[0][0]
+            assert "--channel" in cmd
+            assert "6" in cmd
+
+    def test_results_stored_in_context(self, authorized_context):
+        authorized_context.add("monitor_interface", "wlan1mon")
+        csv = (
+            "BSSID, First time seen, Last time seen, channel, Speed, Privacy, "
+            "Cipher, Authentication, Power, # beacons, # IV, LAN IP, ID-length, ESSID, Key\n"
+            "00:11:22:33:44:55, 2024-01-01 00:00:00, 2024-01-01 00:01:00, 6, 54, WPA2, "
+            "CCMP, PSK, -42, 100, 0, 0.0.0.0, 6, TestAP, \n\n"
+            "Station MAC, First time seen, Last time seen, Power, # packets, BSSID, Probed ESSIDs\n"
+            "11:22:33:44:55:66, 2024-01-01 00:00:00, 2024-01-01 00:01:00, -60, 10, "
+            "00:11:22:33:44:55, TestAP\n"
+        )
+        with patch("redops.modules.active.wireless.scan.subprocess.Popen") as mock_popen:
+            proc = Mock()
+            mock_popen.return_value = proc
+            with patch("redops.modules.active.wireless.scan.time.sleep"):
+                with patch("redops.modules.active.wireless.scan.Path.exists", return_value=True):
+                    with patch("redops.modules.active.wireless.scan.Path.read_bytes", return_value=csv.encode()):
+                        scan_access_points(authorized_context, {"duration": 1})
+        aps = authorized_context.get("access_points")
+        clients = authorized_context.get("clients")
+        assert len(aps) == 1
+        assert aps[0]["essid"] == "TestAP"
+        assert len(clients) == 1
+        assert authorized_context.get("scan_complete") is True
+
+
+# ───────────────────────────────
+# Evil Twin
+# ───────────────────────────────
+
+class TestSelectTarget:
+    """Tests for target AP selection logic."""
+
+    def test_select_by_bssid(self):
+        aps = [
+            {"bssid": "00:11:22:33:44:55", "essid": "A", "signal": "-30", "channel": "6"},
+            {"bssid": "aa:bb:cc:dd:ee:ff", "essid": "B", "signal": "-50", "channel": "11"},
+        ]
+        result = _select_target(aps, "aa:bb:cc:dd:ee:ff")
+        assert result["essid"] == "B"
+
+    def test_select_highest_signal_when_no_bssid(self):
+        aps = [
+            {"bssid": "00:11:22:33:44:55", "essid": "A", "signal": "-70", "channel": "6"},
+            {"bssid": "aa:bb:cc:dd:ee:ff", "essid": "B", "signal": "-30", "channel": "11"},
+        ]
+        result = _select_target(aps, None)
+        assert result["essid"] == "B"
+
+    def test_fallback_for_non_numeric_signal(self):
+        aps = [
+            {"bssid": "00:11:22:33:44:55", "essid": "A", "signal": "bad", "channel": "6"},
+            {"bssid": "aa:bb:cc:dd:ee:ff", "essid": "B", "signal": "-50", "channel": "11"},
+        ]
+        result = _select_target(aps, None)
+        assert result["essid"] == "B"
+
+
+class TestStartEvilTwin:
+    """Tests for evil twin AP setup."""
+
+    def test_no_access_points_early_return(self, authorized_context):
+        result = start_evil_twin(authorized_context)
+        assert result.get("evil_twin_active") is False
+        assert any("No APs" in str(m) for m in authorized_context.logs)
+
+    def test_default_ap_interface_and_ip(self, authorized_context):
+        authorized_context.add(
+            "access_points",
+            [{"bssid": "00:11:22:33:44:55", "essid": "TestAP", "signal": "-40", "channel": "6"}],
+        )
+        with patch("redops.modules.active.wireless.evil_twin.subprocess.run"):
+            with patch("redops.modules.active.wireless.evil_twin.subprocess.Popen") as mock_popen:
+                mock_proc = Mock()
+                mock_popen.return_value = mock_proc
+                start_evil_twin(authorized_context)
+        assert authorized_context.get("evil_twin_active") is True
+        assert authorized_context.get("evil_twin_essid") == "TestAP"
+        assert authorized_context.get("ap_subnet") == "192.168.99.0/24"
+        assert authorized_context.get("evil_twin_channel") == "6"
+
+    def test_custom_ap_interface_and_ip(self, authorized_context):
+        authorized_context.add(
+            "access_points",
+            [{"bssid": "00:11:22:33:44:55", "essid": "TestAP", "signal": "-40", "channel": "1"}],
+        )
+        with patch("redops.modules.active.wireless.evil_twin.subprocess.run") as mock_run:
+            with patch("redops.modules.active.wireless.evil_twin.subprocess.Popen"):
+                start_evil_twin(
+                    authorized_context,
+                    {"ap_interface": "wlan2", "ap_ip": "10.0.0.1"},
+                )
+            # Check IP configuration commands
+            cmds = [call[0][0] for call in mock_run.call_args_list]
+            assert any("wlan2" in str(cmd) and "flush" in str(cmd) for cmd in cmds)
+            assert any("10.0.0.1/24" in str(cmd) for cmd in cmds)
+
+    def test_target_bssid_selection(self, authorized_context):
+        authorized_context.add(
+            "access_points",
+            [
+                {"bssid": "00:11:22:33:44:55", "essid": "A", "signal": "-60", "channel": "6"},
+                {"bssid": "aa:bb:cc:dd:ee:ff", "essid": "B", "signal": "-30", "channel": "11"},
+            ],
+        )
+        with patch("redops.modules.active.wireless.evil_twin.subprocess.run"):
+            with patch("redops.modules.active.wireless.evil_twin.subprocess.Popen"):
+                start_evil_twin(authorized_context, {"target_bssid": "aa:bb:cc:dd:ee:ff"})
+        assert authorized_context.get("evil_twin_essid") == "B"
+        assert authorized_context.get("evil_twin_bssid") == "aa:bb:cc:dd:ee:ff"
+
+    def test_config_files_written(self, authorized_context):
+        authorized_context.add(
+            "access_points",
+            [{"bssid": "00:11:22:33:44:55", "essid": "TestAP", "signal": "-40", "channel": "6"}],
+        )
+        with patch("redops.modules.active.wireless.evil_twin.subprocess.run"):
+            with patch("redops.modules.active.wireless.evil_twin.subprocess.Popen"):
+                start_evil_twin(authorized_context)
+        hostapd = Path("/tmp/redops_hostapd.conf")
+        dnsmasq = Path("/tmp/redops_dnsmasq.conf")
+        if hostapd.exists():
+            content = hostapd.read_text()
+            assert "ssid=TestAP" in content
+            assert "channel=6" in content
+            hostapd.unlink(missing_ok=True)
+        if dnsmasq.exists():
+            content = dnsmasq.read_text()
+            assert "dhcp-range" in content
+            dnsmasq.unlink(missing_ok=True)
+
+    def test_process_handles_stored(self, authorized_context):
+        authorized_context.add(
+            "access_points",
+            [{"bssid": "00:11:22:33:44:55", "essid": "TestAP", "signal": "-40", "channel": "6"}],
+        )
+        mock_proc = Mock()
+        with patch("redops.modules.active.wireless.evil_twin.subprocess.run"):
+            with patch("redops.modules.active.wireless.evil_twin.subprocess.Popen", return_value=mock_proc):
+                start_evil_twin(authorized_context)
+        assert authorized_context.get("hostapd_proc") is mock_proc
+        assert authorized_context.get("dnsmasq_proc") is mock_proc
+        assert authorized_context.get("captured_clients") == []
+
+
+class TestStopEvilTwin:
+    """Tests for evil twin teardown."""
+
+    def test_terminates_processes(self, authorized_context):
+        mock_proc = Mock()
+        authorized_context.add("hostapd_proc", mock_proc)
+        authorized_context.add("dnsmasq_proc", mock_proc)
+        with patch("redops.modules.active.wireless.evil_twin.subprocess.run"):
+            stop_evil_twin(authorized_context)
+        assert mock_proc.terminate.call_count == 2
+        assert authorized_context.get("evil_twin_active") is False
+
+    def test_handles_missing_processes(self, authorized_context):
+        authorized_context.add("hostapd_proc", None)
+        authorized_context.add("dnsmasq_proc", None)
+        with patch("redops.modules.active.wireless.evil_twin.subprocess.run"):
+            # Should not raise
+            stop_evil_twin(authorized_context)
+        assert authorized_context.get("evil_twin_active") is False
+
+
+# ───────────────────────────────
+# Monitor Mode
+# ───────────────────────────────
+
+class TestGetWirelessInterfaces:
+    """Tests for wireless interface enumeration."""
+
+    def test_parses_iwconfig_output(self):
+        iwconfig = "wlan0     IEEE 802.11  ESSID:off/any\nwlan1     IEEE 802.11  Mode:Monitor"
+        with patch("redops.modules.active.wireless.monitor.subprocess.run") as mock_run:
+            mock_run.return_value = Mock(stdout=iwconfig, stderr="")
+            interfaces = get_wireless_interfaces()
+            assert "wlan0" in interfaces
+            assert "wlan1" in interfaces
+
+    def test_empty_output_returns_empty_list(self):
+        with patch("redops.modules.active.wireless.monitor.subprocess.run") as mock_run:
+            mock_run.return_value = Mock(stdout="", stderr="")
+            interfaces = get_wireless_interfaces()
+            assert interfaces == []
+
+
+class TestEnableMonitorMode:
+    """Tests for monitor mode enable."""
+
+    def test_default_interface(self, authorized_context):
+        with patch("redops.modules.active.wireless.monitor.subprocess.run") as mock_run:
+            mock_run.return_value = Mock(stdout="wlan1mon  Monitor", stderr="")
+            enable_monitor_mode(authorized_context)
+            cmds = [call[0][0] for call in mock_run.call_args_list]
+            assert any("airmon-ng" in str(cmd) and "check" in str(cmd) for cmd in cmds)
+            assert any("airmon-ng" in str(cmd) and "start" in str(cmd) for cmd in cmds)
+            assert any("wlan1mon" in str(cmd) for cmd in cmds)
+
+    def test_success_sets_context(self, authorized_context):
+        with patch("redops.modules.active.wireless.monitor.subprocess.run") as mock_run:
+            mock_run.return_value = Mock(stdout="wlan1mon  Monitor  Frequency:2.457 GHz", stderr="")
+            enable_monitor_mode(authorized_context, {"interface": "wlan0"})
+        assert authorized_context.get("monitor_interface") == "wlan0mon"
+        assert authorized_context.get("monitor_ready") is True
+
+    def test_failure_sets_false(self, authorized_context):
+        with patch("redops.modules.active.wireless.monitor.subprocess.run") as mock_run:
+            mock_run.return_value = Mock(stdout="No such device", stderr="")
+            enable_monitor_mode(authorized_context)
+        assert authorized_context.get("monitor_ready") is False
+
+    def test_custom_interface(self, authorized_context):
+        with patch("redops.modules.active.wireless.monitor.subprocess.run") as mock_run:
+            mock_run.return_value = Mock(stdout="wlan2mon  Monitor", stderr="")
+            enable_monitor_mode(authorized_context, {"interface": "wlan2"})
+        assert authorized_context.get("monitor_interface") == "wlan2mon"
+
+
+class TestDisableMonitorMode:
+    """Tests for monitor mode disable."""
+
+    def test_default_interface_from_context(self, authorized_context):
+        authorized_context.add("monitor_interface", "wlan1mon")
+        with patch("redops.modules.active.wireless.monitor.subprocess.run") as mock_run:
+            disable_monitor_mode(authorized_context)
+            cmds = [call[0][0] for call in mock_run.call_args_list]
+            assert any("stop" in str(cmd) and "wlan1mon" in str(cmd) for cmd in cmds)
+
+    def test_default_interface_fallback(self, authorized_context):
+        with patch("redops.modules.active.wireless.monitor.subprocess.run") as mock_run:
+            disable_monitor_mode(authorized_context)
+            cmds = [call[0][0] for call in mock_run.call_args_list]
+            assert any("stop" in str(cmd) and "wlan1mon" in str(cmd) for cmd in cmds)
+
+    def test_restarts_networkmanager(self, authorized_context):
+        with patch("redops.modules.active.wireless.monitor.subprocess.run") as mock_run:
+            disable_monitor_mode(authorized_context)
+            cmds = [call[0][0] for call in mock_run.call_args_list]
+            assert any("NetworkManager" in str(cmd) for cmd in cmds)
+
+    def test_sets_monitor_ready_false(self, authorized_context):
+        authorized_context.add("monitor_ready", True)
+        with patch("redops.modules.active.wireless.monitor.subprocess.run"):
+            disable_monitor_mode(authorized_context)
+        assert authorized_context.get("monitor_ready") is False
+
+
+# ───────────────────────────────
+# Deauth
+# ───────────────────────────────
+
+@pytest.fixture
+def mock_scapy():
+    """Inject mock scapy objects into deauth module for testing.
+
+    Scapy is not installed in the test environment, so we inject mocks
+    for all scapy symbols the module references when HAS_SCAPY is True.
+    """
+    import redops.modules.active.wireless.deauth as deauth_mod
+
+    original = {}
+    mock_pkt = MagicMock()
+    mock_pkt.__truediv__ = MagicMock(return_value=mock_pkt)
+
+    mocks = {
+        "RadioTap": MagicMock(return_value=mock_pkt),
+        "Dot11": MagicMock(return_value=mock_pkt),
+        "Dot11Deauth": MagicMock(return_value=mock_pkt),
+        "sendp": MagicMock(),
+        "HAS_SCAPY": True,
+    }
+
+    for name, mock_obj in mocks.items():
+        if hasattr(deauth_mod, name):
+            original[name] = getattr(deauth_mod, name)
+        setattr(deauth_mod, name, mock_obj)
+
+    yield mocks
+
+    for name in mocks:
+        if name in original:
+            setattr(deauth_mod, name, original[name])
+        else:
+            delattr(deauth_mod, name)
+
+
+class TestDeauthFlood:
+    """Tests for deauth flood module."""
+
+    def test_no_scapy_early_return(self, authorized_context):
+        with patch("redops.modules.active.wireless.deauth.HAS_SCAPY", False):
+            result = deauth_flood(authorized_context)
+            assert result.get("deauth_active") is False
+            assert any("Scapy not installed" in str(m) for m in authorized_context.logs)
+
+    def test_no_target_bssid_early_return(self, authorized_context, mock_scapy):
+        result = deauth_flood(authorized_context)
+        assert result.get("deauth_active") is None
+        assert any("No target BSSID" in str(m) for m in authorized_context.logs)
+
+    def test_spawns_thread_with_defaults(self, authorized_context, mock_scapy):
+        authorized_context.add("evil_twin_bssid", "00:11:22:33:44:55")
+        authorized_context.add("clients", [])
+        result = deauth_flood(authorized_context, {"duration": 0})
+        assert result.get("deauth_active") is True
+        thread = result.get("deauth_thread")
+        assert isinstance(thread, threading.Thread)
+        assert thread.daemon is True
+        # Join so the thread doesn't outlive the test and trigger warnings
+        thread.join(timeout=2)
+
+    def test_custom_parameters(self, authorized_context, mock_scapy):
+        authorized_context.add("evil_twin_bssid", "00:11:22:33:44:55")
+        authorized_context.add("clients", [])
+        with patch("redops.modules.active.wireless.deauth.time.sleep"):
+            deauth_flood(
+                authorized_context,
+                {"duration": 0, "count": 128, "interval": 0.5},
+            )
+        assert authorized_context.get("deauth_active") is True
+
+    def test_targets_specific_clients(self, authorized_context, mock_scapy):
+        authorized_context.add("evil_twin_bssid", "00:11:22:33:44:55")
+        authorized_context.add(
+            "clients",
+            [
+                {"mac": "aa:bb:cc:dd:ee:ff", "associated_bssid": "00:11:22:33:44:55"},
+                {"mac": "11:22:33:44:55:66", "associated_bssid": "other"},
+            ],
+        )
+        with patch("redops.modules.active.wireless.deauth.time.sleep"):
+            result = deauth_flood(authorized_context, {"duration": 0})
+        thread = result.get("deauth_thread")
+        thread.join(timeout=2)
+        # Should target only the client associated with our BSSID
+        # Can't easily inspect thread internals, but verify it runs
+        assert authorized_context.get("deauth_active") is True
+
+    def test_broadcast_when_no_matching_clients(self, authorized_context, mock_scapy):
+        authorized_context.add("evil_twin_bssid", "00:11:22:33:44:55")
+        authorized_context.add("clients", [{"mac": "aa:bb:cc:dd:ee:ff", "associated_bssid": "other"}])
+        with patch("redops.modules.active.wireless.deauth.time.sleep"):
+            result = deauth_flood(authorized_context, {"duration": 0})
+        thread = result.get("deauth_thread")
+        thread.join(timeout=2)
+        assert authorized_context.get("deauth_active") is True
+
+
+# ───────────────────────────────
+# Integration / End-to-end flows
+# ───────────────────────────────
+
+class TestActiveModuleIntegration:
+    """Integration tests demonstrating typical active module workflows."""
+
+    def test_full_wireless_pipeline(self, authorized_context, mock_scapy):
+        """Enable monitor → scan APs → start evil twin → deauth → stop."""
+        with patch("redops.modules.active.wireless.monitor.subprocess.run") as mock_run:
+            # enable_monitor_mode
+            mock_run.return_value = Mock(stdout="wlan1mon  Monitor", stderr="")
+            enable_monitor_mode(authorized_context, {"interface": "wlan1"})
+
+        assert authorized_context.get("monitor_ready") is True
+
+        # scan_access_points
+        csv = (
+            "BSSID, First time seen, Last time seen, channel, Speed, Privacy, "
+            "Cipher, Authentication, Power, # beacons, # IV, LAN IP, ID-length, ESSID, Key\n"
+            "00:11:22:33:44:55, 2024-01-01 00:00:00, 2024-01-01 00:01:00, 6, 54, WPA2, "
+            "CCMP, PSK, -42, 100, 0, 0.0.0.0, 6, TestAP, \n\n"
+            "Station MAC, First time seen, Last time seen, Power, # packets, BSSID, Probed ESSIDs\n"
+            "11:22:33:44:55:66, 2024-01-01 00:00:00, 2024-01-01 00:01:00, -60, 10, "
+            "00:11:22:33:44:55, TestAP\n"
+        )
+        with patch("redops.modules.active.wireless.scan.subprocess.Popen") as mock_popen:
+            proc = Mock()
+            mock_popen.return_value = proc
+            with patch("redops.modules.active.wireless.scan.time.sleep"):
+                with patch("redops.modules.active.wireless.scan.Path.exists", return_value=True):
+                    with patch("redops.modules.active.wireless.scan.Path.read_bytes", return_value=csv.encode()):
+                        scan_access_points(authorized_context, {"duration": 1})
+
+        aps = authorized_context.get("access_points")
+        assert len(aps) == 1
+        assert aps[0]["essid"] == "TestAP"
+
+        # start_evil_twin
+        with patch("redops.modules.active.wireless.evil_twin.subprocess.run"):
+            with patch("redops.modules.active.wireless.evil_twin.subprocess.Popen"):
+                start_evil_twin(authorized_context)
+
+        assert authorized_context.get("evil_twin_active") is True
+        assert authorized_context.get("evil_twin_essid") == "TestAP"
+
+        # deauth_flood
+        with patch("redops.modules.active.wireless.deauth.time.sleep"):
+            deauth_flood(authorized_context, {"duration": 0})
+            time.sleep(0.05)
+
+        assert authorized_context.get("deauth_active") is True
+
+        # stop_evil_twin
+        with patch("redops.modules.active.wireless.evil_twin.subprocess.run"):
+            stop_evil_twin(authorized_context)
+
+        assert authorized_context.get("evil_twin_active") is False
+
+        # disable_monitor_mode
+        with patch("redops.modules.active.wireless.monitor.subprocess.run"):
+            disable_monitor_mode(authorized_context)
+
+        assert authorized_context.get("monitor_ready") is False
diff --git a/tests/test_agent.py b/tests/test_agent.py
index a3fe983..438ab93 100644
--- a/tests/test_agent.py
+++ b/tests/test_agent.py
@@ -3,6 +3,7 @@
 from unittest.mock import patch, MagicMock
 
 from redops.core.context import Context
+from redops.modules.active.authorization import record_authorization
 from redops.modules.ai.agent import _parse_agent_response, run_agent
 from redops.modules.ai.planner import build_attack_surface_summary
 from redops.modules.ai.tools import TOOL_REGISTRY, get_tool_descriptions
@@ -156,6 +157,7 @@ def test_agent_completes(self, mock_ollama):
         )
 
         ctx = Context(target="home-lab")
+        record_authorization(ctx, operator="test-operator", target_assertion="home-lab")
         result = run_agent(ctx, {"max_iterations": 3})
 
         assert result.get("agent_complete") is True
@@ -170,6 +172,7 @@ def test_agent_calls_tool(self, mock_ollama):
         ]
 
         ctx = Context(target="home-lab")
+        record_authorization(ctx, operator="test-operator", target_assertion="home-lab")
         ctx.add("port_scan_results", [])
         result = run_agent(ctx, {"max_iterations": 5})
 
@@ -183,6 +186,7 @@ def test_agent_max_iterations(self, mock_ollama):
         )
 
         ctx = Context(target="home-lab")
+        record_authorization(ctx, operator="test-operator", target_assertion="home-lab")
         ctx.add("port_scan_results", [])
         result = run_agent(ctx, {"max_iterations": 2})
 
@@ -195,6 +199,7 @@ def test_agent_handles_empty_response(self, mock_ollama):
         mock_ollama.return_value = ""
 
         ctx = Context(target="home-lab")
+        record_authorization(ctx, operator="test-operator", target_assertion="home-lab")
         result = run_agent(ctx, {"max_iterations": 3})
 
         assert result.get("agent_complete") is False
@@ -206,6 +211,7 @@ def test_agent_handles_unparseable_response(self, mock_ollama):
         mock_ollama.return_value = "gobbledygook"
 
         ctx = Context(target="home-lab")
+        record_authorization(ctx, operator="test-operator", target_assertion="home-lab")
         result = run_agent(ctx, {"max_iterations": 3})
 
         assert result.get("agent_complete") is False
@@ -218,6 +224,7 @@ def test_agent_handles_unknown_tool(self, mock_ollama):
         ]
 
         ctx = Context(target="home-lab")
+        record_authorization(ctx, operator="test-operator", target_assertion="home-lab")
         result = run_agent(ctx, {"max_iterations": 5})
 
         warning_logs = result.get_logs(level="WARNING")
@@ -230,6 +237,7 @@ def test_agent_no_requests(self):
         try:
             agent.HAS_REQUESTS = False
             ctx = Context(target="home-lab")
+            record_authorization(ctx, operator="test-operator", target_assertion="home-lab")
             result = agent.run_agent(ctx)
             assert result.get("agent_complete") is False
         finally:
@@ -299,6 +307,7 @@ def test_agent_uses_preset_model_and_temperature(self, mock_requests):
         mock_requests.RequestException = Exception
 
         ctx = Context(target="home-lab")
+        record_authorization(ctx, operator="test-operator", target_assertion="home-lab")
         result = run_agent(ctx, {"preset": "qwen-uncensored", "max_iterations": 1})
 
         assert result.get("agent_complete") is True
@@ -323,6 +332,7 @@ def test_explicit_params_override_preset(self, mock_requests):
         mock_requests.RequestException = Exception
 
         ctx = Context(target="home-lab")
+        record_authorization(ctx, operator="test-operator", target_assertion="home-lab")
         run_agent(
             ctx,
             {
@@ -340,6 +350,7 @@ def test_explicit_params_override_preset(self, mock_requests):
 
     def test_unknown_preset_logs_error(self):
         ctx = Context(target="home-lab")
+        record_authorization(ctx, operator="test-operator", target_assertion="home-lab")
         result = run_agent(ctx, {"preset": "bogus-preset"})
         assert result.get("agent_complete") is False
         error_logs = result.get_logs(level="ERROR")
@@ -367,6 +378,7 @@ def test_react_loop_completes_with_preset(self, mock_requests):
         mock_requests.RequestException = Exception
 
         ctx = Context(target="home-lab")
+        record_authorization(ctx, operator="test-operator", target_assertion="home-lab")
         ctx.add("port_scan_results", [])
         result = run_agent(ctx, {"preset": "qwen-uncensored", "max_iterations": 5})
 
diff --git a/tests/test_ai_assistant.py b/tests/test_ai_assistant.py
index 17bb50e..424c33b 100644
--- a/tests/test_ai_assistant.py
+++ b/tests/test_ai_assistant.py
@@ -1082,3 +1082,105 @@ def test_groq_import_error(self):
                 finally:
                     if original:
                         sys.modules["groq"] = original
+
+
+class TestCostManagement:
+    """Tests for AI cost tracking and budget enforcement."""
+
+    def test_cost_tracker_initialized(self):
+        """Test that cost tracker is initialized with zeros."""
+        from redops.modules.ai_assistant import AIAssistant
+
+        mock_openai = MagicMock()
+        with patch.dict("sys.modules", {"openai": mock_openai}):
+            with patch.dict(os.environ, {"OPENAI_API_KEY": "test-key"}):
+                with patch("redops.modules.ai_assistant.load_config", return_value={}):
+                    assistant = AIAssistant(provider="openai")
+
+        metrics = assistant.get_cost_metrics()
+        assert metrics["calls"] == 0
+        assert metrics["input_tokens"] == 0
+        assert metrics["output_tokens"] == 0
+        assert metrics["estimated_cost_usd"] == 0.0
+        assert metrics["budget_limit_usd"] is None
+        assert metrics["budget_remaining_usd"] is None
+
+    def test_budget_limit_from_config(self):
+        """Test budget limit loaded from config."""
+        from redops.modules.ai_assistant import AIAssistant
+
+        mock_openai = MagicMock()
+        with patch.dict("sys.modules", {"openai": mock_openai}):
+            with patch.dict(os.environ, {"OPENAI_API_KEY": "test-key"}):
+                with patch(
+                    "redops.modules.ai_assistant.load_config",
+                    return_value={"ai": {"budget_limit": 5.0}},
+                ):
+                    assistant = AIAssistant(provider="openai")
+
+        assert assistant.budget_limit == 5.0
+        metrics = assistant.get_cost_metrics()
+        assert metrics["budget_limit_usd"] == 5.0
+        assert metrics["budget_remaining_usd"] == 5.0
+
+    def test_budget_enforcement_blocks_over_limit(self):
+        """Test that API calls are blocked when budget would be exceeded."""
+        from redops.modules.ai_assistant import AIAssistant
+
+        mock_openai = MagicMock()
+        with patch.dict("sys.modules", {"openai": mock_openai}):
+            with patch.dict(os.environ, {"OPENAI_API_KEY": "test-key"}):
+                with patch("redops.modules.ai_assistant.load_config", return_value={}):
+                    assistant = AIAssistant(provider="openai", budget_limit=0.001)
+
+        # The estimated cost for any call will exceed $0.001
+        with pytest.raises(RuntimeError, match="AI budget exceeded"):
+            assistant._check_budget(0.01)
+
+    def test_record_usage_increments_counters(self):
+        """Test that _record_usage updates cost tracker."""
+        from redops.modules.ai_assistant import AIAssistant
+
+        mock_openai = MagicMock()
+        with patch.dict("sys.modules", {"openai": mock_openai}):
+            with patch.dict(os.environ, {"OPENAI_API_KEY": "test-key"}):
+                with patch("redops.modules.ai_assistant.load_config", return_value={}):
+                    assistant = AIAssistant(provider="openai")
+
+        assistant._record_usage("short prompt", "short response")
+        metrics = assistant.get_cost_metrics()
+        assert metrics["calls"] == 1
+        assert metrics["input_tokens"] > 0
+        assert metrics["output_tokens"] > 0
+        assert metrics["estimated_cost_usd"] > 0
+
+    def test_multiple_calls_accumulate(self):
+        """Test that multiple API calls accumulate cost."""
+        from redops.modules.ai_assistant import AIAssistant
+
+        mock_openai = MagicMock()
+        with patch.dict("sys.modules", {"openai": mock_openai}):
+            with patch.dict(os.environ, {"OPENAI_API_KEY": "test-key"}):
+                with patch("redops.modules.ai_assistant.load_config", return_value={}):
+                    assistant = AIAssistant(provider="openai")
+
+        for _ in range(3):
+            assistant._record_usage("prompt", "response")
+
+        metrics = assistant.get_cost_metrics()
+        assert metrics["calls"] == 3
+        assert metrics["estimated_cost_usd"] > 0
+
+    def test_ollama_has_zero_cost(self):
+        """Test that Ollama (local) provider has zero cost."""
+        from redops.modules.ai_assistant import AIAssistant
+
+        mock_ollama = MagicMock()
+        with patch.dict("sys.modules", {"ollama": mock_ollama}):
+            with patch("redops.modules.ai_assistant.load_config", return_value={}):
+                assistant = AIAssistant(provider="ollama")
+
+        assistant._record_usage("prompt", "response")
+        metrics = assistant.get_cost_metrics()
+        assert metrics["estimated_cost_usd"] == 0.0
+        assert metrics["budget_remaining_usd"] is None
diff --git a/tests/test_asn_lookup.py b/tests/test_asn_lookup.py
index f43c01e..d36ab3d 100644
--- a/tests/test_asn_lookup.py
+++ b/tests/test_asn_lookup.py
@@ -213,9 +213,11 @@ def test_api_error(self, mock_requests):
 class TestLookupAsnCymru:
     """Tests for lookup_asn_cymru function."""
 
-    def test_dns_lookup(self):
+    @patch("socket.gethostbyname_ex")
+    def test_dns_lookup(self, mock_dns):
         """Test Cymru DNS lookup (basic structure)."""
         # This is a fallback method, just ensure it doesn't crash
+        mock_dns.return_value = ("test", [], ["127.0.0.1"])
         result = lookup_asn_cymru("8.8.8.8")
         assert "ip" in result
 
diff --git a/tests/test_cli_commands.py b/tests/test_cli_commands.py
new file mode 100644
index 0000000..80bca92
--- /dev/null
+++ b/tests/test_cli_commands.py
@@ -0,0 +1,247 @@
+"""Tests for Click CLI commands (scan, report, etc.)."""
+
+import json
+from pathlib import Path
+from unittest.mock import MagicMock, patch
+
+import pytest
+from click.testing import CliRunner
+
+from redops.cli.main import cli
+
+
+class TestScanListPipelines:
+    """Tests for 'scan list-pipelines' command."""
+
+    def test_list_pipelines_shows_available_pipelines(self, tmp_path):
+        """list-pipelines should display available pipeline definitions."""
+        runner = CliRunner()
+
+        # Create a fake pipeline JSON in a temp dir
+        pipelines_dir = tmp_path / "config" / "pipelines"
+        pipelines_dir.mkdir(parents=True)
+        pipeline_file = pipelines_dir / "quickstart.json"
+        pipeline_file.write_text(json.dumps({
+            "metadata": {
+                "name": "Quick Start",
+                "description": "Zero-config quickstart pipeline",
+                "version": "1.0.0",
+                "author": "test",
+                "tags": ["quick", "starter"]
+            },
+            "steps": [
+                {"name": "port_scan", "module": "redops.modules.port_scan"}
+            ],
+            "config": {"timeout": 60}
+        }))
+
+        with patch(
+            "redops.cli.commands.scan.Path"
+        ) as mock_path_cls:
+            # Return our temp dir as the resolved pipelines directory
+            mock_path_cls.return_value.parents.__getitem__ = lambda self, i: tmp_path if i == 3 else None
+            mock_path_cls.return_value.exists.return_value = True
+            with patch(
+                "redops.pipelines.loader.PipelineLoader.load"
+            ) as mock_load:
+                mock_pipeline = MagicMock()
+                mock_pipeline.metadata.name = "Quick Start"
+                mock_pipeline.metadata.description = "Zero-config quickstart pipeline"
+                mock_pipeline.steps = [MagicMock()]
+                mock_pipeline.metadata.tags = ["quick", "starter"]
+                mock_load.return_value = mock_pipeline
+                result = runner.invoke(cli, ["scan", "list-pipelines"])
+
+        assert result.exit_code == 0
+        assert "Available Pipelines" in result.output
+        assert "Quick Start" in result.output
+        assert "Zero-config quickstart pipeline" in result.output
+
+    def test_list_pipelines_empty_directory(self):
+        """list-pipelines should handle empty pipeline directory gracefully."""
+        runner = CliRunner()
+
+        with patch(
+            "redops.cli.commands.scan.Path"
+        ) as mock_path_cls:
+            instance = MagicMock()
+            instance.parents = [None, None, None, Path("/nonexistent")]
+            mock_path_cls.return_value = instance
+            with patch.object(Path, "exists", return_value=False):
+                result = runner.invoke(cli, ["scan", "list-pipelines"])
+
+        assert result.exit_code == 0
+        assert "Pipeline directory not found" in result.output
+
+
+class TestScanRunLocal:
+    """Tests for 'scan run --local' command."""
+
+    def test_local_scan_runs_pipeline(self):
+        """scan run --local should execute a pipeline locally without API calls."""
+        runner = CliRunner()
+
+        mock_pipeline = MagicMock()
+        mock_pipeline.metadata.name = "Quick Start"
+        mock_pipeline.enabled_steps = ["port_scan"]
+        mock_pipeline.steps = []
+
+        mock_ctx = MagicMock()
+        mock_ctx.target = "example.com"
+        mock_ctx.logs = []
+        mock_ctx.data = {"findings": []}
+        mock_ctx.get_logs.return_value = []
+
+        mock_runner = MagicMock()
+        mock_runner.run.return_value = mock_ctx
+
+        with patch(
+            "redops.cli.commands.scan._resolve_pipeline_file"
+        ) as mock_resolve:
+            mock_resolve.return_value = Path("config/pipelines/quickstart.json")
+            with patch("redops.pipelines.loader.PipelineLoader.load") as mock_load:
+                mock_load.return_value = mock_pipeline
+                with patch(
+                    "redops.pipelines.runner.PipelineRunner", return_value=mock_runner
+                ):
+                    result = runner.invoke(
+                        cli, ["scan", "run", "--local", "example.com"]
+                    )
+
+        assert result.exit_code == 0
+        assert "Starting local scan on example.com" in result.output
+        assert "Quick Start" in result.output
+        mock_runner.run.assert_called_once_with(target="example.com")
+
+    def test_local_scan_unknown_pipeline(self):
+        """scan run --local with unknown pipeline should exit with error."""
+        runner = CliRunner()
+
+        with patch(
+            "redops.cli.commands.scan._resolve_pipeline_file"
+        ) as mock_resolve:
+            mock_resolve.return_value = None
+            result = runner.invoke(
+                cli, ["scan", "run", "--local", "-p", "nonexistent", "example.com"]
+            )
+
+        assert result.exit_code == 1
+        assert "Pipeline 'nonexistent' not found" in result.output
+        assert "list-pipelines" in result.output
+
+    def test_local_scan_with_output_file(self, tmp_path):
+        """scan run --local with -o should write JSON results."""
+        runner = CliRunner()
+        output_file = tmp_path / "results.json"
+
+        mock_pipeline = MagicMock()
+        mock_pipeline.metadata.name = "Quick Start"
+        mock_pipeline.enabled_steps = ["port_scan"]
+        mock_pipeline.steps = []
+
+        mock_ctx = MagicMock()
+        mock_ctx.target = "example.com"
+        mock_ctx.logs = []
+        mock_ctx.data = {"findings": [{"title": "Open Port", "severity": "info"}]}
+        mock_ctx.get_logs.return_value = []
+
+        mock_runner = MagicMock()
+        mock_runner.run.return_value = mock_ctx
+
+        with patch(
+            "redops.cli.commands.scan._resolve_pipeline_file"
+        ) as mock_resolve:
+            mock_resolve.return_value = Path("config/pipelines/quickstart.json")
+            with patch("redops.pipelines.loader.PipelineLoader.load") as mock_load:
+                mock_load.return_value = mock_pipeline
+                with patch(
+                    "redops.pipelines.runner.PipelineRunner", return_value=mock_runner
+                ):
+                    result = runner.invoke(
+                        cli,
+                        [
+                            "scan",
+                            "run",
+                            "--local",
+                            "-o",
+                            str(output_file),
+                            "example.com",
+                        ],
+                    )
+
+        assert result.exit_code == 0
+        assert output_file.exists()
+        data = json.loads(output_file.read_text())
+        assert data["target"] == "example.com"
+        assert len(data["findings"]) == 1
+
+
+class TestQuickScanLocal:
+    """Tests for 'quick-scan --local' command."""
+
+    def test_quick_scan_local(self):
+        """quick-scan --local should delegate to local scan execution."""
+        runner = CliRunner()
+
+        mock_pipeline = MagicMock()
+        mock_pipeline.metadata.name = "Quick Start"
+        mock_pipeline.enabled_steps = ["port_scan"]
+        mock_pipeline.steps = []
+
+        mock_ctx = MagicMock()
+        mock_ctx.target = "example.com"
+        mock_ctx.logs = []
+        mock_ctx.data = {"findings": []}
+        mock_ctx.get_logs.return_value = []
+
+        mock_runner = MagicMock()
+        mock_runner.run.return_value = mock_ctx
+
+        with patch(
+            "redops.cli.commands.scan._resolve_pipeline_file"
+        ) as mock_resolve:
+            mock_resolve.return_value = Path("config/pipelines/quickstart.json")
+            with patch("redops.pipelines.loader.PipelineLoader.load") as mock_load:
+                mock_load.return_value = mock_pipeline
+                with patch(
+                    "redops.pipelines.runner.PipelineRunner", return_value=mock_runner
+                ):
+                    result = runner.invoke(
+                        cli, ["quick-scan", "--local", "example.com"]
+                    )
+
+        assert result.exit_code == 0
+        assert "Starting local scan on example.com" in result.output
+        mock_runner.run.assert_called_once_with(target="example.com")
+
+    def test_quick_scan_local_default_pipeline(self):
+        """quick-scan --local should use 'quickstart' as default pipeline."""
+        runner = CliRunner()
+
+        mock_pipeline = MagicMock()
+        mock_pipeline.metadata.name = "Quick Start"
+        mock_pipeline.enabled_steps = ["port_scan"]
+        mock_pipeline.steps = []
+
+        mock_ctx = MagicMock()
+        mock_ctx.target = "example.com"
+        mock_ctx.logs = []
+        mock_ctx.data = {"findings": []}
+        mock_ctx.get_logs.return_value = []
+
+        mock_runner = MagicMock()
+        mock_runner.run.return_value = mock_ctx
+
+        with patch(
+            "redops.cli.commands.scan._resolve_pipeline_file"
+        ) as mock_resolve:
+            mock_resolve.return_value = Path("config/pipelines/quickstart.json")
+            with patch("redops.pipelines.loader.PipelineLoader.load") as mock_load:
+                mock_load.return_value = mock_pipeline
+                with patch(
+                    "redops.pipelines.runner.PipelineRunner", return_value=mock_runner
+                ):
+                    runner.invoke(cli, ["quick-scan", "--local", "example.com"])
+
+        # _resolve_pipeline_file should be called with "default" which maps to "quickstart"
+        mock_resolve.assert_called_once_with("default")
diff --git a/tests/test_cli_settings.py b/tests/test_cli_settings.py
index 506be80..ab03ffe 100644
--- a/tests/test_cli_settings.py
+++ b/tests/test_cli_settings.py
@@ -394,9 +394,10 @@ def test_get_api_key_from_config(self, tmp_path):
         config_file.write_text(json.dumps(config))
 
         with patch("redops.cli.settings.get_config_path", return_value=config_file):
-            menu = SettingsMenu(quiet=True)
+            with patch.dict(os.environ, {"OPENAI_API_KEY": ""}):
+                menu = SettingsMenu(quiet=True)
+                result = menu._get_api_key("openai")
 
-        result = menu._get_api_key("openai")
         assert result == "config-key"
 
     def test_get_api_key_from_env(self, tmp_path):
@@ -509,10 +510,10 @@ def test_test_api_key_not_set(self, tmp_path, capsys):
         config_file.write_text(json.dumps(get_default_config()))
 
         with patch("redops.cli.settings.get_config_path", return_value=config_file):
-            menu = SettingsMenu(quiet=True)
-
-        with patch("builtins.input", side_effect=["1", ""]):
-            menu.test_api_key()
+            with patch.dict(os.environ, {"OPENAI_API_KEY": ""}):
+                menu = SettingsMenu(quiet=True)
+                with patch("builtins.input", side_effect=["1", ""]):
+                    menu.test_api_key()
 
         captured = capsys.readouterr()
         assert "No API key configured" in captured.out
@@ -923,7 +924,8 @@ def test_list_api_keys_with_config(self, tmp_path, capsys):
         config_file.write_text(json.dumps(config))
 
         with patch("redops.cli.settings.get_config_path", return_value=config_file):
-            list_api_keys()
+            with patch.dict(os.environ, {"OPENAI_API_KEY": ""}):
+                list_api_keys()
 
         captured = capsys.readouterr()
         assert "conf" in captured.out  # masked key starts with conf
diff --git a/tests/test_config.py b/tests/test_config.py
index b100fa6..d8a952c 100644
--- a/tests/test_config.py
+++ b/tests/test_config.py
@@ -152,7 +152,8 @@ def test_get_key_from_config(self):
         """Test get_key returns stored config value."""
         config = APIKeysConfig(openai="sk-stored-key")
 
-        result = config.get_key("openai")
+        with patch.dict(os.environ, {"OPENAI_API_KEY": ""}):
+            result = config.get_key("openai")
 
         assert result == "sk-stored-key"
 
@@ -186,7 +187,8 @@ def test_get_key_no_env_no_config(self):
         """Test get_key returns None when neither env nor config set."""
         config = APIKeysConfig()
 
-        result = config.get_key("openai")
+        with patch.dict(os.environ, {"OPENAI_API_KEY": ""}):
+            result = config.get_key("openai")
 
         assert result is None
 
@@ -440,7 +442,8 @@ def test_get_api_key(self):
         """Test get_api_key wrapper method."""
         config = RedOpsConfig(api_keys=APIKeysConfig(openai="wrapper-test-key"))
 
-        result = config.get_api_key("openai")
+        with patch.dict(os.environ, {"OPENAI_API_KEY": ""}):
+            result = config.get_api_key("openai")
 
         assert result == "wrapper-test-key"
 
diff --git a/tests/test_context.py b/tests/test_context.py
index f64ae8a..4cc280a 100644
--- a/tests/test_context.py
+++ b/tests/test_context.py
@@ -1,5 +1,6 @@
 """Tests for the Context module."""
 
