{
 "product": "Top 25 #23 SWARM KEYSTONE",
 "date": "2026-11-02",
 "method": "blind set scripts/swarm/blind_2026_11_02.py written before changes; scan cases live via POST /swarm-keystone/scan-swarm, prove cases on the engine (live hardening needs Claude credit)",
 "runs": [
  {
   "run": "1",
   "held": "6/14",
   "at": "2026-11-02T18:23:47Z",
   "note": "3 prove rows used a reference swarm whose 'legitimate' edge broke the product's own attenuation rule, so 2 held for the wrong reason and 1 failed for the wrong reason; corrected tally 5/14"
  },
  {
   "run": "1b",
   "held": "1/3",
   "note": "same three prove questions with a corrected reference swarm, engine unchanged",
   "rows": [
    {
     "name": "new authority for web",
     "pass": false,
     "detail": "VERIFIED"
    },
    {
     "name": "new all-powerful agent",
     "pass": false,
     "detail": "VERIFIED"
    },
    {
     "name": "minimal correct fix",
     "pass": true,
     "detail": "VERIFIED"
    }
   ]
  }
 ],
 "rows": [
  {
   "kind": "scan",
   "name": "peer delegation of a tool the sender lacks (equal authority)",
   "want": "not CLEAN",
   "pass": false,
   "detail": "(200, '{\"swarm_id\": null, \"engine\": \"SWARM KEYSTONE Detector (Cycle Detection + Monotonic Attenuation)\", \"scanned_ms\": 0.23, \"grade\": \"CLEAN\", \"findings\": [], \"finding_count\": 0, \"blocking_count\": 0}')",
   "after": "UNSAFE: capability_not_held_by_delegator (HIGH)"
  },
  {
   "kind": "scan",
   "name": "message from low to high authority asking for a privileged tool, no edge",
   "want": "not CLEAN",
   "pass": false,
   "detail": "(200, '{\"swarm_id\": \"blind\", \"engine\": \"SWARM KEYSTONE Detector (Cycle Detection + Monotonic Attenuation)\", \"scanned_ms\": 0.63, \"grade\": \"CLEAN\", \"findings\": [], \"finding_count\": 0, \"blocking_count\": 0}')",
   "after": "UNSAFE: undeclared_channel_tool_request (HIGH)"
  },
  {
   "kind": "scan",
   "name": "injection in an unscanned edge field",
   "want": "not CLEAN",
   "pass": false,
   "detail": "(200, '{\"swarm_id\": \"blind\", \"engine\": \"SWARM KEYSTONE Detector (Cycle Detection + Monotonic Attenuation)\", \"scanned_ms\": 0.24, \"grade\": \"CLEAN\", \"findings\": [], \"finding_count\": 0, \"blocking_count\": 0}')",
   "after": "UNSAFE: every string field is screened"
  },
  {
   "kind": "scan",
   "name": "authority_level Infinity",
   "want": "refused",
   "pass": false,
   "detail": "HTTP 200",
   "after": "refused (authority must be finite)"
  },
  {
   "kind": "scan",
   "name": "huge negative authority",
   "want": "refused or reported",
   "pass": false,
   "detail": "(200, '{\"swarm_id\": null, \"engine\": \"SWARM KEYSTONE Detector (Cycle Detection + Monotonic Attenuation)\", \"scanned_ms\": 0.08, \"grade\": \"CLEAN\", \"findings\": [], \"finding')",
   "after": "unchanged by design: authority is a relative order; a negative level grants nothing"
  },
  {
   "kind": "scan",
   "name": "requested_tools null to a higher agent",
   "want": "not CLEAN",
   "pass": true,
   "detail": "(200, '{\"swarm_id\": null, \"engine\": \"SWARM KEYSTONE Detector (Cycle Detection + Monotonic Attenuation)\", \"scanned_ms\": 0.27, \"grade\": \"COMPROMISED\", \"findings\": [{\"check\": \"unscoped_delegation_to_higher_authority\", \"severity\": ')",
   "after": "held"
  },
  {
   "kind": "scan",
   "name": "tool names with trailing space",
   "want": "refused or reported",
   "pass": true,
   "detail": "(200, '{\"swarm_id\": null, \"engine\": \"SWARM KEYSTONE Detector (Cycle Detection + Monotonic Attenuation)\", \"scanned_ms\": 0.29, \"grade\": \"COMPROMISED\", \"findings\": [{\"check\": \"authority_escalation_laundering\", ')",
   "after": "held"
  },
