Enumerate every in-scope subdomain of a domain list. Baseline the whole list, then fan out across methodologies the agent chooses by its own judgement - each lane picks a distinct data source, and any lane that adds a new true subdomain spawns two more, until a round goes dry or the method cap is hit. DNS-resolve for liveness, fingerprint each live host with httpx and webanalyze, then aggregate both sources into one normalized JSON report keyed by coverage.