+import pytest
 from redops.core.context import Context
 
 
@@ -159,3 +160,88 @@ def test_context_data_persistence():
     ctx.add("list", [1, 2, 3])
     assert ctx.get("counter") == 2
     assert ctx.get("list") == [1, 2, 3]
+
+
+def test_context_save_creates_checkpoint():
+    """Test that save() creates a deep-copy checkpoint."""
+    ctx = Context(target="test.com")
+    ctx.add("key", "value")
+    initial_logs = len(ctx.logs)
+
+    ctx.save()
+    assert len(ctx._checkpoints) == 1
+
+    # Mutate data after save
+    ctx.add("key", "mutated")
+    assert ctx.get("key") == "mutated"
+
+    # Rollback should restore data but preserve logs (audit trail)
+    ctx.rollback()
+    assert ctx.get("key") == "value"
+    assert len(ctx._checkpoints) == 0
+
+    # Logs are preserved (not rolled back) — should include post-save logs plus rollback log
+    rollback_logs = [log for log in ctx.logs if "rolled back" in log.get("message", "")]
+    assert len(rollback_logs) == 1
+    # The add log and rollback log should both be present
+    assert any("Added data to context" in log.get("message", "") for log in ctx.logs)
+
+
+def test_context_rollback_no_checkpoint_raises():
+    """Test that rollback without save raises RuntimeError."""
+    ctx = Context()
+    with pytest.raises(RuntimeError, match="No checkpoints available"):
+        ctx.rollback()
+
+
+def test_context_nested_save_rollback():
+    """Test nested save/rollback (stack behavior)."""
+    ctx = Context()
+    ctx.add("a", 1)
+    ctx.save()  # checkpoint 1
+
+    ctx.add("b", 2)
+    ctx.save()  # checkpoint 2
+
+    ctx.add("c", 3)
+    assert ctx.get("a") == 1
+    assert ctx.get("b") == 2
+    assert ctx.get("c") == 3
+
+    # Rollback to checkpoint 2
+    ctx.rollback()
+    assert ctx.get("a") == 1
+    assert ctx.get("b") == 2
+    assert ctx.get("c") is None
+
+    # Rollback to checkpoint 1
+    ctx.rollback()
+    assert ctx.get("a") == 1
+    assert ctx.get("b") is None
+    assert ctx.get("c") is None
+
+
+def test_context_clear_checkpoints():
+    """Test clearing all checkpoints."""
+    ctx = Context()
+    ctx.save()
+    ctx.save()
+    assert len(ctx._checkpoints) == 2
+
+    ctx.clear_checkpoints()
+    assert len(ctx._checkpoints) == 0
+
+
+def test_context_checkpoint_is_deep_copy():
+    """Test that checkpoints are deep copies, not references."""
+    ctx = Context()
+    ctx.add("nested", {"inner": [1, 2]})
+    ctx.save()
+
+    # Mutate nested structure
+    ctx.data["nested"]["inner"].append(3)
+    assert ctx.data["nested"]["inner"] == [1, 2, 3]
+
+    # Rollback should restore original nested structure
+    ctx.rollback()
+    assert ctx.data["nested"]["inner"] == [1, 2]
diff --git a/tests/test_cve_check.py b/tests/test_cve_check.py
index 42d2091..27617c4 100644
--- a/tests/test_cve_check.py
+++ b/tests/test_cve_check.py
@@ -1,12 +1,14 @@
 """Tests for CVE cross-reference module."""
 
 from redops.core.context import Context
+from redops.modules.active.authorization import record_authorization
 from redops.modules.active.exploit.cve_check import check_cves
 
 
 class TestCheckCves:
     def test_finds_telnetd_cve(self):
         ctx = Context(target="home-lab")
+        record_authorization(ctx, operator="test-operator", target_assertion="home-lab")
         ctx.add(
             "port_scan_results",
             [
@@ -34,6 +36,7 @@ def test_finds_telnetd_cve(self):
 
     def test_high_value_targets(self):
         ctx = Context(target="home-lab")
+        record_authorization(ctx, operator="test-operator", target_assertion="home-lab")
         ctx.add(
             "port_scan_results",
             [
@@ -59,6 +62,7 @@ def test_high_value_targets(self):
 
     def test_no_matches(self):
         ctx = Context(target="home-lab")
+        record_authorization(ctx, operator="test-operator", target_assertion="home-lab")
         ctx.add(
             "port_scan_results",
             [
@@ -83,12 +87,14 @@ def test_no_matches(self):
 
     def test_empty_scan_results(self):
         ctx = Context(target="home-lab")
+        record_authorization(ctx, operator="test-operator", target_assertion="home-lab")
         result = check_cves(ctx)
         assert result.get("cve_findings") == []
         assert result.get("high_value_targets") == []
 
     def test_matches_on_product_field(self):
         ctx = Context(target="home-lab")
+        record_authorization(ctx, operator="test-operator", target_assertion="home-lab")
         ctx.add(
             "port_scan_results",
             [
diff --git a/tests/test_dashboard_mobile.py b/tests/test_dashboard_mobile.py
new file mode 100644
index 0000000..670452b
--- /dev/null
+++ b/tests/test_dashboard_mobile.py
@@ -0,0 +1,157 @@
+"""Tests for dashboard mobile responsiveness."""
+
+from redops.web.app import get_dashboard_html
+
+
+def test_dashboard_html_is_string():
+    html = get_dashboard_html()
+    assert isinstance(html, str)
+    assert len(html) > 0
+
+
+def test_no_fixed_width_modal():
+    """Login modal must not use w-96 which overflows on phones."""
+    html = get_dashboard_html()
+    assert 'w-96' not in html
+    assert 'max-w-sm' in html
+
+
+def test_modal_uses_responsive_width():
+    html = get_dashboard_html()
+    assert 'w-full max-w-sm' in html
+
+
+def test_modal_responsive_padding():
+    html = get_dashboard_html()
+    assert 'p-6 sm:p-8' in html
+
+
+def test_scan_target_input_no_fixed_min_width():
+    html = get_dashboard_html()
+    assert 'min-w-64' not in html
+    assert 'sm:min-w-0' in html
+
+
+def test_scan_target_input_full_width_mobile():
+    html = get_dashboard_html()
+    assert 'w-full sm:flex-1' in html
+
+
+def test_scan_preset_full_width_mobile():
+    html = get_dashboard_html()
+    assert 'w-full sm:w-auto' in html
+
+
+def test_start_scan_button_full_width_mobile():
+    html = get_dashboard_html()
+    assert 'h-11 w-full sm:w-auto' in html
+
+
+def test_login_submit_has_touch_target():
+    html = get_dashboard_html()
+    assert 'h-11' in html
+
+
+def test_login_inputs_have_touch_target():
+    html = get_dashboard_html()
+    # Both username and password inputs should have h-11
+    assert html.count('h-11') >= 2
+
+
+def test_logout_button_has_touch_target():
+    html = get_dashboard_html()
+    assert 'inline-flex items-center' in html
+
+
+def test_refresh_button_has_touch_target():
+    html = get_dashboard_html()
+    assert 'h-11 px-3 inline-flex items-center' in html
+
+
+def test_view_button_has_touch_target():
+    html = get_dashboard_html()
+    assert 'h-11 px-3 inline-flex items-center' in html
+
+
+def test_desktop_table_hidden_on_mobile():
+    html = get_dashboard_html()
+    assert 'hidden md:block' in html
+
+
+def test_mobile_cards_present():
+    html = get_dashboard_html()
+    assert 'md:hidden' in html
+    assert 'Mobile cards' in html or 'bg-gray-700/50 rounded-lg p-4' in html
+
+
+def test_mobile_card_view_button():
+    html = get_dashboard_html()
+    assert 'View Results' in html
+
+
+def test_viewport_meta_present():
+    html = get_dashboard_html()
+    assert 'width=device-width, initial-scale=1.0' in html
+
+
+def test_chart_js_included():
+    html = get_dashboard_html()
+    assert 'chart.js@4.4.1' in html
+
+
+def test_alpine_js_included():
+    html = get_dashboard_html()
+    assert 'alpinejs' in html
+
+
+def test_tailwind_cdn_included():
+    html = get_dashboard_html()
+    assert 'tailwindcss.com' in html
+
+
+def test_aria_roles_present():
+    html = get_dashboard_html()
+    assert 'role="banner"' in html
+    assert 'role="region"' in html
+    assert 'role="dialog"' in html
+
+
+def test_skip_link_present():
+    html = get_dashboard_html()
+    assert 'Skip to main content' in html
+    assert 'sr-only' in html
+
+
+def test_login_modal_escape_handler():
+    html = get_dashboard_html()
+    assert '@keydown.escape.window="showLogin = false"' in html
+
+
+def test_module_chart_canvas_present():
+    html = get_dashboard_html()
+    assert 'id="moduleChart"' in html
+
+
+def test_risk_gauge_canvas_present():
+    html = get_dashboard_html()
+    assert 'id="riskGauge"' in html
+
+
+def test_timeline_chart_canvas_present():
+    html = get_dashboard_html()
+    assert 'id="timelineChart"' in html
+
+
+def test_all_chart_render_methods_present():
+    html = get_dashboard_html()
+    assert 'renderModuleChart()' in html
+    assert 'renderRiskGauge()' in html
+    assert 'renderTimelineChart()' in html
+
+
+def test_view_results_calls_all_charts():
+    html = get_dashboard_html()
+    assert 'this.renderSeverityChart();' in html
+    assert 'this.renderModuleChart();' in html
+    assert 'this.renderRiskGauge();' in html
+    assert 'this.renderTimelineChart();' in html
diff --git a/tests/test_egress_enforcement.py b/tests/test_egress_enforcement.py
new file mode 100644
index 0000000..604c09e
--- /dev/null
+++ b/tests/test_egress_enforcement.py
@@ -0,0 +1,107 @@
+"""Tests for egress blocking during active chain execution.
+
+Ensures that non-local HTTP requests are rejected while active authorization
+is in scope, preventing cloud API leakage.
+"""
+
+import pytest
+import requests
+
+from redops.modules.active.egress import (
+    EgressBlockedError,
+    _is_local_url,
+    block_external_egress,
+)
+
+
+class TestIsLocalUrl:
+    """Unit tests for the local-url classifier."""
+
+    @pytest.mark.parametrize(
+        "url",
+        [
+            "http://localhost:11434/api/generate",
+            "http://127.0.0.1:8000/health",
+            "http://[::1]:8080/metrics",
+            "http://my-service.local/status",
+            "http://0.0.0.0:9000",
+        ],
+    )
+    def test_local_urls_allowed(self, url):
+        assert _is_local_url(url) is True
+
+    @pytest.mark.parametrize(
+        "url",
+        [
+            "https://api.openai.com/v1/chat/completions",
+            "https://api.anthropic.com/v1/messages",
+            "http://example.com",
+            "https://8.8.8.8",
+            "https://google.com",
+        ],
+    )
+    def test_non_local_urls_blocked(self, url):
+        assert _is_local_url(url) is False
+
+
+class TestBlockExternalEgress:
+    """Integration tests for the egress blocking context manager."""
+
+    def test_allows_local_requests(self):
+        """Local requests should succeed while blocking is active."""
+        with block_external_egress():
+            # We cannot guarantee a local server is running, but we can verify
+            # the patch is applied by checking the thread-local flag.
+            from redops.modules.active.egress import _is_egress_blocked
+
+            assert _is_egress_blocked() is True
+
+    def test_blocks_external_requests(self):
+        """External requests should raise EgressBlockedError."""
+        with block_external_egress():
+            with pytest.raises(EgressBlockedError, match="Egress blocked"):
+                requests.get("https://api.openai.com/v1/models", timeout=1)
+
+    def test_blocks_external_post(self):
+        """External POST requests should also raise."""
+        with block_external_egress():
+            with pytest.raises(EgressBlockedError, match="Egress blocked"):
+                requests.post(
+                    "https://api.anthropic.com/v1/messages",
+                    json={"model": "claude", "messages": []},
+                    timeout=1,
+                )
+
+    def test_releases_after_context_exit(self):
+        """After exiting the context manager, external requests should work again."""
+        with block_external_egress():
+            pass
+        # We do not actually make an external request here to avoid network
+        # dependency in tests; instead we verify the thread-local flag is clear.
+        from redops.modules.active.egress import _is_egress_blocked
+
+        assert _is_egress_blocked() is False
+
+    def test_nested_context_managers(self):
+        """Nested block_external_egress calls should not double-unblock."""
+        with block_external_egress():
+            with block_external_egress():
+                from redops.modules.active.egress import _is_egress_blocked
+
+                assert _is_egress_blocked() is True
+                with pytest.raises(EgressBlockedError):
+                    requests.get("https://example.com", timeout=1)
+            # After inner exit, outer should still block
+            assert _is_egress_blocked() is True
+            with pytest.raises(EgressBlockedError):
+                requests.get("https://example.com", timeout=1)
+        # After outer exit, should be fully released
+        assert _is_egress_blocked() is False
+
+    def test_allows_localhost_requests_inside_block(self):
+        """Requests to localhost should not raise even while blocking is active."""
+        with block_external_egress():
+            # This will raise ConnectionError because no server is listening,
+            # but it should NOT raise EgressBlockedError.
+            with pytest.raises(requests.ConnectionError):
+                requests.get("http://localhost:59999/health", timeout=1)
diff --git a/tests/test_exceptions.py b/tests/test_exceptions.py
new file mode 100644
index 0000000..25ecdf5
--- /dev/null
+++ b/tests/test_exceptions.py
@@ -0,0 +1,97 @@
+"""Tests for the unified exception hierarchy."""
+
+import pytest
+
+from redops.core.exceptions import (
+    RedOpsError,
+    ConfigurationError,
+    SecretNotFoundError,
+    NetworkError,
+    APIClientError,
+    RateLimitError,
+    CircuitOpenError,
+    AuthError,
+    AuthenticationError,
+    AuthorizationError,
+    TokenExpiredError,
+    TokenInvalidError,
+    SessionNotFoundError,
+    ValidationError,
+    SchemaError,
+    PipelineError,
+    ModuleError,
+    ModuleNotFoundError,
+    StorageError,
+    CacheError,
+    AIError,
+    AIBudgetExceededError,
+    AIPromptError,
+)
+
+
+class TestExceptionHierarchy:
+    """Verify the exception inheritance tree."""
+
+    @pytest.mark.parametrize(
+        "exc_class,expected_parent",
+        [
+            (ConfigurationError, RedOpsError),
+            (SecretNotFoundError, ConfigurationError),
+            (NetworkError, RedOpsError),
+            (APIClientError, NetworkError),
+            (RateLimitError, NetworkError),
+            (CircuitOpenError, NetworkError),
+            (AuthError, RedOpsError),
+            (AuthenticationError, AuthError),
+            (AuthorizationError, AuthError),
+            (TokenExpiredError, AuthenticationError),
+            (TokenInvalidError, AuthenticationError),
+            (SessionNotFoundError, AuthenticationError),
+            (ValidationError, RedOpsError),
+            (SchemaError, ValidationError),
+            (PipelineError, RedOpsError),
+            (ModuleError, PipelineError),
+            (ModuleNotFoundError, ModuleError),
+            (StorageError, RedOpsError),
+            (CacheError, StorageError),
+            (AIError, RedOpsError),
+            (AIBudgetExceededError, AIError),
+            (AIPromptError, AIError),
+        ],
+    )
+    def test_inheritance(self, exc_class, expected_parent):
+        assert issubclass(exc_class, expected_parent)
+
+    def test_all_are_redops_errors(self):
+        classes = [
+            ConfigurationError,
+            NetworkError,
+            AuthError,
+            ValidationError,
+            PipelineError,
+            StorageError,
+            AIError,
+        ]
+        for cls in classes:
+            assert issubclass(cls, RedOpsError)
+
+    def test_redops_error_is_builtin_exception(self):
+        assert issubclass(RedOpsError, Exception)
+
+    def test_can_catch_subclass_with_parent(self):
+        with pytest.raises(AuthError):
+            raise AuthenticationError("bad creds")
+
+        with pytest.raises(NetworkError):
+            raise RateLimitError("slow down")
+
+    def test_message_preserved(self):
+        msg = "something went wrong"
+        try:
+            raise PipelineError(msg)
+        except RedOpsError as e:
+            assert str(e) == msg
+
+    def test_exception_attributes(self):
+        e = APIClientError("timeout")
+        assert e.args[0] == "timeout"
diff --git a/tests/test_mitre_mapping.py b/tests/test_mitre_mapping.py
index fb4f43a..870e001 100644
--- a/tests/test_mitre_mapping.py
+++ b/tests/test_mitre_mapping.py
@@ -17,6 +17,7 @@
     get_all_tactics,
     get_mitigations_for_techniques,
     generate_attack_matrix_view,
+    generate_navigator_layer,
 )
 from redops.core.context import Context
 
@@ -539,6 +540,57 @@ def test_sorted_techniques(self):
         assert recon_techs == sorted(recon_techs)
 
 
+class TestNavigatorLayerExport:
+    """Tests for MITRE ATT&CK Navigator layer export."""
+
+    def test_generates_valid_layer_structure(self):
+        """Navigator layer must contain required top-level keys."""
+        layer = generate_navigator_layer({"T1595", "T1190"})
+
+        assert layer["name"] == "RedOPS Scan Results"
+        assert layer["domain"] == "enterprise-attack"
+        assert "versions" in layer
+        assert "techniques" in layer
+        assert "gradient" in layer
+        assert "legendItems" in layer
+
+    def test_techniques_have_required_fields(self):
+        """Each technique entry must have techniqueID, tactic, score, comment."""
+        layer = generate_navigator_layer({"T1595"})
+        techniques = layer["techniques"]
+        assert len(techniques) == 1
+
+        tech = techniques[0]
+        assert tech["techniqueID"] == "T1595"
+        assert tech["tactic"] == "reconnaissance"
+        assert tech["score"] == 1
+        assert "Active Scanning" in tech["comment"]
+        assert tech["enabled"] is True
+
+    def test_skips_unknown_techniques(self):
+        """Unknown technique IDs should be silently skipped."""
+        layer = generate_navigator_layer({"T1595", "T9999"})
+        ids = [t["techniqueID"] for t in layer["techniques"]]
+        assert "T1595" in ids
+        assert "T9999" not in ids
+
+    def test_custom_name_and_description(self):
+        """Custom name and description should be reflected in output."""
+        layer = generate_navigator_layer(
+            {"T1595"},
+            name="Bug Bounty Recon",
+            description="Coverage from bug bounty reconnaissance scan",
+        )
+        assert layer["name"] == "Bug Bounty Recon"
+        assert layer["description"] == "Coverage from bug bounty reconnaissance scan"
+
+    def test_empty_techniques_returns_empty_layer(self):
+        """Empty input should produce valid layer with zero techniques."""
+        layer = generate_navigator_layer(set())
+        assert layer["techniques"] == []
+        assert layer["name"] == "RedOPS Scan Results"
+
+
 class TestKeywordTechniqueMap:
     """Tests for keyword-technique mapping."""
 
diff --git a/tests/test_network.py b/tests/test_network.py
index ea1d589..2eaf614 100644
--- a/tests/test_network.py
+++ b/tests/test_network.py
@@ -3,6 +3,7 @@
 from unittest.mock import MagicMock, patch
 
 from redops.core.context import Context
+from redops.modules.active.authorization import record_authorization
 from redops.modules.active.network.arp_scan import discover_hosts
 from redops.modules.active.network.port_scan import _parse_nmap_xml, scan_ports
 
@@ -24,6 +25,7 @@ def test_discovers_hosts(self, mock_run, mock_sleep):
         )
 
         ctx = Context(target="home-lab")
+        record_authorization(ctx, operator="test-operator", target_assertion="home-lab")
         ctx.add("ap_subnet", "192.168.99.0/24")
         result = discover_hosts(ctx, {"wait": 0})
 
@@ -39,6 +41,7 @@ def test_discovers_hosts(self, mock_run, mock_sleep):
     def test_no_hosts_found(self, mock_run, mock_sleep):
         mock_run.return_value = MagicMock(stdout="", returncode=0)
         ctx = Context(target="home-lab")
+        record_authorization(ctx, operator="test-operator", target_assertion="home-lab")
         result = discover_hosts(ctx, {"wait": 0})
         assert result.get("live_hosts") == []
 
@@ -47,6 +50,7 @@ def test_no_hosts_found(self, mock_run, mock_sleep):
     def test_uses_context_subnet(self, mock_run, mock_sleep):
         mock_run.return_value = MagicMock(stdout="", returncode=0)
         ctx = Context(target="home-lab")
+        record_authorization(ctx, operator="test-operator", target_assertion="home-lab")
         ctx.add("ap_subnet", "10.0.0.0/24")
         discover_hosts(ctx, {"wait": 0})
         call_args = mock_run.call_args[0][0]
@@ -106,6 +110,7 @@ class TestScanPorts:
     def test_scans_all_hosts(self, mock_run):
         mock_run.return_value = MagicMock(stdout=SAMPLE_NMAP_XML, returncode=0)
         ctx = Context(target="home-lab")
+        record_authorization(ctx, operator="test-operator", target_assertion="home-lab")
         ctx.add(
             "live_hosts",
             [
@@ -122,6 +127,7 @@ def test_scans_all_hosts(self, mock_run):
 
     def test_no_hosts_logs_error(self):
         ctx = Context(target="home-lab")
+        record_authorization(ctx, operator="test-operator", target_assertion="home-lab")
         result = scan_ports(ctx)
         error_logs = result.get_logs(level="ERROR")
         assert any("No live hosts" in log["message"] for log in error_logs)
diff --git a/tests/test_pipeline.py b/tests/test_pipeline.py
index 0dc12bf..e6bb95c 100644
--- a/tests/test_pipeline.py
+++ b/tests/test_pipeline.py
@@ -2,6 +2,7 @@
 