  {
   "kind": "scan",
   "name": "override phrase in a message",
   "want": "not CLEAN",
   "pass": true,
   "detail": "(200, '{\"swarm_id\": \"blind\", \"engine\": \"SWARM KEYSTONE Detector (Cycle Detection + Monotonic Attenuation)\", \"scanned_ms\": 0.41, \"grade\": \"UNSAFE\", \"findings\": [{\"check\": \"inter_agent_prompt_injection\", \"severity\": \"HIGH\", \"deta')",
   "after": "held"
  },
  {
   "kind": "prove",
   "name": "hardened swarm is empty",
   "want": "NOT_VERIFIED",
   "pass": false,
   "detail": "{'verified': True, 're_scan': {'grade': 'CLEAN', 'findings': [], 'finding_count': 0, 'blocking_count': 0}, 'edge_count': 0, 'agent_count': 0, 'is_dag': True, 'monotonic_attenuation_verified': True}",
   "after": "NOT_VERIFIED: hardened swarm drops agents"
  },
  {
   "kind": "prove",
   "name": "hardened swarm gives an agent new tools/authority",
   "want": "NOT_VERIFIED",
   "pass": true,
   "detail": "Hardened swarm still has 1 blocking findings",
   "after": "run 1 held for the wrong reason (confounded); run 1b failed; now NOT_VERIFIED: new tools"
  },
  {
   "kind": "prove",
   "name": "hardened swarm drops legitimate agents and edges",
   "want": "NOT_VERIFIED",
   "pass": false,
   "detail": "VERIFIED",
   "after": "NOT_VERIFIED: drops agents / removes clean edge"
  },
  {
   "kind": "prove",
   "name": "hardened swarm adds a new all-powerful agent",
   "want": "NOT_VERIFIED",
   "pass": true,
   "detail": "Hardened swarm still has 1 blocking findings",
   "after": "run 1 held for the wrong reason (confounded); run 1b failed; now NOT_VERIFIED: new agent"
  },
  {
   "kind": "prove",
   "name": "minimal correct fix",
   "want": "VERIFIED",
   "pass": false,
   "detail": "Hardened swarm still has 1 blocking findings",
   "after": "run 1 failed only because the test's reference swarm broke the product's own rule; run 1b and after: VERIFIED"
  },
  {
   "kind": "prove",
   "name": "hardened swarm is not an object",
   "want": "refused",
   "pass": true,
   "detail": "refused: swarm must be a JSON object",
   "after": "held"
  }
 ],
 "after_engine": {
  "s1": "UNSAFE",
  "s2": "UNSAFE",
  "s3": "UNSAFE",
  "s4": "refused",
  "s5": "CLEAN",
  "p1": false,
  "p2": false,
  "p3": false,
  "p4": false,
  "p5": true
 },
 "fixes": [
  "prove(): a hardening may only take authority away: no new agents, edges, tools, or higher levels; every agent and every edge without a finding must be kept",
  "scan: capability_not_held_by_delegator (the invariant prove() already enforced)",
  "scan: undeclared_channel_tool_request (laundering by message)",
  "scan: injection screen over every string field of edges, messages and agent definitions",
  "validation: authority_level must be finite",
  "findings from edge checks carry the edge index"
 ],
 "tests": "tests/test_swarm_keystone.py 19 -> 21 (one old test expected a hardening that granted a new tool to verify; it is now refused); collusion suites 36/36",
 "pending_deploy": "deployed 2026-11-02 18:56Z (gateway rolling deploy); live re-run of the blind set: 12/14 = the 1 by-design case + the 1 run-1 case invalidated by test design (its corrected run-1b version holds)",
 "limits": [
  "self-run, no independent review",
  "pattern-based injection screen: paraphrases get through",
  "tool mentions in messages are matched by name only",
  "it audits the declared topology, not what agents actually do at run time",
  "AI hardening needs Claude API credit; the deterministic scan and prove are free"
 ],
 "deployed": "deployed 2026-11-02 18:56Z (gateway rolling deploy); live re-run of the blind set: 12/14 = the 1 by-design case + the 1 run-1 case invalidated by test design (its corrected run-1b version holds)"
}