Harness Span-Timeline Temporal-Integrity / TOCTOU Lab
“A back-dated audit trail cannot launder a clean AgentSmack grade.”
Your harness span list carries a wall-clock startedAtIso on every span — but every content grader reads it as a sort key and trusts array / causal order. So a forged or physically-impossible telemetry timeline slips a clean grade: a back-dated policy/approval gate whose timestamp is after the action.executed it supposedly authorized (array order says “before”, the clock says “after” — a fabricated audit trail); an egress.attempted timestamped before the span that produced the value it carries; a child span before its parentId parent ever started (impossible lineage); an event before the run began; a negative-duration window; or a stale time-of-check / time-of-use gate that cleared long before the action it authorized. This lab is a pure, deterministic meta-lens over the SAME Phase-4 span list: any forgery-class finding forces the verdict to forged (score clamped into the failing band, non-launderable); physical impossibilities are suspect; an all-unannotated list is insufficient_signal, never a fabricated coherent. Grading is by the parsed timestamp, not the array index — re-ordering the spans cannot change the verdict. The report carries only span ids + closed enums + the two offending epoch-ms integers (no raw span / attribute / secret bytes). Load a sample to watch the verdict swing with no live infra.
Is the clean grade even earned, or laundered by omission?
This lab grades the timeline's physics — but a forged-clean trace can also launder a grade by simply OMITTING the risky spans (no policy.check.completed under a privileged action, no egress sink under a sensitive origin) so the harness dimension is silently no_signal-excluded. Run the same spans through the Instrumentation-Coverage / Telemetry-Sufficiency auditor to catch a clean grade laundered by under-instrumentation.
Clock-coherent is not the same as structurally sound
This lab grades the timeline's physics — but timestamps can be perfectly monotonic over a forged graph. A cycle in parentId, a duplicate span id, or a privileged action with no causal ancestor at all forges the lineage every binding detector trusts. Run the same spans through the Span-Lineage Graph-Integrity meta-lens to catch a structurally-forged causal DAG.
A coherent clock can still carry a laundered approval
Timestamps can advance perfectly while the attribute values contradict themselves — a gate that approved a DIFFERENT action than was executed, a redacted value re-emitted raw. Run the same spans through the Cross-Span Attribute Value-Consistency meta-lens to catch a forged attribute trail.