 import pytest
 from pathlib import Path
+from unittest.mock import patch
 from redops.core.context import Context
 from redops.pipelines.loader import PipelineLoader
 from redops.pipelines.runner import PipelineRunner
@@ -151,3 +152,64 @@ def test_pipeline_runner_disabled_steps():
     # The enabled_steps property should filter out disabled steps
     assert len(pipeline.enabled_steps) == 1
     assert pipeline.enabled_steps[0].name == "Enabled Step"
+
+
+def test_pipeline_runner_rollback_on_step_failure():
+    """Test that context is rolled back when a step fails with continue_on_error."""
+    from redops.pipelines.schemas import Pipeline, PipelineMetadata, PipelineStep
+
+    def _failing_step(ctx, params):
+        ctx.add("corrupted", True)
+        raise RuntimeError("step failure")
+
+    pipeline = Pipeline(
+        metadata=PipelineMetadata(name="Rollback Test", version="1.0"),
+        steps=[
+            PipelineStep(
+                name="Good Step",
+                module="compliance.audit_log.audit_pipeline_start",
+                enabled=True,
+            ),
+            PipelineStep(
+                name="Failing Step",
+                module="compliance.audit_log.audit_pipeline_start",
+                enabled=True,
+                continue_on_error=True,
+            ),
+        ],
+    )
+
+    runner = PipelineRunner(pipeline)
+    with patch.object(runner, "_resolve_module_function") as mock_resolve:
+        def _mock_func(step_name):
+            if step_name == "Failing Step":
+                return _failing_step
+            return lambda ctx, params: ctx
+
+        # The module path maps to the step name for this mock
+        mock_resolve.side_effect = lambda path: _failing_step if "failing" in path.lower() else lambda ctx, params: ctx
+        ctx = runner.run(target="test.com", parallel=False)
+
+    # The failing step should have been rolled back; "corrupted" should not exist
+    assert ctx.get("corrupted") is None
+    assert ctx.get("pipeline_name") == "Rollback Test"
+
+
+def test_pipeline_runner_checkpoints_cleared_after_run():
+    """Test that checkpoints are cleared after pipeline completes."""
+    from redops.pipelines.schemas import Pipeline, PipelineMetadata, PipelineStep
+
+    pipeline = Pipeline(
+        metadata=PipelineMetadata(name="Clear Test", version="1.0"),
+        steps=[
+            PipelineStep(
+                name="Audit Step",
+                module="compliance.audit_log.audit_pipeline_start",
+                enabled=True,
+            )
+        ],
+    )
+
+    runner = PipelineRunner(pipeline)
+    ctx = runner.run(target="test.com")
+    assert len(ctx._checkpoints) == 0
diff --git a/tests/test_pipeline_library.py b/tests/test_pipeline_library.py
new file mode 100644
index 0000000..5f61487
--- /dev/null
+++ b/tests/test_pipeline_library.py
@@ -0,0 +1,176 @@
+"""Tests for the example pipeline library.
+
+Validates that all pipeline JSON files in config/pipelines/ load,
+pass schema validation, and contain expected metadata and steps.
+"""
+
+import json
+from pathlib import Path
+
+import pytest
+
+from redops.pipelines.schemas import Pipeline, PipelineStep
+
+
+PIPELINES_DIR = Path(__file__).parents[1] / "config" / "pipelines"
+
+
+def _load_pipeline(path: Path) -> Pipeline:
+    """Load and validate a pipeline JSON file."""
+    with open(path, "r") as f:
+        data = json.load(f)
+    return Pipeline(**data)
+
+
+class TestPipelineLibrary:
+    """Tests for all pipeline definitions in config/pipelines/."""
+
+    @pytest.fixture(scope="class")
+    def pipeline_paths(self):
+        """Return all pipeline JSON files."""
+        paths = sorted(PIPELINES_DIR.glob("*.json"))
+        assert paths, f"No pipeline files found in {PIPELINES_DIR}"
+        return paths
+
+    def test_all_pipelines_load(self, pipeline_paths):
+        """Every pipeline JSON file loads without error."""
+        for path in pipeline_paths:
+            pipeline = _load_pipeline(path)
+            assert pipeline is not None
+            assert pipeline.metadata.name
+
+    def test_all_pipelines_have_metadata(self, pipeline_paths):
+        """Every pipeline has required metadata fields."""
+        for path in pipeline_paths:
+            pipeline = _load_pipeline(path)
+            assert pipeline.metadata.name
+            assert pipeline.metadata.version
+            assert pipeline.metadata.tags is not None
+
+    def test_all_pipelines_have_at_least_one_step(self, pipeline_paths):
+        """Every pipeline has at least one step."""
+        for path in pipeline_paths:
+            pipeline = _load_pipeline(path)
+            assert len(pipeline.steps) >= 1
+
+    def test_all_pipelines_have_at_least_one_enabled_step(self, pipeline_paths):
+        """Every pipeline has at least one enabled step."""
+        for path in pipeline_paths:
+            pipeline = _load_pipeline(path)
+            assert len(pipeline.enabled_steps) >= 1
+
+    def test_all_steps_have_valid_module_paths(self, pipeline_paths):
+        """Every step references a valid dotted module path."""
+        for path in pipeline_paths:
+            pipeline = _load_pipeline(path)
+            for step in pipeline.steps:
+                assert "." in step.module or step.module.startswith("plugin:")
+                assert step.name
+
+    def test_pipelines_validate(self, pipeline_paths):
+        """Every pipeline passes Pipeline.validate_pipeline()."""
+        for path in pipeline_paths:
+            pipeline = _load_pipeline(path)
+            assert pipeline.validate_pipeline() is True
+
+    def test_no_duplicate_step_names(self, pipeline_paths):
+        """No pipeline contains duplicate step names."""
+        for path in pipeline_paths:
+            pipeline = _load_pipeline(path)
+            names = [step.name for step in pipeline.steps]
+            assert len(names) == len(set(names)), f"Duplicate names in {path.name}"
+
+    def test_pipeline_files_count(self, pipeline_paths):
+        """Pipeline library has expected number of examples."""
+        # Should have at least 9 pipeline files (existing 4 + new 5)
+        assert len(pipeline_paths) >= 9
+
+
+class TestSpecificPipelines:
+    """Tests for individual pipeline content."""
+
+    def test_bug_bounty_recon_exists(self):
+        """Bug bounty recon pipeline exists and has expected steps."""
+        path = PIPELINES_DIR / "bug_bounty_recon.json"
+        assert path.exists()
+        pipeline = _load_pipeline(path)
+        assert pipeline.metadata.name == "Bug Bounty Recon"
+        modules = [step.module for step in pipeline.steps]
+        assert "recon.subdomain_enum.enumerate_subdomains" in modules
+        assert "recon.cert_transparency.query_ct_logs" in modules
+
+    def test_incident_response_exists(self):
+        """Incident response pipeline exists and has threat-intel steps."""
+        path = PIPELINES_DIR / "incident_response.json"
+        assert path.exists()
+        pipeline = _load_pipeline(path)
+        assert pipeline.metadata.name == "Incident Response Triage"
+        modules = [step.module for step in pipeline.steps]
+        assert "threat_intel.abuseipdb.check_ip" in modules
+        assert "threat_intel.greynoise.query_greynoise" in modules
+        assert "intel.stix_export.export_stix" in modules
+
+    def test_compliance_assessment_exists(self):
+        """Compliance assessment pipeline exists and maps controls."""
+        path = PIPELINES_DIR / "compliance_assessment.json"
+        assert path.exists()
+        pipeline = _load_pipeline(path)
+        assert pipeline.metadata.name == "Compliance Assessment"
+        modules = [step.module for step in pipeline.steps]
+        assert "compliance.compliance_map.map_controls" in modules
+        assert "reporting.oscal_report.generate_oscal" in modules
+
+    def test_wireless_recon_exists(self):
+        """Wireless recon pipeline exists and requires authorization."""
+        path = PIPELINES_DIR / "wireless_recon.json"
+        assert path.exists()
+        pipeline = _load_pipeline(path)
+        assert pipeline.metadata.name == "Wireless Reconnaissance"
+        assert pipeline.config.get("requires_authorization") is True
+        modules = [step.module for step in pipeline.steps]
+        assert "active.wireless.scan.scan_access_points" in modules
+        assert "active.wireless.monitor.enable_monitor_mode" in modules
+        assert "active.wireless.monitor.disable_monitor_mode" in modules
+
+    def test_quickstart_exists(self):
+        """Quickstart pipeline exists and targets <60s runtime."""
+        path = PIPELINES_DIR / "quickstart.json"
+        assert path.exists()
+        pipeline = _load_pipeline(path)
+        assert pipeline.metadata.name == "Quick Start"
+        assert pipeline.config.get("timeout") == 60
+        assert pipeline.config.get("strict_scope") is False
+        assert len(pipeline.steps) <= 5
+
+    def test_recon_pipeline_exists(self):
+        """Original recon pipeline still validates."""
+        path = PIPELINES_DIR / "recon_pipeline.json"
+        assert path.exists()
+        pipeline = _load_pipeline(path)
+        assert pipeline.metadata.name == "Reconnaissance Pipeline"
+        assert pipeline.validate_pipeline() is True
+
+    def test_corp_assessment_exists(self):
+        """Original corporate assessment pipeline still validates."""
+        path = PIPELINES_DIR / "corp_assessment.json"
+        assert path.exists()
+        pipeline = _load_pipeline(path)
+        assert pipeline.metadata.name == "Corporate Assessment Pipeline"
+        assert pipeline.validate_pipeline() is True
+
+    def test_forensic_pipeline_exists(self):
+        """Original forensic pipeline still validates."""
+        path = PIPELINES_DIR / "forensic_pipeline.json"
+        assert path.exists()
+        pipeline = _load_pipeline(path)
+        assert pipeline.metadata.name == "Forensic Analysis Pipeline"
+        assert pipeline.validate_pipeline() is True
+
+    def test_active_chain_exists(self):
+        """Original active chain pipeline still validates."""
+        path = PIPELINES_DIR / "active_chain.json"
+        assert path.exists()
+        pipeline = _load_pipeline(path)
+        assert "Active" in pipeline.metadata.name
+        assert "Chain" in pipeline.metadata.name
+        assert pipeline.validate_pipeline() is True
diff --git a/tests/test_rf_modules.py b/tests/test_rf_modules.py
new file mode 100644
index 0000000..5c0b3c6
--- /dev/null
+++ b/tests/test_rf_modules.py
@@ -0,0 +1,1044 @@
+"""Tests for the RF operations module.
+
+Covers parsers, models, session lifecycle, event bus, and AI client.
+Subprocess-dependent modules (interface_manager, tool_manager) are tested
+where parsing logic can be exercised in isolation.
+"""
+
+import asyncio
+import json
+import sqlite3
+import tempfile
+import time
+from datetime import datetime, timezone
+from pathlib import Path
+from unittest.mock import MagicMock, Mock, patch
+
+import pytest
+
+# ── Parsers ──
+from redops.modules.rf.parsers.airodump import (
+    _clean_field,
+    _parse_ap_row,
+    _parse_client_row,
+    _parse_int,
+    parse_airodump_csv,
+)
+from redops.modules.rf.parsers.hcxdumptool import (
+    check_for_captures,
+    parse_hcx_status,
+)
+from redops.modules.rf.parsers.horst import parse_horst_line
+from redops.modules.rf.parsers.reaver import parse_reaver_line
+from redops.modules.rf.parsers.tshark import (
+    build_tshark_stats_command,
+    parse_tshark_json,
+)
+
+# ── Models & Session Manager ──
+from redops.modules.rf.models import (
+    Capture,
+    Client,
+    RFSession,
+    RFFinding,
+    Target,
+    ToolRun,
+    WirelessInterface,
+    get_session,
+    get_targets_for_session,
+    init_db,
+    insert_capture,
+    insert_client,
+    insert_finding,
+    insert_session,
+    insert_target,
+    insert_tool_run,
+    update_tool_run_status,
+)
+from redops.modules.rf.session_manager import (
+    Capture as SMCapture,
+    RFSession as SMRFSession,
+    SessionManager,
+    SessionStatus,
+    _compute_sha256,
+    _now_iso,
+)
+
+# ── Event Bus ──
+from redops.modules.rf.event_bus import (
+    EVENT_AP_DISCOVERED,
+    EVENT_TOOL_STARTED,
+    Event,
+    EventBus,
+)
+
+# ── AI Client ──
+from redops.modules.rf.ai_client import (
+    AIClient,
+    AIClientError,
+    _load_ollama_host,
+    _load_openrouter_config,
+)
+
+# ── Tool Manager ──
+from redops.modules.rf.tool_manager import (
+    IngestionStrategy,
+    ResourceClass,
+    ToolManager,
+    ToolSpec,
+    register_defaults,
+)
+
+
+# ═══════════════════════════════════════════════════════════
+# Helpers
+# ═══════════════════════════════════════════════════════════
+
+@pytest.fixture
+def tmp_db():
+    """Yield a temporary SQLite database path and clean up after."""
+    with tempfile.NamedTemporaryFile(suffix=".db", delete=False) as f:
+        path = Path(f.name)
+    yield path
+    path.unlink(missing_ok=True)
+
+
+@pytest.fixture
+def db_conn(tmp_db):
+    """Open an initialized RF database connection."""
+    conn = init_db(tmp_db)
+    yield conn
+    conn.close()
+
+
+# ═══════════════════════════════════════════════════════════
+# Airodump Parser
+# ═══════════════════════════════════════════════════════════
+
+class TestAirodumpParser:
+    """Tests for airodump-ng CSV parser."""
+
+    def test_clean_field(self):
+        assert _clean_field("  test  ") == "test"
+        assert _clean_field("") == ""
+        assert _clean_field(None) == ""
+
+    def test_parse_int(self):
+        assert _parse_int("42") == 42
+        assert _parse_int("  7  ") == 7
+        assert _parse_int("bad") == 0
+        assert _parse_int("bad", -1) == -1
+        assert _parse_int(None) == 0
+
+    def test_parse_ap_row_valid(self):
+        row = [
+            "00:11:22:33:44:55", "2024-01-01", "2024-01-02",
+            "6", "54", "WPA2", "CCMP", "PSK", "-42",
+            "100", "50", "", "6", "TestAP", "",
+        ]
+        result = _parse_ap_row(row)
+        assert result is not None
+        assert result["bssid"] == "00:11:22:33:44:55"
+        assert result["essid"] == "TestAP"
+        assert result["channel"] == 6
+        assert result["signal"] == -42
+
+    def test_parse_ap_row_short(self):
+        assert _parse_ap_row(["00:11:22:33:44:55"]) is None
+
+    def test_parse_ap_row_invalid_bssid(self):
+        row = ["short", "", "", "6"] + [""] * 10
+        assert _parse_ap_row(row) is None
+
+    def test_parse_client_row_valid(self):
+        row = [
+            "AA:BB:CC:DD:EE:FF", "2024-01-01", "2024-01-02",
+            "-60", "10", "00:11:22:33:44:55", "TestAP,OtherAP",
+        ]
+        result = _parse_client_row(row)
+        assert result is not None
+        assert result["mac"] == "AA:BB:CC:DD:EE:FF"
+        assert result["signal"] == -60
+        assert result["probes"] == ["TestAP", "OtherAP"]
+
+    def test_parse_airodump_csv_full(self, tmp_path):
+        csv = (
+            "BSSID, First time seen, Last time seen, channel, Speed, Privacy, "
+            "Cipher, Authentication, Power, # beacons, # IV, LAN IP, ID-length, ESSID, Key\n"
+            "00:11:22:33:44:55, 2024-01-01, 2024-01-02, 6, 54, WPA2, "
+            "CCMP, PSK, -42, 100, 0, 0.0.0.0, 6, TestAP, \n\n"
+            "Station MAC, First time seen, Last time seen, Power, # packets, BSSID, Probed ESSIDs\n"
+            "AA:BB:CC:DD:EE:FF, 2024-01-01, 2024-01-02, -60, 10, "
+            "00:11:22:33:44:55, TestAP\n"
+        )
+        f = tmp_path / "test.csv"
+        f.write_text(csv)
+        aps, clients = parse_airodump_csv(str(f))
+        assert len(aps) == 1
+        assert aps[0]["essid"] == "TestAP"
+        assert len(clients) == 1
+        assert clients[0]["mac"] == "AA:BB:CC:DD:EE:FF"
+
+    def test_parse_airodump_csv_missing_file(self, tmp_path):
+        with pytest.raises(FileNotFoundError):
+            parse_airodump_csv(str(tmp_path / "nonexistent.csv"))
+
+
+# ═══════════════════════════════════════════════════════════
+# Hcxdumptool Parser
+# ═══════════════════════════════════════════════════════════
+
+class TestHcxdumptoolParser:
+    """Tests for hcxdumptool status parser."""
+
+    def test_parse_hcx_status_empty(self):
+        assert parse_hcx_status("") is None
+        assert parse_hcx_status("   ") is None
+
+    def test_parse_hcx_status_packets(self):
+        result = parse_hcx_status("[60] packets: 1500")
+        assert result["timestamp"] == 60
+        assert result["packets"] == 1500
+
+    def test_parse_hcx_status_bssid_essid(self):
+        result = parse_hcx_status("BSSID: 00:11:22:33:44:55 ESSID: TestAP")
+        assert result["bssid"] == "00:11:22:33:44:55"
+        assert result["essid"] == "TestAP"
+
+    def test_parse_hcx_status_client(self):
+        result = parse_hcx_status("CLIENT: aa:bb:cc:dd:ee:ff")
+        assert result["client"] == "AA:BB:CC:DD:EE:FF"
+
+    def test_parse_hcx_status_pmkid(self):
+        result = parse_hcx_status("PMKID captured")
+        assert result["pmkid_detected"] is True
+        assert result["eapol_detected"] is False
+
+    def test_parse_hcx_status_eapol(self):
+        result = parse_hcx_status("EAPOL frame received")
+        assert result["pmkid_detected"] is False
+        assert result["eapol_detected"] is True
+
+    def test_check_for_captures_missing_file(self, tmp_path):
+        with pytest.raises(FileNotFoundError):
+            check_for_captures(tmp_path / "nonexistent.pcapng")
+
+    def test_check_for_captures_success(self, tmp_path):
+        pcap = tmp_path / "test.pcapng"
+        pcap.write_text("dummy")
+        with patch("redops.modules.rf.parsers.hcxdumptool.subprocess.run") as mock_run:
+            mock_run.return_value = Mock(
+                stdout="PMKID: 2\nEAPOL: 3\nbest handshake: 1",
+                stderr="",
+                returncode=0,
+            )
+            result = check_for_captures(pcap)
+        assert result["pmkids"] == 2
+        assert result["handshakes"] == 3
+        assert result["best_handshakes"] == 1
+
+    def test_check_for_captures_tool_not_found(self, tmp_path):
+        pcap = tmp_path / "test.pcapng"
+        pcap.write_text("dummy")
+        with patch("redops.modules.rf.parsers.hcxdumptool.subprocess.run") as mock_run:
+            mock_run.side_effect = FileNotFoundError("hcxpcapngtool")
+            result = check_for_captures(pcap)
+        assert "not found" in result["error"]
+
+    def test_check_for_captures_timeout(self, tmp_path):
+        pcap = tmp_path / "test.pcapng"
+        pcap.write_text("dummy")
+        with patch("redops.modules.rf.parsers.hcxdumptool.subprocess.run") as mock_run:
+            import subprocess as sp
+            mock_run.side_effect = sp.TimeoutExpired("hcxpcapngtool", 60)
+            result = check_for_captures(pcap)
+        assert "timed out" in result["error"]
+
+
+# ═══════════════════════════════════════════════════════════
+# Horst Parser
+# ═══════════════════════════════════════════════════════════
+
+class TestHorstParser:
+    """Tests for horst output parser."""
+
+    def test_parse_horst_line_standard(self):
+        line = "1234.5  -45  6  BEACON  00:11:22:33:44:55"
+        result = parse_horst_line(line)
+        assert result["mac"] == "00:11:22:33:44:55"
+        assert result["signal"] == -45
+        assert result["channel"] == 6
+        assert result["type"] == "BEACON"
+
+    def test_parse_horst_line_bracket(self):
+        line = "[6]  -50dBm  DATA  AA:BB:CC:DD:EE:FF  extra info"
+        result = parse_horst_line(line)
+        assert result["mac"] == "AA:BB:CC:DD:EE:FF"
+        assert result["signal"] == -50
+        assert result["channel"] == 6
+        assert result["type"] == "DATA"
+        assert result["extra"] == "extra info"
+
+    def test_parse_horst_line_empty(self):
+        assert parse_horst_line("") is None
+        assert parse_horst_line("   ") is None
+
+    def test_parse_horst_line_header_skipped(self):
+        assert parse_horst_line("# comment") is None
+        assert parse_horst_line("---") is None
+
+    def test_parse_horst_line_no_match(self):
+        assert parse_horst_line("not a valid line") is None
+
+
+# ═══════════════════════════════════════════════════════════
+# Reaver Parser
+# ═══════════════════════════════════════════════════════════
+
+class TestReaverParser:
+    """Tests for reaver output parser."""
+
+    def test_parse_reaver_line_empty(self):
+        assert parse_reaver_line("") is None
+
+    def test_wps_pin_found(self):
+        result = parse_reaver_line("WPS PIN: '12345678'")
+        assert result["type"] == "success"
+        assert result["wps_pin"] == "12345678"
+
+    def test_wpa_psk_found(self):
+        result = parse_reaver_line("WPA PSK: 'secretpassword'")
+        assert result["type"] == "success"
+        assert result["wpa_psk"] == "secretpassword"
+
+    def test_pin_attempt(self):
+        result = parse_reaver_line("Trying pin 1234")
+        assert result["type"] == "attempt"
+        assert result["pin"] == "1234"
+
+    def test_pin_attempt_with_progress(self):
+        result = parse_reaver_line("Trying pin 1234 (12.5% complete)")
+        assert result["type"] == "attempt"
+        assert result["pin"] == "1234"
+        assert result["progress"] == 12.5
+
+    def test_progress_standalone(self):
+        result = parse_reaver_line("45.0% complete")
+        assert result["type"] == "progress"
+        assert result["progress"] == 45.0
+
+    def test_association(self):
+        result = parse_reaver_line("Associated with AA:BB (ESSID: TestNet)")
+        assert result["type"] == "association"
+        assert result["bssid"] == "AA:BB"
+        assert result["essid"] == "TestNet"
+
+    def test_locked_warning(self):
+        result = parse_reaver_line("WARNING: WPS locked")
+        assert result["type"] == "warning"
+        assert result["warning"] == "locked"
+
+    def test_rate_limited_warning(self):
+        result = parse_reaver_line("WARNING: rate limiting detected")
+        assert result["type"] == "warning"
+        assert result["warning"] == "rate_limited"
+
+    def test_timeout_warning(self):
+        result = parse_reaver_line("WARNING: timeout occurred")
+        assert result["type"] == "warning"
+        assert result["warning"] == "timeout"
+
+    def test_failure(self):
+        result = parse_reaver_line("WPS transaction failed")
+        assert result["type"] == "failure"
+
+    def test_no_match(self):
+        assert parse_reaver_line("random log line") is None
+
+
+# ═══════════════════════════════════════════════════════════
+# Tshark Parser
+# ═══════════════════════════════════════════════════════════
+
+class TestTsharkParser:
+    """Tests for tshark JSON parser and command builder."""
+
+    def test_build_command_basic(self):
+        cmd = build_tshark_stats_command("wlan0mon", 30)
+        assert cmd[0] == "tshark"
+        assert "wlan0mon" in cmd
+        assert "duration:30" in cmd
+
+    def test_build_command_empty_interface_raises(self):
+        with pytest.raises(ValueError, match="empty"):
+            build_tshark_stats_command("", 30)
+
+    def test_build_command_zero_duration_raises(self):
+        with pytest.raises(ValueError, match="positive"):
+            build_tshark_stats_command("wlan0", 0)
+
+    def test_build_command_negative_duration_raises(self):
+        with pytest.raises(ValueError, match="positive"):
+            build_tshark_stats_command("wlan0", -1)
+
+    def test_parse_tshark_json_empty(self):
+        assert parse_tshark_json("") is None
+        assert parse_tshark_json("   ") is None
+
+    def test_parse_tshark_json_invalid(self):
+        assert parse_tshark_json("not json") is None
+
+    def test_parse_tshark_json_index_line_skipped(self):
+        line = '{"index": {}}'
+        assert parse_tshark_json(line) is None
+
+    def test_parse_tshark_json_no_layers_skipped(self):
+        line = '{"timestamp": 123}'
+        assert parse_tshark_json(line) is None
+
+    def test_parse_tshark_json_full(self):
+        line = json.dumps({
+            "timestamp": "1234567890",
+            "layers": {
+                "frame": {
+                    "frame_frame_len": ["1500"],
+                    "frame_frame_protocols": ["eth:ip:tcp"],
+                },
+                "eth": {
+                    "eth_eth_src": ["00:11:22:33:44:55"],
+                    "eth_eth_dst": ["AA:BB:CC:DD:EE:FF"],
+                },
+                "ip": {
+                    "ip_ip_src": ["192.168.1.1"],
+                    "ip_ip_dst": ["192.168.1.2"],
+                },
+            },
+        })
+        result = parse_tshark_json(line)
+        assert result["timestamp"] == "1234567890"
+        assert result["length"] == 1500
+        assert result["protocol"] == "eth:ip:tcp"
+        assert result["src_mac"] == "00:11:22:33:44:55"
+        assert result["dst_mac"] == "AA:BB:CC:DD:EE:FF"
+        assert result["src_ip"] == "192.168.1.1"
+        assert result["dst_ip"] == "192.168.1.2"
+
+    def test_parse_tshark_json_no_ip(self):
+        line = json.dumps({
+            "layers": {
+                "frame": {"frame_frame_len": "64"},
+                "eth": {
+                    "eth_eth_src": "00:11:22:33:44:55",
+                },
+            },
+        })
+        result = parse_tshark_json(line)
+        assert result["length"] == 64
+        assert result["src_mac"] == "00:11:22:33:44:55"
+        assert result.get("src_ip") is None
+
+    def test_get_pcap_summary_missing_file(self, tmp_path):
+        with pytest.raises(FileNotFoundError):
+            from redops.modules.rf.parsers.tshark import get_pcap_summary
+            get_pcap_summary(tmp_path / "nonexistent.pcap")
+
+    def test_get_pcap_summary_success(self, tmp_path):
+        pcap = tmp_path / "test.pcap"
+        pcap.write_text("dummy")
+        from redops.modules.rf.parsers.tshark import get_pcap_summary
+        with patch("redops.modules.rf.parsers.tshark.subprocess.run") as mock_run:
+            mock_run.return_value = Mock(
+                stdout=json.dumps({
+                    "layers": {
+                        "frame": {
+                            "frame_frame_len": ["100"],
+                            "frame_frame_protocols": ["eth:ip:tcp"],
+                        },
+                        "eth": {
+                            "eth_eth_src": ["00:11:22:33:44:55"],
+                            "eth_eth_dst": ["AA:BB:CC:DD:EE:FF"],
+                        },
+                        "ip": {
+                            "ip_ip_src": ["10.0.0.1"],
+                            "ip_ip_dst": ["10.0.0.2"],
+                        },
+                    },
+                }),
+                stderr="",
+                returncode=0,
+            )
+            result = get_pcap_summary(pcap, max_packets=1)
+        assert result["packet_count"] == 1
+        assert "tcp" in result["protocols"]
+
+
+# ═══════════════════════════════════════════════════════════
+# RF Models (DB layer)
+# ═══════════════════════════════════════════════════════════
+
+class TestRFModels:
+    """Tests for RF SQLite-backed models."""
+
+    def test_init_db_creates_tables(self, db_conn):
+        tables = db_conn.execute(
+            "SELECT name FROM sqlite_master WHERE type='table'"
+        ).fetchall()
+        names = {t[0] for t in tables}
+        assert "rf_sessions" in names
+        assert "targets" in names
+        assert "clients" in names
+        assert "captures" in names
+        assert "rf_findings" in names
+        assert "tool_runs" in names
+
+    def test_insert_and_get_session(self, db_conn):
+        session = RFSession(name="Test Session")
+        sid = insert_session(db_conn, session)
+        assert isinstance(sid, int)
+        fetched = get_session(db_conn, sid)
+        assert fetched is not None
+        assert fetched.name == "Test Session"
+        assert fetched.status == "created"
+
+    def test_insert_target(self, db_conn):
+        session = RFSession(name="S")
+        sid = insert_session(db_conn, session)
+        target = Target(
+            session_id=sid,
+            bssid="00:11:22:33:44:55",
+            essid="TestAP",
+            tags=["wps", "high-signal"],
+        )
+        tid = insert_target(db_conn, target)
+        assert isinstance(tid, int)
+        targets = get_targets_for_session(db_conn, sid)
+        assert len(targets) == 1
+        assert targets[0].bssid == "00:11:22:33:44:55"
+        assert targets[0].tags == ["wps", "high-signal"]
+
+    def test_insert_client(self, db_conn):
+        client = Client(mac="AA:BB:CC:DD:EE:FF", probes=["Net1", "Net2"])
+        cid = insert_client(db_conn, client)
+        assert isinstance(cid, int)
+
+    def test_insert_capture(self, db_conn):
+        session = RFSession(name="S")
+        sid = insert_session(db_conn, session)
+        cap = Capture(
+            target_id=None,
+            session_id=sid,
+            capture_type="handshake",
+            file_path="/tmp/cap.pcap",
+        )
+        cap_id = insert_capture(db_conn, cap)
+        assert isinstance(cap_id, int)
+
+    def test_insert_finding(self, db_conn):
+        session = RFSession(name="S")
+        sid = insert_session(db_conn, session)
+        finding = RFFinding(
+            target_id=None,
+            session_id=sid,
+            finding_type="vuln",
+            severity="high",
+            evidence={"key": "value"},
+        )
+        fid = insert_finding(db_conn, finding)
+        assert isinstance(fid, int)
+
+    def test_insert_tool_run(self, db_conn):
+        session = RFSession(name="S")
+        sid = insert_session(db_conn, session)
+        tr = ToolRun(session_id=sid, tool="airodump-ng", command="airodump-ng wlan0")
+        trid = insert_tool_run(db_conn, tr)
+        assert isinstance(trid, int)
+
+    def test_update_tool_run_status(self, db_conn):
+        session = RFSession(name="S")
+        sid = insert_session(db_conn, session)
+        tr = ToolRun(session_id=sid, tool="test")
+        trid = insert_tool_run(db_conn, tr)
+        update_tool_run_status(db_conn, trid, "done", 0)
+        row = db_conn.execute(
+            "SELECT status, exit_code FROM tool_runs WHERE id=?", (trid,)
+        ).fetchone()
+        assert row[0] == "done"
+        assert row[1] == 0
+
+    def test_get_session_missing(self, db_conn):
+        assert get_session(db_conn, 9999) is None
+
+
+# ═══════════════════════════════════════════════════════════
+# Session Manager
+# ═══════════════════════════════════════════════════════════
+
+class TestSessionManager:
+    """Tests for RF SessionManager lifecycle."""
+
+    def test_create_session(self, tmp_path):
+        sm = SessionManager(base_dir=tmp_path)
+        session = sm.create_session("Lab Test")
+        assert session.name == "Lab Test"
+        assert session.status == SessionStatus.CREATED
+        assert Path(session.session_dir).exists()
+        # Check subdirs created
+        for sub in sm._SESSION_SUBDIRS:
+            assert (Path(session.session_dir) / sub).exists()
+
+    def test_create_session_empty_name_raises(self, tmp_path):
+        sm = SessionManager(base_dir=tmp_path)
+        with pytest.raises(ValueError, match="empty"):
+            sm.create_session("")
+
+    def test_create_session_duplicate_raises(self, tmp_path):
+        sm = SessionManager(base_dir=tmp_path)
+        sm.create_session("Duplicate")
+        with pytest.raises(FileExistsError):
+            sm.create_session("Duplicate")
+
+    def test_start_session(self, tmp_path):
+        sm = SessionManager(base_dir=tmp_path)
+        session = sm.create_session("S")
+        sm.start_session(session.session_id)
+        fetched = sm.get_session(session.session_id)
+        assert fetched.status == SessionStatus.ACTIVE
+        assert fetched.started_at is not None
+
+    def test_start_not_created_raises(self, tmp_path):
+        sm = SessionManager(base_dir=tmp_path)
+        session = sm.create_session("S")
+        sm.start_session(session.session_id)
+        with pytest.raises(ValueError, match="created"):
+            sm.start_session(session.session_id)
+
+    def test_end_session(self, tmp_path):
+        sm = SessionManager(base_dir=tmp_path)
+        session = sm.create_session("S")
+        sm.start_session(session.session_id)
+        sm.end_session(session.session_id)
+        fetched = sm.get_session(session.session_id)
+        assert fetched.status == SessionStatus.CLOSED
+        assert fetched.ended_at is not None
+
+    def test_add_capture(self, tmp_path):
+        sm = SessionManager(base_dir=tmp_path)
+        session = sm.create_session("S")
+        sm.start_session(session.session_id)
+        cap_file = tmp_path / "test.pcap"
+        cap_file.write_text("pcap data")
+        capture = sm.add_capture(
+            session.session_id,
+            target_id="00:11:22:33:44:55",
+            capture_type="pcap",
+            file_path=cap_file,
+            tool="airodump-ng",
+        )
+        assert capture.capture_type == "pcap"
+        assert capture.sha256 is not None
+        assert len(capture.sha256) == 64
+
+    def test_add_capture_inactive_raises(self, tmp_path):
+        sm = SessionManager(base_dir=tmp_path)
+        session = sm.create_session("S")
+        cap_file = tmp_path / "test.pcap"
+        cap_file.write_text("data")
+        with pytest.raises(ValueError, match="created"):
+            sm.add_capture(
+                session.session_id,
+                target_id="t",
+                capture_type="pcap",
+                file_path=cap_file,
+                tool="t",
+            )
+
+    def test_list_sessions(self, tmp_path):
+        sm = SessionManager(base_dir=tmp_path)
+        sm.create_session("A")
+        sm.create_session("B")
+        sessions = sm.list_sessions()
+        assert len(sessions) == 2
+
+    def test_archive_session(self, tmp_path):
+        sm = SessionManager(base_dir=tmp_path)
+        session = sm.create_session("ArchiveMe")
+        sm.start_session(session.session_id)
+        sm.end_session(session.session_id)
+        archive = sm.archive_session(session.session_id)
+        assert archive.exists()
+        assert archive.suffix == ".gz"
+
+    def test_archive_not_closed_raises(self, tmp_path):
+        sm = SessionManager(base_dir=tmp_path)
+        session = sm.create_session("S")
+        with pytest.raises(ValueError, match="closed"):
+            sm.archive_session(session.session_id)
+
+    def test_compute_sha256(self, tmp_path):
+        f = tmp_path / "hash.txt"
+        f.write_text("hello")
+        h = _compute_sha256(f)
+        assert len(h) == 64
+        # Verify with stdlib
+        import hashlib
+        expected = hashlib.sha256(b"hello").hexdigest()
+        assert h == expected
+
+    def test_now_iso(self):
+        s = _now_iso()
+        assert "T" in s
+        assert "+" in s
+
+
+# ═══════════════════════════════════════════════════════════
+# Event Bus
+# ═══════════════════════════════════════════════════════════
+
+@pytest.fixture
+def event_bus():
+    return EventBus(history_size=10)
+
+
+class TestEventBus:
+    """Tests for the RF asyncio event bus."""
+
+    @pytest.mark.asyncio
+    async def test_subscribe_and_emit(self, event_bus):
+        events = []
+
+        def handler(evt):
+            events.append(evt)
+
+        sub_id = event_bus.subscribe(EVENT_AP_DISCOVERED, handler)
+        evt = await event_bus.emit(EVENT_AP_DISCOVERED, {"bssid": "00:11:22:33:44:55"})
+        assert len(events) == 1
+        assert events[0].data["bssid"] == "00:11:22:33:44:55"
+        assert event_bus.unsubscribe(sub_id) is True
+
+    @pytest.mark.asyncio
+    async def test_async_subscriber(self, event_bus):
+        events = []
+
+        async def handler(evt):
+            events.append(evt)
+
+        event_bus.subscribe(EVENT_AP_DISCOVERED, handler)
+        await event_bus.emit(EVENT_AP_DISCOVERED, {"x": 1})
+        assert len(events) == 1
+
+    @pytest.mark.asyncio
+    async def test_unsubscribe_unknown(self, event_bus):
+        assert event_bus.unsubscribe("not-real") is False
+
+    @pytest.mark.asyncio
+    async def test_emit_no_subscribers(self, event_bus):
+        evt = await event_bus.emit(EVENT_TOOL_STARTED, {})
+        assert evt.event_type == EVENT_TOOL_STARTED
+
+    @pytest.mark.asyncio
+    async def test_history_tracks_events(self, event_bus):
+        await event_bus.emit(EVENT_AP_DISCOVERED, {"a": 1})
+        await event_bus.emit(EVENT_AP_DISCOVERED, {"b": 2})
+        recent = event_bus.recent_events
+        assert len(recent) == 2
+
+    @pytest.mark.asyncio
+    async def test_recent_events_by_type(self, event_bus):
+        await event_bus.emit(EVENT_AP_DISCOVERED, {})
+        await event_bus.emit(EVENT_TOOL_STARTED, {})
+        aps = event_bus.recent_events_by_type(EVENT_AP_DISCOVERED)
+        assert len(aps) == 1
+
+    @pytest.mark.asyncio
+    async def test_history_respects_size(self):
+        bus = EventBus(history_size=3)
+        for i in range(5):
+            await bus.emit(EVENT_AP_DISCOVERED, {"i": i})
+        assert len(bus.recent_events) == 3
+
+    @pytest.mark.asyncio
+    async def test_subscriber_count(self, event_bus):
+        assert event_bus.subscriber_count == 0
+        event_bus.subscribe(EVENT_AP_DISCOVERED, lambda e: None)
+        assert event_bus.subscriber_count == 1
+        sid = event_bus.subscribe(EVENT_AP_DISCOVERED, lambda e: None)
+        assert event_bus.subscriber_count == 2
+        event_bus.unsubscribe(sid)
+        assert event_bus.subscriber_count == 1
+
+    @pytest.mark.asyncio
+    async def test_emit_sync(self, event_bus):
+        events = []
+
+        def handler(evt):
+            events.append(evt)
+
+        event_bus.subscribe(EVENT_AP_DISCOVERED, handler)
+        evt = event_bus.emit_sync(EVENT_AP_DISCOVERED, {"sync": True})
+        assert len(events) == 1
+        assert events[0].data["sync"] is True
+
+    @pytest.mark.asyncio
+    async def test_emit_sync_skips_async(self, event_bus):
+        async def async_handler(evt):
+            pass
+
+        event_bus.subscribe(EVENT_AP_DISCOVERED, async_handler)
+        # Should not raise; async subscriber skipped with warning
+        evt = event_bus.emit_sync(EVENT_AP_DISCOVERED, {})
+        assert evt.event_type == EVENT_AP_DISCOVERED
+
+    @pytest.mark.asyncio
+    async def test_create_queue(self, event_bus):
+        qid = event_bus.create_queue(EVENT_AP_DISCOVERED)
+        queue = event_bus.get_queue(qid)
+        assert queue is not None
+        await event_bus.emit(EVENT_AP_DISCOVERED, {"x": 1})
+        evt = queue.get_nowait()
+        assert evt.data["x"] == 1
+        assert event_bus.remove_queue(qid) is True
+        assert event_bus.remove_queue("bad") is False
+
+    @pytest.mark.asyncio
+    async def test_queue_filtering(self, event_bus):
+        qid = event_bus.create_queue(EVENT_AP_DISCOVERED)
+        queue = event_bus.get_queue(qid)
+        await event_bus.emit(EVENT_TOOL_STARTED, {})
+        await event_bus.emit(EVENT_AP_DISCOVERED, {"y": 2})
+        # Only AP event should land
+        assert queue.qsize() == 1
+        evt = queue.get_nowait()
+        assert evt.data["y"] == 2
+
+    @pytest.mark.asyncio
+    async def test_clear_history(self, event_bus):
+        await event_bus.emit(EVENT_AP_DISCOVERED, {})
+        event_bus.clear_history()
+        assert len(event_bus.recent_events) == 0
+
+    @pytest.mark.asyncio
+    async def test_subscriber_error_isolated(self, event_bus):
+        def bad_handler(evt):
+            raise RuntimeError("boom")
+
+        good_events = []
+
+        def good_handler(evt):
+            good_events.append(evt)
+
+        event_bus.subscribe(EVENT_AP_DISCOVERED, bad_handler)
+        event_bus.subscribe(EVENT_AP_DISCOVERED, good_handler)
+        await event_bus.emit(EVENT_AP_DISCOVERED, {})
+        assert len(good_events) == 1
+
+
+# ═══════════════════════════════════════════════════════════
+# AI Client
+# ═══════════════════════════════════════════════════════════
+
+class TestAIClientConfig:
+    """Tests for AIClient configuration loading."""
+
+    def test_load_ollama_host_default(self):
+        with patch.dict("os.environ", {}, clear=True):
+            with patch.object(Path, "exists", return_value=False):
+                host = _load_ollama_host()
+                assert host == "http://localhost:11434"
+
+    def test_load_ollama_host_from_env(self):
+        with patch.dict("os.environ", {"OLLAMA_HOST": "http://remote:11434"}):
+            host = _load_ollama_host()
+            assert host == "http://remote:11434"
+
+    def test_load_ollama_host_from_file(self, tmp_path):
+        env_file = tmp_path / "ollama-remote.env"
+        env_file.write_text('OLLAMA_HOST="http://file:11434"\n')
+        with patch.dict("os.environ", {}, clear=True):
+            with patch("redops.modules.rf.ai_client._ENV_FILE", env_file):
+                host = _load_ollama_host()
+                assert host == "http://file:11434"
+
+    def test_load_openrouter_config(self):
+        with patch.dict(
+            "os.environ",
+            {"OPENROUTER_BASE_URL": "http://or.com", "OPENROUTER_API_KEY": "key123"},
+        ):
+            base, key = _load_openrouter_config()
+            assert base == "http://or.com"
+            assert key == "key123"
+
+
+class TestAIClientParsing:
+    """Tests for AIClient JSON parsing helper."""
+
+    def test_parse_json_response_plain(self):
+        raw = '{"recommendations": [{"bssid": "00:11:22:33:44:55"}]}'
+        result = AIClient._parse_json_response(raw)
+        assert result["recommendations"][0]["bssid"] == "00:11:22:33:44:55"
+
+    def test_parse_json_response_markdown_fences(self):
+        raw = "```json\n{\"key\": \"value\"}\n```"
+        result = AIClient._parse_json_response(raw)
+        assert result["key"] == "value"
+
+    def test_parse_json_response_non_dict(self):
+        raw = "[1, 2, 3]"
+        result = AIClient._parse_json_response(raw)
+        assert result == {"data": [1, 2, 3]}
+
+    def test_parse_json_response_invalid(self):
+        raw = "not json"
+        result = AIClient._parse_json_response(raw)
+        assert result["raw_response"] == "not json"
+
+
+# ═══════════════════════════════════════════════════════════
+# Tool Manager
+# ═══════════════════════════════════════════════════════════
+
+@pytest.fixture
+def tool_manager():
+    from redops.core.event_bus import EventBus as CoreEventBus
+    bus = CoreEventBus()
+    return ToolManager(event_bus=bus, session_path=Path("/tmp"))
+
+
+class TestToolManager:
+    """Tests for ToolManager registry and command building."""
+
+    def test_register_tool(self, tool_manager):
+        spec = ToolSpec(
+            name="test-tool",
+            binary_path="/usr/bin/test",
+            requires_monitor=True,
+            requires_root=True,
+        )
+        tool_manager.register_tool(spec)
+        assert "test-tool" in tool_manager._registry
+
+    def test_register_defaults(self, tool_manager):
+        register_defaults(tool_manager)
+        assert "airodump-ng" in tool_manager._registry
+        assert "tshark" in tool_manager._registry
+        assert "reaver" in tool_manager._registry
+
+    def test_build_command_basic(self, tool_manager):
+        spec = ToolSpec(name="test", binary_path="test", requires_root=False)
+        cmd = tool_manager._build_command(spec, "wlan0", ["-v"])
+        assert cmd == ["test", "-v", "wlan0"]
+
+    def test_build_command_with_root(self, tool_manager):
+        spec = ToolSpec(name="test", binary_path="test", requires_root=True)
+        cmd = tool_manager._build_command(spec, "wlan0", [])
+        assert cmd[0] == "sudo"
+        assert "test" in cmd
+
+    def test_build_command_interface_override(self, tool_manager):
+        spec = ToolSpec(name="test", binary_path="test")
+        cmd = tool_manager._build_command(spec, "wlan0", ["-i", "wlan1"])
+        # When -i is in args, interface should NOT be appended
+        assert "wlan1" in cmd
+        assert "wlan0" not in cmd
+
+    def test_interface_lock_acquire_and_release(self, tool_manager):
+        spec = ToolSpec(name="t1", binary_path="t1")
+        tool_manager._acquire_interface("wlan0", "id1", spec)
+        assert tool_manager.interface_lock["wlan0"] == "id1"
+        tool_manager._release_interface("wlan0", "id1")
+        assert "wlan0" not in tool_manager.interface_lock
+
+    def test_interface_lock_prevents_double_acquire(self, tool_manager):
+        spec = ToolSpec(name="t1", binary_path="t1")
+        tool_manager._acquire_interface("wlan0", "id1", spec)
+        with pytest.raises(RuntimeError, match="locked"):
+            tool_manager._acquire_interface("wlan0", "id2", spec)
+        tool_manager._release_interface("wlan0", "id1")
+
+    def test_inject_tool_exclusivity(self, tool_manager):
+        inject_spec = ToolSpec(
+            name="reaver",
+            binary_path="reaver",
+            resource_class=ResourceClass.RF_INJECT,
+        )
+        tool_manager._acquire_interface("wlan0", "id1", inject_spec)
+        # Populate _running so the exclusivity check can inspect the spec
+        mock_proc = Mock()
+        mock_proc.spec = inject_spec
+        tool_manager._running["id1"] = mock_proc
+        with pytest.raises(RuntimeError, match="inject"):
+            tool_manager._acquire_interface("wlan1", "id2", inject_spec)
+        tool_manager._release_interface("wlan0", "id1")
+        tool_manager._running.pop("id1", None)
+
+    def test_release_interface_wrong_holder_warns(self, tool_manager, monkeypatch):
+        from unittest.mock import MagicMock
+        import redops.modules.rf.tool_manager as tm_mod
+        tool_manager.interface_lock["wlan0"] = "id1"
+        warn_mock = MagicMock()
+        monkeypatch.setattr(tm_mod.logger, "warning", warn_mock)
+        tool_manager._release_interface("wlan0", "id2")
+        assert warn_mock.called
+        assert "not by" in warn_mock.call_args[0][0]
+
+    def test_get_running_empty(self, tool_manager):
+        assert tool_manager.get_running() == []
+
+    def test_tool_spec_defaults(self):
+        spec = ToolSpec(name="simple", binary_path="/bin/simple")
+        assert spec.requires_monitor is False
+        assert spec.ingestion_strategy == IngestionStrategy.STREAM
+
+
+# ═══════════════════════════════════════════════════════════
+# Integration: EventBus + ToolManager
+# ═══════════════════════════════════════════════════════════
+
+class TestRFIntegration:
+    """Integration tests across RF subsystems."""
+
+    @pytest.mark.asyncio
+    async def test_event_bus_tool_lifecycle(self):
+        bus = EventBus()
+        events = []
+
+        def collect(evt):
+            events.append(evt.event_type)
+
+        bus.subscribe(EVENT_TOOL_STARTED, collect)
+        bus.subscribe("tool_stopped", collect)
+
+        await bus.emit(EVENT_TOOL_STARTED, {"tool": "airodump-ng"})
+        await bus.emit("tool_stopped", {"tool": "airodump-ng"})
+
+        assert len(events) == 2
+        assert events[0] == EVENT_TOOL_STARTED
+
+    def test_session_manager_with_captures(self, tmp_path):
+        sm = SessionManager(base_dir=tmp_path)
+        session = sm.create_session("Integration")
+        sm.start_session(session.session_id)
+
+        # Create a fake capture
+        cap_dir = Path(session.session_dir) / "evidence"
+        cap_file = cap_dir / "test.pcap"
+        cap_file.write_text("pcap data")
+
+        capture = sm.add_capture(
+            session.session_id,
+            target_id="00:11:22:33:44:55",
+            capture_type="pcap",
+            file_path=cap_file,
+            tool="airodump-ng",
+        )
+
+        sm.end_session(session.session_id)
+        archived = sm.archive_session(session.session_id)
+
+        assert archived.exists()
+        assert capture.sha256 is not None
+
+        # Verify session.json was written
+        session_json = Path(session.session_dir) / "session.json"
+        assert session_json.exists()
+        data = json.loads(session_json.read_text())
+        assert data["status"] == "closed"
diff --git a/tests/test_security_controls.py b/tests/test_security_controls.py
new file mode 100644
index 0000000..f10643f
--- /dev/null
+++ b/tests/test_security_controls.py
@@ -0,0 +1,543 @@
+"""Security control tests for RedOPS.
+
+Covers JWT refresh token flow, API key rotation, SQL injection prevention,
+credential masking in reports, and rate limiting enforcement.
+"""
+
+import json
+import time
+from datetime import datetime, timedelta, timezone
+from unittest.mock import MagicMock, AsyncMock
+
+import pytest
+from fastapi import Request
+
+from redops.api.auth import (
+    create_access_token,
+    create_refresh_token,
+    decode_token,
+    verify_token,
+    create_api_key,
+    verify_api_key,
+    revoke_api_key,
+    list_api_keys,
+    _api_keys,
+    _revoked_tokens,
+)
+from redops.api.middleware import RateLimitMiddleware
+from redops.db.models import User, Scan, Finding
+from redops.reports.generator import (
+    ReportGenerator,
+    ReportConfig,
+    ReportType,
+    ReportFormat,
+    Finding as ReportFinding,
+    ScanResult,
+)
+
+
+# =============================================================================
+# JWT Refresh Token Flow
+# =============================================================================
+
+
+class TestJWTRefreshTokenFlow:
+    """Tests for JWT refresh token lifecycle."""
+
+    def test_refresh_token_created(self):
+        """Refresh token is created with type claim."""
+        token = create_refresh_token(user_id="user-123")
+        payload = decode_token(token)
+
+        assert payload is not None
+        assert payload["sub"] == "user-123"
+        assert payload["type"] == "refresh"
+        assert "jti" in payload
+
+    async def test_refresh_token_not_accepted_as_access(self):
+        """Refresh token is rejected by access-token verifier."""
+        token = create_refresh_token(user_id="user-123")
+        user = await verify_token(token)
+
+        assert user is None
+
+    def test_refresh_token_expiration(self):
+        """Expired refresh token returns None."""
+        import jwt as jwt_lib
+        from redops.api.auth import JWT_SECRET_KEY, JWT_ALGORITHM
+
+        now = datetime.now(timezone.utc)
+        expired_payload = {
+            "sub": "user-123",
+            "exp": now - timedelta(seconds=1),
+            "iat": now,
+            "jti": "test-jti-123",
+            "type": "refresh",
+        }
+        expired_token = jwt_lib.encode(
+            expired_payload, JWT_SECRET_KEY, algorithm=JWT_ALGORITHM
+        )
+        payload = decode_token(expired_token)
+        assert payload is None
+
+    def test_refresh_token_revoked(self):
+        """Revoked refresh token is rejected."""
+        token = create_refresh_token(user_id="user-123")
+        payload = decode_token(token)
+        assert payload is not None
+
+        _revoked_tokens.add(payload["jti"])
+        payload_after = decode_token(token)
+        assert payload_after is None
+
+        _revoked_tokens.discard(payload["jti"])
+
+    def test_decode_invalid_refresh_token(self):
+        """Invalid refresh token returns None."""
+        payload = decode_token("totally.invalid.token")
+        assert payload is None
+
+    def test_refresh_token_has_expiry(self):
+        """Refresh token contains an expiration claim."""
+        token = create_refresh_token(user_id="user-123")
+        payload = decode_token(token)
+
+        assert payload is not None
+        assert "exp" in payload
+        assert "iat" in payload
+        exp = datetime.fromtimestamp(payload["exp"], tz=timezone.utc)
+        iat = datetime.fromtimestamp(payload["iat"], tz=timezone.utc)
+        assert (exp - iat).days == 7
+
+
+# =============================================================================
+# API Key Rotation Flow
+# =============================================================================
+
+
+class TestAPIKeyRotationFlow:
+    """Tests for API key rotation workflow."""
+
+    async def test_rotate_api_key_revokes_old_and_creates_new(self):
+        """Rotating an API key invalidates the old one and creates a replacement."""
+        old_key = create_api_key(
+            user_id="user-rot",
+            name="service-key",
+            scopes=["scans:read"],
+            expires_in_days=30,
+        )
+        user = await verify_api_key(old_key.key)
+        assert user is not None
+        assert user["id"] == "user-rot"
+
+        result = revoke_api_key(old_key.id, "user-rot")
+        assert result is True
+        assert await verify_api_key(old_key.key) is None
+
+        new_key = create_api_key(
+            user_id="user-rot",
+            name="service-key",
+            scopes=["scans:read"],
+            expires_in_days=30,
+        )
+        assert new_key.key != old_key.key
+        user = await verify_api_key(new_key.key)
+        assert user is not None
+        assert user["id"] == "user-rot"
+
+    def test_rotated_key_appears_in_list(self):
+        """After rotation, only active keys are listed."""
+        key = create_api_key(user_id="user-list", name="rot-key")
+        revoke_api_key(key.id, "user-list")
+        create_api_key(user_id="user-list", name="rot-key")
+
+        keys = list_api_keys("user-list")
+        active = [k for k in keys if k.name == "rot-key" and k.is_active]
+        inactive = [k for k in keys if k.name == "rot-key" and not k.is_active]
+
+        assert len(active) == 1
+        assert len(inactive) == 1
+
+    async def test_rotation_preserves_scopes(self):
+        """Replacement key preserves original scopes."""
+        original = create_api_key(
+            user_id="user-scope",
+            name="scoped-key",
+            scopes=["scans:read", "findings:write"],
+        )
+        revoke_api_key(original.id, "user-scope")
+
+        replacement = create_api_key(
+            user_id="user-scope",
+            name="scoped-key",
+            scopes=["scans:read", "findings:write"],
+        )
+        user = await verify_api_key(replacement.key)
+        assert user is not None
+        assert set(user["scopes"]) == {"scans:read", "findings:write"}
+
+    def test_rotation_changes_key_hash(self):
+        """Rotated key has a different hash from the original."""
+        original = create_api_key(user_id="user-hash", name="hash-key")
+        revoke_api_key(original.id, "user-hash")
+        replacement = create_api_key(user_id="user-hash", name="hash-key")
+
+        assert original.key != replacement.key
+        from redops.api.auth import hash_api_key
+        assert hash_api_key(original.key) != hash_api_key(replacement.key)
+
+    async def test_unauthorized_rotation_fails(self):
+        """Revoking another user's key fails."""
+        key = create_api_key(user_id="user-a", name="protected-key")
+        result = revoke_api_key(key.id, "user-b")
+        assert result is False
+        assert await verify_api_key(key.key) is not None
+
+
+# =============================================================================
+# SQL Injection Prevention
+# =============================================================================
+
+
+class TestSQLInjectionPrevention:
+    """Tests verifying SQLAlchemy ORM uses parameterized queries."""
+
+    def test_user_model_query_is_parameterized(self):
+        """User lookups use bound parameters, not string interpolation."""
+        from sqlalchemy import select
+
+        stmt = select(User).where(User.username == "admin")
+        raw_stmt = str(stmt.compile())
+        assert "=" in raw_stmt or ":" in raw_stmt
+
+    def test_scan_target_query_is_parameterized(self):
+        """Scan target lookups use bound parameters."""
+        from sqlalchemy import select
+
+        malicious_input = "'; DROP TABLE scans; --"
+        stmt = select(Scan).where(Scan.target == malicious_input)
+        compiled = str(stmt.compile(compile_kwargs={"literal_binds": True}))
+
+        # SQLAlchemy escapes quotes in literal_binds mode; the malicious
+        # content is present but safely quoted (single quotes doubled).
+        assert "DROP TABLE" in compiled  # The string is present, but quoted
+        # Prove injection is neutralised: there is no unquoted semicolon
+        # followed by DROP — the whole payload is inside a string literal.
+        lines = compiled.splitlines()
+        where_line = [ln for ln in lines if "WHERE" in ln.upper()][0]
+        # The payload should appear after an equals sign inside quotes
+        assert "=" in where_line
+
+    def test_finding_title_query_is_parameterized(self):
+        """Finding title lookups use bound parameters."""
+        from sqlalchemy import select
+
+        malicious_input = "1' OR '1'='1"
+        stmt = select(Finding).where(Finding.title == malicious_input)
+        compiled = str(stmt.compile(compile_kwargs={"literal_binds": True}))
+
+        # SQLAlchemy doubles single quotes for safe literal rendering
+        assert "1'' OR ''1''=''1" in compiled or "1' OR '1'='1" in compiled
+
+    def test_orm_insert_uses_parameters(self):
+        """INSERT statements use bound parameters."""
+        from sqlalchemy import insert
+
+        stmt = insert(User).values(
+            username="test",
+            email="test@example.com",
+            password_hash="hash",
+        )
+        compiled = str(stmt.compile())
+        assert ":" in compiled or "%(" in compiled
+
+    def test_model_columns_are_typed(self):
+        """ORM column definitions enforce type safety."""
+        from sqlalchemy import String, Text
+
+        assert isinstance(User.username.type, String)
+        assert isinstance(Scan.target.type, String)
+        assert isinstance(Finding.description.type, Text)
+
+
+# =============================================================================
+# Credential Masking in Reports
+# =============================================================================
+
+
+class TestCredentialMaskingInReports:
+    """Tests verifying reports do not leak sensitive credentials."""
+
+    @pytest.fixture
+    def generator(self):
+        """Create a report generator."""
+        return ReportGenerator()
+
+    def _make_scan_with_credential_evidence(self):
+        """Helper: create a scan result containing credential-like evidence."""
+        findings = [
+            ReportFinding(
+                id="cred-1",
+                title="Exposed API Key",
+                severity="critical",
+                description="An API key was found in source code.",
+                evidence={
+                    "api_key": "sk-live-abc123def456",
+                    "password": "SuperSecretP@ss!",
+                    "token": "Bearer eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIn0",
+                    "connection_string": "postgresql://user:fake_pass@localhost:5432/test_db",
+                },
+                remediation="Rotate credentials immediately.",
+            ),
+            ReportFinding(
+                id="cred-2",
+                title="Weak Password Policy",
+                severity="medium",
+                description="Password policy allows weak passwords.",
+                evidence={
+                    "sample_password": "password123",
+                },
+            ),
+        ]
+        return ScanResult(
+            scan_id="scan-creds",
+            target="https://example.com",
+            pipeline="security_audit",
+            started_at=datetime.now(timezone.utc),
+            completed_at=datetime.now(timezone.utc),
+            status="completed",
+            findings=findings,
+        )
+
+    def test_json_report_does_not_mask_evidence_by_default(self, generator):
+        """JSON report currently includes raw evidence (documented behavior)."""
+        scan = self._make_scan_with_credential_evidence()
+        content = generator.generate(
+            scan,
+            report_type=ReportType.EXECUTIVE_SUMMARY,
+            report_format=ReportFormat.JSON,
+        )
+        data = json.loads(content.decode("utf-8"))
+        # JSON generator currently omits evidence field; document this gap
+        finding = data["findings"][0]
+        assert "evidence" not in finding
+        # If evidence is added later, this test should be updated to
+        # assert that credentials are masked.
+
+    def test_html_report_does_not_render_evidence_details(self, generator):
+        """HTML report only renders summary, not full evidence dict."""
+        scan = self._make_scan_with_credential_evidence()
+        content = generator.generate(
+            scan,
+            report_type=ReportType.EXECUTIVE_SUMMARY,
+            report_format=ReportFormat.HTML,
+        )
+        html = content.decode("utf-8")
+        assert "sk-live-abc123def456" not in html
+        assert "SuperSecretP@ss!" not in html
+
+    def test_markdown_report_does_not_render_evidence_details(self, generator):
+        """Markdown report only renders summary, not full evidence dict."""
+        scan = self._make_scan_with_credential_evidence()
+        content = generator.generate(
+            scan,
+            report_type=ReportType.EXECUTIVE_SUMMARY,
+            report_format=ReportFormat.MARKDOWN,
+        )
+        md = content.decode("utf-8")
+        assert "sk-live-abc123def456" not in md
+        assert "SuperSecretP@ss!" not in md
+
+    def test_pdf_report_does_not_leak_credentials(self, generator):
+        """PDF report does not include raw credential strings."""
+        scan = self._make_scan_with_credential_evidence()
+        content = generator.generate(
+            scan,
+            report_type=ReportType.EXECUTIVE_SUMMARY,
+            report_format=ReportFormat.PDF,
+        )
+        assert b"sk-live-abc123def456" not in content
+        assert b"SuperSecretP@ss!" not in content
+
+    def test_report_config_masking_method_exists(self):
+        """ReportConfig has no credential masking — documented gap."""
+        config = ReportConfig()
+        assert not hasattr(config, "mask_credentials")
+
+    def test_scan_result_metadata_does_not_leak(self, generator):
+        """Metadata field in scan result should not contain secrets."""
+        scan = ScanResult(
+            scan_id="scan-meta",
+            target="https://example.com",
+            pipeline="test",
+            started_at=datetime.now(timezone.utc),
+            completed_at=datetime.now(timezone.utc),
+            status="completed",
+            findings=[],
+            metadata={
+                "api_key": "hidden-key",
+                "build_secret": "shh",
+            },
+        )
+        content = generator.generate(
+            scan,
+            report_type=ReportType.EXECUTIVE_SUMMARY,
+            report_format=ReportFormat.JSON,
+        )
+        data = json.loads(content.decode("utf-8"))
+        # Metadata is currently omitted from JSON output; document gap
+        assert "metadata" not in data
+        # If metadata is added later, this test should verify credentials
+        # are masked or excluded.
+
+
+# =============================================================================
+# Rate Limiting Enforcement
+# =============================================================================
+
+
+class TestRateLimitMiddleware:
+    """Tests for API-level rate limiting enforcement."""
+
+    @pytest.fixture
+    def middleware(self):
+        """Create rate limit middleware with strict limits."""
+        app = MagicMock()
+        return RateLimitMiddleware(
+            app,
+            requests_per_minute=3,
+            requests_per_hour=10,
+        )
+
+    def _make_request(self, client_host="192.168.1.1"):
+        """Helper to create a mocked Request."""
+        request = MagicMock(spec=Request)
+        request.client = MagicMock()
+        request.client.host = client_host
+        request.state = MagicMock()
+        return request
+
+    @pytest.mark.asyncio
+    async def test_allows_requests_under_limit(self, middleware):
+        """Requests under the rate limit are allowed."""
+        request = self._make_request()
+        response = MagicMock()
+        response.headers = {}
+
+        async def call_next(req):
+            return response
+
+        result = await middleware.dispatch(request, call_next)
+        assert result is response
+        assert result.headers.get("X-RateLimit-Remaining") == "2"
+
+    @pytest.mark.asyncio
+    async def test_blocks_requests_over_minute_limit(self, middleware):
+        """Requests exceeding per-minute limit are blocked."""
+        request = self._make_request()
+
+        for _ in range(3):
+            async def call_next(req):
+                r = MagicMock()
+                r.headers = {}
+                return r
+            await middleware.dispatch(request, call_next)
+
+        async def call_next_blocked(req):
+            return MagicMock()
+
+        result = await middleware.dispatch(request, call_next_blocked)
+        assert result.status_code == 429
+        assert b"rate_limit_exceeded" in result.body
+
+    @pytest.mark.asyncio
+    async def test_blocks_requests_over_hour_limit(self, middleware):
+        """Requests exceeding per-hour limit are blocked."""
+        request = self._make_request()
+        middleware.requests_per_minute = 100
+        middleware.requests_per_hour = 2
+
+        for _ in range(2):
+            async def call_next(req):
+                r = MagicMock()
+                r.headers = {}
+                return r
+            await middleware.dispatch(request, call_next)
+
+        async def call_next_blocked(req):
+            return MagicMock()
+
+        result = await middleware.dispatch(request, call_next_blocked)
+        assert result.status_code == 429
+        assert b"Too many requests per hour" in result.body
+
+    @pytest.mark.asyncio
+    async def test_different_clients_have_separate_limits(self, middleware):
+        """Rate limits are tracked per-client IP."""
+        req_a = self._make_request("10.0.0.1")
+        req_b = self._make_request("10.0.0.2")
+
+        for _ in range(3):
+            async def call_next(req):
+                r = MagicMock()
+                r.headers = {}
+                return r
+            await middleware.dispatch(req_a, call_next)
+
+        result_a = await middleware.dispatch(req_a, lambda r: MagicMock())
+        assert result_a.status_code == 429
+
+        async def call_next_b(req):
+            r = MagicMock()
+            r.headers = {}
+            return r
+        result_b = await middleware.dispatch(req_b, call_next_b)
+        assert result_b.status_code != 429
+
+    @pytest.mark.asyncio
+    async def test_rate_limit_headers_present(self, middleware):
+        """Rate limit headers are included in successful responses."""
+        request = self._make_request()
+        response = MagicMock()
+        response.headers = {}
+
+        async def call_next(req):
+            return response
+
+        result = await middleware.dispatch(request, call_next)
+        assert "X-RateLimit-Limit" in result.headers
+        assert "X-RateLimit-Remaining" in result.headers
+        assert result.headers["X-RateLimit-Limit"] == "3"
+
+    @pytest.mark.asyncio
+    async def test_rate_limit_retry_after_header(self, middleware):
+        """Blocked responses include Retry-After header."""
+        request = self._make_request()
+        middleware.requests_per_hour = 100
+
+        for _ in range(3):
+            async def call_next(req):
+                r = MagicMock()
+                r.headers = {}
+                return r
+            await middleware.dispatch(request, call_next)
+
+        result = await middleware.dispatch(request, lambda r: MagicMock())
+        assert result.status_code == 429
+        assert result.headers.get("Retry-After") == "60"
+
+    @pytest.mark.asyncio
+    async def test_unknown_client_defaults_to_unknown(self, middleware):
+        """Requests with no client info default to 'unknown'."""
+        request = MagicMock(spec=Request)
+        request.client = None
+        request.state = MagicMock()
+
+        response = MagicMock()
+        response.headers = {}
+
+        async def call_next(req):
+            return response
+
+        result = await middleware.dispatch(request, call_next)
+        assert result is response
diff --git a/tests/test_web_auth.py b/tests/test_web_auth.py
index 1c2e77f..d23f624 100644
--- a/tests/test_web_auth.py
+++ b/tests/test_web_auth.py
@@ -457,3 +457,98 @@ def test_authenticated_at_is_utc(self):
         )
 
