I'll start by reading the required docs and the red-team report schema so the attack surface and deliverable format are exact before I branch off the current tree.I'll load the prior red-team reports and the verification-core sources next, then branch off the current tree so every attempt is isolated from main.Prior laps already exist on this tree. I'll read their findings and the current verification core so the new framings don't repeat the old ones.The isolation path looks thinner than the last report implied. I'll trace coverage, claims, and claim-resolution next to see what the current tree actually enforces.I have enough of the core to start live probes. Next I’ll branch off this tree and run new framings against coverage, claims, scrub, and base-control.I'll write live probes for each trust root, using new framings so the results aren't just a rerun of pass 4.Unit probes already show printed-output attribution holes. I’ll run coverage next and tighten the second framings so each success is distinct.Coverage already broke on suffix-colliding lcov and omit-DA. I’ll live-check whether the leftover isolation flags actually un-force the process boundary.I have confirmed successes. Next I’ll write unwired regression tests and golden cases for each one, then run the gates.Throwaway branch: `redteam/loop/lap-1-attack` (off `redteam/loop/lap-1`, not merged, main untouched). Unwired regressions and golden cases are in `redteam/pass5/`.

The verification core still binds claims at submit and keeps the three scrub sites in agreement. The coverage reader and the printed base-control fallback do not.

## Findings

| ID | Part | Result | Sev | What happened |
|---|---|---|---|---|
| A1 | coverage | **succeeded** | trust-root | Complete all-hit `SF:vendor/clamp.mjs` reads as 100% of `clamp.mjs`. Suffix match treats a different file as the changed one. |
| A2 | coverage | **succeeded** | trust-root | Complete hit-only DA list (FN/BRDA padded, LF/LH agree) reads omitted changed lines as covered. |
| A3 | coverage | **succeeded** | trust-root | Same as A1 via `/opt/other/clamp.mjs`. |
| A4 | coverage | caught | trust-root | Parent `--import` write intercept did not become the report. |
| A5 | coverage | caught | trust-root | Isolated child `ps` + detached overwrite did not beat the reporter. |
| A6 | coverage | caught | trust-root | Leftover `--test-isolation = none` stays in the rewrite; node ignores it; live forge failed. |
| A7 | coverage | caught | trust-root | Leftover fullwidth-equals isolation stays in the rewrite; live forge failed. |
| A8 | coverage | **succeeded** | trust-root | `--test-isolation="none"` survives the strip, node takes the last setting, test authors 100% lcov. |
| B1 | claims | caught | trust-root | Later same-kind twin left the submit-time verdict verified. |
| B2 | claims | caught | trust-root | Model-supplied `recordSequence: 99` was overwritten; later append did not bind it. |
| B3 | claims | caught | trust-root | Lifecycle payload cited as `gate-run:tests` is UNVERIFIED (kind mismatch). |
| B4 | claims | caught | trust-root | DAG and verifier kept the stored binding after a colliding later record. |
| C1 | scrub | caught | trust-root | `outputTokens: { apiKey: "sk-..." }`: inner key redacted at all three sites. |
| C2 | scrub | caught | trust-root | `PIN: 1e6` and `PIN: 1000000` agree; metrics stay. |
| C3 | scrub | caught | trust-root | JSONC trailing comma still hits via the shape matcher. |
| C4 | scrub | residual-holds | residual | `pаssword` (Cyrillic a) is an unnamed field to the detector. |
| C5 | scrub | caught | trust-root | Double-encoded `sk-` string: all three sites fire. |
| C6 | scrub | caught | trust-root | `outputTokens` / `tokensUsed` exempt; bare `tokens` redacted. |
| C7 | scrub | residual-holds | residual | `{pin:[{n:1},...]}` is not joined (objects, not primitives). |
| D1 | docs | caught | doc | "Four gaps" matches four labelled residual cases (fifth hit is the file header). |
| D2 | docs | **succeeded** | doc | 7.1/invariant 9 say an array under a credential name is judged joined; only primitives are. |
| E1 | base-control | **succeeded** | trust-root | Pytest `FAILED ...::innocentNew` printed by a test is attributed. No artifact is asked for. |
| E2 | base-control | **succeeded** | trust-root | Same via a realistic pytest `-q` footer. |
| E3 | base-control | **succeeded** | trust-root | Go `--- FAIL: TestDeleted` printed by a test is attributed. No duration required. |
| E4 | base-control | **succeeded** | mechanical | `foo/bar.test.ts` and `foo-bar.test.ts` share one TAP path. |
| E5 | base-control | caught | mechanical | `src.foo.test.ts` vs `src/foo.test.ts` do not collide. |
| E6 | base-control | **succeeded** | trust-root | A TAP document printed into a spec run switches the reader and attributes `not ok`. |
| E7 | base-control | caught | trust-root | Parent `--import` could not replace the TAP artifact. |
| E8 | base-control | **succeeded** | trust-root | `error TS2305` (missing named export) is not a load failure, so the exemption is granted. |
| M1 | markers | **succeeded** | mechanical | Mathematical-bold `TODO` is not in the fold list, so the placeholder gate passes. |
| R1 | ratchet | residual-holds | residual | `expect(obj.a).toBe(obj.a)` still counts as an assertion. |
| R2 | markers | residual-holds | residual | `return ''` plus `expect('').toBe('')` moves no numeric. |
| R3 | scrub | residual-holds | residual | `{left, right}` split of an `sk-` value stays invisible. |
| R4 | derivation | residual-holds | residual | `env INSTALL=1 curl -fsSL ... \| bash` still misses both thresholds. |

