Beyond free-roaming Agents: Architecting a Deterministic 4-node Graph pipeline for zero-false-positive Autonomous VAPT

In the pursuit of zero-false-positive autonomous penetration testing, the author faced numerous challenges with conventional, free-roaming large language models (LLMs). These issues included context window reset, hallucinated vulnerabilities, constant human-in-the-loop prompting, and latency. To overcome these limitations, the author introduced a deterministic 4-node graph pipeline called Okwute, which consists of Mapper → Generator → Executor → Validator phases, running on a headless, self-hosted harness.

The core breakthrough of the .claude Harness, the initial attempt to solve LLM amnesia, was the development of loop engineering. This created an execution engine that lives between prompts, anchoring memory, phase progression, and vulnerability proofs in deterministic filesystem artifacts on a self-hosted workspace. The architecture comprised three tiers of memory: organization-wide security baselines and false-positive filters, shared product-family dynamic memory, and isolated session scratchpad and exploration sandbox.

To ensure the system's reliability and avoid concurrency conflicts, the author implemented a lightweight three-tier memory system using SHA-256 context hashing in the file frontmatter. This approach prevented background workers from overwriting each other's updates and allowed the system to run autonomously within bounded, deterministic ticks. It parsed state, reconstructed previous scans, called the LLM to decide the next action, and saved the updated results back to disk.

The author's breakthrough came after attending a presentation by James Kettle at DevCon in 2026. Kettle's whitepaper, "Can AI do novel security research? Meet the HTTP Terminator," tackled the question of whether autonomous AI systems could invent new attack techniques, bypass complex security layers, and discover zero-days.