         assert user.authenticated_at.tzinfo == timezone.utc
+
+
+class TestRedisSessionStore:
+    """Tests for RedisSessionStore with mocked Redis."""
+
+    def _mock_redis(self, data=None):
+        """Return a mock Redis client."""
+        redis = MagicMock()
+        redis.ping.return_value = True
+        redis.hgetall.return_value = data or {}
+        redis.delete.return_value = 1
+        redis.expire.return_value = True
+        redis.hset.return_value = True
+        return redis
+
+    def test_create_session_with_redis(self):
+        """Test session creation stores data in Redis."""
+        from redops.web.auth import RedisSessionStore
+
+        mock_redis = self._mock_redis()
+        with patch("redis.from_url", return_value=mock_redis):
+            store = RedisSessionStore(secret="test", redis_url="redis://localhost:6379/0")
+            token = store.create_session("testuser")
+
+        assert token is not None
+        assert len(token) > 20
+        mock_redis.hset.assert_called_once()
+        mock_redis.expire.assert_called_once()
+
+    def test_validate_session_with_redis(self):
+        """Test session validation reads from Redis."""
+        from redops.web.auth import RedisSessionStore
+
+        from datetime import datetime, timezone, timedelta
+
+        future = (datetime.now(timezone.utc) + timedelta(hours=1)).isoformat()
+        mock_redis = self._mock_redis(data={"username": "testuser", "expires_at": future})
+        with patch("redis.from_url", return_value=mock_redis):
+            store = RedisSessionStore(secret="test")
+            # We need a real token that hashes correctly
+            token = store.create_session("testuser")
+            # Reset mock to not interfere with validation
+            mock_redis.hgetall.return_value = {"username": "testuser", "expires_at": future}
+            username = store.validate_session(token)
+
+        assert username == "testuser"
+
+    def test_validate_expired_session_deletes_from_redis(self):
+        """Test expired session is deleted from Redis."""
+        from redops.web.auth import RedisSessionStore
+
+        past = (datetime.now(timezone.utc) - timedelta(hours=1)).isoformat()
+        mock_redis = self._mock_redis(data={"username": "testuser", "expires_at": past})
+        with patch("redis.from_url", return_value=mock_redis):
+            store = RedisSessionStore(secret="test")
+            username = store.validate_session("any_token")
+
+        assert username is None
+        mock_redis.delete.assert_called_once()
+
+    def test_invalidate_session_with_redis(self):
+        """Test session invalidation deletes from Redis."""
+        from redops.web.auth import RedisSessionStore
+
+        mock_redis = self._mock_redis()
+        with patch("redis.from_url", return_value=mock_redis):
+            store = RedisSessionStore(secret="test")
+            result = store.invalidate_session("any_token")
+
+        assert result is True
+        mock_redis.delete.assert_called_once()
+
+    def test_cleanup_expired_is_noop_with_redis(self):
+        """Test cleanup_expired is a no-op with Redis (TTL handles it)."""
+        from redops.web.auth import RedisSessionStore
+
+        mock_redis = self._mock_redis()
+        with patch("redis.from_url", return_value=mock_redis):
+            store = RedisSessionStore(secret="test")
+            removed = store.cleanup_expired()
+
+        assert removed == 0
+
+    def test_fallback_to_memory_when_redis_unavailable(self):
+        """Test fallback to in-memory when Redis connection fails."""
+        from redops.web.auth import RedisSessionStore
+
+        with patch("redis.from_url", side_effect=ImportError("No redis")):
+            store = RedisSessionStore(secret="test")
+
+        assert store._fallback is True
+        assert store._redis is None
+
+        token = store.create_session("testuser")
+        assert store.validate_session(token) == "testuser"
diff --git a/tests/test_web_websocket.py b/tests/test_web_websocket.py
index b62e0b8..247ee00 100644
--- a/tests/test_web_websocket.py
+++ b/tests/test_web_websocket.py
@@ -187,7 +187,7 @@ async def test_send_personal_handles_error(self):
         """Test send personal handles errors."""
         cm = ConnectionManager()
         ws = AsyncMock()
-        ws.send_text.side_effect = Exception("Connection closed")
+        ws.send_text.side_effect = RuntimeError("Connection closed")
         cm.active_connections.add(ws)
         event = WSEvent(event="test", data={})
 
@@ -215,7 +215,7 @@ async def test_broadcast_handles_disconnects(self):
         cm = ConnectionManager()
         ws1 = AsyncMock()
         ws2 = AsyncMock()
-        ws2.send_text.side_effect = Exception("Disconnected")
+        ws2.send_text.side_effect = ConnectionError("Disconnected")
         cm.active_connections.add(ws1)
         cm.active_connections.add(ws2)
         event = WSEvent(event="test", data={})
diff --git a/tests/test_websocket.py b/tests/test_websocket.py
index 4d845d5..13b0cbe 100644
--- a/tests/test_websocket.py
+++ b/tests/test_websocket.py
@@ -124,7 +124,7 @@ async def test_broadcast_handles_disconnected(self, manager):
         """Test that broadcast removes disconnected clients."""
         ws_good = AsyncMock()
         ws_bad = AsyncMock()
-        ws_bad.send_text.side_effect = Exception("Connection closed")
+        ws_bad.send_text.side_effect = OSError("Connection closed")
 
         manager.active_connections = {ws_good, ws_bad}
 
diff --git a/tests/test_wireless.py b/tests/test_wireless.py
index 95895d1..bb2709b 100644
--- a/tests/test_wireless.py
+++ b/tests/test_wireless.py
@@ -3,6 +3,7 @@
 from unittest.mock import MagicMock, patch
 
 from redops.core.context import Context
+from redops.modules.active.authorization import record_authorization
 from redops.modules.active.wireless.monitor import (
     disable_monitor_mode,
     enable_monitor_mode,
@@ -38,6 +39,7 @@ class TestEnableMonitorMode:
     def test_success(self, mock_run):
         mock_run.return_value = MagicMock(stdout="Mode:Monitor", returncode=0)
         ctx = Context(target="home-lab")
+        record_authorization(ctx, operator="test-operator", target_assertion="home-lab")
         result = enable_monitor_mode(ctx, {"interface": "wlan1"})
         assert result.get("monitor_ready") is True
         assert result.get("monitor_interface") == "wlan1mon"
@@ -46,6 +48,7 @@ def test_success(self, mock_run):
     def test_failure(self, mock_run):
         mock_run.return_value = MagicMock(stdout="Mode:Managed", returncode=1)
         ctx = Context(target="home-lab")
+        record_authorization(ctx, operator="test-operator", target_assertion="home-lab")
         result = enable_monitor_mode(ctx, {"interface": "wlan1"})
         assert result.get("monitor_ready") is False
 
@@ -53,6 +56,7 @@ def test_failure(self, mock_run):
     def test_default_interface(self, mock_run):
         mock_run.return_value = MagicMock(stdout="Mode:Monitor", returncode=0)
         ctx = Context(target="home-lab")
+        record_authorization(ctx, operator="test-operator", target_assertion="home-lab")
         result = enable_monitor_mode(ctx)
         assert result.get("monitor_interface") == "wlan1mon"
 
@@ -62,6 +66,7 @@ class TestDisableMonitorMode:
     def test_restores_managed_mode(self, mock_run):
         mock_run.return_value = MagicMock(returncode=0)
         ctx = Context(target="home-lab")
+        record_authorization(ctx, operator="test-operator", target_assertion="home-lab")
         ctx.add("monitor_interface", "wlan1mon")
         result = disable_monitor_mode(ctx)
         assert result.get("monitor_ready") is False
@@ -70,6 +75,7 @@ def test_restores_managed_mode(self, mock_run):
     def test_uses_context_interface(self, mock_run):
         mock_run.return_value = MagicMock(returncode=0)
         ctx = Context(target="home-lab")
+        record_authorization(ctx, operator="test-operator", target_assertion="home-lab")
         ctx.add("monitor_interface", "wlan2mon")
         disable_monitor_mode(ctx)
         calls = [str(c) for c in mock_run.call_args_list]
@@ -118,6 +124,7 @@ def test_stores_results_in_context(self, mock_popen, mock_sleep, tmp_path):
         mock_popen.return_value = mock_proc
 
         ctx = Context(target="home-lab")
+        record_authorization(ctx, operator="test-operator", target_assertion="home-lab")
         ctx.add("monitor_interface", "wlan1mon")
 
         with patch(
@@ -150,6 +157,7 @@ def test_start_evil_twin_success(self, mock_sleep, mock_run, mock_popen):
         mock_popen.return_value = MagicMock()
 
         ctx = Context(target="home-lab")
+        record_authorization(ctx, operator="test-operator", target_assertion="home-lab")
         ctx.add(
             "access_points",
             [
@@ -173,6 +181,7 @@ def test_start_evil_twin_no_aps(self):
         from redops.modules.active.wireless.evil_twin import start_evil_twin
 
         ctx = Context(target="home-lab")
+        record_authorization(ctx, operator="test-operator", target_assertion="home-lab")
         result = start_evil_twin(ctx)
         assert result.get("evil_twin_active") is False
 
@@ -245,6 +254,7 @@ def test_no_scapy_logs_error(self):
         try:
             deauth.HAS_SCAPY = False
             ctx = Context(target="home-lab")
+            record_authorization(ctx, operator="test-operator", target_assertion="home-lab")
             result = deauth.deauth_flood(ctx)
             assert result.get("deauth_active") is False
             error_logs = result.get_logs(level="ERROR")
@@ -259,6 +269,7 @@ def test_no_target_bssid_logs_error(self):
         try:
             deauth.HAS_SCAPY = True
             ctx = Context(target="home-lab")
+            record_authorization(ctx, operator="test-operator", target_assertion="home-lab")
             result = deauth.deauth_flood(ctx)
             error_logs = result.get_logs(level="ERROR")
             assert any("BSSID" in log["message"] for log in error_logs)

From bf8f42fb95517e4bb80ca169f57eb6c68bcf525b Mon Sep 17 00:00:00 2001
From: AreteDriver 
Date: Mon, 20 Jul 2026 12:54:14 -0700
Subject: [PATCH 06/10] fix: error handling overhaul - narrow all bare except
 Exception blocks

Replaced 249 bare except Exception blocks across core/ and modules/ with
domain-specific exception tuples. Added DNS exception handling for dnspython
operations to preserve real error coverage.

Key changes:
- Core: narrowed to (OSError, RuntimeError, TypeError, ValueError, ConnectionError)
- Modules: narrowed per domain - intel APIs, recon DNS, metadata parsing, RF
- Added dns.resolver/dns.exception catches for DNS-specific errors
- Added _DNSException fallback in domains.py for mocked test environments
- Fixed 50+ tests that used generic Exception mocks to match narrowed tuples

Two pre-existing document test failures remain (PackageNotFoundError,
EmptyFileError) unrelated to this change.

Co-Authored-By: Claude 
---
 src/redops/core/alerting.py                   |  8 +++---
 src/redops/core/async_processor.py            | 12 ++++-----
 src/redops/core/cli.py                        |  2 +-
 src/redops/core/data_io.py                    |  2 +-
 src/redops/core/data_validation.py            |  4 +--
 src/redops/core/docs_generator.py             |  2 +-
 src/redops/core/event_bus.py                  | 14 +++++-----
 src/redops/core/feature_flags.py              |  2 +-
 src/redops/core/health.py                     | 26 +++++++++----------
 src/redops/core/logging_audit.py              |  4 +--
 src/redops/core/metrics.py                    |  2 +-
 src/redops/core/notifications.py              | 14 +++++-----
 src/redops/core/plugin_system.py              | 10 +++----
 src/redops/core/rate_limiter.py               |  2 +-
 src/redops/core/scan_history.py               |  2 +-
 src/redops/core/secrets.py                    |  2 +-
 src/redops/core/task_queue.py                 | 14 +++++-----
 src/redops/core/workflow.py                   | 10 +++----
 src/redops/modules/ai_assistant.py            |  8 +++---
 src/redops/modules/intel/censys_intel.py      | 12 ++++-----
 src/redops/modules/intel/hibp_intel.py        |  4 +--
 src/redops/modules/intel/hunter_intel.py      |  4 +--
 .../modules/intel/securitytrails_intel.py     |  4 +--
 src/redops/modules/intel/shodan_intel.py      | 10 +++----
 src/redops/modules/intel/stix_export.py       |  2 +-
 src/redops/modules/intel/virustotal_intel.py  |  6 ++---
 src/redops/modules/metadata/code_artifacts.py | 18 ++++++-------
 src/redops/modules/metadata/documents.py      |  8 +++---
 src/redops/modules/metadata/exif.py           | 10 +++----
 src/redops/modules/notifications.py           | 14 +++++-----
 src/redops/modules/recon/asn_lookup.py        | 14 +++++-----
 src/redops/modules/recon/cert_transparency.py |  6 ++---
 src/redops/modules/recon/domains.py           | 12 ++++++---
 src/redops/modules/recon/subdomain_enum.py    | 12 ++++-----
 src/redops/modules/recon/tech_stack.py        |  8 +++---
 src/redops/modules/reporting/junit_report.py  |  2 +-
 src/redops/modules/reporting/pdf_report.py    |  2 +-
 src/redops/modules/rf/ai_client.py            |  2 +-
 src/redops/modules/rf/dashboard.py            |  2 +-
 src/redops/modules/rf/event_bus.py            |  4 +--
 src/redops/modules/rf/tool_manager.py         |  4 +--
 src/redops/modules/threat_intel/abuseipdb.py  |  6 ++---
 src/redops/modules/threat_intel/greynoise.py  |  6 ++---
 .../modules/threat_intel/malwarebazaar.py     |  2 +-
 src/redops/modules/threat_intel/threatfox.py  |  2 +-
 src/redops/modules/threat_intel/urlhaus.py    |  8 +++---
 tests/test_abuseipdb.py                       |  2 +-
 tests/test_asn_lookup.py                      |  3 ++-
 tests/test_censys_intel.py                    | 17 ++++++------
 tests/test_core_notifications.py              |  2 +-
 tests/test_documents.py                       |  6 ++---
 tests/test_exif.py                            |  4 +--
 tests/test_health.py                          |  2 +-
 tests/test_hibp_intel.py                      |  4 +--
 tests/test_hunter_intel.py                    |  4 +--
 tests/test_recon_domains.py                   | 17 ++++++------
 tests/test_securitytrails_intel.py            |  4 +--
 tests/test_shodan_intel.py                    | 13 +++++-----
 tests/test_subdomain_enum.py                  |  7 +++--
 tests/test_tech_stack.py                      | 14 +++++-----
 tests/test_urlhaus.py                         |  2 +-
 tests/test_virustotal_intel.py                |  7 ++---
 62 files changed, 222 insertions(+), 210 deletions(-)

diff --git a/src/redops/core/alerting.py b/src/redops/core/alerting.py
index d4fe4c9..194ab44 100644
--- a/src/redops/core/alerting.py
+++ b/src/redops/core/alerting.py
@@ -419,7 +419,7 @@ def _send_request(self, payload: dict[str, Any]) -> bool:
                 }
                 return response.status < 400
 
-        except Exception as e:
+        except (OSError, ConnectionError, RuntimeError, ValueError) as e:
             self._last_response = {"error": str(e)}
             return False
 
@@ -496,7 +496,7 @@ def _send_email(self, subject: str, body: str) -> bool:
                 server.sendmail(self._from_address, self._recipients, msg.as_string())
 
             return True
-        except Exception:
+        except (OSError, ConnectionError, RuntimeError, ValueError):
             return False
 
 
@@ -842,7 +842,7 @@ def _send_alert(self, alert: Alert, rule: AlertRule) -> None:
             if channel and channel.enabled:
                 try:
                     channel.send(alert)
-                except Exception:
+                except (OSError, ConnectionError, RuntimeError, TypeError, ValueError):
                     pass
 
     def _send_resolved(self, alert: Alert) -> None:
@@ -855,7 +855,7 @@ def _send_resolved(self, alert: Alert) -> None:
             if channel and channel.enabled:
                 try:
                     channel.send_resolved(alert)
-                except Exception:
+                except (OSError, ConnectionError, RuntimeError, TypeError, ValueError):
                     pass  # Best-effort notification - don't fail resolve
 
     # History
diff --git a/src/redops/core/async_processor.py b/src/redops/core/async_processor.py
index 8a987c5..0864b0c 100644
--- a/src/redops/core/async_processor.py
+++ b/src/redops/core/async_processor.py
@@ -241,7 +241,7 @@ def wrapper():
                     def target():
                         try:
                             result_container[0] = func(*args, **kwargs)
-                        except Exception as e:
+                        except (OSError, RuntimeError, TypeError, ValueError) as e:
                             error_container[0] = e
 
                     thread = threading.Thread(target=target)
@@ -258,7 +258,7 @@ def target():
                 else:
                     return func(*args, **kwargs)
 
-            except Exception:
+            except (OSError, RuntimeError, TypeError, ValueError):
                 with self._lock:
                     info.state = TaskState.FAILED
                     info.completed_at = time.time()
@@ -327,7 +327,7 @@ def get_result(
                 state=TaskState.CANCELLED,
                 error="Task was cancelled",
             )
-        except Exception as e:
+        except (OSError, RuntimeError, TypeError, ValueError) as e:
             return TaskResult(
                 task_id=task_id,
                 state=TaskState.FAILED,
@@ -454,7 +454,7 @@ async def run(
                 error="Task was cancelled",
                 started_at=started_at,
             )
-        except Exception as e:
+        except (OSError, RuntimeError, TypeError, ValueError) as e:
             return TaskResult(
                 task_id=task_id,
                 state=TaskState.FAILED,
@@ -792,14 +792,14 @@ async def execute(self, initial_value: Any) -> TaskResult:
                 completed_at=time.time(),
             )
 
-        except Exception as e:
+        except (OSError, RuntimeError, TypeError, ValueError, ArithmeticError) as e:
             for handler in self._error_handlers:
                 try:
                     if asyncio.iscoroutinefunction(handler):
                         await handler(e, current)
                     else:
                         handler(e, current)
-                except Exception:
+                except (OSError, RuntimeError, TypeError, ValueError, ArithmeticError):
                     pass  # Ignore handler errors
 
             return TaskResult(
diff --git a/src/redops/core/cli.py b/src/redops/core/cli.py
index 4bbe122..edef1d9 100644
--- a/src/redops/core/cli.py
+++ b/src/redops/core/cli.py
@@ -523,7 +523,7 @@ def run(self, args: Sequence[str] | None = None) -> int:
             self._output.write("")  # Newline
             self._output.error("Interrupted")
             return 130
-        except Exception as e:
+        except (OSError, RuntimeError, TypeError, ValueError) as e:
             self._output.error(f"Error: {e}")
             if parsed.verbose > 0:
                 import traceback
diff --git a/src/redops/core/data_io.py b/src/redops/core/data_io.py
index 864eeb8..63d3d5a 100644
--- a/src/redops/core/data_io.py
+++ b/src/redops/core/data_io.py
@@ -189,7 +189,7 @@ def validate(self, record: dict[str, Any]) -> list[ValidationError]:
                                     record[field_name],
                                 )
                             )
-                    except Exception as e:
+                    except (OSError, RuntimeError, TypeError, ValueError) as e:
                         errors.append(
                             ValidationError(
                                 f"Validation error for {field_name}: {e}",
diff --git a/src/redops/core/data_validation.py b/src/redops/core/data_validation.py
index 7bdb4f1..2019e0a 100644
--- a/src/redops/core/data_validation.py
+++ b/src/redops/core/data_validation.py
@@ -448,7 +448,7 @@ def validate(self, value: Any, path: str = "") -> None:
                 raise ValidationError(self.message, path, value)
         except ValidationError:
             raise
-        except Exception as e:
+        except (OSError, RuntimeError, TypeError, ValueError) as e:
             raise ValidationError(f"{self.message}: {e}", path, value)
 
     def describe(self) -> str:
@@ -534,7 +534,7 @@ def coerce(self, value: Any, target_type: Type) -> Any:
         # Try direct conversion
         try:
             return target_type(value)
-        except Exception as e:
+        except (OSError, RuntimeError, TypeError, ValueError) as e:
             raise CoercionError(value, target_type.__name__, str(e))
 
     def _to_str(self, value: Any) -> str:
diff --git a/src/redops/core/docs_generator.py b/src/redops/core/docs_generator.py
index 6d5043b..db41c3e 100644
--- a/src/redops/core/docs_generator.py
+++ b/src/redops/core/docs_generator.py
@@ -1230,7 +1230,7 @@ def generate_package_docs(
             try:
                 doc = self._analyzer.analyze_module(py_file)
                 docs[doc_name] = self._formatter.format_module(doc)
-            except Exception as e:
+            except (OSError, RuntimeError, TypeError, ValueError) as e:
                 docs[doc_name] = f"Error generating docs: {e}"
 
         # Write to output directory if specified
diff --git a/src/redops/core/event_bus.py b/src/redops/core/event_bus.py
index d3bd7ba..3140658 100644
--- a/src/redops/core/event_bus.py
+++ b/src/redops/core/event_bus.py
@@ -246,7 +246,7 @@ def matches(self, event: Event) -> bool:
             try:
                 if not self.filter_fn(event):
                     return False
-            except Exception as e:
+            except (OSError, RuntimeError, TypeError, ValueError) as e:
                 logger.warning(f"Filter function failed: {e}")
                 return False
 
@@ -609,7 +609,7 @@ def publish(self, event: Event) -> int:
                 if sub.once:
                     to_remove.append(sub)
 
-            except Exception as e:
+            except (OSError, RuntimeError, TypeError, ValueError) as e:
                 logger.error(f"Handler {sub.handler} failed: {e}")
                 self._stats["events_failed"] += 1
                 self._dlq.add(event, sub.handler, e)
@@ -767,7 +767,7 @@ async def publish(self, event: Event) -> int:
                 if sub.once:
                     to_remove.append(sub)
 
-            except Exception as e:
+            except (OSError, RuntimeError, TypeError, ValueError) as e:
                 logger.error(f"Async handler {sub.handler} failed: {e}")
                 self._stats["events_failed"] += 1
                 self._dlq.add(event, sub.handler, e)
@@ -796,7 +796,7 @@ async def call_handler(sub: Subscription) -> bool:
                 sub.call_count += 1
                 sub.last_called = datetime.now()
                 return True
-            except Exception as e:
+            except (OSError, RuntimeError, TypeError, ValueError) as e:
                 logger.error(f"Handler failed: {e}")
                 self._dlq.add(event, sub.handler, e)
                 return False
@@ -918,7 +918,7 @@ def _worker_loop(self) -> None:
                 self._inner_bus.publish(event)
             except queue.Empty:
                 continue
-            except Exception as e:
+            except (OSError, RuntimeError, TypeError, ValueError) as e:
                 logger.error(f"Worker error: {e}")
 
     def subscribe(self, *args, **kwargs) -> Subscription:
@@ -1034,7 +1034,7 @@ def _do_flush(self) -> list[Event]:
         if self._on_flush and events:
             try:
                 self._on_flush(events)
-            except Exception as e:
+            except (OSError, RuntimeError, TypeError, ValueError) as e:
                 logger.error(f"Flush callback failed: {e}")
 
         return events
@@ -1102,7 +1102,7 @@ def replay(
         for event in events:
             try:
                 handler(event)
-            except Exception as e:
+            except (OSError, RuntimeError, TypeError, ValueError) as e:
                 logger.error(f"Replay handler failed on {event.id}: {e}")
 
         return len(events)
diff --git a/src/redops/core/feature_flags.py b/src/redops/core/feature_flags.py
index b862904..12a1210 100644
--- a/src/redops/core/feature_flags.py
+++ b/src/redops/core/feature_flags.py
@@ -597,7 +597,7 @@ def evaluate(
         for listener in self._listeners:
             try:
                 listener(key, value, ctx)
-            except Exception:
+            except (OSError, RuntimeError, TypeError, ValueError):
                 pass  # Don't let listener errors affect evaluation
 
         return value
diff --git a/src/redops/core/health.py b/src/redops/core/health.py
index e83936e..ee7cc70 100644
--- a/src/redops/core/health.py
+++ b/src/redops/core/health.py
@@ -247,7 +247,7 @@ def check(self) -> CheckResult:
                 error="Connection timed out",
                 duration_ms=duration,
             )
-        except Exception as e:
+        except (OSError, ConnectionError, RuntimeError) as e:
             duration = (time.perf_counter() - start) * 1000
             return self._create_result(
                 HealthStatus.UNHEALTHY,
@@ -334,7 +334,7 @@ def check(self) -> CheckResult:
                 error=str(e.reason),
                 duration_ms=duration,
             )
-        except Exception as e:
+        except (OSError, ConnectionError, RuntimeError, ValueError) as e:
             duration = (time.perf_counter() - start) * 1000
             return self._create_result(
                 HealthStatus.UNHEALTHY,
@@ -407,7 +407,7 @@ def check(self) -> CheckResult:
                 details,
                 duration_ms=duration,
             )
-        except Exception as e:
+        except (OSError, PermissionError, RuntimeError, ValueError) as e:
             duration = (time.perf_counter() - start) * 1000
             return self._create_result(
                 HealthStatus.UNHEALTHY,
@@ -493,7 +493,7 @@ def check(self) -> CheckResult:
                     {},
                     duration_ms=duration,
                 )
-        except Exception as e:
+        except (OSError, RuntimeError, ValueError) as e:
             duration = (time.perf_counter() - start) * 1000
             return self._create_result(
                 HealthStatus.UNKNOWN,
@@ -561,7 +561,7 @@ def check(self) -> CheckResult:
                 error="pgrep not found",
                 duration_ms=duration,
             )
-        except Exception as e:
+        except (OSError, RuntimeError, ValueError) as e:
             duration = (time.perf_counter() - start) * 1000
             return self._create_result(
                 HealthStatus.UNHEALTHY,
@@ -640,7 +640,7 @@ def check(self) -> CheckResult:
                 details,
                 duration_ms=duration,
             )
-        except Exception as e:
+        except (OSError, PermissionError, RuntimeError) as e:
             duration = (time.perf_counter() - start) * 1000
             return self._create_result(
                 HealthStatus.UNHEALTHY,
@@ -690,7 +690,7 @@ def check(self) -> CheckResult:
                     error="Check returned False",
                     duration_ms=duration,
                 )
-        except Exception as e:
+        except (OSError, RuntimeError, TypeError, ValueError) as e:
             duration = (time.perf_counter() - start) * 1000
             return self._create_result(
                 HealthStatus.UNHEALTHY,
@@ -736,7 +736,7 @@ def check(self) -> CheckResult:
                 {"query": self.query},
                 duration_ms=duration,
             )
-        except Exception as e:
+        except (OSError, ConnectionError, RuntimeError, TypeError) as e:
             duration = (time.perf_counter() - start) * 1000
             return self._create_result(
                 HealthStatus.UNHEALTHY,
@@ -805,7 +805,7 @@ def check(self) -> CheckResult:
                 error="redis package not installed",
                 duration_ms=duration,
             )
-        except Exception as e:
+        except (OSError, ConnectionError, RuntimeError, TypeError) as e:
             duration = (time.perf_counter() - start) * 1000
             return self._create_result(
                 HealthStatus.UNHEALTHY,
@@ -884,7 +884,7 @@ def _run_check(self, check: HealthCheck) -> CheckResult:
         def run():
             try:
                 result[0] = check.check()
-            except Exception as e:
+            except (OSError, RuntimeError, TypeError, ValueError) as e:
                 exception[0] = e
 
         thread = threading.Thread(target=run)
@@ -926,7 +926,7 @@ async def _run_async_check(self, check: AsyncHealthCheck) -> CheckResult:
                 error="Timeout",
                 duration_ms=check.timeout * 1000,
             )
-        except Exception as e:
+        except (OSError, RuntimeError, TypeError, ValueError) as e:
             return CheckResult(
                 name=check.name,
                 status=HealthStatus.UNHEALTHY,
@@ -1111,7 +1111,7 @@ def is_alive(self) -> bool:
         if self._custom_check:
             try:
                 return self._custom_check()
-            except Exception:
+            except (OSError, RuntimeError, TypeError, ValueError):
                 return False
 
         if self._manager:
@@ -1122,7 +1122,7 @@ def is_alive(self) -> bool:
                 if checks:
                     result = self._manager.run_check(checks[0])
                     return result is not None
-            except Exception:
+            except (OSError, RuntimeError, TypeError, ValueError):
                 return False
 
         return True
diff --git a/src/redops/core/logging_audit.py b/src/redops/core/logging_audit.py
index a84b3b1..8f4f40f 100644
--- a/src/redops/core/logging_audit.py
+++ b/src/redops/core/logging_audit.py
@@ -791,7 +791,7 @@ def _log(
             for handler in self._handlers:
                 try:
                     handler.handle(entry)
-                except Exception:
+                except (OSError, RuntimeError, TypeError, ValueError, AttributeError):
                     # Don't let handler errors break logging
                     pass
 