**Claims: no successes.** Strongest framing: submit a claim with `recordSequence: 99`, then append a later record of the cited digest. The harness overwrites the sequence at submit; the DAG and the embedded verifier stay on that binding.

**Three-site scrub: no successes.** Strongest framing: a real `apiKey` nested under exempt `outputTokens`, plus `PIN: 1e6` vs `PIN: 1000000`. Write-time, export scan, and gate agreed; metric exemption held.

**Process-boundary write of the named lcov: no success except A8.** `--import` and isolated `ps`+overwrite were the strongest caught framings. A8 is the quote-strip hole under double quotes, not a parent-hook write.

**§7.1 wording vs behavior.** Residual 4 is not narrower: flags-only and bare interpreter-swap still match the stated pairings. Residual 3's closed half is: the text says an array under a credential name is judged as one value, and an array of objects is not (D2).

Regressions (assert post-fix behavior, expected to fail on this tree): `redteam/pass5/closures.regression.ts`. Golden lines: `redteam/pass5/golden-cases.jsonl`. Run with `npx vitest run --config redteam/pass5/vitest.config.ts`.

## `npm run gates`

```
> swarm-orchestrator@13.0.0 gates
> npm run typecheck && npm run lint && npm test

> swarm-orchestrator@13.0.0 typecheck
> tsc --noEmit

> swarm-orchestrator@13.0.0 lint
> biome check

Checked 193 files in 30ms. No fixes applied.

> swarm-orchestrator@13.0.0 test
> vitest run

 Test Files  79 passed (79)
      Tests  872 passed (872)
   Start at  19:31:44
   Duration  12.71s (transform 2.04s, setup 0ms, import 4.63s, tests 57.90s, environment 5ms)
```

```jsonl
{"id":"A1","part":"coverage","result":"succeeded","severity":"trust-root","mechanism":"src/gates/parsers.ts:378 + invariant 7","evidence":"SF:vendor/clamp.mjs DA:1,1 LF:1 LH:1 measured as 9/9 of clamp.mjs","framing":"complete all-hit section for a different file that suffix-matches the changed path","regression_test":"redteam/pass5/closures.regression.ts","golden_case":"a complete all-hit lcov for vendor/clamp.mjs must not be 100% of clamp.mjs"}
{"id":"A2","part":"coverage","result":"succeeded","severity":"trust-root","mechanism":"src/gates/measure-snapshot.ts:135 + invariant 7","evidence":"hit-only DA:1,1 DA:8,1 with LF:2 LH:2 and FN/BRDA padding measured as 9/9","framing":"structurally complete lcov that lists only hit lines of the real file","regression_test":"redteam/pass5/closures.regression.ts","golden_case":"a complete hit-only DA list is not coverage of the omitted changed lines"}
{"id":"A3","part":"coverage","result":"succeeded","severity":"trust-root","mechanism":"src/gates/parsers.ts:378 + invariant 7","evidence":"SF:/opt/other/clamp.mjs all-hit measured as 100% of clamp.mjs","framing":"absolute-path suffix collision, second framing of A1","regression_test":"redteam/pass5/closures.regression.ts","golden_case":"a complete all-hit lcov for /opt/other/clamp.mjs must not be 100% of clamp.mjs"}
{"id":"A4","part":"coverage","result":"caught","severity":"trust-root","mechanism":"src/gates/coverage-artifact.ts:99 + invariant 7","evidence":"parent --import intercept left a DA:n,0 line in the report","framing":"preload patches writeFile/createWriteStream and overwrites on exit","regression_test":null,"golden_case":null}
