Output and state - AgentGG

The output directory

A scan writes every result under one output directory.

out/
├── summary.md               ← human report
├── findings/
│   ├── <name>.md            ← one .md per finding (GHSA-shaped)
│   └── <name>/              ← live validation evidence for that finding
└── state/                   ← what `status` and `revalidate` read
    ├── scan.json            ← root path + timestamps
    ├── recon.json           ← the recon brief (phase 1)
    ├── plan.json            ← which agents queued / skipped + why (phase 2)
    ├── usage.json           ← tokens the model calls used
    ├── runs/<id>.json       ← one per command run on this directory
    ├── agents/<slug>.json   ← per-agent resume sidecar
    └── files/<slug>/<path>.json ← FileRecord per agent and source file

summary.md

The human report for the scan.

findings/

One markdown file per finding. See Resume and reports for the file shape. When live validation reproduced or refuted a finding, a folder with the same name as the finding file holds its evidence. See Test findings against a running app.

state/

File	Purpose
`scan.json`	The scan root path and its timestamps.
`recon.json`	The recon brief from phase 1.
`plan.json`	Which agents the plan queues or skips, and why. Phase 2 writes it before any agent runs.
`usage.json`	The tokens that the scan’s model calls used.
`runs/<id>.json`	One record for each command run on this directory, for example scan, revalidate, live-validate, score, fix, or summary. It keeps the command line, with the values of `--api-key` and `--oauth-token` replaced by `***`.
`agents/<slug>.json`	The resume record for one agent.
`files/<slug>/<path>.json`	The record for one source file that one agent scanned. It holds the findings, their verdicts, scores, live results, and suggested fixes.
`files/<slug>/live-validation/<id>/`	The live validation evidence for one finding. The report copies it into `findings/`.

Why the state directory matters

Resume, status, and revalidate all read the state/ directory. A re-run with the same -o skips files that did not change. A different -o starts a fresh scan. See Resume and reports for what makes a re-run reuse this state.