@@ -971,7 +971,7 @@ def wrapper(*args, **kwargs):
                     logger._log(level, f"Exiting {func_name}")
 
                 return result
-            except Exception as e:
+            except (OSError, RuntimeError, TypeError, ValueError) as e:
                 logger.error(f"Exception in {func_name}", exception=e)
                 raise
 
diff --git a/src/redops/core/metrics.py b/src/redops/core/metrics.py
index 24b39ef..62fba5f 100644
--- a/src/redops/core/metrics.py
+++ b/src/redops/core/metrics.py
@@ -827,7 +827,7 @@ def _send(self, data: str) -> None:
         try:
             sock = self._get_socket()
             sock.sendto(data.encode("utf-8"), (self._host, self._port))
-        except Exception:
+        except (OSError, ConnectionError, RuntimeError):
             pass  # StatsD is fire-and-forget
 
     def _flush_buffer(self) -> None:
diff --git a/src/redops/core/notifications.py b/src/redops/core/notifications.py
index 3ac5a10..e52eb4b 100644
--- a/src/redops/core/notifications.py
+++ b/src/redops/core/notifications.py
@@ -164,7 +164,7 @@ def replace_var(match):
                     else:
                         value = getattr(value, part, "")
                 return str(value) if value is not None else ""
-            except Exception:
+            except (OSError, RuntimeError, TypeError, ValueError, AttributeError):
                 return ""
 
         return self.VARIABLE_PATTERN.sub(replace_var, template)
@@ -371,7 +371,7 @@ def send(self, notification: Notification) -> bool:
 
             return True
 
-        except Exception as e:
+        except (OSError, ConnectionError, RuntimeError, ValueError) as e:
             notification.error = str(e)
             return False
 
@@ -414,7 +414,7 @@ def send(self, notification: Notification) -> bool:
             with urllib.request.urlopen(request, timeout=self.timeout) as response:
                 return response.status < 400
 
-        except Exception as e:
+        except (OSError, ConnectionError, RuntimeError, ValueError) as e:
             notification.error = str(e)
             return False
 
@@ -494,7 +494,7 @@ def send(self, notification: Notification) -> bool:
             with urllib.request.urlopen(request, timeout=self.timeout) as response:
                 return response.status == 200
 
-        except Exception as e:
+        except (OSError, ConnectionError, RuntimeError, ValueError) as e:
             notification.error = str(e)
             return False
 
@@ -528,7 +528,7 @@ def send(self, notification: Notification) -> bool:
             self.output_func(message)
             return True
 
-        except Exception as e:
+        except (OSError, ConnectionError, RuntimeError, ValueError) as e:
             notification.error = str(e)
             return False
 
@@ -551,7 +551,7 @@ def send(self, notification: Notification) -> bool:
         try:
             result = self.callback(notification)
             return bool(result) if result is not None else True
-        except Exception as e:
+        except (OSError, ConnectionError, RuntimeError, ValueError) as e:
             notification.error = str(e)
             return False
 
@@ -725,7 +725,7 @@ def send(
         for listener in self._listeners:
             try:
                 listener(notification, result)
-            except Exception:
+            except (OSError, RuntimeError, TypeError, ValueError, AttributeError):
                 pass
 
         return result
diff --git a/src/redops/core/plugin_system.py b/src/redops/core/plugin_system.py
index 6298997..c431e29 100644
--- a/src/redops/core/plugin_system.py
+++ b/src/redops/core/plugin_system.py
@@ -327,7 +327,7 @@ def discover_plugins(self) -> list[str]:
                     plugin_name = plugin_path.stem
                     self._discover_plugin_file(plugin_path)
                     discovered.append(plugin_name)
-                except Exception as e:
+                except (OSError, RuntimeError, TypeError, ValueError, ImportError) as e:
                     # Record discovery error but continue
                     self._plugins[plugin_path.stem] = PluginInfo(
                         metadata=PluginMetadata(
@@ -430,7 +430,7 @@ def register(
         try:
             instance = plugin_class()
             instance.initialize(config)
-        except Exception as e:
+        except (OSError, RuntimeError, TypeError, ValueError, AttributeError) as e:
             raise PluginLoadError(f"Failed to initialize plugin: {e}")
 
         self._load_order_counter += 1
@@ -540,7 +540,7 @@ def unregister(self, name: str) -> bool:
         if plugin_info.instance:
             try:
                 plugin_info.instance.shutdown()
-            except Exception:
+            except (OSError, RuntimeError, TypeError, ValueError, AttributeError):
                 pass  # Ignore shutdown errors
 
         del self._plugins[name]
@@ -691,7 +691,7 @@ def execute_hooks(
                         kwargs.get("value"),
                         ctx,
                     )
-            except Exception as e:
+            except (OSError, RuntimeError, TypeError, ValueError, AttributeError) as e:
                 # Log error but continue with other hooks
                 ctx.log(
                     f"Hook error in {hook.__class__.__name__}: {e}",
@@ -743,7 +743,7 @@ def shutdown_all(self) -> None:
             if info and info.instance:
                 try:
                     info.instance.shutdown()
-                except Exception:
+                except (OSError, RuntimeError, TypeError, ValueError, AttributeError):
                     pass
 
 
diff --git a/src/redops/core/rate_limiter.py b/src/redops/core/rate_limiter.py
index ed9f06f..dfcb0c5 100644
--- a/src/redops/core/rate_limiter.py
+++ b/src/redops/core/rate_limiter.py
@@ -720,7 +720,7 @@ def execute_with_retry(
 
             try:
                 return func(*args, **kwargs)
-            except Exception:
+            except (OSError, RuntimeError, TypeError, ValueError):
                 with self._lock:
                     self._attempt_counts[key] = attempt + 1
 
diff --git a/src/redops/core/scan_history.py b/src/redops/core/scan_history.py
index f059515..ba190c3 100644
--- a/src/redops/core/scan_history.py
+++ b/src/redops/core/scan_history.py
@@ -162,7 +162,7 @@ def _get_connection(self):
         try:
             yield conn
             conn.commit()
-        except Exception:
+        except (OSError, RuntimeError, TypeError, ValueError):
             conn.rollback()
             raise
         finally:
diff --git a/src/redops/core/secrets.py b/src/redops/core/secrets.py
index 989cc22..430a4e4 100644
--- a/src/redops/core/secrets.py
+++ b/src/redops/core/secrets.py
@@ -860,7 +860,7 @@ def get_secret(self, name: str) -> Secret | None:
         for callback in self._access_callbacks:
             try:
                 callback(name, result)
-            except Exception as e:  # noqa: BLE001
+            except (OSError, RuntimeError, TypeError, ValueError) as e:
                 logger.warning(f"Access callback failed: {e}")
 
         self._audit.log("get", name)
diff --git a/src/redops/core/task_queue.py b/src/redops/core/task_queue.py
index d51f0ba..01c5111 100644
--- a/src/redops/core/task_queue.py
+++ b/src/redops/core/task_queue.py
@@ -306,7 +306,7 @@ def _run_loop(self) -> None:
                 self._execute_task(task)
             except queue.Empty:
                 continue
-            except Exception as e:
+            except (OSError, RuntimeError, TypeError, ValueError) as e:
                 logger.error(f"Worker {self.worker_id} error: {e}")
 
     def _execute_task(self, task: Task) -> None:
@@ -340,7 +340,7 @@ def _execute_task(self, task: Task) -> None:
             task.status = TaskStatus.TIMEOUT
             task.last_error = str(e)
             self._tasks_failed += 1
-        except Exception as e:
+        except (OSError, RuntimeError, TypeError, ValueError) as e:
             result.error = str(e)
             result.error_type = type(e).__name__
             task.last_error = str(e)
@@ -360,7 +360,7 @@ def _execute_task(self, task: Task) -> None:
             if self._result_callback:
                 try:
                     self._result_callback(result)
-                except Exception as e:
+                except (OSError, RuntimeError, TypeError, ValueError) as e:
                     logger.error(f"Result callback failed: {e}")
 
     def _execute_with_timeout(self, task: Task) -> Any:
@@ -370,7 +370,7 @@ def _execute_with_timeout(self, task: Task) -> Any:
         def target():
             try:
                 result_container["result"] = task.func(*task.args, **task.kwargs)
-            except Exception as e:
+            except (OSError, RuntimeError, TypeError, ValueError) as e:
                 result_container["error"] = e
 
         thread = threading.Thread(target=target)
@@ -593,7 +593,7 @@ def _scheduler_loop(self) -> None:
                         else:
                             break
                 time.sleep(0.1)
-            except Exception as e:
+            except (OSError, RuntimeError, TypeError, ValueError) as e:
                 logger.error(f"Scheduler error: {e}")
 
     def get_result(
@@ -817,7 +817,7 @@ def _run_loop(self) -> None:
                             if job["running_instances"] < job["max_instances"]:
                                 self._execute_job(job_id, job)
                 time.sleep(0.05)  # Check more frequently
-            except Exception as e:
+            except (OSError, RuntimeError, TypeError, ValueError) as e:
                 logger.error(f"Scheduler loop error: {e}")
 
     def _execute_job(self, job_id: str, job: dict[str, Any]) -> None:
@@ -841,7 +841,7 @@ def run_job():
                     )
                 else:
                     job["func"](*job["args"], **job["kwargs"])
-            except Exception as e:
+            except (OSError, RuntimeError, TypeError, ValueError) as e:
                 logger.error(f"Job {job_id} failed: {e}")
             finally:
                 with self._lock:
diff --git a/src/redops/core/workflow.py b/src/redops/core/workflow.py
index be67e1f..9049394 100644
--- a/src/redops/core/workflow.py
+++ b/src/redops/core/workflow.py
@@ -257,7 +257,7 @@ def execute(self, context: WorkflowContext) -> dict[str, TaskResult]:
                         for f in futures:
                             f.cancel()
                         break
-                except Exception as e:
+                except (OSError, RuntimeError, TypeError, ValueError) as e:
                     results[task.id] = TaskResult(
                         task_id=task.id,
                         state=TaskState.FAILED,
@@ -282,7 +282,7 @@ def _execute_task(self, task: Task, context: WorkflowContext) -> TaskResult:
                 start_time=start_time,
                 end_time=datetime.now(timezone.utc),
             )
-        except Exception as e:
+        except (OSError, RuntimeError, TypeError, ValueError) as e:
             return TaskResult(
                 task_id=task.id,
                 state=TaskState.FAILED,
@@ -564,7 +564,7 @@ def execute(
             else:
                 workflow.state = WorkflowState.COMPLETED
 
-        except Exception:
+        except (OSError, RuntimeError, TypeError, ValueError):
             workflow.state = WorkflowState.FAILED
             raise
 
@@ -617,7 +617,7 @@ def _execute_task(
 
                 return result
 
-            except Exception as e:
+            except (OSError, RuntimeError, TypeError, ValueError) as e:
                 last_error = e
                 retries += 1
                 if retries <= task._retries:
@@ -662,7 +662,7 @@ def _execute_parallel(
                 try:
                     result = future.result()
                     results[task.id] = result
-                except Exception as e:
+                except (OSError, RuntimeError, TypeError, ValueError) as e:
                     results[task.id] = TaskResult(
                         task_id=task.id,
                         state=TaskState.FAILED,
diff --git a/src/redops/modules/ai_assistant.py b/src/redops/modules/ai_assistant.py
index 40c9062..70c9c03 100644
--- a/src/redops/modules/ai_assistant.py
+++ b/src/redops/modules/ai_assistant.py
@@ -60,7 +60,7 @@ def _count_openai_tokens(text: str, model: str = "gpt-4o") -> int:
 
         encoding = tiktoken.encoding_for_model(model)
         return len(encoding.encode(text))
-    except Exception:
+    except (OSError, RuntimeError, TypeError, ValueError, ImportError):
         return _approximate_tokens(text)
 
 
@@ -596,7 +596,7 @@ def ai_analyze(ctx, params: dict[str, Any] | None = None):
                 "cost": assistant.get_cost_metrics(),
             },
         )
-    except Exception as e:
+    except (OSError, RuntimeError, TypeError, ValueError, ImportError) as e:
         ctx.log(f"AI analysis failed: {e}", level="ERROR")
 
     return ctx
@@ -617,7 +617,7 @@ def ai_summarize(ctx, params: dict[str, Any] | None = None):
                 "cost": assistant.get_cost_metrics(),
             },
         )
-    except Exception as e:
+    except (OSError, RuntimeError, TypeError, ValueError, ImportError) as e:
         ctx.log(f"AI summarization failed: {e}", level="ERROR")
 
     return ctx
@@ -638,7 +638,7 @@ def ai_recommend(ctx, params: dict[str, Any] | None = None):
                 "cost": assistant.get_cost_metrics(),
             },
         )
-    except Exception as e:
+    except (OSError, RuntimeError, TypeError, ValueError, ImportError) as e:
         ctx.log(f"AI recommendations failed: {e}", level="ERROR")
 
     return ctx
diff --git a/src/redops/modules/intel/censys_intel.py b/src/redops/modules/intel/censys_intel.py
index e1dd836..12fa085 100644
--- a/src/redops/modules/intel/censys_intel.py
+++ b/src/redops/modules/intel/censys_intel.py
@@ -89,7 +89,7 @@ def get_censys_client():
 
             api_id = get_api_key_direct("censys_id")
             api_secret = get_api_key_direct("censys_secret")
-        except Exception:
+        except (OSError, RuntimeError, TypeError, ValueError, ImportError):
             pass
 
     if not api_id or not api_secret:
@@ -99,7 +99,7 @@ def get_censys_client():
         hosts = CensysHosts(api_id=api_id, api_secret=api_secret)
         certs = CensysCerts(api_id=api_id, api_secret=api_secret)
         return hosts, certs
-    except Exception:
+    except (OSError, RuntimeError, TypeError, ValueError, ImportError):
         return None, None
 
 
@@ -149,7 +149,7 @@ def query_censys_host(ctx: Context, params: dict[str, Any] | None = None) -> Con
 
                 ip = socket.gethostbyname(target)
                 ctx.log(f"Resolved {target} to {ip}", level="DEBUG")
-            except Exception as e:
+            except (OSError, ValueError, TypeError) as e:
                 ctx.log(f"Could not resolve {target}: {e}", level="WARNING")
                 censys_data["error"] = f"Could not resolve domain: {e}"
                 ctx.add("censys_host", censys_data)
@@ -210,7 +210,7 @@ def query_censys_host(ctx: Context, params: dict[str, Any] | None = None) -> Con
             level="INFO",
         )
 
-    except Exception as e:
+    except (OSError, RuntimeError, TypeError, ValueError, KeyError, IndexError, AttributeError) as e:
         error_msg = str(e)
         if "404" in error_msg or "not found" in error_msg.lower():
             censys_data["error"] = f"No Censys data for {ip}"
@@ -293,7 +293,7 @@ def query_censys_certificates(
             level="INFO",
         )
 
-    except Exception as e:
+    except (OSError, RuntimeError, TypeError, ValueError, KeyError, IndexError, AttributeError) as e:
         cert_data["error"] = f"Censys certificate error: {str(e)}"
         ctx.log(cert_data["error"], level="WARNING")
 
@@ -380,7 +380,7 @@ def search_censys_hosts(ctx: Context, params: dict[str, Any] | None = None) -> C
             level="INFO",
         )
 
-    except Exception as e:
+    except (OSError, RuntimeError, TypeError, ValueError, KeyError, IndexError, AttributeError) as e:
         search_data["error"] = f"Censys search error: {str(e)}"
         ctx.log(search_data["error"], level="WARNING")
 
diff --git a/src/redops/modules/intel/hibp_intel.py b/src/redops/modules/intel/hibp_intel.py
index 946c584..1c297f4 100644
--- a/src/redops/modules/intel/hibp_intel.py
+++ b/src/redops/modules/intel/hibp_intel.py
@@ -92,7 +92,7 @@ def get_hibp_api_key() -> str | None:
             from redops.cli.settings import get_api_key_direct
 
             api_key = get_api_key_direct("hibp")
-        except Exception:
+        except (OSError, RuntimeError, TypeError, ValueError, ImportError):
             pass
     return api_key
 
@@ -132,7 +132,7 @@ def _make_hibp_request(
             return {"error": "rate_limited"}
         else:
             return {"error": f"HTTP {response.status_code}"}
-    except Exception as e:
+    except (OSError, RuntimeError, TypeError, ValueError, ConnectionError) as e:
         return {"error": str(e)}
 
 
diff --git a/src/redops/modules/intel/hunter_intel.py b/src/redops/modules/intel/hunter_intel.py
index a505f8d..85d6cb6 100644
--- a/src/redops/modules/intel/hunter_intel.py
+++ b/src/redops/modules/intel/hunter_intel.py
@@ -81,7 +81,7 @@ def get_hunter_api_key() -> str | None:
             from redops.cli.settings import get_api_key_direct
 
             api_key = get_api_key_direct("hunter")
-        except Exception:
+        except (OSError, RuntimeError, TypeError, ValueError, ImportError):
             pass  # Settings module may not be available - use env var fallback
     return api_key
 
@@ -112,7 +112,7 @@ def _make_hunter_request(
             return {"error": "invalid_api_key"}
         else:
             return {"error": f"HTTP {response.status_code}"}
-    except Exception as e:
+    except (OSError, RuntimeError, TypeError, ValueError, ConnectionError) as e:
         return {"error": str(e)}
 
 
diff --git a/src/redops/modules/intel/securitytrails_intel.py b/src/redops/modules/intel/securitytrails_intel.py
index 22c6a88..49c4d72 100644
--- a/src/redops/modules/intel/securitytrails_intel.py
+++ b/src/redops/modules/intel/securitytrails_intel.py
@@ -68,7 +68,7 @@ def get_st_api_key() -> str | None:
             from redops.cli.settings import get_api_key_direct
 
             api_key = get_api_key_direct("securitytrails")
-        except Exception:
+        except (OSError, RuntimeError, TypeError, ValueError, ImportError):
             pass
     return api_key
 
@@ -93,7 +93,7 @@ def _make_st_request(endpoint: str, api_key: str) -> dict[str, Any] | None:
             return {"error": "rate_limited"}
         else:
             return {"error": f"HTTP {response.status_code}"}
-    except Exception as e:
+    except (OSError, RuntimeError, TypeError, ValueError, ConnectionError) as e:
         return {"error": str(e)}
 
 
diff --git a/src/redops/modules/intel/shodan_intel.py b/src/redops/modules/intel/shodan_intel.py
index 00f13b1..704840a 100644
--- a/src/redops/modules/intel/shodan_intel.py
+++ b/src/redops/modules/intel/shodan_intel.py
@@ -93,7 +93,7 @@ def get_shodan_client():
             from redops.cli.settings import get_api_key_direct
 
             api_key = get_api_key_direct("shodan")
-        except Exception:
+        except (OSError, RuntimeError, TypeError, ValueError, ImportError):
             pass
 
     if not api_key:
@@ -149,7 +149,7 @@ def query_shodan_host(ctx: Context, params: dict[str, Any] | None = None) -> Con
 
                 ip = socket.gethostbyname(target)
                 ctx.log(f"Resolved {target} to {ip}", level="DEBUG")
-            except Exception as e:
+            except (OSError, ValueError, TypeError) as e:
                 ctx.log(f"Could not resolve {target}: {e}", level="WARNING")
                 shodan_data["error"] = f"Could not resolve domain: {e}"
                 ctx.add("shodan_host", shodan_data)
@@ -194,7 +194,7 @@ def query_shodan_host(ctx: Context, params: dict[str, Any] | None = None) -> Con
             level="INFO",
         )
 
-    except Exception as e:
+    except (OSError, RuntimeError, TypeError, ValueError, KeyError, IndexError, AttributeError) as e:
         error_msg = str(e)
         if "No information available" in error_msg:
             shodan_data["error"] = f"No Shodan data for {ip}"
@@ -264,7 +264,7 @@ def query_shodan_dns(ctx: Context, params: dict[str, Any] | None = None) -> Cont
             level="INFO",
         )
 
-    except Exception as e:
+    except (OSError, RuntimeError, TypeError, ValueError, KeyError, IndexError, AttributeError) as e:
         dns_data["error"] = f"Shodan DNS error: {str(e)}"
         ctx.log(dns_data["error"], level="WARNING")
 
@@ -345,7 +345,7 @@ def search_shodan(ctx: Context, params: dict[str, Any] | None = None) -> Context
             level="INFO",
         )
 
-    except Exception as e:
+    except (OSError, RuntimeError, TypeError, ValueError, KeyError, IndexError, AttributeError) as e:
         search_data["error"] = f"Shodan search error: {str(e)}"
         ctx.log(search_data["error"], level="WARNING")
 
diff --git a/src/redops/modules/intel/stix_export.py b/src/redops/modules/intel/stix_export.py
index 755f1bf..429661a 100644
--- a/src/redops/modules/intel/stix_export.py
+++ b/src/redops/modules/intel/stix_export.py
@@ -384,7 +384,7 @@ def export_to_stix(ctx, params: dict[str, Any] | None = None):
         ctx.add("stix_bundle", bundle.to_dict())
         ctx.log(f"STIX bundle created with {len(bundle.objects)} objects", level="INFO")
 
-    except Exception as e:
+    except (OSError, RuntimeError, TypeError, ValueError, KeyError, IndexError, AttributeError) as e:
         ctx.log(f"STIX export failed: {e}", level="ERROR")
 
     return ctx
diff --git a/src/redops/modules/intel/virustotal_intel.py b/src/redops/modules/intel/virustotal_intel.py
index f0d1f46..3ecae1d 100644
--- a/src/redops/modules/intel/virustotal_intel.py
+++ b/src/redops/modules/intel/virustotal_intel.py
@@ -103,7 +103,7 @@ def get_vt_api_key() -> str | None:
             from redops.cli.settings import get_api_key_direct
 
             api_key = get_api_key_direct("virustotal")
-        except Exception:
+        except (OSError, RuntimeError, TypeError, ValueError, ImportError):
             pass
     return api_key
 
@@ -126,7 +126,7 @@ def _make_vt_request(endpoint: str, api_key: str) -> dict[str, Any] | None:
             return {"error": "not_found"}
         else:
             return {"error": f"HTTP {response.status_code}"}
-    except Exception as e:
+    except (OSError, RuntimeError, TypeError, ValueError, ConnectionError) as e:
         return {"error": str(e)}
 
 
@@ -228,7 +228,7 @@ def query_vt_ip(ctx: Context, params: dict[str, Any] | None = None) -> Context:
             import socket
 
             ip = socket.gethostbyname(target)
-        except Exception as e:
+        except (OSError, ValueError, TypeError) as e:
             ctx.log(f"Could not resolve {target}: {e}", level="WARNING")
             return ctx
 
diff --git a/src/redops/modules/metadata/code_artifacts.py b/src/redops/modules/metadata/code_artifacts.py
index 6b9e1d3..cfcb06f 100644
--- a/src/redops/modules/metadata/code_artifacts.py
+++ b/src/redops/modules/metadata/code_artifacts.py
@@ -494,7 +494,7 @@ def parse_requirements_txt(file_path: Path) -> list[dict[str, str]]:
                 deps.append({"name": name, "version": version})
 
         return deps
-    except Exception:
+    except (OSError, ValueError, TypeError, KeyError, IndexError, AttributeError):
         return []
 
 
@@ -528,7 +528,7 @@ def parse_pyproject_toml(file_path: Path) -> list[dict[str, str]]:
                     )
 
         return deps
-    except Exception:
+    except (OSError, ValueError, TypeError, KeyError, IndexError, AttributeError):
         return []
 
 
@@ -560,7 +560,7 @@ def parse_package_json(file_path: Path) -> list[dict[str, str]]:
                     )
 
         return deps
-    except Exception:
+    except (OSError, ValueError, TypeError, KeyError, IndexError, AttributeError, json.JSONDecodeError):
         return []
 
 
@@ -598,7 +598,7 @@ def parse_go_mod(file_path: Path) -> list[dict[str, str]]:
             deps.append({"name": match.group(1), "version": match.group(2)})
 
         return deps
-    except Exception:
+    except (OSError, ValueError, TypeError, IndexError, AttributeError):
         return []
 
 
@@ -627,7 +627,7 @@ def parse_gemfile(file_path: Path) -> list[dict[str, str]]:
             deps.append({"name": name, "version": version})
 
         return deps
-    except Exception:
+    except (OSError, ValueError, TypeError, IndexError, AttributeError):
         return []
 
 
@@ -658,7 +658,7 @@ def parse_cargo_toml(file_path: Path) -> list[dict[str, str]]:
                 deps.append({"name": match.group(1), "version": match.group(2)})
 
         return deps
-    except Exception:
+    except (OSError, ValueError, TypeError, KeyError, IndexError, AttributeError):
         return []
 
 
@@ -775,7 +775,7 @@ def scan_file_for_secrets(
                         }
                     )
 
-    except Exception:
+    except (OSError, ValueError, TypeError, IndexError, AttributeError):
         pass
 
     return results
@@ -895,7 +895,7 @@ def extract_git_metadata(repo_path: str) -> dict[str, Any] | None:
                 url = re.sub(r"://[^:]+:[^@]+@", "://***:***@", url)
                 metadata["remote_url"] = url
 
-        except Exception:
+        except (OSError, ValueError, TypeError, IndexError, AttributeError):
             pass
 
     # Check HEAD for current branch
@@ -907,7 +907,7 @@ def extract_git_metadata(repo_path: str) -> dict[str, Any] | None:
 
             if head_content.startswith("ref: refs/heads/"):
                 metadata["current_branch"] = head_content[16:]
-        except Exception:
+        except (OSError, ValueError, TypeError, IndexError, AttributeError):
             pass
 
     return metadata
diff --git a/src/redops/modules/metadata/documents.py b/src/redops/modules/metadata/documents.py
index 7605366..557196a 100644
--- a/src/redops/modules/metadata/documents.py
+++ b/src/redops/modules/metadata/documents.py
@@ -299,7 +299,7 @@ def extract_pdf_metadata(file_path: str) -> DocumentMetadata | None:
             metadata["attachments"] = attachment_names
             warnings.append(f"Document contains {len(attachment_names)} embedded files")
 
-    except Exception as e:
+    except (OSError, RuntimeError, TypeError, ValueError, KeyError, IndexError, AttributeError) as e:
         warnings.append(f"Error reading PDF: {str(e)}")
 
     return DocumentMetadata(
@@ -388,7 +388,7 @@ def extract_docx_metadata(
 
     except PackageNotFoundError:
         warnings.append("Invalid or corrupted Word document")
-    except Exception as e:
+    except (OSError, RuntimeError, TypeError, ValueError, KeyError, IndexError, AttributeError) as e:
         warnings.append(f"Error reading Word document: {str(e)}")
 
     return DocumentMetadata(
@@ -439,7 +439,7 @@ def check_docx_for_hidden_data(doc) -> list[str]:
                 warnings.append("Document contains embedded OLE objects")
                 break
 
-    except Exception:
+    except (OSError, RuntimeError, TypeError, ValueError, KeyError, IndexError, AttributeError):
         pass  # Silently ignore errors in hidden data check
 
     return warnings
@@ -488,7 +488,7 @@ def check_for_hidden_data(file_path: str) -> list[str]:
         try:
             doc = DocxDocument(file_path)
             return check_docx_for_hidden_data(doc)
-        except Exception:
+        except (OSError, RuntimeError, TypeError, ValueError, KeyError, IndexError, AttributeError):
             return ["Could not check for hidden data"]
 
     return []
diff --git a/src/redops/modules/metadata/exif.py b/src/redops/modules/metadata/exif.py
index 6dcf443..9bf6421 100644
--- a/src/redops/modules/metadata/exif.py
+++ b/src/redops/modules/metadata/exif.py
@@ -241,7 +241,7 @@ def extract_exif_from_file(file_path: str) -> ExifData | None:
             else:
                 warnings.append("No EXIF data found in image")
 
-    except Exception as e:
+    except (OSError, RuntimeError, ValueError, TypeError, KeyError, IndexError, AttributeError) as e:
         warnings.append(f"Error extracting EXIF: {str(e)}")
         return ExifData(
             filename=path.name,
@@ -312,7 +312,7 @@ def parse_gps_info(gps_info: dict[int, Any]) -> dict[str, Any] | None:
 
         return result
 
-    except Exception:
+    except (OSError, RuntimeError, ValueError, TypeError, KeyError, IndexError, AttributeError):
         return None
 
 
@@ -355,7 +355,7 @@ def convert_exif_value(value: Any) -> Any:
     if isinstance(value, bytes):
         try:
             return value.decode("utf-8", errors="replace")
-        except Exception:
+        except (OSError, ValueError, TypeError, KeyError, IndexError, AttributeError):
             return str(value)
     elif isinstance(value, tuple):
         return [convert_exif_value(v) for v in value]
@@ -372,7 +372,7 @@ def convert_exif_value(value: Any) -> Any:
             if isinstance(value, (int, float, str, bool, type(None))):
                 return value
             return str(value)
-        except Exception:
+        except (OSError, ValueError, TypeError, KeyError, IndexError, AttributeError):
             return str(value)
 
 
@@ -511,7 +511,7 @@ def strip_exif(file_path: str, output_path: str | None = None) -> bool:
 
             return True
 
-    except Exception:
+    except (OSError, ValueError, TypeError, KeyError, IndexError, AttributeError):
         return False
 
 
diff --git a/src/redops/modules/notifications.py b/src/redops/modules/notifications.py
index e1a45c0..c9a0349 100644
--- a/src/redops/modules/notifications.py
+++ b/src/redops/modules/notifications.py
@@ -265,7 +265,7 @@ def _send_slack(self, message: dict[str, Any], critical: int, high: int) -> bool
                 timeout=10,
             )
             return response.status_code == 200
-        except Exception as e:
+        except (OSError, RuntimeError, TypeError, ValueError, ConnectionError) as e:
             logger.warning("Failed to send Slack notification: %s", e)
             return False
 
@@ -293,7 +293,7 @@ def _send_slack_alert(self, title: str, message: str, color: str) -> bool:
                 timeout=10,
             )
             return response.status_code == 200
-        except Exception as e:
+        except (OSError, RuntimeError, TypeError, ValueError, ConnectionError) as e:
             logger.warning("Failed to send Slack alert: %s", e)
             return False
 
@@ -338,7 +338,7 @@ def _send_discord(self, message: dict[str, Any], critical: int, high: int) -> bo
                 timeout=10,
             )
             return response.status_code in (200, 204)
-        except Exception as e:
+        except (OSError, RuntimeError, TypeError, ValueError, ConnectionError) as e:
             logger.warning("Failed to send Discord notification: %s", e)
             return False
 
@@ -369,7 +369,7 @@ def _send_discord_alert(self, title: str, message: str, color: str) -> bool:
                 timeout=10,
             )
             return response.status_code in (200, 204)
-        except Exception as e:
+        except (OSError, RuntimeError, TypeError, ValueError, ConnectionError) as e:
             logger.warning("Failed to send Discord alert: %s", e)
             return False
 
@@ -393,7 +393,7 @@ def _send_email(self, subject: str, body: str) -> bool:
                 server.send_message(msg)
 
             return True
-        except Exception as e:
+        except (OSError, RuntimeError, TypeError, ValueError, ConnectionError, smtplib.SMTPException) as e:
             logger.warning("Failed to send email notification: %s", e)
             return False
 
@@ -405,7 +405,7 @@ def _send_webhook(self, url: str, data: dict[str, Any]) -> bool:
         try:
             response = requests.post(url, json=data, timeout=10)
             return response.status_code in (200, 201, 202, 204)
-        except Exception as e:
+        except (OSError, RuntimeError, TypeError, ValueError, ConnectionError) as e:
             logger.warning("Failed to send webhook to %s: %s", url, e)
             return False
 
@@ -439,7 +439,7 @@ def notify_on_complete(ctx, params: dict[str, Any] | None = None):
         ctx.add("notification_results", results)
         ctx.log(f"Notifications sent: {results}", level="INFO")
 
-    except Exception as e:
+    except (OSError, RuntimeError, TypeError, ValueError, ConnectionError) as e:
         ctx.log(f"Notification failed: {e}", level="WARNING")
 
     return ctx
diff --git a/src/redops/modules/recon/asn_lookup.py b/src/redops/modules/recon/asn_lookup.py
index efb41f7..9f7c453 100644
--- a/src/redops/modules/recon/asn_lookup.py
+++ b/src/redops/modules/recon/asn_lookup.py
@@ -126,7 +126,7 @@ def is_ip_address(value: str) -> bool:
         try:
             socket.inet_pton(socket.AF_INET6, value)
             return True
-        except Exception:
+        except (OSError, ValueError, TypeError):
             pass
 
     return False
@@ -145,7 +145,7 @@ def resolve_domain_to_ip(domain: str) -> str | None:
     """Resolve a domain to its IP address."""
     try:
         return socket.gethostbyname(domain)
-    except Exception:
+    except (OSError, ValueError, TypeError):
         return None
 
 
@@ -206,7 +206,7 @@ def lookup_asn_bgpview(ip: str) -> dict[str, Any]:
 
     except requests.exceptions.RequestException as e:
         return {"error": f"API request failed: {str(e)}"}
-    except Exception as e:
+    except (OSError, ValueError, TypeError, KeyError, IndexError, AttributeError) as e:
         return {"error": f"Lookup failed: {str(e)}"}
 
 
@@ -243,7 +243,7 @@ def lookup_asn_cymru(ip: str) -> dict[str, Any]:
             "note": "Limited data via DNS fallback",
         }
 
-    except Exception:
+    except (OSError, ValueError, TypeError):
         return {"error": "DNS lookup failed"}
 
 
@@ -290,7 +290,7 @@ def lookup_asn_details(asn: str) -> dict[str, Any]:
 
     except requests.exceptions.RequestException:
         return {"asn": asn_num, "error": "API request failed"}
-    except Exception:
+    except (OSError, ValueError, TypeError, KeyError, IndexError, AttributeError):
         return {"asn": asn_num, "error": "Lookup failed"}
 
 
@@ -348,7 +348,7 @@ def get_asn_prefixes(asn: str) -> list[dict[str, Any]]:
 
         return prefixes
 
-    except Exception:
+    except (OSError, ValueError, TypeError, KeyError, IndexError, AttributeError):
         return []
 
 
@@ -394,7 +394,7 @@ def get_asn_peers(asn: str) -> dict[str, list[dict[str, Any]]]:
             ],
         }
 
-    except Exception:
+    except (OSError, ValueError, TypeError, KeyError, IndexError, AttributeError):
         return {"upstreams": [], "downstreams": [], "peers": []}
 
 
diff --git a/src/redops/modules/recon/cert_transparency.py b/src/redops/modules/recon/cert_transparency.py
index a6a760c..5a239bd 100644
--- a/src/redops/modules/recon/cert_transparency.py
+++ b/src/redops/modules/recon/cert_transparency.py
@@ -142,7 +142,7 @@ def query_crtsh(
         return []
     except json.JSONDecodeError:
         return []
-    except Exception:
+    except (OSError, RuntimeError, TypeError, ValueError):
         return []
 
 
@@ -166,7 +166,7 @@ def is_cert_valid(cert: dict[str, Any], now: datetime) -> bool:
             )
             return expiry > now
         return True
-    except Exception:
+    except (OSError, RuntimeError, TypeError, ValueError):
         return True
 
 
@@ -271,7 +271,7 @@ def analyze_certificates(
                     expired_count += 1
                 elif (expiry - now).days < 30:
                     expiring_soon_count += 1
-            except Exception:
+            except (OSError, RuntimeError, TypeError, ValueError):
                 pass
 
         # Check for wildcards
diff --git a/src/redops/modules/recon/domains.py b/src/redops/modules/recon/domains.py
index be2dec1..5dc5210 100644
--- a/src/redops/modules/recon/domains.py
+++ b/src/redops/modules/recon/domains.py
@@ -16,8 +16,12 @@
     import dns.exception
 
     DNS_AVAILABLE = True
+    _DNSException = getattr(dns.exception, "DNSException", None)
+    if not isinstance(_DNSException, type) or not issubclass(_DNSException, BaseException):
+        _DNSException = Exception
 except ImportError:
     DNS_AVAILABLE = False
+    _DNSException = Exception
 
 
 def get_dns_records(domain: str, record_type: str = "A") -> list[str]:
@@ -48,7 +52,7 @@ def _get_dns_records_socket(domain: str) -> list[str]:
     try:
         result = socket.gethostbyname_ex(domain)
         return result[2]
-    except Exception:
+    except (OSError, ValueError, TypeError):
         return []
 
 
@@ -93,7 +97,7 @@ def _get_dns_records_dnspython(domain: str, record_type: str) -> list[str]:
     except dns.exception.Timeout:
         # Query timed out
         pass
-    except Exception:
+    except (OSError, RuntimeError, ValueError, TypeError):
         # Other errors
         pass
 
@@ -274,7 +278,7 @@ def profile_domain(ctx: Context, params: dict[str, Any] | None = None) -> Contex
                 services = [v[0] for v in txt_analysis["verification_records"]]
                 ctx.log(f"Domain verified with services: {services}", level="INFO")
 
-    except Exception as e:
+    except (OSError, RuntimeError, TypeError, ValueError) as e:
         ctx.log(f"Error during DNS enumeration: {e}", level="ERROR")
 
     ctx.add("domain_profile", profile)
@@ -512,7 +516,7 @@ def check_zone_transfer(ctx: Context, params: dict[str, Any] | None = None) -> C
             )
             ctx.add(f"finding_axfr_{ns_clean}", finding.model_dump())
 
-        except Exception:
+        except (OSError, RuntimeError, TypeError, ValueError, _DNSException):
             # Zone transfer denied (expected/secure behavior)
             zone_transfer_results["nameservers_checked"].append(
                 {
diff --git a/src/redops/modules/recon/subdomain_enum.py b/src/redops/modules/recon/subdomain_enum.py
index 637c473..ba364d3 100644
--- a/src/redops/modules/recon/subdomain_enum.py
+++ b/src/redops/modules/recon/subdomain_enum.py
@@ -416,14 +416,14 @@ def resolve_domain(domain: str, timeout: int = 3) -> bool:
             resolver.lifetime = timeout
             resolver.resolve(domain, "A")
             return True
-        except Exception:
+        except (OSError, ValueError, TypeError, dns.resolver.NXDOMAIN, dns.resolver.NoAnswer, dns.resolver.NoNameservers, dns.exception.Timeout):
             return False
     else:
         try:
             socket.setdefaulttimeout(timeout)
             socket.gethostbyname(domain)
             return True
-        except Exception:
+        except (OSError, ValueError, TypeError):
             return False
 
 
@@ -487,7 +487,7 @@ def get_subdomains_from_dns(domain: str, timeout: int = 3) -> set[str]:
                 mx_host = str(rdata.exchange).rstrip(".")
                 if mx_host.endswith(domain):
                     subdomains.add(mx_host)
-        except Exception:
+        except (OSError, ValueError, TypeError, dns.resolver.NXDOMAIN, dns.resolver.NoAnswer, dns.resolver.NoNameservers, dns.exception.Timeout):
             pass
 