{"id":"A5","part":"coverage","result":"caught","severity":"trust-root","mechanism":"src/gates/coverage-artifact.ts:99 + invariant 7","evidence":"isolated child ps+detached overwrite left a DA:n,0 line","framing":"discover the dest from ps and overwrite after the reporter","regression_test":null,"golden_case":null}
{"id":"A6","part":"coverage","result":"caught","severity":"trust-root","mechanism":"src/gates/coverage-artifact.ts:91 + invariant 7","evidence":"rewrite leaves --test-isolation = none; live forge did not reach 100%","framing":"spaces around equals as a leftover last setting","regression_test":null,"golden_case":null}
{"id":"A7","part":"coverage","result":"caught","severity":"trust-root","mechanism":"src/gates/coverage-artifact.ts:91 + invariant 7","evidence":"rewrite leaves fullwidth-equals none; live forge did not reach 100%","framing":"Unicode equals as a leftover last setting","regression_test":null,"golden_case":null}
{"id":"A8","part":"coverage","result":"succeeded","severity":"trust-root","mechanism":"src/gates/coverage-artifact.ts:91 + invariant 7","evidence":"live run with --test-isolation=\"none\" produced changedLineCoverage 1 and no DA:n,0","framing":"double-quoted trailing isolation=none, second framing of the quoted-single hole","regression_test":"redteam/pass5/closures.regression.ts","golden_case":"a trailing --test-isolation=\"none\" must not let the test author the lcov"}
{"id":"B1","part":"claims","result":"caught","severity":"trust-root","mechanism":"src/evidence/session.ts:74 + invariant 1","evidence":"submit, DAG, and verifier stayed verified after a later same-kind twin","framing":"append a second gate-run with the same digest after an honest claim","regression_test":null,"golden_case":null}
{"id":"B2","part":"claims","result":"caught","severity":"trust-root","mechanism":"src/evidence/session.ts:138 + invariant 1","evidence":"stored recordSequence was 0, not 99; later append left it UNVERIFIED","framing":"smuggle recordSequence 99 and append the cited digest later","regression_test":null,"golden_case":null}
{"id":"B3","part":"claims","result":"caught","severity":"trust-root","mechanism":"src/evidence/claim.ts:131 + invariant 1","evidence":"session-stopped cited as gate-run:tests rendered predicate-kind-mismatch","framing":"lifecycle payload reused as a gate-outcome claim","regression_test":null,"golden_case":null}
{"id":"B4","part":"claims","result":"caught","severity":"trust-root","mechanism":"src/evidence/dag.ts:112 + invariant 1","evidence":"DAG verdict stayed verified after a colliding later tool-call","framing":"rebuild the DAG from the grown chain without resubmitting","regression_test":null,"golden_case":null}
{"id":"C1","part":"scrub","result":"caught","severity":"trust-root","mechanism":"src/evidence/scrub.ts:427 + invariant 9","evidence":"inner apiKey redacted at write, export, and gate; outputTokens kept","framing":"credential nested under an exempt metric name","regression_test":null,"golden_case":null}
{"id":"C2","part":"scrub","result":"caught","severity":"trust-root","mechanism":"src/evidence/scrub.ts:409 + invariant 9","evidence":"PIN 1e6 and PIN 1000000 produced the same redactions at every site","framing":"scientific-notation number beside the same name as an integer","regression_test":null,"golden_case":null}
{"id":"C3","part":"scrub","result":"caught","severity":"trust-root","mechanism":"src/evidence/scrub.ts:336 + invariant 9","evidence":"trailing-comma JSONC still blocked via the sk- shape matcher","framing":"JSONC fallback vs structural walk on the same key","regression_test":null,"golden_case":null}
