malicious-decl-input-update
planarian @ a924e09 · Spec v4.6 · snapshot main · all versions
A flake input update (the supply-chain path) brings in a module that declares gym-bad-payload. The incident names the input, its lock change (old and new revisions), and who applied the update.
| Harness | Scoring | Expects | Latest verdict |
|---|---|---|---|
| fake, vm | must-pass | declaration_origin: lock_change true, path flake input gym-modules, unit service:gym-bad-payload, when generation-created, who root; incident: service:gym-web | fake: PASS; VM: not run in this build |
What it exercises
No invariant by name.