         # Check NS records
@@ -497,7 +497,7 @@ def get_subdomains_from_dns(domain: str, timeout: int = 3) -> set[str]:
                 ns_host = str(rdata).rstrip(".")
                 if ns_host.endswith(domain):
                     subdomains.add(ns_host)
-        except Exception:
+        except (OSError, ValueError, TypeError, dns.resolver.NXDOMAIN, dns.resolver.NoAnswer, dns.resolver.NoNameservers, dns.exception.Timeout):
             pass
 
         # Check TXT records for SPF includes
@@ -512,10 +512,10 @@ def get_subdomains_from_dns(domain: str, timeout: int = 3) -> set[str]:
                             include_domain = part[8:]
                             if include_domain.endswith(domain):
                                 subdomains.add(include_domain)
-        except Exception:
+        except (OSError, ValueError, TypeError, dns.resolver.NXDOMAIN, dns.resolver.NoAnswer, dns.resolver.NoNameservers, dns.exception.Timeout):
             pass
 
-    except Exception:
+    except (OSError, ValueError, TypeError, dns.resolver.NXDOMAIN, dns.resolver.NoAnswer, dns.resolver.NoNameservers, dns.exception.Timeout):
         pass
 
     return subdomains
diff --git a/src/redops/modules/recon/tech_stack.py b/src/redops/modules/recon/tech_stack.py
index c807307..5f14d19 100644
--- a/src/redops/modules/recon/tech_stack.py
+++ b/src/redops/modules/recon/tech_stack.py
@@ -464,7 +464,7 @@ def make_request(
             verify=verify_ssl,
         )
         return response
-    except Exception:
+    except (OSError, RuntimeError, TypeError, ValueError, ConnectionError):
         # Try HTTP if HTTPS fails
         if url.startswith("https://"):
             try:
@@ -476,7 +476,7 @@ def make_request(
                     allow_redirects=follow_redirects,
                 )
                 return response
-            except Exception:
+            except (OSError, RuntimeError, TypeError, ValueError, ConnectionError):
                 pass
         return None
 
@@ -610,7 +610,7 @@ def fetch_favicon_hash(
                 # Check against known hashes
                 identified = FAVICON_HASHES.get(hash_value)
                 return (hash_value, identified)
-        except Exception:
+        except (OSError, RuntimeError, TypeError, ValueError, ConnectionError):
             continue
 
     return None
@@ -669,7 +669,7 @@ def get_ssl_info(target: str) -> dict[str, Any] | None:
                         "serial_number": cert.get("serialNumber"),
                         "version": cert.get("version"),
                     }
-    except Exception:
+    except (OSError, RuntimeError, TypeError, ValueError):
         pass
 
     return None
diff --git a/src/redops/modules/reporting/junit_report.py b/src/redops/modules/reporting/junit_report.py
index bdd40bc..ebd512b 100644
--- a/src/redops/modules/reporting/junit_report.py
+++ b/src/redops/modules/reporting/junit_report.py
@@ -417,7 +417,7 @@ def prettify_xml(xml_str: str) -> str:
     try:
         dom = minidom.parseString(xml_str)
         return dom.toprettyxml(indent="  ", encoding=None)
-    except Exception:
+    except (OSError, RuntimeError, TypeError, ValueError):
         return f'\n{xml_str}'
 
 
diff --git a/src/redops/modules/reporting/pdf_report.py b/src/redops/modules/reporting/pdf_report.py
index 5cf92fb..0ea250d 100644
--- a/src/redops/modules/reporting/pdf_report.py
+++ b/src/redops/modules/reporting/pdf_report.py
@@ -486,7 +486,7 @@ def generate_pdf_report(ctx, params: dict[str, Any] | None = None):
 
     except ImportError as e:
         ctx.log(f"PDF generation skipped: {e}", level="WARNING")
-    except Exception as e:
+    except (OSError, RuntimeError, TypeError, ValueError, KeyError, IndexError, AttributeError) as e:
         ctx.log(f"PDF generation failed: {e}", level="ERROR")
 
     return ctx
diff --git a/src/redops/modules/rf/ai_client.py b/src/redops/modules/rf/ai_client.py
index ca80b41..21eceeb 100644
--- a/src/redops/modules/rf/ai_client.py
+++ b/src/redops/modules/rf/ai_client.py
@@ -296,7 +296,7 @@ async def _process_batch(self) -> None:
             try:
                 result = await self._send_request(prompt, system)
                 future.set_result(result)
-            except Exception as exc:
+            except (OSError, RuntimeError, TypeError, ValueError, ConnectionError) as exc:
                 future.set_exception(exc)
 
     # ------------------------------------------------------------------
diff --git a/src/redops/modules/rf/dashboard.py b/src/redops/modules/rf/dashboard.py
index 05a513c..2ae95ea 100644
--- a/src/redops/modules/rf/dashboard.py
+++ b/src/redops/modules/rf/dashboard.py
@@ -594,7 +594,7 @@ async def analyze(body: AnalyzeRequest) -> AnalyzeResponse:
             targets=targets,
             objective=body.objective,
         )
-    except Exception as exc:
+    except (OSError, RuntimeError, TypeError, ValueError, ConnectionError) as exc:
         logger.error("AI analysis failed: %s", exc)
         raise HTTPException(
             status_code=502,
diff --git a/src/redops/modules/rf/event_bus.py b/src/redops/modules/rf/event_bus.py
index b59affe..eead1c5 100644
--- a/src/redops/modules/rf/event_bus.py
+++ b/src/redops/modules/rf/event_bus.py
@@ -293,7 +293,7 @@ async def emit(
                     await sub.callback(event)  # type: ignore[misc]
                 else:
                     await loop.run_in_executor(None, sub.callback, event)
-            except Exception:
+            except (OSError, RuntimeError, TypeError, ValueError):
                 logger.exception(
                     "Error in subscriber %s for %s",
                     sub.sub_id,
@@ -354,7 +354,7 @@ def emit_sync(
                 continue
             try:
                 sub.callback(event)
-            except Exception:
+            except (OSError, RuntimeError, TypeError, ValueError):
                 logger.exception(
                     "Error in subscriber %s for %s",
                     sub.sub_id,
diff --git a/src/redops/modules/rf/tool_manager.py b/src/redops/modules/rf/tool_manager.py
index ce4d61c..628aa1e 100644
--- a/src/redops/modules/rf/tool_manager.py
+++ b/src/redops/modules/rf/tool_manager.py
@@ -454,7 +454,7 @@ async def stop_all(self) -> None:
         for tool_id in tool_ids:
             try:
                 await self.stop_tool(tool_id)
-            except Exception:
+            except (OSError, RuntimeError, TypeError, ValueError):
                 logger.exception(
                     "Error stopping tool %s",
                     tool_id[:8],
@@ -627,7 +627,7 @@ async def _stream_reader(
                         await asyncio.sleep(0.1)
         except asyncio.CancelledError:
             logger.debug("Stream reader cancelled for %s", tool_id[:8])
-        except Exception:
+        except (OSError, RuntimeError, TypeError, ValueError):
             logger.exception("Stream reader error for tool %s", tool_id[:8])
 
 
diff --git a/src/redops/modules/threat_intel/abuseipdb.py b/src/redops/modules/threat_intel/abuseipdb.py
index 50ef385..55c3b89 100644
--- a/src/redops/modules/threat_intel/abuseipdb.py
+++ b/src/redops/modules/threat_intel/abuseipdb.py
@@ -114,7 +114,7 @@ def _check_ip(
         return {"ip": ip, "error": f"API error: {str(e)}"}
     except requests.exceptions.RequestException as e:
         return {"ip": ip, "error": f"Request failed: {str(e)}"}
-    except Exception as e:
+    except (OSError, RuntimeError, TypeError, ValueError, ConnectionError) as e:
         return {"ip": ip, "error": f"Query failed: {str(e)}"}
 
 
@@ -189,7 +189,7 @@ def report_ip(
         return {"error": f"API error: {str(e)}"}
     except requests.exceptions.RequestException as e:
         return {"error": f"Request failed: {str(e)}"}
-    except Exception as e:
+    except (OSError, RuntimeError, TypeError, ValueError, ConnectionError) as e:
         return {"error": f"Report failed: {str(e)}"}
 
 
@@ -229,7 +229,7 @@ def get_blacklist(
         data = response.json()
         return data.get("data", [])
 
-    except Exception:
+    except (OSError, RuntimeError, TypeError, ValueError, ConnectionError):
         return []
 
 
diff --git a/src/redops/modules/threat_intel/greynoise.py b/src/redops/modules/threat_intel/greynoise.py
index 3a93c41..ebd8a83 100644
--- a/src/redops/modules/threat_intel/greynoise.py
+++ b/src/redops/modules/threat_intel/greynoise.py
@@ -117,7 +117,7 @@ def _query_community_api(ip: str, api_key: str | None = None) -> dict[str, Any]:
 
     except requests.exceptions.RequestException as e:
         return {"ip": ip, "error": f"API request failed: {str(e)}"}
-    except Exception as e:
+    except (OSError, RuntimeError, TypeError, ValueError, ConnectionError) as e:
         return {"ip": ip, "error": f"Query failed: {str(e)}"}
 
 
@@ -156,7 +156,7 @@ def get_greynoise_context(ip: str, api_key: str) -> dict[str, Any]:
 
     except requests.exceptions.RequestException as e:
         return {"ip": ip, "error": f"API request failed: {str(e)}"}
-    except Exception as e:
+    except (OSError, RuntimeError, TypeError, ValueError, ConnectionError) as e:
         return {"ip": ip, "error": f"Context lookup failed: {str(e)}"}
 
 
@@ -197,7 +197,7 @@ def get_greynoise_riot(ip: str, api_key: str | None = None) -> dict[str, Any]:
 
     except requests.exceptions.RequestException as e:
         return {"ip": ip, "error": f"RIOT lookup failed: {str(e)}"}
-    except Exception as e:
+    except (OSError, RuntimeError, TypeError, ValueError, ConnectionError) as e:
         return {"ip": ip, "error": f"RIOT query failed: {str(e)}"}
 
 
diff --git a/src/redops/modules/threat_intel/malwarebazaar.py b/src/redops/modules/threat_intel/malwarebazaar.py
index e5e1230..ea25a8a 100644
--- a/src/redops/modules/threat_intel/malwarebazaar.py
+++ b/src/redops/modules/threat_intel/malwarebazaar.py
@@ -195,7 +195,7 @@ def _query_api(payload: dict[str, Any]) -> dict[str, Any]:
 
     except requests.exceptions.RequestException as e:
         return {"error": f"API request failed: {str(e)}"}
-    except Exception as e:
+    except (OSError, RuntimeError, TypeError, ValueError, ConnectionError) as e:
         return {"error": f"Query failed: {str(e)}"}
 
 
diff --git a/src/redops/modules/threat_intel/threatfox.py b/src/redops/modules/threat_intel/threatfox.py
index 0f25584..7cb08ce 100644
--- a/src/redops/modules/threat_intel/threatfox.py
+++ b/src/redops/modules/threat_intel/threatfox.py
@@ -195,7 +195,7 @@ def _query_api(payload: dict[str, Any]) -> dict[str, Any]:
 
     except requests.exceptions.RequestException as e:
         return {"error": f"API request failed: {str(e)}"}
-    except Exception as e:
+    except (OSError, RuntimeError, TypeError, ValueError, ConnectionError) as e:
         return {"error": f"Query failed: {str(e)}"}
 
 
diff --git a/src/redops/modules/threat_intel/urlhaus.py b/src/redops/modules/threat_intel/urlhaus.py
index 2cfebab..193bff5 100644
--- a/src/redops/modules/threat_intel/urlhaus.py
+++ b/src/redops/modules/threat_intel/urlhaus.py
@@ -86,7 +86,7 @@ def _query_url(url: str) -> dict[str, Any]:
 
     except requests.exceptions.RequestException as e:
         return {"queried_url": url, "error": f"Request failed: {str(e)}"}
-    except Exception as e:
+    except (OSError, RuntimeError, TypeError, ValueError, ConnectionError) as e:
         return {"queried_url": url, "error": f"Query failed: {str(e)}"}
 
 
@@ -116,7 +116,7 @@ def check_host(host: str) -> dict[str, Any]:
 
     except requests.exceptions.RequestException as e:
         return {"queried_host": host, "error": f"Request failed: {str(e)}"}
-    except Exception as e:
+    except (OSError, RuntimeError, TypeError, ValueError, ConnectionError) as e:
         return {"queried_host": host, "error": f"Query failed: {str(e)}"}
 
 
@@ -167,7 +167,7 @@ def check_payload(
 
     except requests.exceptions.RequestException as e:
         return {"queried_hash": hash_value, "error": f"Request failed: {str(e)}"}
-    except Exception as e:
+    except (OSError, RuntimeError, TypeError, ValueError, ConnectionError) as e:
         return {"queried_hash": hash_value, "error": f"Query failed: {str(e)}"}
 
 
@@ -193,7 +193,7 @@ def get_recent_urls(limit: int = 100) -> list[dict[str, Any]]:
         data = response.json()
         return data.get("urls", [])
 
-    except Exception:
+    except (OSError, RuntimeError, TypeError, ValueError, ConnectionError):
         return []
 
 
diff --git a/tests/test_abuseipdb.py b/tests/test_abuseipdb.py
index 74d3605..cff4b31 100644
--- a/tests/test_abuseipdb.py
+++ b/tests/test_abuseipdb.py
@@ -159,7 +159,7 @@ def test_successful_blacklist(self, mock_requests):
     @patch("redops.modules.threat_intel.abuseipdb.requests")
     def test_blacklist_error(self, mock_requests):
         """Test error handling in blacklist."""
-        mock_requests.get.side_effect = Exception("API error")
+        mock_requests.get.side_effect = ConnectionError("API error")
 
         result = get_blacklist("test-key")
 
diff --git a/tests/test_asn_lookup.py b/tests/test_asn_lookup.py
index d36ab3d..2f5adc3 100644
--- a/tests/test_asn_lookup.py
+++ b/tests/test_asn_lookup.py
@@ -1,5 +1,6 @@
 """Tests for the ASN lookup module."""
 
+import socket
 from unittest.mock import patch, MagicMock
 from redops.core.context import Context
 from redops.modules.recon.asn_lookup import (
@@ -79,7 +80,7 @@ def test_successful_resolution(self, mock_gethostbyname):
     @patch("socket.gethostbyname")
     def test_failed_resolution(self, mock_gethostbyname):
         """Test failed domain resolution."""
-        mock_gethostbyname.side_effect = Exception("Host not found")
+        mock_gethostbyname.side_effect = socket.gaierror("Host not found")
 
         result = resolve_domain_to_ip("nonexistent.example.com")
         assert result is None
diff --git a/tests/test_censys_intel.py b/tests/test_censys_intel.py
index 80e906c..4345201 100644
--- a/tests/test_censys_intel.py
+++ b/tests/test_censys_intel.py
@@ -1,5 +1,6 @@
 """Tests for Censys intelligence module."""
 
+import socket
 from unittest.mock import patch, MagicMock
 
 from redops.core.context import Context
@@ -477,7 +478,7 @@ def test_settings_fallback_exception(self):
                 # Mock settings to raise exception
                 with patch(
                     "redops.cli.settings.get_api_key_direct",
-                    side_effect=Exception("Settings error"),
+                    side_effect=RuntimeError("Settings error"),
                 ):
                     from importlib import reload
                     import redops.modules.intel.censys_intel as censys_mod
@@ -488,7 +489,7 @@ def test_settings_fallback_exception(self):
 
     def test_client_creation_exception_returns_none(self):
         """Test that client creation exception returns (None, None)."""
-        mock_hosts_class = MagicMock(side_effect=Exception("Auth failed"))
+        mock_hosts_class = MagicMock(side_effect=RuntimeError("Auth failed"))
         mock_certs_class = MagicMock()
 
         mock_search = MagicMock()
@@ -526,7 +527,7 @@ def test_domain_resolution_failure(self):
             return_value=(mock_hosts, None),
         ):
             with patch(
-                "socket.gethostbyname", side_effect=Exception("DNS resolution failed")
+                "socket.gethostbyname", side_effect=socket.gaierror("DNS resolution failed")
             ):
                 result = query_censys_host(ctx)
 
@@ -576,7 +577,7 @@ def test_404_error(self):
         ctx = Context(target="93.184.216.34")
 
         mock_hosts = MagicMock()
-        mock_hosts.view.side_effect = Exception("404 - Host not found")
+        mock_hosts.view.side_effect = RuntimeError("404 - Host not found")
 
         with patch(
             "redops.modules.intel.censys_intel.get_censys_client",
@@ -593,7 +594,7 @@ def test_not_found_error_lowercase(self):
         ctx = Context(target="10.0.0.1")
 
         mock_hosts = MagicMock()
-        mock_hosts.view.side_effect = Exception("Resource not found")
+        mock_hosts.view.side_effect = RuntimeError("Resource not found")
 
         with patch(
             "redops.modules.intel.censys_intel.get_censys_client",
@@ -609,7 +610,7 @@ def test_generic_api_error(self):
         ctx = Context(target="93.184.216.34")
 
         mock_hosts = MagicMock()
-        mock_hosts.view.side_effect = Exception("Rate limit exceeded")
+        mock_hosts.view.side_effect = RuntimeError("Rate limit exceeded")
 
         with patch(
             "redops.modules.intel.censys_intel.get_censys_client",
@@ -691,7 +692,7 @@ def test_certificate_query_exception(self):
         ctx = Context(target="example.com")
 
         mock_certs = MagicMock()
-        mock_certs.search.side_effect = Exception("API timeout")
+        mock_certs.search.side_effect = RuntimeError("API timeout")
 
         with patch(
             "redops.modules.intel.censys_intel.get_censys_client",
@@ -761,7 +762,7 @@ def test_search_exception(self):
         ctx = Context(target="example.com")
 
         mock_hosts = MagicMock()
-        mock_hosts.search.side_effect = Exception("Search failed")
+        mock_hosts.search.side_effect = RuntimeError("Search failed")
 
         with patch(
             "redops.modules.intel.censys_intel.get_censys_client",
diff --git a/tests/test_core_notifications.py b/tests/test_core_notifications.py
index 6053431..8048f46 100644
--- a/tests/test_core_notifications.py
+++ b/tests/test_core_notifications.py
@@ -261,7 +261,7 @@ def test_callback_returns_false(self):
 
     def test_callback_exception(self):
         """Test callback exception is caught."""
-        callback = MagicMock(side_effect=Exception("Test error"))
+        callback = MagicMock(side_effect=RuntimeError("Test error"))
         channel = CallbackChannel(config={"callback": callback})
 
         n = Notification(title="Test", message="Test")
diff --git a/tests/test_documents.py b/tests/test_documents.py
index d8fe641..e26dc27 100644
--- a/tests/test_documents.py
+++ b/tests/test_documents.py
@@ -795,7 +795,7 @@ def test_pdf_with_attachments(self):
     def test_pdf_reader_exception(self):
         """Test PDF extraction handles reader exceptions."""
         mock_reader_class = MagicMock()
-        mock_reader_class.side_effect = Exception("Corrupted PDF")
+        mock_reader_class.side_effect = RuntimeError("Corrupted PDF")
 
         with patch("redops.modules.metadata.documents.PYPDF_AVAILABLE", True):
             with patch(
@@ -945,7 +945,7 @@ class MockPackageNotFoundError(Exception):
     def test_docx_generic_exception(self):
         """Test DOCX extraction handles generic exceptions."""
         mock_doc_class = MagicMock()
-        mock_doc_class.side_effect = Exception("Generic error")
+        mock_doc_class.side_effect = RuntimeError("Generic error")
 
         # Create a fake PackageNotFoundError that won't match
         class FakePackageNotFoundError(Exception):
@@ -1056,7 +1056,7 @@ def test_hidden_data_check_exception(self):
         """Test hidden data check handles exceptions gracefully."""
         mock_doc = MagicMock()
         mock_doc.core_properties.revision = "5"
-        mock_doc.part.rels.values.side_effect = Exception("Access error")
+        mock_doc.part.rels.values.side_effect = RuntimeError("Access error")
 
         # Should not raise, should return empty list
         warnings = check_docx_for_hidden_data(mock_doc)
diff --git a/tests/test_exif.py b/tests/test_exif.py
index e4cce9f..e6c1bc6 100644
--- a/tests/test_exif.py
+++ b/tests/test_exif.py
@@ -689,7 +689,7 @@ def mock_open(path):
                 img = original_open(path)
                 # Make _getexif raise an exception
                 img._getexif = lambda: (_ for _ in ()).throw(
-                    Exception("EXIF read error")
+                    RuntimeError("EXIF read error")
                 )
                 return img
 
@@ -728,7 +728,7 @@ def test_parse_gps_exception_returns_none(self):
         # Force dms_to_decimal to raise an exception
         with patch(
             "redops.modules.metadata.exif.dms_to_decimal",
-            side_effect=Exception("Conversion error"),
+            side_effect=RuntimeError("Conversion error"),
         ):
             gps_info = {
                 1: "N",
diff --git a/tests/test_health.py b/tests/test_health.py
index 3cfdc17..a03c729 100644
--- a/tests/test_health.py
+++ b/tests/test_health.py
@@ -415,7 +415,7 @@ def test_failed_connection(self):
         """Test failed database connection."""
 
         def bad_connection():
-            raise Exception("Connection failed")
+            raise ConnectionError("Connection failed")
 
         check = DatabaseCheck(bad_connection)
         result = check.check()
diff --git a/tests/test_hibp_intel.py b/tests/test_hibp_intel.py
index 4c7497a..bb9093a 100644
--- a/tests/test_hibp_intel.py
+++ b/tests/test_hibp_intel.py
@@ -410,7 +410,7 @@ def test_settings_exception(self):
             os.environ.pop("HIBP_API_KEY", None)
 
             with patch(
-                "redops.cli.settings.get_api_key_direct", side_effect=Exception("Error")
+                "redops.cli.settings.get_api_key_direct", side_effect=RuntimeError("Error")
             ):
                 key = get_hibp_api_key()
 
@@ -530,7 +530,7 @@ def test_other_error_response(self):
     def test_request_exception(self):
         """Test request exception handling."""
         mock_requests = MagicMock()
-        mock_requests.get.side_effect = Exception("Connection error")
+        mock_requests.get.side_effect = ConnectionError("Connection error")
 
         with patch.dict("sys.modules", {"requests": mock_requests}):
             from importlib import reload
diff --git a/tests/test_hunter_intel.py b/tests/test_hunter_intel.py
index ef84d9e..a3d4994 100644
--- a/tests/test_hunter_intel.py
+++ b/tests/test_hunter_intel.py
@@ -344,7 +344,7 @@ def test_settings_fallback_exception(self):
         with patch.dict("os.environ", {}, clear=True):
             with patch(
                 "redops.cli.settings.get_api_key_direct",
-                side_effect=Exception("Settings error"),
+                side_effect=RuntimeError("Settings error"),
             ):
                 result = get_hunter_api_key()
                 assert result is None
@@ -483,7 +483,7 @@ def test_other_status_code_response(self):
     def test_request_exception(self):
         """Test request exception handling."""
         mock_requests = MagicMock()
-        mock_requests.get.side_effect = Exception("Connection error")
+        mock_requests.get.side_effect = ConnectionError("Connection error")
 
         import sys
 
diff --git a/tests/test_recon_domains.py b/tests/test_recon_domains.py
index 6aa2ce6..72f07f2 100644
--- a/tests/test_recon_domains.py
+++ b/tests/test_recon_domains.py
@@ -3,6 +3,7 @@
 import sys
 from importlib import reload
 from unittest.mock import patch, MagicMock
+import dns.exception
 import pytest
 from redops.core.context import Context
 from redops.modules.recon.domains import (
@@ -83,7 +84,7 @@ def test_socket_fallback(self):
     def test_socket_fallback_failure(self):
         """Test socket fallback handles errors."""
         with patch("socket.gethostbyname_ex") as mock_socket:
-            mock_socket.side_effect = Exception("DNS lookup failed")
+            mock_socket.side_effect = OSError("DNS lookup failed")
 
             records = _get_dns_records_socket("nonexistent.invalid")
 
@@ -210,7 +211,7 @@ def test_profile_domain_no_target(self):
     def test_profile_domain_dns_error(self):
         """Test domain profiling with DNS errors."""
         with patch("redops.modules.recon.domains.get_all_dns_records") as mock_dns:
-            mock_dns.side_effect = Exception("DNS error")
+            mock_dns.side_effect = RuntimeError("DNS error")
 
             ctx = Context(target="example.com")
             result = profile_domain(ctx)
@@ -445,7 +446,7 @@ def test_zone_transfer_denied(self):
             mock_ns.return_value = ["ns1.example.com."]
 
             with patch("dns.zone.from_xfr") as mock_xfr:
-                mock_xfr.side_effect = Exception("Transfer failed")
+                mock_xfr.side_effect = dns.exception.DNSException("Transfer failed")
 
                 ctx = Context(target="example.com")
                 result = check_zone_transfer(ctx)
@@ -722,7 +723,7 @@ def test_dnspython_generic_exception(self):
 
         with patch("dns.resolver.Resolver") as mock_resolver_class:
             mock_resolver = MagicMock()
-            mock_resolver.resolve.side_effect = Exception("Unknown error")
+            mock_resolver.resolve.side_effect = RuntimeError("Unknown error")
             mock_resolver_class.return_value = mock_resolver
 
             records = _get_dns_records_dnspython("example.com", "A")
@@ -891,7 +892,7 @@ def test_zone_transfer_not_vulnerable_completion(self):
             mock_ns.return_value = ["ns1.example.com."]
 
             with patch("dns.zone.from_xfr") as mock_xfr:
-                mock_xfr.side_effect = Exception("Transfer denied")
+                mock_xfr.side_effect = dns.exception.DNSException("Transfer denied")
 
                 ctx = Context(target="example.com")
                 result = check_zone_transfer(ctx)
@@ -1389,7 +1390,7 @@ def test_zone_transfer_vulnerable_mocked(self):
     def test_zone_transfer_denied_mocked(self):
         """Test zone transfer denied with mocked dns modules."""
         mock_zone_module = MagicMock()
-        mock_zone_module.from_xfr.side_effect = Exception("Transfer denied")
+        mock_zone_module.from_xfr.side_effect = dns.exception.DNSException("Transfer denied")
 
         mock_query_module = MagicMock()
 
@@ -1417,7 +1418,7 @@ def test_zone_transfer_denied_mocked(self):
     def test_zone_transfer_completion_not_vulnerable_logging(self):
         """Test zone transfer completion logging when not vulnerable."""
         mock_zone_module = MagicMock()
-        mock_zone_module.from_xfr.side_effect = Exception("Transfer denied")
+        mock_zone_module.from_xfr.side_effect = dns.exception.DNSException("Transfer denied")
 
         mock_query_module = MagicMock()
 
@@ -1511,7 +1512,7 @@ def side_effect(*args, **kwargs):
                 mock_zone_instance.iterate_rdatasets.return_value = [1, 2]
                 return mock_zone_instance
             else:
-                raise Exception("Transfer denied")
+                raise RuntimeError("Transfer denied")
 
         mock_zone_module.from_xfr.side_effect = side_effect
 
diff --git a/tests/test_securitytrails_intel.py b/tests/test_securitytrails_intel.py
index fa8c3a4..118e94d 100644
--- a/tests/test_securitytrails_intel.py
+++ b/tests/test_securitytrails_intel.py
@@ -336,7 +336,7 @@ def test_settings_fallback_exception(self):
         with patch.dict("os.environ", {}, clear=True):
             with patch(
                 "redops.cli.settings.get_api_key_direct",
-                side_effect=Exception("Settings error"),
+                side_effect=RuntimeError("Settings error"),
             ):
                 result = get_st_api_key()
                 assert result is None
@@ -441,7 +441,7 @@ def test_other_status_code_response(self):
     def test_request_exception(self):
         """Test request exception handling."""
         mock_requests = MagicMock()
-        mock_requests.get.side_effect = Exception("Connection error")
+        mock_requests.get.side_effect = ConnectionError("Connection error")
 
         with patch.dict(sys.modules, {"requests": mock_requests}):
             import redops.modules.intel.securitytrails_intel as st_mod
diff --git a/tests/test_shodan_intel.py b/tests/test_shodan_intel.py
index 7abd6b2..3f33a4d 100644
--- a/tests/test_shodan_intel.py
+++ b/tests/test_shodan_intel.py
@@ -1,5 +1,6 @@
 """Tests for Shodan intelligence module."""
 
+import socket
 import sys
 from importlib import reload
 from unittest.mock import patch, MagicMock
@@ -376,7 +377,7 @@ def test_settings_fallback_exception(self):
             with patch.dict("os.environ", {}, clear=True):
                 with patch(
                     "redops.cli.settings.get_api_key_direct",
-                    side_effect=Exception("Settings error"),
+                    side_effect=RuntimeError("Settings error"),
                 ):
                     import redops.modules.intel.shodan_intel as shodan_mod
 
@@ -399,7 +400,7 @@ def test_domain_resolution_failure(self):
             return_value=mock_client,
         ):
             with patch(
-                "socket.gethostbyname", side_effect=Exception("DNS resolution failed")
+                "socket.gethostbyname", side_effect=socket.gaierror("DNS resolution failed")
             ):
                 result = query_shodan_host(ctx)
 
@@ -412,7 +413,7 @@ def test_no_information_available_error(self):
         ctx = Context(target="10.0.0.1")
 
         mock_client = MagicMock()
-        mock_client.host.side_effect = Exception("No information available for that IP")
+        mock_client.host.side_effect = RuntimeError("No information available for that IP")
 
         with patch(
             "redops.modules.intel.shodan_intel.get_shodan_client",
@@ -428,7 +429,7 @@ def test_generic_api_error(self):
         ctx = Context(target="93.184.216.34")
 
         mock_client = MagicMock()
-        mock_client.host.side_effect = Exception("Rate limit exceeded")
+        mock_client.host.side_effect = RuntimeError("Rate limit exceeded")
 
         with patch(
             "redops.modules.intel.shodan_intel.get_shodan_client",
@@ -482,7 +483,7 @@ def test_dns_query_exception(self):
         ctx = Context(target="example.com")
 
         mock_client = MagicMock()
-        mock_client.dns.domain_info.side_effect = Exception("DNS lookup failed")
+        mock_client.dns.domain_info.side_effect = RuntimeError("DNS lookup failed")
 
         with patch(
             "redops.modules.intel.shodan_intel.get_shodan_client",
@@ -523,7 +524,7 @@ def test_search_exception(self):
         ctx = Context(target="example.com")
 
         mock_client = MagicMock()
-        mock_client.search.side_effect = Exception("Search failed")
+        mock_client.search.side_effect = RuntimeError("Search failed")
 
         with patch(
             "redops.modules.intel.shodan_intel.get_shodan_client",
diff --git a/tests/test_subdomain_enum.py b/tests/test_subdomain_enum.py
index 484e62e..6dd797f 100644
--- a/tests/test_subdomain_enum.py
+++ b/tests/test_subdomain_enum.py
@@ -1,5 +1,8 @@
 """Tests for the subdomain enumeration module."""
 
+import dns.resolver
+import dns.exception
+import socket
 from unittest.mock import patch, MagicMock
 from redops.core.context import Context
 from redops.modules.recon.subdomain_enum import (
@@ -126,7 +129,7 @@ def test_with_dnspython(self, mock_resolver_class):
     def test_resolution_failure_dnspython(self, mock_resolver_class):
         """Test failed resolution with dnspython."""
         mock_resolver = MagicMock()
-        mock_resolver.resolve.side_effect = Exception("NXDOMAIN")
+        mock_resolver.resolve.side_effect = dns.resolver.NXDOMAIN("NXDOMAIN")
         mock_resolver_class.return_value = mock_resolver
 
         result = resolve_domain("nonexistent.example.com")
@@ -145,7 +148,7 @@ def test_socket_fallback(self, mock_gethostbyname):
     @patch("socket.gethostbyname")
     def test_socket_failure(self, mock_gethostbyname):
         """Test socket resolution failure."""
-        mock_gethostbyname.side_effect = Exception("Host not found")
+        mock_gethostbyname.side_effect = socket.gaierror("Host not found")
 
         result = resolve_domain("nonexistent.example.com")
         assert result is False
diff --git a/tests/test_tech_stack.py b/tests/test_tech_stack.py
index a9678eb..b36cc70 100644
--- a/tests/test_tech_stack.py
+++ b/tests/test_tech_stack.py
@@ -754,7 +754,7 @@ def test_make_request_https_fails_tries_http(self):
         """Test that HTTPS failure falls back to HTTP."""
         # First call (HTTPS) fails, second call (HTTP) succeeds
         mock_response = MagicMock()
-        self.mock_requests.get.side_effect = [Exception("SSL Error"), mock_response]
+        self.mock_requests.get.side_effect = [ConnectionError("SSL Error"), mock_response]
 
         result = self.ts_module.make_request("https://example.com")
 
@@ -763,14 +763,14 @@ def test_make_request_https_fails_tries_http(self):
 
     def test_make_request_both_fail(self):
         """Test when both HTTPS and HTTP fail."""
-        self.mock_requests.get.side_effect = Exception("Connection failed")
+        self.mock_requests.get.side_effect = ConnectionError("Connection failed")
 
         result = self.ts_module.make_request("https://example.com")
         assert result is None
 
     def test_make_request_http_url_no_fallback(self):
         """Test HTTP URL doesn't trigger HTTPS fallback."""
-        self.mock_requests.get.side_effect = Exception("Connection failed")
+        self.mock_requests.get.side_effect = ConnectionError("Connection failed")
 
         result = self.ts_module.make_request("http://example.com")
         assert result is None
@@ -853,7 +853,7 @@ def test_fetch_favicon_empty_content(self):
 
     def test_fetch_favicon_exception(self):
         """Test favicon fetch with exception."""
-        self.mock_requests.get.side_effect = Exception("Connection error")
+        self.mock_requests.get.side_effect = ConnectionError("Connection error")
 
         result = self.ts_module.fetch_favicon_hash("https://example.com")
         assert result is None
@@ -887,21 +887,21 @@ def test_ssl_info_invalid_host(self):
     def test_ssl_info_http_url(self):
         """Test extracting hostname from HTTP URL."""
         with patch("socket.create_connection") as mock_socket:
-            mock_socket.side_effect = Exception("Connection failed")
+            mock_socket.side_effect = OSError("Connection failed")
             result = get_ssl_info("http://example.com")
             assert result is None
 
     def test_ssl_info_https_url(self):
         """Test extracting hostname from HTTPS URL."""
         with patch("socket.create_connection") as mock_socket:
-            mock_socket.side_effect = Exception("Connection failed")
+            mock_socket.side_effect = OSError("Connection failed")
             result = get_ssl_info("https://example.com")
             assert result is None
 
     def test_ssl_info_with_port(self):
         """Test extracting hostname when port is present."""
         with patch("socket.create_connection") as mock_socket:
-            mock_socket.side_effect = Exception("Connection failed")
+            mock_socket.side_effect = OSError("Connection failed")
             result = get_ssl_info("example.com:8443")
             assert result is None
 
diff --git a/tests/test_urlhaus.py b/tests/test_urlhaus.py
index 99e5c98..60abc08 100644
--- a/tests/test_urlhaus.py
+++ b/tests/test_urlhaus.py
@@ -217,7 +217,7 @@ def test_get_recent(self, mock_requests):
     @patch("redops.modules.threat_intel.urlhaus.requests")
     def test_get_recent_error(self, mock_requests):
         """Test error handling."""
-        mock_requests.get.side_effect = Exception("API error")
+        mock_requests.get.side_effect = ConnectionError("API error")
 
         result = get_recent_urls()
 
diff --git a/tests/test_virustotal_intel.py b/tests/test_virustotal_intel.py
index bc52284..3f3297a 100644
--- a/tests/test_virustotal_intel.py
+++ b/tests/test_virustotal_intel.py
@@ -1,5 +1,6 @@
 """Tests for VirusTotal intelligence module."""
 
+import socket
 import sys
 from importlib import reload
 from unittest.mock import patch, MagicMock
@@ -399,7 +400,7 @@ def test_settings_fallback_exception(self):
         with patch.dict("os.environ", {}, clear=True):
             with patch(
                 "redops.cli.settings.get_api_key_direct",
-                side_effect=Exception("Settings error"),
+                side_effect=RuntimeError("Settings error"),
             ):
                 result = get_vt_api_key()
                 assert result is None
@@ -489,7 +490,7 @@ def test_other_status_code_response(self):
     def test_request_exception(self):
         """Test request exception handling."""
         mock_requests = MagicMock()
-        mock_requests.get.side_effect = Exception("Connection error")
+        mock_requests.get.side_effect = ConnectionError("Connection error")
 
         with patch.dict(sys.modules, {"requests": mock_requests}):
             import redops.modules.intel.virustotal_intel as vt_mod
@@ -564,7 +565,7 @@ def test_domain_resolution_failure(self):
         ctx = Context(target="nonexistent.invalid.domain")
 
         with patch(
-            "socket.gethostbyname", side_effect=Exception("DNS resolution failed")
+            "socket.gethostbyname", side_effect=socket.gaierror("DNS resolution failed")
         ):
             result = query_vt_ip(ctx)
 

From 572c18623c4e08c7886c1b720f4affdbe328791d Mon Sep 17 00:00:00 2001
From: AreteDriver 
Date: Mon, 20 Jul 2026 12:56:22 -0700
Subject: [PATCH 07/10] chore: pin fpdf2 to >=2.8.0 for enum compatibility

XPos/YPos enums were introduced in fpdf2 2.8.0. Previous minimum
of 2.7.0 could cause AttributeError on import.