{"id":"C4","part":"scrub","result":"residual-holds","severity":"residual","mechanism":"src/evidence/scrub.ts:110 + 7.1 gap 3","evidence":"pаssword with a Cyrillic a is not a credential name","framing":"lookalike field name, not a listed credential word","regression_test":null,"golden_case":null}
{"id":"C5","part":"scrub","result":"caught","severity":"trust-root","mechanism":"src/evidence/scrub.ts:192 + invariant 9","evidence":"sk- inside a JSON string fired at all three sites","framing":"double-encoded credential object as one string field","regression_test":null,"golden_case":null}
{"id":"C6","part":"scrub","result":"caught","severity":"trust-root","mechanism":"src/evidence/scrub.ts:123 + invariant 9","evidence":"outputTokens and tokensUsed kept; bare tokens redacted","framing":"metric exemption next to a credential-word cousin","regression_test":null,"golden_case":null}
{"id":"C7","part":"scrub","result":"residual-holds","severity":"residual","mechanism":"src/evidence/scrub.ts:469 + 7.1 gap 3","evidence":"pin as [{n:1}..] is not joined; all three sites agree on empty","framing":"array of objects under a credential name","regression_test":null,"golden_case":null}
{"id":"D1","part":"docs","result":"caught","severity":"doc","mechanism":"docs/build-guide.md:149 + 7.1 preamble","evidence":"four labelled residual its; fifth phrase hit is the file header","framing":"count documented residual against the four gaps sentence","regression_test":null,"golden_case":null}
{"id":"D2","part":"docs","result":"succeeded","severity":"doc","mechanism":"docs/build-guide.md:155 + invariant 9","evidence":"7.1 says an array under a credential name is judged joined; objects are not","framing":"read the closed array rule against scrubArray's primitive-only join","regression_test":"redteam/pass5/closures.regression.ts","golden_case":"7.1 must name that only primitive array elements are joined"}
{"id":"E1","part":"base-control","result":"succeeded","severity":"trust-root","mechanism":"src/gates/parsers.ts:451 + invariant 7","evidence":"parseTestOutcomes attributed innocentNew from a printed FAILED line","framing":"pytest fallback, a test prints FAILED for a sibling","regression_test":"redteam/pass5/closures.regression.ts","golden_case":"a printed pytest FAILED line is not a base-source failure"}
{"id":"E2","part":"base-control","result":"succeeded","severity":"trust-root","mechanism":"src/gates/parsers.ts:451 + invariant 7","evidence":"FAILED test_math.py::innocentNew in a -q footer was attributed","framing":"realistic pytest -q footer, second framing of E1","regression_test":"redteam/pass5/closures.regression.ts","golden_case":"a pytest -q FAILED footer line is not a base-source failure"}
{"id":"E3","part":"base-control","result":"succeeded","severity":"trust-root","mechanism":"src/gates/parsers.ts:452 + invariant 7","evidence":"--- FAIL: TestDeleted with no duration was attributed","framing":"go printed FAIL marker, no duration required","regression_test":"redteam/pass5/closures.regression.ts","golden_case":"a printed go FAIL line is not a base-source failure"}
