The Blackboard Pattern

What is the Blackboard Pattern?

The blackboard pattern is a software architecture for multi-agent coordination. Imagine a physical blackboard in a war room where team members write their discoveries, hypotheses, and requests for other team members. Anyone can read the blackboard, and anyone can write to it. There is no rigid hierarchy — collaboration emerges from shared information.

In P4L4D1N, the blackboard is a Redis-backed data structure that all agents read from and write to during a pentest. It is the communication backbone that enables agent collaboration without requiring direct agent-to-agent messaging.

Blackboard Data Types

P4L4D1N's blackboard stores five types of information, each serving a distinct coordination purpose:

1. Findings

When an agent validates a vulnerability, it posts a finding to the blackboard. Every other agent can see this finding and factor it into their own analysis.

A finding contains:

• Agent role — Which specialist discovered it
• Title — Short description of the vulnerability
• Severity — Critical, High, Medium, Low, or Info
• Description — Detailed explanation with evidence
• Additional metadata (CVSS, CWE, affected URL, etc.)

Example: The Web App Agent posts a finding: "Reflected XSS in search parameter on /products endpoint — payload <script>alert(1)</script> executes in response."

2. Leads

Leads are hypotheses or suggestions that one agent posts for another agent to investigate. This is how cross-domain collaboration happens.

A lead contains:

• From agent — Who posted the lead
• To agent — Who should investigate
• Message — Description of what to look for

Example: The Infrastructure Agent posts a lead: "Found Redis on port 6379 without authentication. API agents should check if session tokens are stored there — possible session hijacking vector."

Leads are powerful because they enable the kind of insight that only comes from combining perspectives. The Infrastructure Agent knows about open ports but does not specialize in API security. The API Agent specializes in session management but might not have checked which backing stores are exposed.

3. Agent Status

Each agent regularly updates its status on the blackboard, allowing the orchestrator and supervisor to monitor progress:

• Working — Actively analyzing or testing
• Wrap-up — Finishing current analysis before time runs out
• Complete — Done with all planned analysis
• Error — Encountered a problem

4. Chat Messages

Agents can post informal messages to the blackboard, creating a log of their reasoning process. This is particularly valuable for understanding how agents arrived at their conclusions.

Example: The Auth Agent posts: "Testing JWT token validation. The token uses HS256 signing. Attempting algorithm confusion attack by changing header to 'none'. Result: server rejects unsigned tokens — properly validated."

Chat messages create an audit trail of agent activity visible in TurboPentest's live agent activity panel.

5. Assignments

The supervisor can post assignments to the blackboard, directing agents toward specific areas. For example, if the supervisor notices no agent has investigated the GraphQL endpoint, it can post an assignment: "API Agent: GraphQL introspection endpoint found at /graphql — please test for query depth attacks and field suggestion enumeration."

How the Blackboard Enables Collaboration

Cross-Agent Discovery

The most powerful aspect of the blackboard is enabling discoveries that no single agent could make alone. Here is a real-world example:

1. Infrastructure Agent finds that port 9200 is open (Elasticsearch)
2. It posts a lead: "Elasticsearch cluster on port 9200 — Web agents should check if search queries pass through unsanitized"
3. Web App Agent reads the lead, tests the search endpoint, and finds that search queries are forwarded directly to Elasticsearch
4. It crafts an Elasticsearch injection payload and confirms data exfiltration
5. It posts a finding: "Elasticsearch injection via /search endpoint — full index readable"
6. Exploit Chain Agent (Blitz tier) reads both the Infrastructure Agent's port discovery and the Web Agent's injection finding, producing a chain: "Exposed Elasticsearch (Infra) + Unsanitized query passthrough (Web) = Critical data breach"

No single agent would have found this chain alone. The Infrastructure Agent does not test web injection. The Web Agent might not have looked at port 9200. The collaboration through the blackboard made the discovery possible.

Avoiding Duplicate Work

When an agent posts a finding, other agents can see it and skip testing the same vulnerability. If the Web Agent already found and validated an XSS on /search, the API Agent does not need to re-test it.

Real-Time Strategy Adaptation

The supervisor reads the blackboard to understand what has been covered and what has been missed. If all agents are focused on the web layer but nobody has tested the API endpoints, the supervisor can post assignments redirecting effort.

Technical Implementation

P4L4D1N's blackboard is implemented using Redis as the backing store, with several key design decisions:

Redis Data Structures

• Findings — Stored as a Redis list (RPUSH/LRANGE), allowing agents to append findings and read the full list
• Leads — Also a Redis list, enabling chronological ordering
• Status — Stored as simple key-value pairs (SET/GET), one per agent
• Chat — Redis list with timestamped entries
• Assignments — Redis list for supervisor directives

Time-to-Live

All blackboard data has a 24-hour TTL (time-to-live). After the pentest completes, blackboard data is available for review in the live agent panel but automatically cleaned up after 24 hours.

Circuit Breaker

Redis operations are wrapped in a circuit breaker pattern. If Redis becomes temporarily unavailable, agents continue working with their own local state rather than failing entirely. This ensures that a Redis hiccup does not crash the pentest.

Event Publishing

Every blackboard write triggers a real-time event via server-sent events (SSE). This powers TurboPentest's live agent activity panel, letting users watch agents collaborate in real-time during a scan.

The Blackboard vs. Other Coordination Patterns

Direct Messaging

In a direct messaging system, agents send messages to specific other agents. This requires each agent to know which other agents are running and what they specialize in. The blackboard pattern avoids this coupling — agents just write to the board, and whoever cares about the information reads it.

Central Controller

In a central controller pattern, a single coordinator receives all agent output, makes decisions, and sends instructions. This creates a bottleneck and a single point of failure. The blackboard distributes coordination — any agent can read and react to any other agent's output.

The Blackboard Advantage

The blackboard pattern offers the best balance of flexibility and coordination for multi-agent pentesting. Agents are loosely coupled (they communicate through shared state rather than direct connections), any agent can benefit from any other agent's discoveries, and the system degrades gracefully if individual agents fail.