Co-Authored-By: Claude 
---
 pyproject.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pyproject.toml b/pyproject.toml
index 1d13bd6..7779d83 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -49,7 +49,7 @@ full = [
     "dnspython>=2.8.0",
     "requests>=2.31.0",
     "jinja2>=3.1.0",
-    "fpdf2>=2.7.0",
+    "fpdf2>=2.8.0",
     "reportlab>=4.0.0",
     "tenacity>=8.0.0",
     "shodan>=1.31.0",

From 098d0a10ee5b217bd67fb52f17aed17473aa9357 Mon Sep 17 00:00:00 2001
From: AreteDriver 
Date: Mon, 20 Jul 2026 13:17:46 -0700
Subject: [PATCH 08/10] fix: narrow last bare except in web/app.py worker
 safety net

Co-Authored-By: Claude 
---
 src/redops/web/app.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/redops/web/app.py b/src/redops/web/app.py
index 6c85c06..f6e074e 100644
--- a/src/redops/web/app.py
+++ b/src/redops/web/app.py
@@ -573,7 +573,7 @@ async def run_scan_task(scan_id: str, request: ScanRequest):
         # Emit completion
         await emit_scan_completed(scan_id, len(ctx.data))
 
-    except Exception as e:  # Worker safety net — prevents unhandled exceptions from killing the background task
+    except (OSError, RuntimeError, ImportError, TypeError, ValueError, ConnectionError, RedOpsError) as e:  # Worker safety net — prevents unhandled exceptions from killing the background task
         _scans[scan_id].status = "failed"
         _scans[scan_id].error = str(e)
         await emit_scan_failed(scan_id, str(e))

From 18bc889d899da1756b6ed740d58de622a0161415 Mon Sep 17 00:00:00 2001
From: AreteDriver 
Date: Tue, 21 Jul 2026 03:30:26 -0700
Subject: [PATCH 09/10] =?UTF-8?q?feat:=20Priority-1=20production=20readine?=
 =?UTF-8?q?ss=20=E2=80=94=20session=20store,=20error=20handling,=20auth=20?=
 =?UTF-8?q?tests,=20CI?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Add Redis-backed ScanStore with backward-compatible dict proxies
- Narrow ~74 bare except Exception to specific tuples across 20+ files
- Add record_authorization_from_params pipeline step + tests
- Remove continue-on-error from security.yml and release.yml
- Add mypy strict=true to pyproject.toml
- Fix tests for narrowed exception catch tuples
- Preserve app.py worker safety net as intentional broad except
- Full suite: 5428 passed, 43 skipped

Co-Authored-By: Claude 
---
 .github/workflows/release.yml                 |    1 -
 .github/workflows/security.yml                |    2 -
 config/pipelines/active_chain.json            |   12 +
 config/pipelines/threat_intel_hunt.json       |   78 ++
 config/pipelines/web_app_assessment.json      |   79 ++
 pyproject.toml                                |    7 +
 src/redops/analysis/comparison.py             |   43 +-
 src/redops/api/server.py                      |    2 +-
 src/redops/cache/backends.py                  |   18 +-
 src/redops/cli/app.py                         |   29 +-
 src/redops/cli/commands/config.py             |    2 +-
 src/redops/cli/commands/scan.py               |   34 +-
 src/redops/cli/main.py                        |    4 +-
 src/redops/cli/settings.py                    |    2 +-
 src/redops/db/connection.py                   |    5 +-
 src/redops/jobs/queue.py                      |    6 +-
 src/redops/jobs/redis_backend.py              |    4 +-
 src/redops/jobs/scheduler.py                  |    4 +-
 src/redops/main.py                            |    4 +-
 src/redops/mcp/server.py                      |    8 +-
 src/redops/mcp/tools.py                       |    4 +-
 src/redops/modules/active/authorization.py    |   29 +
 src/redops/notifications/email.py             |    4 +-
 src/redops/notifications/manager.py           |    6 +-
 src/redops/notifications/webhooks.py          |   10 +-
 src/redops/observability/metrics.py           |    8 +-
 src/redops/observability/tracing.py           |    6 +-
 src/redops/pipelines/loader.py                |    3 +-
 src/redops/pipelines/runner.py                |    5 +-
 src/redops/plugins/examples/header_scanner.py |    4 +-
 src/redops/plugins/examples/port_scanner.py   |    2 +-
 src/redops/plugins/repository.py              |    2 +-
 src/redops/plugins/scanner.py                 |    6 +-
 src/redops/scheduler/executor.py              |    8 +-
 src/redops/scheduler/models.py                |    2 +-
 src/redops/scheduler/scheduler.py             |   10 +-
 src/redops/tenants/manager.py                 |    2 +-
 src/redops/web/app.py                         | 1155 +++++++++++++++--
 src/redops/web/store.py                       |  342 +++++
 tests/integration/test_basic_integration.py   |   70 +
 tests/test_active_authorization.py            |   32 +
 tests/test_cli_commands.py                    |   18 +
 tests/test_cli_settings.py                    |    2 +-
 tests/test_main.py                            |    4 +-
 tests/test_mcp_server.py                      |    6 +-
 tests/test_scan_store.py                      |  146 +++
 tests/test_scheduler.py                       |    2 +-
 tests/test_web_app.py                         |    6 +-
 48 files changed, 2065 insertions(+), 173 deletions(-)
 create mode 100644 config/pipelines/threat_intel_hunt.json
 create mode 100644 config/pipelines/web_app_assessment.json
 create mode 100644 src/redops/web/store.py
 create mode 100644 tests/test_scan_store.py

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6fb6907..4f47661 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -81,7 +81,6 @@ jobs:
         with:
           password: ${{ secrets.PYPI_API_TOKEN }}
           skip-existing: true
-        continue-on-error: true
 
   publish-docker:
     name: Publish Docker Image
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 5d2faec..aaf7a28 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -36,11 +36,9 @@ jobs:
 
       - name: Run Safety check
         run: safety check --full-report
-        continue-on-error: true
 
       - name: Run pip-audit
         run: pip-audit
-        continue-on-error: true
 
   semgrep:
     name: Semgrep Analysis
diff --git a/config/pipelines/active_chain.json b/config/pipelines/active_chain.json
index 4808ba1..a2b409b 100644
--- a/config/pipelines/active_chain.json
+++ b/config/pipelines/active_chain.json
@@ -8,6 +8,18 @@
     "warning": "Authorized home lab use only"
   },
   "steps": [
+    {
+      "name": "Record Authorization",
+      "module": "active.authorization.record_authorization_from_params",
+      "params": {
+        "operator": "{{operator}}",
+        "target_assertion": "{{target}}",
+        "consent_text": "I am authorized to perform active security testing on the stated target. This is my own network, a designated lab environment, or a system for which I have explicit written permission.",
+        "duration_hours": 4
+      },
+      "enabled": true,
+      "continue_on_error": false
+    },
     {
       "name": "Validate Scope",
       "module": "compliance.scope_guard.validate_scope",
diff --git a/config/pipelines/threat_intel_hunt.json b/config/pipelines/threat_intel_hunt.json
new file mode 100644
index 0000000..e6badc0
--- /dev/null
+++ b/config/pipelines/threat_intel_hunt.json
@@ -0,0 +1,78 @@
+{
+  "metadata": {
+    "name": "Threat Intelligence Hunt",
+    "description": "Proactive threat hunting: IP reputation, malware hashes, passive DNS, and dark web exposure checks",
+    "version": "1.0",
+    "author": "RedOps",
+    "tags": ["threat-intel", "reputation", "passive-dns", "malware", "dark-web"]
+  },
+  "steps": [
+    {
+      "name": "IP Reputation Check",
+      "module": "threat_intel.abuseipdb.check_ip",
+      "params": {},
+      "enabled": true,
+      "continue_on_error": true
+    },
+    {
+      "name": "GreyNoise Context",
+      "module": "threat_intel.greynoise.query_ip",
+      "params": {},
+      "enabled": true,
+      "continue_on_error": true
+    },
+    {
+      "name": "Passive DNS Lookup",
+      "module": "threat_intel.passivedns.lookup_domain",
+      "params": {},
+      "enabled": true,
+      "continue_on_error": true
+    },
+    {
+      "name": "Malware Bazaar Hash Check",
+      "module": "threat_intel.malwarebazaar.query_hash",
+      "params": {},
+      "enabled": true,
+      "continue_on_error": true
+    },
+    {
+      "name": "ThreatFox IOC Check",
+      "module": "threat_intel.threatfox.query_ioc",
+      "params": {},
+      "enabled": true,
+      "continue_on_error": true
+    },
+    {
+      "name": "URLhaus URL Check",
+      "module": "threat_intel.urlhaus.check_url",
+      "params": {},
+      "enabled": true,
+      "continue_on_error": true
+    },
+    {
+      "name": "AlienVault OTX Pulse",
+      "module": "threat_intel.alienvault.query_otx",
+      "params": {},
+      "enabled": true,
+      "continue_on_error": true
+    },
+    {
+      "name": "Score Risks",
+      "module": "intel.risk_scoring.score_risks",
+      "params": {},
+      "enabled": true,
+      "continue_on_error": true
+    },
+    {
+      "name": "Generate Markdown Report",
+      "module": "reporting.markdown_report.generate_technical_report",
+      "params": {},
+      "enabled": true,
+      "continue_on_error": true
+    }
+  ],
+  "config": {
+    "timeout": 300,
+    "strict_scope": true
+  }
+}
diff --git a/config/pipelines/web_app_assessment.json b/config/pipelines/web_app_assessment.json
new file mode 100644
index 0000000..cad3feb
--- /dev/null
+++ b/config/pipelines/web_app_assessment.json
@@ -0,0 +1,79 @@
+{
+  "metadata": {
+    "name": "Web Application Assessment",
+    "description": "OWASP-aligned web application security assessment: headers, SSL/TLS, exposed panels, and technology fingerprinting",
+    "version": "1.0",
+    "author": "RedOps",
+    "tags": ["web-app", "owasp", "ssl", "headers", "exposure"]
+  },
+  "steps": [
+    {
+      "name": "Profile Domain",
+      "module": "recon.domains.profile_domain",
+      "params": {},
+      "enabled": true,
+      "continue_on_error": true
+    },
+    {
+      "name": "SSL/TLS Configuration Audit",
+      "module": "recon.ssl_analyzer.analyze_ssl",
+      "params": {
+        "check_heartbleed": true,
+        "check_poodle": true
+      },
+      "enabled": true,
+      "continue_on_error": true
+    },
+    {
+      "name": "Security Headers Check",
+      "module": "recon.http_headers.analyze_headers",
+      "params": {
+        "check_csp": true,
+        "check_hsts": true
+      },
+      "enabled": true,
+      "continue_on_error": true
+    },
+    {
+      "name": "Fingerprint Technology Stack",
+      "module": "recon.tech_stack.fingerprint",
+      "params": {},
+      "enabled": true,
+      "continue_on_error": true
+    },
+    {
+      "name": "Detect Exposed Admin Panels",
+      "module": "recon.exposed_panels.detect",
+      "params": {
+        "panels": ["phpmyadmin", "wp-admin", "adminer", "cPanel"]
+      },
+      "enabled": true,
+      "continue_on_error": true
+    },
+    {
+      "name": "Score Risks",
+      "module": "intel.risk_scoring.score_risks",
+      "params": {},
+      "enabled": true,
+      "continue_on_error": true
+    },
+    {
+      "name": "Generate SARIF Report",
+      "module": "reporting.sarif_report.generate_sarif",
+      "params": {},
+      "enabled": true,
+      "continue_on_error": true
+    },
+    {
+      "name": "Generate Markdown Report",
+      "module": "reporting.markdown_report.generate_technical_report",
+      "params": {},
+      "enabled": true,
+      "continue_on_error": true
+    }
+  ],
+  "config": {
+    "timeout": 300,
+    "strict_scope": true
+  }
+}
diff --git a/pyproject.toml b/pyproject.toml
index 7779d83..09db841 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -140,6 +140,13 @@ exclude_lines = [
 show_missing = true
 skip_covered = true
 
+[tool.mypy]
+python_version = "3.10"
+strict = true
+ignore_missing_imports = true
+warn_unreachable = true
+show_error_codes = true
+
 [tool.setuptools]
 package-dir = {"" = "src"}
 
diff --git a/src/redops/analysis/comparison.py b/src/redops/analysis/comparison.py
index 595ecfb..6523e8f 100644
--- a/src/redops/analysis/comparison.py
+++ b/src/redops/analysis/comparison.py
@@ -73,6 +73,22 @@ def _generate_fingerprint(self) -> str:
         fingerprint_str = "|".join(components)
         return hashlib.sha256(fingerprint_str.encode()).hexdigest()[:16]
 
+    def to_dict(self) -> dict[str, Any]:
+        """Convert to dictionary for serialization."""
+        return {
+            "id": self.id,
+            "title": self.title,
+            "severity": self.severity,
+            "description": self.description,
+            "module": self.module,
+            "category": self.category,
+            "evidence": self.evidence,
+            "cvss_score": self.cvss_score,
+            "cve_ids": self.cve_ids,
+            "status": self.status,
+            "fingerprint": self.fingerprint,
+        }
+
 
 @dataclass
 class FindingDiff:
@@ -120,6 +136,22 @@ def is_regression(self) -> bool:
             return new_sev > old_sev
         return False
 
+    def to_dict(self) -> dict[str, Any]:
+        """Convert diff to dictionary for serialization."""
+        result: dict[str, Any] = {
+            "diff_type": self.diff_type.value,
+            "finding": self.finding.to_dict(),
+            "is_improvement": self.is_improvement,
+            "is_regression": self.is_regression,
+        }
+        if self.previous_finding:
+            result["previous_finding"] = self.previous_finding.to_dict()
+        if self.changes:
+            result["changes"] = {
+                k: {"from": v[0], "to": v[1]} for k, v in self.changes.items()
+            }
+        return result
+
 
 @dataclass
 class ComparisonResult:
@@ -203,9 +235,9 @@ def severity_summary(self, diff_type: DiffType | None = None) -> dict[str, int]:
 
         return counts
 
-    def to_dict(self) -> dict[str, Any]:
+    def to_dict(self, include_findings: bool = True) -> dict[str, Any]:
         """Convert to dictionary for serialization."""
-        return {
+        result = {
             "baseline_scan_id": self.baseline_scan_id,
             "current_scan_id": self.current_scan_id,
             "baseline_date": self.baseline_date.isoformat(),
@@ -225,6 +257,13 @@ def to_dict(self) -> dict[str, Any]:
             "severity_new": self.severity_summary(DiffType.NEW),
             "severity_resolved": self.severity_summary(DiffType.RESOLVED),
         }
+        if include_findings:
+            result["new_findings"] = [d.to_dict() for d in self.new_findings]
+            result["resolved_findings"] = [d.to_dict() for d in self.resolved_findings]
+            result["modified_findings"] = [d.to_dict() for d in self.modified_findings]
+            result["unchanged_findings"] = [d.to_dict() for d in self.unchanged_findings]
+            result["regression_findings"] = [d.to_dict() for d in self.regression_findings]
+        return result
 
 
 class ScanComparator:
diff --git a/src/redops/api/server.py b/src/redops/api/server.py
index 317995d..9725f5f 100644
--- a/src/redops/api/server.py
+++ b/src/redops/api/server.py
@@ -1093,7 +1093,7 @@ def handle_request(self, request: APIRequest) -> APIResponse:
 
         try:
             return match.handler(request)
-        except Exception as e:
+        except (RuntimeError, ValueError, TypeError) as e:
             return self._error_response(
                 HTTPStatus.INTERNAL_ERROR,
                 "internal_error",
diff --git a/src/redops/cache/backends.py b/src/redops/cache/backends.py
index 9bee160..419c206 100644
--- a/src/redops/cache/backends.py
+++ b/src/redops/cache/backends.py
@@ -329,7 +329,7 @@ def is_available(self) -> bool:
         try:
             self._client.ping()
             return True
-        except Exception:
+        except (ConnectionError, TimeoutError, OSError):
             return False
 
     def _make_key(self, key: str) -> str:
@@ -365,7 +365,7 @@ def get(self, key: str) -> CacheEntry | None:
             )
 
             return entry
-        except Exception as e:
+        except (ConnectionError, TimeoutError, OSError, json.JSONDecodeError, UnicodeDecodeError) as e:
             logger.error(f"Redis get error: {e}")
             return None
 
@@ -409,7 +409,7 @@ def set(
                 if ttl:
                     self._client.expire(tag_key, ttl)
 
-        except Exception as e:
+        except (ConnectionError, TimeoutError, OSError, TypeError) as e:
             logger.error(f"Redis set error: {e}")
 
     def delete(self, key: str) -> bool:
@@ -420,7 +420,7 @@ def delete(self, key: str) -> bool:
         try:
             full_key = self._make_key(key)
             return self._client.delete(full_key) > 0
-        except Exception as e:
+        except (ConnectionError, TimeoutError, OSError) as e:
             logger.error(f"Redis delete error: {e}")
             return False
 
@@ -432,7 +432,7 @@ def exists(self, key: str) -> bool:
         try:
             full_key = self._make_key(key)
             return self._client.exists(full_key) > 0
-        except Exception as e:
+        except (ConnectionError, TimeoutError, OSError) as e:
             logger.error(f"Redis exists error: {e}")
             return False
 
@@ -447,7 +447,7 @@ def clear(self) -> int:
             if keys:
                 return self._client.delete(*keys)
             return 0
-        except Exception as e:
+        except (ConnectionError, TimeoutError, OSError) as e:
             logger.error(f"Redis clear error: {e}")
             return 0
 
@@ -460,7 +460,7 @@ def keys(self, pattern: str = "*") -> list[str]:
             full_pattern = self._make_key(pattern)
             keys = list(self._client.scan_iter(full_pattern))
             return [self._strip_prefix(k.decode("utf-8")) for k in keys]
-        except Exception as e:
+        except (ConnectionError, TimeoutError, OSError, UnicodeDecodeError) as e:
             logger.error(f"Redis keys error: {e}")
             return []
 
@@ -478,7 +478,7 @@ def delete_by_tag(self, tag: str) -> int:
                     count += 1
             self._client.delete(tag_key)
             return count
-        except Exception as e:
+        except (ConnectionError, TimeoutError, OSError, UnicodeDecodeError) as e:
             logger.error(f"Redis delete_by_tag error: {e}")
             return 0
 
@@ -498,7 +498,7 @@ def get_stats(self) -> dict[str, Any]:
                 "connected_clients": info.get("connected_clients", 0),
                 "uptime_days": info.get("uptime_in_days", 0),
             }
-        except Exception as e:
+        except (ConnectionError, TimeoutError, OSError) as e:
             logger.error(f"Redis stats error: {e}")
             return {"backend": "redis", "available": False, "error": str(e)}
 
diff --git a/src/redops/cli/app.py b/src/redops/cli/app.py
index a9e917a..6f68397 100644
--- a/src/redops/cli/app.py
+++ b/src/redops/cli/app.py
@@ -570,7 +570,7 @@ def cmd_ai(args: argparse.Namespace, config: CLIConfig) -> int:
     # Initialize AI assistant
     try:
         assistant = AIAssistant(provider=provider, model=model)
-    except Exception as e:
+    except (ImportError, ValueError) as e:
         print_error(f"Failed to initialize AI assistant: {e}")
         print_info(
             "Make sure you have configured an API key using 'redops settings' or 'redops apikey set'"
@@ -587,9 +587,12 @@ def cmd_ai(args: argparse.Namespace, config: CLIConfig) -> int:
         try:
             with open(input_file, "r") as f:
                 scan_data = json.load(f)
-        except Exception as e:
+        except OSError as e:
             print_error(f"Failed to read input file: {e}")
             return 1
+        except json.JSONDecodeError as e:
+            print_error(f"Invalid JSON in input file: {e}")
+            return 1
 
         if not config.quiet:
             print_info("Analyzing scan results with AI...")
@@ -610,8 +613,8 @@ def cmd_ai(args: argparse.Namespace, config: CLIConfig) -> int:
             try:
                 with open(context_file, "r") as f:
                     context_data = json.load(f)
-            except Exception:
-                pass
+            except (OSError, json.JSONDecodeError):
+                context_data = None
 
         if not config.quiet:
             print_info("Getting AI explanation...")
@@ -629,9 +632,12 @@ def cmd_ai(args: argparse.Namespace, config: CLIConfig) -> int:
         try:
             with open(input_file, "r") as f:
                 scan_data = json.load(f)
-        except Exception as e:
+        except OSError as e:
             print_error(f"Failed to read input file: {e}")
             return 1
+        except json.JSONDecodeError as e:
+            print_error(f"Invalid JSON in input file: {e}")
+            return 1
 
         if not config.quiet:
             print_info("Generating remediation suggestions...")
@@ -649,9 +655,12 @@ def cmd_ai(args: argparse.Namespace, config: CLIConfig) -> int:
         try:
             with open(input_file, "r") as f:
                 scan_data = json.load(f)
-        except Exception as e:
+        except OSError as e:
             print_error(f"Failed to read input file: {e}")
             return 1
+        except json.JSONDecodeError as e:
+            print_error(f"Invalid JSON in input file: {e}")
+            return 1
 
         if not config.quiet:
             print_info("Generating AI summary...")
@@ -688,7 +697,7 @@ def cmd_ai(args: argparse.Namespace, config: CLIConfig) -> int:
                     with open(filepath, "r") as f:
                         context_data = json.load(f)
                     print(f"Loaded context from: {filepath}")
-                except Exception as e:
+                except (OSError, json.JSONDecodeError) as e:
                     print(f"Error loading file: {e}")
                 continue
 
@@ -921,7 +930,7 @@ def cmd_plugin(args: argparse.Namespace, config: CLIConfig) -> int:
             else:
                 print_warning("No plugins found in source")
                 return 1
-        except Exception as e:
+        except (ImportError, OSError, ValueError) as e:
             print_error(f"Failed to load plugin: {e}")
             return 1
 
@@ -1057,7 +1066,7 @@ def execute_scan(target: str, modules: list[str], config: CLIConfig) -> ScanResu
             try:
                 ctx = run_module(ctx, module_name, config)
                 modules_run.append(module_name)
-            except Exception as e:
+            except (RuntimeError, ImportError, ConnectionError, OSError, ValueError) as e:
                 errors.append(f"{module_name}: {str(e)}")
                 if config.verbosity == Verbosity.DEBUG:
                     import traceback
@@ -1083,7 +1092,7 @@ def execute_scan(target: str, modules: list[str], config: CLIConfig) -> ScanResu
             context=ctx,
         )
 
-    except Exception as e:
+    except (RuntimeError, ImportError, OSError, ConnectionError, ValueError) as e:
         return ScanResult(
             success=False,
             target=target,
diff --git a/src/redops/cli/commands/config.py b/src/redops/cli/commands/config.py
index 5935f53..cd8a06e 100644
--- a/src/redops/cli/commands/config.py
+++ b/src/redops/cli/commands/config.py
@@ -222,7 +222,7 @@ def validate_cmd(path):
 
     try:
         config_data = load_config(str(config_path))
-    except Exception as e:
+    except (ValueError, TypeError, OSError, RuntimeError) as e:
         print_error(f"Failed to parse config: {e}")
         sys.exit(1)
 
diff --git a/src/redops/cli/commands/scan.py b/src/redops/cli/commands/scan.py
index 965c129..18ab72b 100644
--- a/src/redops/cli/commands/scan.py
+++ b/src/redops/cli/commands/scan.py
@@ -72,7 +72,7 @@ def _run_local_scan(
 
     try:
         config = RedOpsConfig.from_env()
-    except Exception:
+    except (OSError, ValueError, TypeError):
         config = RedOpsConfig()
 
     console.print(f"[bold]Starting local scan on {target}[/bold]")
@@ -114,7 +114,7 @@ def _run_local_scan(
 
         return 0
 
-    except Exception as e:
+    except (RuntimeError, ValueError, TypeError, OSError, ConnectionError) as e:
         print_error(f"Local scan failed: {e}")
         return 1
 
@@ -134,18 +134,40 @@ def _extract_findings_from_context(ctx) -> list[dict]:
     return findings
 
 
-@click.group()
-def scan():
+class _DefaultScanGroup(click.Group):
+    """Custom group that treats unknown first argument as target for local scan."""
+
+    def parse_args(self, ctx, args):
+        # Known subcommands
+        known = {"run", "list", "status", "cancel", "list-pipelines"}
+        # If no args or first arg is a known subcommand or starts with '-', use normal parsing
+        if not args or args[0] in known or args[0].startswith("-"):
+            return super().parse_args(ctx, args)
+        # Otherwise insert 'run' and '--local' so the user can type:
+        #   redops scan example.com
+        # which becomes:
+        #   redops scan run --local example.com
+        args.insert(0, "--local")
+        args.insert(0, "run")
+        return super().parse_args(ctx, args)
+
+
+@click.group(cls=_DefaultScanGroup, invoke_without_command=True)
+@click.pass_context
+def scan(ctx):
     """Scan management commands.
 
     \b
     Examples:
+        redops scan https://example.com
         redops scan run https://example.com
         redops scan list
         redops scan status scan-123
         redops scan cancel scan-123
     """
-    pass
+    if ctx.invoked_subcommand is None:
+        # No subcommand given — show help
+        click.echo(ctx.get_help())
 
 
 @scan.command("run")
@@ -470,7 +492,7 @@ def list_pipelines_cmd():
                 console.print(f"    [dim]{pipeline.metadata.description}[/dim]")
             console.print(f"    Steps: {len(pipeline.steps)} | Tags: {', '.join(pipeline.metadata.tags)}")
             console.print()
-        except Exception as e:
+        except (OSError, ValueError, TypeError, RuntimeError) as e:
             console.print(f"  [red]{path.name}[/red] — error: {e}")
             console.print()
 
diff --git a/src/redops/cli/main.py b/src/redops/cli/main.py
index c295e4d..66e7631 100644
--- a/src/redops/cli/main.py
+++ b/src/redops/cli/main.py
@@ -233,7 +233,7 @@ def doctor(check):
             console.print(f"  {status} {name}: {message}")
             if not passed:
                 all_passed = False
-        except Exception as e:
+        except (RuntimeError, ValueError, TypeError, OSError, ConnectionError, ImportError) as e:
             console.print(f"  [red]✗[/red] {name}: Error - {e}")
             all_passed = False
 
@@ -297,7 +297,7 @@ def _check_database():
         if db.check_connection():
             return True, "Connected"
         return False, "Connection failed"
-    except Exception as e:
+    except (ImportError, RuntimeError, OSError, ConnectionError) as e:
         return False, f"Not configured ({e})"
 
 
diff --git a/src/redops/cli/settings.py b/src/redops/cli/settings.py
index 1e1c5cb..99db59c 100644
--- a/src/redops/cli/settings.py
+++ b/src/redops/cli/settings.py
@@ -535,7 +535,7 @@ def _test_provider(self, provider: str, key: str) -> bool:
         except ImportError:
             print(f"Required library for {provider} is not installed.")
             return False
-        except Exception as e:
+        except (ConnectionError, TimeoutError, OSError, RuntimeError, ValueError) as e:
             print(f"Error: {e}")
             return False
         return False
diff --git a/src/redops/db/connection.py b/src/redops/db/connection.py
index 05ba62e..20cafff 100644
--- a/src/redops/db/connection.py
+++ b/src/redops/db/connection.py
@@ -10,6 +10,7 @@
 import logging
 
 from sqlalchemy import create_engine, event, text
+from sqlalchemy.exc import OperationalError, DatabaseError, SQLAlchemyError
 from sqlalchemy.orm import sessionmaker, Session
 from sqlalchemy.pool import QueuePool
 
@@ -141,7 +142,7 @@ def session_scope(self) -> Generator[Session, None, None]:
         try:
             yield session
             session.commit()
-        except Exception:
+        except SQLAlchemyError:
             session.rollback()
             raise
         finally:
@@ -163,7 +164,7 @@ def check_connection(self) -> bool:
             with self.engine.connect() as conn:
                 conn.execute(text("SELECT 1"))
             return True
-        except Exception as e:
+        except (OperationalError, DatabaseError, OSError) as e:
             logger.error(f"Database connection check failed: {e}")
             return False
 
diff --git a/src/redops/jobs/queue.py b/src/redops/jobs/queue.py
index 74bdd45..2a960b4 100644
--- a/src/redops/jobs/queue.py
+++ b/src/redops/jobs/queue.py
@@ -620,7 +620,7 @@ def _run_loop(self) -> None:
                     # No jobs available, wait a bit
                     self._shutdown_event.wait(0.5)
 
-            except Exception as e:
+            except (RuntimeError, TypeError, ValueError, OSError, ConnectionError) as e:
                 logger.error(f"Worker error: {e}")
                 if job:
                     self._handle_job_error(job, e)
@@ -662,7 +662,7 @@ def _execute_job(self, job: Job) -> None:
             job.completed_at = datetime.now(timezone.utc)
             logger.warning(f"Job {job.id} timed out")
 
-        except Exception as e:
+        except (RuntimeError, ImportError, TypeError, ValueError, OSError, ConnectionError) as e:
             self._handle_job_error(job, e)
 
         finally:
@@ -682,7 +682,7 @@ def _execute_with_timeout(
         def target():
             try:
                 result_container["result"] = func(*args, **kwargs)
-            except Exception as e:
+            except (RuntimeError, ImportError, TypeError, ValueError, OSError, ConnectionError) as e:
                 result_container["error"] = e
 
         thread = threading.Thread(target=target)
diff --git a/src/redops/jobs/redis_backend.py b/src/redops/jobs/redis_backend.py
index 702c983..912f6c7 100644
--- a/src/redops/jobs/redis_backend.py
+++ b/src/redops/jobs/redis_backend.py
@@ -490,7 +490,7 @@ def _scheduler_loop(self) -> None:
                     count = self._queue.process_scheduled()
                     if count > 0:
                         logger.debug(f"Moved {count} scheduled jobs to queue")
-            except Exception as e:
+            except (ConnectionError, TimeoutError, OSError, RuntimeError) as e:
                 logger.error(f"Scheduler error: {e}")
 
             self._shutdown_event.wait(self._scheduler_interval)
@@ -503,7 +503,7 @@ def _cleanup_loop(self) -> None:
                     count = self._queue.cleanup_stale()
                     if count > 0:
                         logger.info(f"Cleaned up {count} stale jobs")
-            except Exception as e:
+            except (ConnectionError, TimeoutError, OSError, RuntimeError) as e:
                 logger.error(f"Cleanup error: {e}")
 
             self._shutdown_event.wait(self._cleanup_interval)
diff --git a/src/redops/jobs/scheduler.py b/src/redops/jobs/scheduler.py
index fb9a5fa..db94ec2 100644
--- a/src/redops/jobs/scheduler.py
+++ b/src/redops/jobs/scheduler.py
@@ -544,12 +544,12 @@ def _run_loop(self) -> None:
                                 logger.debug(
                                     f"Triggered scheduled job {job.id}: {job.name}"
                                 )
-                            except Exception as e:
+                            except (RuntimeError, TypeError, ValueError, OSError, ConnectionError) as e:
                                 job.error_count += 1
                                 job.last_error = str(e)
                                 logger.error(f"Failed to trigger job {job.id}: {e}")
 
-            except Exception as e:
+            except (RuntimeError, OSError, ConnectionError) as e:
                 logger.error(f"Scheduler error: {e}")
 
             self._shutdown_event.wait(self._check_interval)
diff --git a/src/redops/main.py b/src/redops/main.py
index 0d50c56..1f0e3fe 100644
--- a/src/redops/main.py
+++ b/src/redops/main.py
@@ -97,7 +97,7 @@ def run_pipeline(
 
         return 0
 
-    except Exception as e:
+    except (RuntimeError, ImportError, OSError, ValueError, TypeError, ConnectionError) as e:
         print(f"[RedOps] ERROR: {e}", file=sys.stderr)
         if config and config.output.verbose:
             import traceback
@@ -131,7 +131,7 @@ def list_pipelines(directory: str = "./config/pipelines"):
             print(f"    File: {pipeline_file.name}")
             print(f"    Steps: {len(pipeline.steps)}")
             print()
-        except Exception as e:
+        except (ValueError, OSError, TypeError) as e:
             print(f"  • {pipeline_file.name} (error loading: {e})")
             print()
 
diff --git a/src/redops/mcp/server.py b/src/redops/mcp/server.py
index e45a226..b9d2236 100644
--- a/src/redops/mcp/server.py
+++ b/src/redops/mcp/server.py
@@ -143,7 +143,7 @@ async def handle_message(self, message: dict) -> dict | None:
                 return self._error_response(
                     msg_id, -32601, f"Method not found: {method}"
                 )
-        except Exception as e:
+        except (RuntimeError, ValueError, TypeError, OSError, ConnectionError, ImportError) as e:
             return self._error_response(msg_id, -32603, str(e))
 
     def _handle_initialize(self, msg_id: int, params: dict) -> dict:
@@ -197,7 +197,7 @@ async def _handle_tools_call(self, msg_id: int, params: dict) -> dict:
                     ],
                 },
             }
-        except Exception as e:
+        except (RuntimeError, ValueError, TypeError, OSError, ConnectionError, ImportError) as e:
             return {
                 "jsonrpc": JSONRPC_VERSION,
                 "id": msg_id,
@@ -251,7 +251,7 @@ async def _tool_scan(self, arguments: dict) -> dict:
         for name, module_fn in modules:
             try:
                 ctx = module_fn(ctx)
-            except Exception as e:
+            except (RuntimeError, ValueError, TypeError, OSError, ConnectionError, ImportError) as e:
                 ctx.log(f"Module {name} failed: {e}", level="ERROR")
 
         return {
@@ -374,7 +374,7 @@ async def run_server():
                 writer.write((json.dumps(response) + "\n").encode())
                 await writer.drain()
 
-        except Exception as e:
+        except (RuntimeError, ValueError, TypeError, OSError, ConnectionError, ImportError, TimeoutError) as e:
             # Log errors to stderr (not stdout which is for protocol)
             print(f"Error: {e}", file=sys.stderr)
             break
diff --git a/src/redops/mcp/tools.py b/src/redops/mcp/tools.py
index e454d63..37c17ae 100644
--- a/src/redops/mcp/tools.py
+++ b/src/redops/mcp/tools.py
@@ -219,7 +219,7 @@ async def _tool_check_ip(arguments: dict[str, Any]) -> dict[str, Any]:
 
             ctx = query_greynoise(ctx)
             results["sources"]["greynoise"] = ctx.get("greynoise_result", {})
-        except Exception as e:
+        except (ImportError, RuntimeError, ValueError, TypeError, ConnectionError, OSError, TimeoutError) as e:
             results["sources"]["greynoise"] = {"error": str(e)}
 
     if "abuseipdb" in sources:
@@ -228,7 +228,7 @@ async def _tool_check_ip(arguments: dict[str, Any]) -> dict[str, Any]:
 
             ctx = check_ip_reputation(ctx)
             results["sources"]["abuseipdb"] = ctx.get("abuseipdb_result", {})
-        except Exception as e:
+        except (ImportError, RuntimeError, ValueError, TypeError, ConnectionError, OSError, TimeoutError) as e:
             results["sources"]["abuseipdb"] = {"error": str(e)}
 
     return results
diff --git a/src/redops/modules/active/authorization.py b/src/redops/modules/active/authorization.py
index 2d814f4..7533b23 100644
--- a/src/redops/modules/active/authorization.py
+++ b/src/redops/modules/active/authorization.py
@@ -110,6 +110,35 @@ def is_active_authorized(ctx: Context) -> bool:
     return False
 
 
+def record_authorization_from_params(
+    ctx: Context,
+    params: dict | None = None,
+) -> Context:
+    """Pipeline-step wrapper for ``record_authorization``.
+
+    Accepts parameters via the ``params`` dict so it can be invoked from a
+    pipeline JSON definition.
+
+    Params:
+        operator: Identity of the operator.
+        target_assertion: Specific target being authorized.
+        consent_text: Optional custom consent text.
+        duration_hours: How long the authorization remains valid.
+
+    Returns:
+        The updated context with ``ctx.authorization`` set.
+    """
+    params = params or {}
+    record_authorization(
+        ctx,
+        operator=params.get("operator", "unknown-operator"),
+        target_assertion=params.get("target_assertion", ctx.target or "unknown"),
+        consent_text=params.get("consent_text", DEFAULT_CONSENT_TEXT),
+        duration_hours=params.get("duration_hours", 24),
+    )
+    return ctx
+
+
 def assert_active_authorized(ctx: Context) -> None:
     """Raise ActiveAuthorizationError if the context lacks valid authorization.
 
diff --git a/src/redops/notifications/email.py b/src/redops/notifications/email.py
index 391438d..853217e 100644
--- a/src/redops/notifications/email.py
+++ b/src/redops/notifications/email.py
@@ -527,7 +527,7 @@ def send_email(
             logger.info(f"Email sent to {len(all_recipients)} recipients: {subject}")
             return True
 
-        except Exception as e:
+        except (ConnectionError, TimeoutError, OSError, RuntimeError, ValueError) as e:
             logger.error(f"Failed to send email: {e}")
             return False
 
@@ -685,6 +685,6 @@ def test_connection(self) -> bool:
                     if self.config.smtp_user:
                         server.login(self.config.smtp_user, self.config.smtp_password)
                     return True
-        except Exception as e:
+        except (ConnectionError, TimeoutError, OSError, RuntimeError, ValueError) as e:
             logger.error(f"SMTP connection test failed: {e}")
             return False
diff --git a/src/redops/notifications/manager.py b/src/redops/notifications/manager.py
index 9f7528a..604513d 100644
--- a/src/redops/notifications/manager.py
+++ b/src/redops/notifications/manager.py
@@ -139,7 +139,7 @@ def _worker_loop(self) -> None:
 
             except queue.Empty:
                 continue
-            except Exception as e:
+            except (RuntimeError, ValueError, TypeError, OSError, ConnectionError) as e:
                 logger.error(f"Notification worker error: {e}")
 
     def _send_to_providers(
@@ -163,7 +163,7 @@ def _send_to_providers(
                     success = provider.send(message)
                     if success:
                         break
-                except Exception as e:
+                except (RuntimeError, ValueError, TypeError, OSError, ConnectionError) as e:
                     logger.error(f"Provider {name} attempt {attempt + 1} failed: {e}")
 
                 if attempt < retries:
@@ -212,7 +212,7 @@ def _apply_formatters(self, message: NotificationMessage) -> NotificationMessage
         for formatter in self._formatters:
             try:
                 message = formatter(message)
-            except Exception as e:
+            except (RuntimeError, ValueError, TypeError, OSError, ConnectionError) as e:
                 logger.error(f"Formatter error: {e}")
         return message
 
diff --git a/src/redops/notifications/webhooks.py b/src/redops/notifications/webhooks.py
index d497245..bf15b8f 100644
--- a/src/redops/notifications/webhooks.py
+++ b/src/redops/notifications/webhooks.py
@@ -215,7 +215,7 @@ def send(self, message: NotificationMessage) -> bool:
                 response.raise_for_status()
                 logger.info(f"Slack notification sent: {message.title}")
                 return True
-        except Exception as e:
+        except (ConnectionError, TimeoutError, OSError, RuntimeError, ValueError) as e:
             logger.error(f"Failed to send Slack notification: {e}")
             return False
 
@@ -334,7 +334,7 @@ def send(self, message: NotificationMessage) -> bool:
                 response.raise_for_status()
                 logger.info(f"Teams notification sent: {message.title}")
                 return True
-        except Exception as e:
+        except (ConnectionError, TimeoutError, OSError, RuntimeError, ValueError) as e:
             logger.error(f"Failed to send Teams notification: {e}")
             return False
 
@@ -438,7 +438,7 @@ def send(self, message: NotificationMessage) -> bool:
                 response.raise_for_status()
                 logger.info(f"Discord notification sent: {message.title}")
                 return True
-        except Exception as e:
+        except (ConnectionError, TimeoutError, OSError, RuntimeError, ValueError) as e:
             logger.error(f"Failed to send Discord notification: {e}")
             return False
 
@@ -516,7 +516,7 @@ def send(self, message: NotificationMessage) -> bool:
                 response.raise_for_status()
                 logger.info(f"Webhook notification sent: {message.title}")
                 return True
-        except Exception as e:
+        except (ConnectionError, TimeoutError, OSError, RuntimeError, ValueError) as e:
             logger.error(f"Failed to send webhook notification: {e}")
             return False
 
@@ -598,6 +598,6 @@ def send(self, message: NotificationMessage) -> bool:
                 response.raise_for_status()
                 logger.info(f"PagerDuty notification sent: {message.title}")
                 return True
-        except Exception as e:
+        except (ConnectionError, TimeoutError, OSError, RuntimeError, ValueError) as e:
             logger.error(f"Failed to send PagerDuty notification: {e}")
             return False
diff --git a/src/redops/observability/metrics.py b/src/redops/observability/metrics.py
index 6929152..622812a 100644
--- a/src/redops/observability/metrics.py
+++ b/src/redops/observability/metrics.py
@@ -102,7 +102,7 @@ def _initialize_otel(self) -> None:
         try:
             prometheus_reader = PrometheusMetricReader()
             readers.append(prometheus_reader)
-        except Exception:
+        except (ImportError, RuntimeError, OSError):
             pass
 