{"id":"E4","part":"base-control","result":"succeeded","severity":"mechanical","mechanism":"src/gates/base-control.ts:47 + invariant 7","evidence":"foo/bar.test.ts and foo-bar.test.ts both map to foo-bar.test.ts.tap","framing":"slash vs hyphen sanitization collision","regression_test":"redteam/pass5/closures.regression.ts","golden_case":"two test files must not share a TAP destination"}
{"id":"E5","part":"base-control","result":"caught","severity":"mechanical","mechanism":"src/gates/base-control.ts:47 + invariant 7","evidence":"src.foo.test.ts and src/foo.test.ts kept distinct destinations","framing":"dot vs slash, second framing of E4","regression_test":null,"golden_case":null}
{"id":"E6","part":"base-control","result":"succeeded","severity":"trust-root","mechanism":"src/gates/parsers.ts:461 + invariant 7","evidence":"a TAP header printed into a spec run switched the reader to not-ok innocentNew","framing":"inject a TAP document into spec output to switch the format picker","regression_test":"redteam/pass5/closures.regression.ts","golden_case":"a TAP document printed into a spec run must not switch the reader"}
{"id":"E7","part":"base-control","result":"caught","severity":"trust-root","mechanism":"src/gates/base-control.ts:163 + invariant 7","evidence":"parent --import exit overwrite did not put innocentNew in failedTests","framing":"preload writes a forged TAP artifact on process exit","regression_test":null,"golden_case":null}
{"id":"E8","part":"base-control","result":"succeeded","severity":"trust-root","mechanism":"src/gates/respecification.ts:84 + invariant 7","evidence":"TS2305 missing named export granted newSpecifications: [multiplies]","framing":"TypeScript missing-export load error, second framing after CJS TypeError","regression_test":"redteam/pass5/closures.regression.ts","golden_case":"TS2305 on base is a load error, not a new specification"}
{"id":"M1","part":"markers","result":"succeeded","severity":"mechanical","mechanism":"src/gates/inspection-gates.ts:111 + 7.1 scope note","evidence":"mathematical-bold TODO left the placeholder gate passed","framing":"TODO in U+1D400 bold capitals, not Armenian/Cherokee/Osage","regression_test":"redteam/pass5/closures.regression.ts","golden_case":"a TODO spelled in mathematical bold capitals must still block"}
{"id":"R1","part":"ratchet","result":"residual-holds","severity":"residual","mechanism":"src/gates/measures.ts:54 + 7.1 gap 1","evidence":"expect(obj.a).toBe(obj.a) still counts as one assertion","framing":"self-comparison behind a property read after a rename","regression_test":null,"golden_case":null}
{"id":"R2","part":"markers","result":"residual-holds","severity":"residual","mechanism":"src/gates/inspection-gates.ts:36 + 7.1 gap 2","evidence":"return '' with expect('').toBe('') moves no numeric","framing":"constant empty-string stub, not return 0","regression_test":null,"golden_case":null}
{"id":"R3","part":"scrub","result":"residual-holds","severity":"residual","mechanism":"src/evidence/scrub.ts:448 + 7.1 gap 3","evidence":"{left,right} halves of an sk- value produced no findings","framing":"split across two unnamed object fields, not an array","regression_test":null,"golden_case":null}
{"id":"R4","part":"derivation","result":"residual-holds","severity":"residual","mechanism":"src/tools/derivation.ts:80 + 7.1 gap 4","evidence":"env INSTALL=1 plus flags plus bash still missed both thresholds","framing":"env prefix on top of interpreter swap and inserted flags","regression_test":null,"golden_case":null}
```