         # Add console exporter for debugging
@@ -382,7 +382,7 @@ def wrapper(*args, **kwargs):
             try:
                 result = func(*args, **kwargs)
                 return result
-            except Exception:
+            except (RuntimeError, ValueError, TypeError, OSError, ConnectionError):
                 scan_status = "failure"
                 raise
             finally:
@@ -425,7 +425,7 @@ async def async_wrapper(*args, **kwargs):
                 result = await func(*args, **kwargs)
                 status_code = getattr(result, "status_code", 200)
                 return result
-            except Exception:
+            except (RuntimeError, ValueError, TypeError, OSError, ConnectionError, TimeoutError):
                 status_code = 500
                 raise
             finally:
@@ -441,7 +441,7 @@ def sync_wrapper(*args, **kwargs):
                 result = func(*args, **kwargs)
                 status_code = getattr(result, "status_code", 200)
                 return result
-            except Exception:
+            except (RuntimeError, ValueError, TypeError, OSError, ConnectionError, TimeoutError):
                 status_code = 500
                 raise
             finally:
diff --git a/src/redops/observability/tracing.py b/src/redops/observability/tracing.py
index 2efa067..19b175d 100644
--- a/src/redops/observability/tracing.py
+++ b/src/redops/observability/tracing.py
@@ -185,7 +185,7 @@ def start_span(
         ) as span:
             try:
                 yield span
-            except Exception as e:
+            except (RuntimeError, ValueError, TypeError, OSError, ConnectionError) as e:
                 if span:
                     span.set_status(Status(StatusCode.ERROR, str(e)))
                     span.record_exception(e)
@@ -312,7 +312,7 @@ def wrapper(*args, **kwargs):
                         )
                         span.set_attribute("pipeline.findings_count", findings)
                     return result
-                except Exception as e:
+                except (RuntimeError, ValueError, TypeError, OSError, ConnectionError) as e:
                     if span:
                         span.set_attribute("pipeline.error", str(e))
                     raise
@@ -349,7 +349,7 @@ def wrapper(ctx, params=None):
                 try:
                     result = func(ctx, params)
                     return result
-                except Exception as e:
+                except (RuntimeError, ValueError, TypeError, OSError, ConnectionError) as e:
                     if span:
                         span.set_attribute("module.error", str(e))
                     raise
diff --git a/src/redops/pipelines/loader.py b/src/redops/pipelines/loader.py
index 0ef3a11..f948029 100644
--- a/src/redops/pipelines/loader.py
+++ b/src/redops/pipelines/loader.py
@@ -4,6 +4,7 @@
 
 import json
 from pathlib import Path
+from pydantic import ValidationError
 from redops.pipelines.schemas import Pipeline
 
 
@@ -43,7 +44,7 @@ def load(path: str | Path) -> Pipeline:
             pipeline = Pipeline(**data)
             pipeline.validate_pipeline()
             return pipeline
-        except Exception as e:
+        except (ValidationError, ValueError, TypeError) as e:
             raise ValueError(f"Pipeline validation failed: {e}")
 
     @staticmethod
diff --git a/src/redops/pipelines/runner.py b/src/redops/pipelines/runner.py
index e81e1d9..af715a9 100644
--- a/src/redops/pipelines/runner.py
+++ b/src/redops/pipelines/runner.py
@@ -13,6 +13,7 @@
 from typing import Callable, TYPE_CHECKING
 from redops.pipelines.schemas import Pipeline, PipelineStep
 from redops.core.context import Context
+from redops.modules.active.exceptions import ActiveAuthorizationError
 from redops.core.plugin_system import (
     PluginRegistry,
     HookPoint,
@@ -153,7 +154,7 @@ def _execute_step(self, step: PipelineStep, ctx: Context) -> Context:
 
             return ctx
 
-        except Exception as e:
+        except (RuntimeError, ImportError, TypeError, ValueError, OSError, ConnectionError, ActiveAuthorizationError, AttributeError) as e:
             error_msg = f"Step failed: {step.name} - {str(e)}"
             ctx.log(error_msg, level="ERROR", step=step.name, error=str(e))
 
@@ -286,7 +287,7 @@ def run_step(step: PipelineStep) -> tuple:
             try:
                 result_ctx = self._execute_step(step, step_ctx)
                 return (step.name, result_ctx.data, result_ctx.logs, None)
-            except Exception as e:
+            except (RuntimeError, ImportError, TypeError, ValueError, OSError, ConnectionError, ActiveAuthorizationError, AttributeError) as e:
                 return (step.name, {}, [], str(e))
 
         # Run steps in parallel using ThreadPoolExecutor
diff --git a/src/redops/plugins/examples/header_scanner.py b/src/redops/plugins/examples/header_scanner.py
index 32b2d5c..a91d124 100644
--- a/src/redops/plugins/examples/header_scanner.py
+++ b/src/redops/plugins/examples/header_scanner.py
@@ -115,7 +115,7 @@ def validate_target(self, target: str) -> bool:
         try:
             parsed = urlparse(target)
             return parsed.scheme in ("http", "https") and bool(parsed.netloc)
-        except Exception:
+        except (ValueError, TypeError):
             return False
 
     def scan(
@@ -194,7 +194,7 @@ def scan(
             # Store response headers
             result.metadata["response_headers"] = headers
 
-        except Exception as e:
+        except (ValueError, TypeError, AttributeError, KeyError) as e:
             result.success = False
             result.error = str(e)
             self._trigger_hook("on_error", e)
diff --git a/src/redops/plugins/examples/port_scanner.py b/src/redops/plugins/examples/port_scanner.py
index 4768cd7..e4b4909 100644
--- a/src/redops/plugins/examples/port_scanner.py
+++ b/src/redops/plugins/examples/port_scanner.py
@@ -248,7 +248,7 @@ def _scan_ports(
                 try:
                     if future.result():
                         open_ports.append(port)
-                except Exception:
+                except (OSError, ConnectionError, TimeoutError):
                     pass
 
         return sorted(open_ports)
diff --git a/src/redops/plugins/repository.py b/src/redops/plugins/repository.py
index 769257f..d76c043 100644
--- a/src/redops/plugins/repository.py
+++ b/src/redops/plugins/repository.py
@@ -550,7 +550,7 @@ def _run_hooks(self, event: str, *args, **kwargs) -> None:
         for callback in self._hooks.get(event, []):
             try:
                 callback(*args, **kwargs)
-            except Exception:
+            except (RuntimeError, TypeError, ValueError, OSError):
                 pass
 
     @property
diff --git a/src/redops/plugins/scanner.py b/src/redops/plugins/scanner.py
index 0d6c0a3..71ac00d 100644
--- a/src/redops/plugins/scanner.py
+++ b/src/redops/plugins/scanner.py
@@ -400,7 +400,7 @@ def _trigger_hook(self, event: str, *args, **kwargs) -> None:
         for callback in self._hooks.get(event, []):
             try:
                 callback(*args, **kwargs)
-            except Exception:
+            except (RuntimeError, TypeError, ValueError, OSError):
                 pass  # Ignore hook errors
 
     def _create_finding(
@@ -515,7 +515,7 @@ def scan(
                 for future in concurrent.futures.as_completed(futures):
                     try:
                         results.append(future.result())
-                    except Exception as e:
+                    except (RuntimeError, ImportError, TypeError, ValueError, OSError, ConnectionError) as e:
                         scanner = futures[future]
                         results.append(
                             ScannerResult(
@@ -530,7 +530,7 @@ def scan(
                 if scanner.validate_target(target):
                     try:
                         results.append(scanner.scan(target, config))
-                    except Exception as e:
+                    except (RuntimeError, ImportError, TypeError, ValueError, OSError, ConnectionError) as e:
                         results.append(
                             ScannerResult(
                                 scanner_name=scanner.get_name(),
diff --git a/src/redops/scheduler/executor.py b/src/redops/scheduler/executor.py
index e1da492..bb8cd5b 100644
--- a/src/redops/scheduler/executor.py
+++ b/src/redops/scheduler/executor.py
@@ -86,7 +86,7 @@ def execute(self, job: ScanJob) -> None:
             for hook in self._pre_hooks:
                 try:
                     hook(job)
-                except Exception as e:
+                except (RuntimeError, TypeError, ValueError, OSError) as e:
                     logger.warning(f"Pre-hook error: {e}")
 
             # Get pipeline
@@ -123,7 +123,7 @@ def execute(self, job: ScanJob) -> None:
 
             logger.info(f"Job {job.id} completed: {findings_count} findings")
 
-        except Exception as e:
+        except (RuntimeError, ImportError, TypeError, ValueError, OSError, ConnectionError) as e:
             error_msg = str(e)
             logger.error(f"Job {job.id} failed: {error_msg}")
             logger.debug(traceback.format_exc())
@@ -142,7 +142,7 @@ def execute(self, job: ScanJob) -> None:
             for hook in self._post_hooks:
                 try:
                     hook(job)
-                except Exception as e:
+                except (RuntimeError, TypeError, ValueError, OSError) as e:
                     logger.warning(f"Post-hook error: {e}")
 
     def _count_findings(self, result: Any) -> int:
@@ -214,7 +214,7 @@ def _send_notification(self, job: ScanJob, message: str) -> None:
         if self._notification_handler:
             try:
                 self._notification_handler(job, message)
-            except Exception as e:
+            except (RuntimeError, TypeError, ValueError, OSError, ConnectionError) as e:
                 logger.error(f"Notification failed: {e}")
 
 
diff --git a/src/redops/scheduler/models.py b/src/redops/scheduler/models.py
index a5f3309..4242fa5 100644
--- a/src/redops/scheduler/models.py
+++ b/src/redops/scheduler/models.py
@@ -214,7 +214,7 @@ def _parse_cron_next(self, base: datetime) -> datetime:
         except ImportError:
             # Fallback to daily if croniter not installed
             return base + timedelta(days=1)
-        except Exception:
+        except (ValueError, TypeError):
             return base + timedelta(days=1)
 
     def is_due(self, current_time: datetime | None = None) -> bool:
diff --git a/src/redops/scheduler/scheduler.py b/src/redops/scheduler/scheduler.py
index 0e2ee5f..a7b2634 100644
--- a/src/redops/scheduler/scheduler.py
+++ b/src/redops/scheduler/scheduler.py
@@ -85,7 +85,7 @@ def _load_from_file(self) -> None:
             logger.info(
                 f"Loaded {len(self._schedules)} schedules from {self._storage_path}"
             )
-        except Exception as e:
+        except (OSError, json.JSONDecodeError, KeyError, ValueError, TypeError) as e:
             logger.error(f"Failed to load schedules: {e}")
 
     def _save_to_file(self) -> None:
@@ -100,7 +100,7 @@ def _save_to_file(self) -> None:
             }
             with open(self._storage_path, "w") as f:
                 json.dump(data, f, indent=2)
-        except Exception as e:
+        except (OSError, TypeError, ValueError) as e:
             logger.error(f"Failed to save schedules: {e}")
 
     def add_schedule(self, schedule: ScanSchedule) -> None:
@@ -279,7 +279,7 @@ def _run_loop(self) -> None:
             try:
                 self._check_and_dispatch()
                 self._check_timeouts()
-            except Exception as e:
+            except (RuntimeError, OSError, TypeError, ValueError, ConnectionError) as e:
                 logger.error(f"Scheduler error: {e}")
 
             # Sleep in small increments to allow quick shutdown
@@ -300,7 +300,7 @@ def _check_and_dispatch(self) -> None:
 
             try:
                 self._dispatch_schedule(schedule)
-            except Exception as e:
+            except (RuntimeError, TypeError, ValueError, OSError, ConnectionError) as e:
                 logger.error(f"Failed to dispatch schedule {schedule.id}: {e}")
                 self._job_semaphore.release()
 
@@ -345,7 +345,7 @@ def _execute_job(self, job: ScanJob) -> None:
             self.store.update_job(job)
             logger.info(f"Job {job.id} completed with {job.findings_count} findings")
 
-        except Exception as e:
+        except (RuntimeError, ImportError, TypeError, ValueError, OSError, ConnectionError) as e:
             job.fail(str(e))
             self.store.update_job(job)
             logger.error(f"Job {job.id} failed: {e}")
diff --git a/src/redops/tenants/manager.py b/src/redops/tenants/manager.py
index 401a017..9d34244 100644
--- a/src/redops/tenants/manager.py
+++ b/src/redops/tenants/manager.py
@@ -506,7 +506,7 @@ def _run_hooks(self, event: str, *args, **kwargs) -> None:
         for callback in self._hooks.get(event, []):
             try:
                 callback(*args, **kwargs)
-            except Exception as e:
+            except (RuntimeError, ValueError, TypeError, OSError, ConnectionError) as e:
                 logger.error(f"Hook error ({event}): {e}")
 
 
diff --git a/src/redops/web/app.py b/src/redops/web/app.py
index f6e074e..2e685e2 100644
--- a/src/redops/web/app.py
+++ b/src/redops/web/app.py
@@ -6,6 +6,7 @@
 
 import os
 from datetime import datetime, timezone
+from typing import Any
 
 from fastapi import (
     FastAPI,
@@ -44,6 +45,8 @@
 
 from redops.core.exceptions import RedOpsError, ModuleError
 from redops.main import __version__
+from redops.analysis.comparison import ScanComparator
+from redops.web.store import ScanStore
 
 
 # Request/Response models
@@ -85,6 +88,23 @@ class ScanStatus(BaseModel):
     error: str | None = None
 
 
+class ScanCompareRequest(BaseModel):
+    """Request model for scan comparison."""
+
+    baseline_scan_id: str = Field(..., description="Baseline scan ID")
+    current_scan_id: str = Field(..., description="Current scan ID")
+
+
+class FindingTriageUpdate(BaseModel):
+    """Request model for updating finding triage status."""
+
+    status: str = Field(
+        ..., description="Triage status: open, false_positive, accepted_risk"
+    )
+    notes: str | None = Field(default=None, description="Triage notes")
+    assignee: str | None = Field(default=None, description="Assigned user")
+
+
 class AIRequest(BaseModel):
     """Request model for AI operations."""
 
@@ -95,6 +115,20 @@ class AIRequest(BaseModel):
     scan_id: str | None = Field(default=None, description="Scan ID for analysis")
     provider: str | None = Field(default=None, description="AI provider override")
     model: str | None = Field(default=None, description="Model override")
+    budget_limit: float | None = Field(
+        default=None, ge=0, description="Max estimated USD spend for this call"
+    )
+
+
+class AICostMetrics(BaseModel):
+    """Cost metrics for an AI call."""
+
+    calls: int
+    input_tokens: int
+    output_tokens: int
+    estimated_cost_usd: float
+    budget_limit_usd: float | None = None
+    budget_remaining_usd: float | None = None
 
 
 class AIResponse(BaseModel):
@@ -104,6 +138,7 @@ class AIResponse(BaseModel):
     result: str
     provider: str
     model: str
+    cost: AICostMetrics | None = None
 
 
 class HealthResponse(BaseModel):
@@ -139,9 +174,138 @@ class AuthStatusResponse(BaseModel):
     auth_enabled: bool
 
 
-# In-memory scan storage (for demo; use database in production)
-_scans: dict[str, ScanStatus] = {}
-_scan_results: dict[str, dict] = {}
+# Scan storage backend (memory or Redis) — singleton per process
+_scan_store = ScanStore.get_instance()
+
+
+class _ScanDictProxy:
+    """Backward-compatible proxy for `_scans` dict access."""
+
+    def __getitem__(self, key: str) -> ScanStatus:
+        val = _scan_store.get_scan(key)
+        if val is None:
+            raise KeyError(key)
+        return val
+
+    def __setitem__(self, key: str, value: ScanStatus) -> None:
+        _scan_store.set_scan(key, value)
+
+    def __contains__(self, key: str) -> bool:
+        return _scan_store.get_scan(key) is not None
+
+    def __delitem__(self, key: str) -> None:
+        # No-op: store has no delete API; clear() resets everything
+        pass
+
+    def get(self, key: str, default: Any = None) -> Any:
+        val = _scan_store.get_scan(key)
+        return val if val is not None else default
+
+    def values(self):
+        return _scan_store.list_scans()
+
+    def clear(self) -> None:
+        _scan_store.clear()
+
+
+class _ResultsDictProxy:
+    """Backward-compatible proxy for `_scan_results` dict access."""
+
+    def __getitem__(self, key: str) -> dict:
+        val = _scan_store.get_results(key)
+        if val is None:
+            raise KeyError(key)
+        return val
+
+    def __setitem__(self, key: str, value: dict) -> None:
+        _scan_store.set_results(key, value)
+
+    def __contains__(self, key: str) -> bool:
+        return _scan_store.get_results(key) is not None
+
+    def __delitem__(self, key: str) -> None:
+        pass
+
+    def get(self, key: str, default: Any = None) -> Any:
+        val = _scan_store.get_results(key)
+        return val if val is not None else default
+
+    def clear(self) -> None:
+        _scan_store.clear()
+
+
+class _TriageDictProxy:
+    """Backward-compatible proxy for `_finding_triage` dict access."""
+
+    def __getitem__(self, key: str) -> dict:
+        val = _scan_store.get_triage(key)
+        if val is None:
+            raise KeyError(key)
+        return val
+
+    def __setitem__(self, key: str, value: dict) -> None:
+        _scan_store.set_triage(key, value)
+
+    def __contains__(self, key: str) -> bool:
+        return _scan_store.get_triage(key) is not None
+
+    def __delitem__(self, key: str) -> None:
+        pass
+
+    def get(self, key: str, default: Any = None) -> Any:
+        val = _scan_store.get_triage(key)
+        return val if val is not None else default
+
+    def clear(self) -> None:
+        _scan_store.clear()
+
+
+class _BaselinesDictProxy:
+    """Backward-compatible proxy for `_baselines` dict access."""
+
+    def __getitem__(self, key: str) -> str:
+        val = _scan_store.get_baseline(key)
+        if val is None:
+            raise KeyError(key)
+        return val
+
+    def __setitem__(self, key: str, value: str) -> None:
+        _scan_store.set_baseline(key, value)
+
+    def __contains__(self, key: str) -> bool:
+        return _scan_store.get_baseline(key) is not None
+
+    def __delitem__(self, key: str) -> None:
+        pass
+
+    def get(self, key: str, default: Any = None) -> Any:
+        val = _scan_store.get_baseline(key)
+        return val if val is not None else default
+
+    def clear(self) -> None:
+        _scan_store.clear()
+
+
+class _AICostTrackerProxy:
+    """Backward-compatible proxy for `_ai_cost_tracker` dict access."""
+
+    def __getitem__(self, key: str) -> Any:
+        return _scan_store.get_ai_costs()[key]
+
+    def __setitem__(self, key: str, value: Any) -> None:
+        costs = {key: value}
+        _scan_store.increment_ai_costs(costs)
+
+    def clear(self) -> None:
+        _scan_store.clear()
+
+
+# Backward-compatible module-level proxies (tests import these directly)
+_scans = _ScanDictProxy()
+_scan_results = _ResultsDictProxy()
+_finding_triage = _TriageDictProxy()
+_baselines = _BaselinesDictProxy()
+_ai_cost_tracker = _AICostTrackerProxy()
 
 
 def create_app(auth_config: AuthConfig | None = None) -> FastAPI:
@@ -301,7 +465,7 @@ async def start_scan(
             started_at=now,
             progress=0,
         )
-        _scans[scan_id] = status
+        _scan_store.set_scan(scan_id, status)
 
         # Run scan in background
         background_tasks.add_task(run_scan_task, scan_id, request)
@@ -318,34 +482,348 @@ async def start_scan(
     @app.get("/api/scans", response_model=list[ScanStatus], tags=["Scans"])
     async def list_scans(
         status: str | None = Query(None, description="Filter by status"),
+        search: str | None = Query(None, description="Search target or scan ID"),
+        sort: str = Query("started_at_desc", description="Sort field and direction"),
         limit: int = Query(20, ge=1, le=100, description="Max results"),
         user: AuthenticatedUser = Depends(require_auth),
     ):
-        """List all scans."""
-        scans = list(_scans.values())
+        """List all scans with optional filtering, search, and sorting."""
+        scans = _scan_store.list_scans()
         if status:
             scans = [s for s in scans if s.status == status]
-        return sorted(scans, key=lambda s: s.started_at, reverse=True)[:limit]
+        if search:
+            q = search.lower()
+            scans = [s for s in scans if q in s.target.lower() or q in s.scan_id.lower()]
+        # Sorting
+        reverse = sort.endswith("_desc")
+        sort_key = sort.removesuffix("_desc").removesuffix("_asc") if "_" in sort else sort
+        if sort_key == "target":
+            scans = sorted(scans, key=lambda s: s.target.lower(), reverse=reverse)
+        elif sort_key == "status":
+            scans = sorted(scans, key=lambda s: s.status, reverse=reverse)
+        elif sort_key == "progress":
+            scans = sorted(scans, key=lambda s: s.progress, reverse=reverse)
+        else:
+            scans = sorted(scans, key=lambda s: s.started_at or "", reverse=reverse)
+        return scans[:limit]
 
     @app.get("/api/scans/{scan_id}", response_model=ScanStatus, tags=["Scans"])
     async def get_scan(scan_id: str, user: AuthenticatedUser = Depends(require_auth)):
         """Get scan status by ID."""
-        if scan_id not in _scans:
+        scan = _scan_store.get_scan(scan_id)
+        if scan is None:
             raise HTTPException(status_code=404, detail="Scan not found")
-        return _scans[scan_id]
+        return scan
+
+    def _merge_triage_into_findings(scan_id: str, data: Any) -> Any:
+        """Recursively merge triage state into finding dicts within results."""
+        if isinstance(data, list):
+            return [_merge_triage_into_findings(scan_id, item) for item in data]
+        if isinstance(data, dict):
+            merged = {k: _merge_triage_into_findings(scan_id, v) for k, v in data.items()}
+            if "severity" in merged:
+                fid = merged.get("id", "") or merged.get("title", "") or ""
+                triage = _scan_store.get_triage(f"{scan_id}:{fid}")
+                if triage:
+                    merged["triage"] = triage
+            return merged
+        return data
+
+    def _collect_findings(data: Any, findings: list[dict] | None = None) -> list[dict]:
+        """Recursively collect all dicts that look like findings (have severity)."""
+        if findings is None:
+            findings = []
+        if isinstance(data, list):
+            for item in data:
+                _collect_findings(item, findings)
+        elif isinstance(data, dict):
+            if "severity" in data:
+                findings.append(data)
+            for v in data.values():
+                _collect_findings(v, findings)
+        return findings
 
     @app.get("/api/scans/{scan_id}/results", tags=["Scans"])
     async def get_scan_results(
         scan_id: str, user: AuthenticatedUser = Depends(require_auth)
     ):
         """Get scan results."""
-        if scan_id not in _scans:
+        scan = _scan_store.get_scan(scan_id)
+        if scan is None:
             raise HTTPException(status_code=404, detail="Scan not found")
-        if _scans[scan_id].status != "completed":
+        if scan.status != "completed":
             raise HTTPException(status_code=400, detail="Scan not completed")
-        if scan_id not in _scan_results:
+        raw = _scan_store.get_results(scan_id)
+        if raw is None:
+            raise HTTPException(status_code=404, detail="Results not available")
+        merged = _merge_triage_into_findings(scan_id, raw)
+        # Normalize findings into an array for dashboard charts / UI
+        if isinstance(merged, dict) and "findings" not in merged:
+            merged = {**merged, "findings": _collect_findings(merged)}
+        # Attach delta info if a baseline exists for this target
+        target = scan.target
+        baseline_scan_id = _scan_store.get_baseline(target)
+        if baseline_scan_id and baseline_scan_id != scan_id:
+            baseline_data = _scan_store.get_results(baseline_scan_id)
+            if baseline_data is not None:
+                baseline_findings = []
+                current_findings = []
+                for key, value in baseline_data.items():
+                    if isinstance(value, dict) and (key.startswith("finding_") or "severity" in value):
+                        baseline_findings.append(value)
+                for key, value in raw.items():
+                    if isinstance(value, dict) and (key.startswith("finding_") or "severity" in value):
+                        current_findings.append(value)
+                comparator = ScanComparator()
+                delta = comparator.compare(
+                    {"scan_id": baseline_scan_id, "findings": baseline_findings},
+                    {"scan_id": scan_id, "findings": current_findings},
+                )
+                merged["_delta"] = {
+                    "has_baseline": True,
+                    "baseline_scan_id": baseline_scan_id,
+                    **delta.to_dict(include_findings=True),
+                }
+        return merged
+
+    @app.post("/api/scans/compare", tags=["Scans"])
+    async def compare_scans(
+        request: ScanCompareRequest, user: AuthenticatedUser = Depends(require_auth)
+    ):
+        """Compare two scans to identify changes."""
+        baseline_data = _scan_store.get_results(request.baseline_scan_id)
+        if baseline_data is None:
+            raise HTTPException(status_code=404, detail="Baseline scan results not found")
+        current_data = _scan_store.get_results(request.current_scan_id)
+        if current_data is None:
+            raise HTTPException(status_code=404, detail="Current scan results not found")
+
+        # Build findings lists from ctx.data format (keys like finding_xxx)
+        baseline_findings = []
+        current_findings = []
+        for key, value in baseline_data.items():
+            if isinstance(value, dict) and (key.startswith("finding_") or "severity" in value):
+                baseline_findings.append(value)
+        for key, value in current_data.items():
+            if isinstance(value, dict) and (key.startswith("finding_") or "severity" in value):
+                current_findings.append(value)
+
+        comparator = ScanComparator()
+        result = comparator.compare(
+            {"scan_id": request.baseline_scan_id, "findings": baseline_findings},
+            {"scan_id": request.current_scan_id, "findings": current_findings},
+        )
+        return result.to_dict(include_findings=True)
+
+    @app.post("/api/scans/{scan_id}/findings/{finding_id}/triage", tags=["Scans"])
+    async def update_finding_triage(
+        scan_id: str,
+        finding_id: str,
+        request: FindingTriageUpdate,
+        user: AuthenticatedUser = Depends(require_auth),
+    ):
+        """Update triage status for a finding."""
+        if _scan_store.get_scan(scan_id) is None:
+            raise HTTPException(status_code=404, detail="Scan not found")
+        valid_statuses = {"open", "false_positive", "accepted_risk"}
+        if request.status not in valid_statuses:
+            raise HTTPException(
+                status_code=400,
+                detail=f"Invalid status. Must be one of: {', '.join(valid_statuses)}",
+            )
+        key = f"{scan_id}:{finding_id}"
+        triage = {
+            "status": request.status,
+            "notes": request.notes or "",
+            "assignee": request.assignee or "",
+            "updated_at": datetime.now(timezone.utc).isoformat(),
+            "updated_by": user.username,
+        }
+        _scan_store.set_triage(key, triage)
+        return {"success": True, "triage": triage}
+
+    _MITRE_TACTICS_ORDER = [
+        "Reconnaissance", "Resource Development", "Initial Access", "Execution",
+        "Persistence", "Privilege Escalation", "Defense Evasion", "Credential Access",
+        "Discovery", "Lateral Movement", "Collection", "Command and Control",
+        "Exfiltration", "Impact",
+    ]
+
+    @app.get("/api/scans/{scan_id}/mitre", tags=["Scans"])
+    async def get_scan_mitre(
+        scan_id: str, user: AuthenticatedUser = Depends(require_auth)
+    ):
+        """Get MITRE ATT&CK coverage for a scan."""
+        scan = _scan_store.get_scan(scan_id)
+        if scan is None:
+            raise HTTPException(status_code=404, detail="Scan not found")
+        data = _scan_store.get_results(scan_id) or {}
+        mitre_mapping = data.get("mitre_mapping", {}) if isinstance(data, dict) else {}
+        mitre_techniques = set(data.get("mitre_techniques_used", [])) if isinstance(data, dict) else set()
+
+        matrix = {}
+        for technique_id, technique_info in mitre_mapping.items():
+            if isinstance(technique_info, dict):
+                tactic = technique_info.get("tactic", "Unknown")
+                name = technique_info.get("name", technique_id)
+            else:
+                tactic = "Unknown"
+                name = technique_id
+            matrix.setdefault(tactic, []).append({"id": technique_id, "name": name})
+        if not matrix and mitre_techniques:
+            matrix["Identified Techniques"] = [{"id": t, "name": t} for t in sorted(mitre_techniques)]
+
+        total_techniques = sum(len(v) for v in matrix.values())
+        tactics_covered = len([t for t in matrix if matrix.get(t)])
+        return {
+            "matrix": matrix,
+            "tactics_order": _MITRE_TACTICS_ORDER,
+            "total_techniques": total_techniques,
+            "tactics_covered": tactics_covered,
+        }
+
+    @app.get("/api/scans/{scan_id}/navigator-layer", tags=["Scans"])
+    async def get_scan_navigator_layer(
+        scan_id: str, user: AuthenticatedUser = Depends(require_auth)
+    ):
+        """Export MITRE ATT&CK Navigator layer JSON for a scan."""
+        scan = _scan_store.get_scan(scan_id)
+        if scan is None:
+            raise HTTPException(status_code=404, detail="Scan not found")
+        data = _scan_store.get_results(scan_id)
+        if data is None:
+            raise HTTPException(status_code=404, detail="Results not available")
+        techniques = set(data.get("mitre_techniques_used", [])) if isinstance(data, dict) else set()
+        if not techniques and isinstance(data, dict):
+            for key, value in data.items():
+                if isinstance(value, dict) and "mitre_techniques" in value:
+                    techniques.update(value.get("mitre_techniques", []))
+        from redops.modules.simulation.mitre_mapping import generate_navigator_layer
+
+        layer = generate_navigator_layer(
+            techniques,
+            name=f"RedOPS Scan {scan_id}",
+            description=f"ATT&CK coverage for target: {scan.target}",
+        )
+        return Response(
+            content=__import__("json").dumps(layer, indent=2),
+            media_type="application/json",
+            headers={"Content-Disposition": f'attachment; filename="navigator-layer-{scan_id}.json"'},
+        )
+
+    @app.get("/api/scans/{scan_id}/attack-graph", tags=["Scans"])
+    async def get_scan_attack_graph(
+        scan_id: str, user: AuthenticatedUser = Depends(require_auth)
+    ):
+        """Return attack graph data for a scan in Cytoscape.js format."""
+        scan = _scan_store.get_scan(scan_id)
+        if scan is None:
+            raise HTTPException(status_code=404, detail="Scan not found")
+        data = _scan_store.get_results(scan_id)
+        if data is None:
             raise HTTPException(status_code=404, detail="Results not available")
-        return _scan_results[scan_id]
+        if not isinstance(data, dict):
+            raise HTTPException(status_code=404, detail="No graph data available")
+
+        # Extract attack paths and chains from scan results
+        attack_paths = data.get("attack_paths", [])
+        attack_chains = data.get("attack_chains_raw", [])
+        summary = data.get("attack_path_summary", {})
+
+        # Build Cytoscape.js elements
+        elements = []
+        seen_nodes = set()
+
+        for chain in attack_chains:
+            path = chain.get("path", [])
+            for i, node_id in enumerate(path):
+                if node_id not in seen_nodes:
+                    seen_nodes.add(node_id)
+                    elements.append(
+                        {
+                            "data": {
+                                "id": node_id,
+                                "label": node_id,
+                                "type": "entry" if i == 0 else ("target" if i == len(path) - 1 else "intermediate"),
+                            },
+                            "group": "nodes",
+                        }
+                    )
+                if i < len(path) - 1:
+                    elements.append(
+                        {
+                            "data": {
+                                "id": f"{node_id}->{path[i + 1]}",
+                                "source": node_id,
+                                "target": path[i + 1],
+                                "type": "attack-step",
+                            },
+                            "group": "edges",
+                        }
+                    )
+
+        return {
+            "elements": elements,
+            "summary": summary,
+            "attack_paths": attack_paths,
+        }
+
+    @app.post("/api/scans/{scan_id}/baseline", tags=["Scans"])
+    async def set_scan_baseline(
+        scan_id: str, user: AuthenticatedUser = Depends(require_auth)
+    ):
+        """Set a scan as the baseline for its target."""
+        scan = _scan_store.get_scan(scan_id)
+        if scan is None:
+            raise HTTPException(status_code=404, detail="Scan not found")
+        if scan.status != "completed":
+            raise HTTPException(status_code=400, detail="Scan not completed")
+        _scan_store.set_baseline(scan.target, scan_id)
+        return {
+            "success": True,
+            "scan_id": scan_id,
+            "target": scan.target,
+            "message": f"Baseline set for {scan.target}",
+        }
+
+    @app.get("/api/scans/{scan_id}/delta", tags=["Scans"])
+    async def get_scan_delta(
+        scan_id: str, user: AuthenticatedUser = Depends(require_auth)
+    ):
+        """Get delta between this scan and the baseline for its target."""
+        scan = _scan_store.get_scan(scan_id)
+        if scan is None:
+            raise HTTPException(status_code=404, detail="Scan not found")
+        baseline_scan_id = _scan_store.get_baseline(scan.target)
+        if not baseline_scan_id:
+            return {"has_baseline": False, "message": "No baseline set for this target"}
+        baseline_data = _scan_store.get_results(baseline_scan_id)
+        if baseline_data is None:
+            raise HTTPException(status_code=404, detail="Baseline scan results not found")
+        current_data = _scan_store.get_results(scan_id)
+        if current_data is None:
+            raise HTTPException(status_code=404, detail="Current scan results not found")
+
+        baseline_findings = []
+        current_findings = []
+        for key, value in baseline_data.items():
+            if isinstance(value, dict) and (key.startswith("finding_") or "severity" in value):
+                baseline_findings.append(value)
+        for key, value in current_data.items():
+            if isinstance(value, dict) and (key.startswith("finding_") or "severity" in value):
+                current_findings.append(value)
+
+        comparator = ScanComparator()
+        result = comparator.compare(
+            {"scan_id": baseline_scan_id, "findings": baseline_findings},
+            {"scan_id": scan_id, "findings": current_findings},
+        )
+        return {
+            "has_baseline": True,
+            "baseline_scan_id": baseline_scan_id,
+            "current_scan_id": scan_id,
+            "delta": result.to_dict(include_findings=True),
+        }
 
     # AI endpoints (protected)
     @app.post("/api/ai", response_model=AIResponse, tags=["AI"])
@@ -359,6 +837,7 @@ async def ai_action(
             assistant = AIAssistant(
                 provider=request.provider,
                 model=request.model,
+                budget_limit=request.budget_limit,
             )
 
             if request.action == "explain":
@@ -372,47 +851,68 @@ async def ai_action(
                     raise HTTPException(
                         status_code=400, detail="scan_id required for analyze action"
                     )
-                if request.scan_id not in _scan_results:
+                results = _scan_store.get_results(request.scan_id)
+                if results is None:
                     raise HTTPException(
                         status_code=404, detail="Scan results not found"
                     )
-                result = assistant.analyze_findings(_scan_results[request.scan_id])
+                result = assistant.analyze_findings(results)
             elif request.action == "suggest":
                 if not request.scan_id:
                     raise HTTPException(
                         status_code=400, detail="scan_id required for suggest action"
                     )
-                if request.scan_id not in _scan_results:
+                results = _scan_store.get_results(request.scan_id)
+                if results is None:
                     raise HTTPException(
                         status_code=404, detail="Scan results not found"
                     )
-                result = assistant.suggest_remediations(_scan_results[request.scan_id])
+                result = assistant.suggest_remediations(results)
             elif request.action == "summarize":
                 if not request.scan_id:
                     raise HTTPException(
                         status_code=400, detail="scan_id required for summarize action"
                     )
-                if request.scan_id not in _scan_results:
+                results = _scan_store.get_results(request.scan_id)
+                if results is None:
                     raise HTTPException(
                         status_code=404, detail="Scan results not found"
                     )
-                result = assistant.summarize(_scan_results[request.scan_id])
+                result = assistant.summarize(results)
             else:
                 raise HTTPException(
                     status_code=400, detail=f"Unknown action: {request.action}"
                 )
 
+            # Merge per-call cost into global tracker
+            metrics = assistant.get_cost_metrics()
+            _scan_store.increment_ai_costs(metrics)
+
             return AIResponse(
                 action=request.action,
                 result=result,
                 provider=assistant.provider,
                 model=assistant.model,
+                cost=AICostMetrics(
+                    calls=metrics["calls"],
+                    input_tokens=metrics["input_tokens"],
+                    output_tokens=metrics["output_tokens"],
+                    estimated_cost_usd=metrics["estimated_cost_usd"],
+                    budget_limit_usd=metrics["budget_limit_usd"],
+                    budget_remaining_usd=metrics["budget_remaining_usd"],
+                ),
             )
 
         except ImportError as e:
             raise HTTPException(status_code=503, detail=f"AI not available: {e}")
         except ValueError as e:
             raise HTTPException(status_code=400, detail=str(e))
+        except RuntimeError as e:
+            raise HTTPException(status_code=429, detail=str(e))
+        except HTTPException:
+            raise
+        except (ConnectionError, TimeoutError, OSError, TypeError) as e:
+            raise HTTPException(status_code=503, detail=f"AI service error: {e}")
 
     # Settings endpoints
     @app.get("/api/settings/providers", tags=["Settings"])
@@ -460,6 +960,17 @@ async def list_presets():
             ]
         }
 
+    @app.get("/api/settings/ai-cost", tags=["Settings"])
+    async def get_ai_cost_metrics(user: AuthenticatedUser = Depends(require_auth)):
+        """Return global AI cost metrics."""
+        costs = _scan_store.get_ai_costs()
+        return {
+            "calls": costs["calls"],
+            "input_tokens": costs["input_tokens"],
+            "output_tokens": costs["output_tokens"],
+            "estimated_cost_usd": round(costs["estimated_cost_usd"], 6),
+        }
+
     # Dashboard HTML
     @app.get("/", response_class=HTMLResponse, tags=["Dashboard"])
     async def dashboard():
@@ -525,8 +1036,12 @@ async def run_scan_task(scan_id: str, request: ScanRequest):
     import asyncio
 
     try:
-        _scans[scan_id].status = "running"
-        _scans[scan_id].progress = 0
+        scan = _scan_store.get_scan(scan_id)
+        if scan is None:
+            return
+        scan.status = "running"
+        scan.progress = 0
+        _scan_store.set_scan(scan_id, scan)
 
         # Emit scan started event
         await emit_scan_started(scan_id, request.target, request.preset)
@@ -538,14 +1053,15 @@ async def run_scan_task(scan_id: str, request: ScanRequest):
         ctx = Context(target=request.target)
 
         modules = [
-            ("domain_profile", recon.domain_profile),
-            ("tech_stack", recon.tech_stack),
+            ("profile_domain", recon.profile_domain),
+            ("fingerprint", recon.fingerprint),
         ]
 
         for i, (name, module_fn) in enumerate(modules):
-            _scans[scan_id].current_module = name
+            scan.current_module = name
             progress = int((i / len(modules)) * 100)
-            _scans[scan_id].progress = progress
+            scan.progress = progress
+            _scan_store.set_scan(scan_id, scan)
 
             # Emit progress and module start
             await emit_scan_progress(scan_id, progress, name)
@@ -564,18 +1080,22 @@ async def run_scan_task(scan_id: str, request: ScanRequest):
             await asyncio.sleep(0.5)  # Yield to event loop
 
         # Store results
-        _scan_results[scan_id] = ctx.data
-        _scans[scan_id].status = "completed"
-        _scans[scan_id].progress = 100
-        _scans[scan_id].completed_at = datetime.now(timezone.utc).isoformat() + "Z"
-        _scans[scan_id].current_module = None
+        _scan_store.set_results(scan_id, ctx.data)
+        scan.status = "completed"
+        scan.progress = 100
+        scan.completed_at = datetime.now(timezone.utc).isoformat() + "Z"
+        scan.current_module = None
+        _scan_store.set_scan(scan_id, scan)
 
         # Emit completion
         await emit_scan_completed(scan_id, len(ctx.data))
 
-    except (OSError, RuntimeError, ImportError, TypeError, ValueError, ConnectionError, RedOpsError) as e:  # Worker safety net — prevents unhandled exceptions from killing the background task
-        _scans[scan_id].status = "failed"
-        _scans[scan_id].error = str(e)
+    except Exception as e:  # Worker safety net — prevents unhandled exceptions from killing the background task
+        scan = _scan_store.get_scan(scan_id)
+        if scan is not None:
+            scan.status = "failed"
+            scan.error = str(e)
+            _scan_store.set_scan(scan_id, scan)
         await emit_scan_failed(scan_id, str(e))
 
 
@@ -594,6 +1114,9 @@ def get_dashboard_html() -> str:
 
     Skip to main content
     

+        
+        

+