{
  "kind": "coordinated_action",
  "product_version": "0.12.897",
  "wheel_sha256": "a9c3bf17b036c5f661df05ba4a02cf3afa834b44c2492f3e60fb3b66061a0a24",
  "method": "Published detector functions evaluated on authored inert events or disposable configuration files.",
  "scope": "No live agent, runtime adapter, daemon ingestion, product UI, external command or network action was exercised.",
  "cases": [
    {
      "case": "six-unrelated-sessions",
      "inputs": {
        "fingerprints_by_session": {
          "claude_code:session0": [
            [
              "PUT",
              "collector.invalid",
              "/shared/board"
            ]
          ],
          "claude_code:session1": [
            [
              "PUT",
              "collector.invalid",
              "/shared/board"
            ]
          ],
          "claude_code:session2": [
            [
              "PUT",
              "collector.invalid",
              "/shared/board"
            ]
          ],
          "claude_code:session3": [
            [
              "PUT",
              "collector.invalid",
              "/shared/board"
            ]
          ],
          "claude_code:session4": [
            [
              "PUT",
              "collector.invalid",
              "/shared/board"
            ]
          ],
          "claude_code:session5": [
            [
              "PUT",
              "collector.invalid",
              "/shared/board"
            ]
          ]
        },
        "parents": {},
        "history": {},
        "history_since_ms": 1799740800000,
        "now": 1800000000.0,
        "min_families": 5,
        "settle_hours": 24
      },
      "expected_severity": "warning",
      "actual_severity": "warning",
      "findings": [
        {
          "kind": "coordinated_action",
          "session_id": "claude_code:session0",
          "runtime": "fleet",
          "severity": "warning",
          "title": "6 unrelated sessions sent PUT to collector.invalid/shared/board",
          "detail": "6 sessions with no parent or child link between them sent PUT requests to collector.invalid/shared/board. This node has no record of that action before now. Independent agents converging on one shared destination is how a shared cache becomes a message board. This is read from the agents' tool arguments, not observed on the network. You can Stop or Pause these agents from the ClawMetry dashboard or device.",
          "evidence": {
            "fingerprint": {
              "verb": "PUT",
              "host": "collector.invalid",
              "path_prefix": "/shared/board"
            },
            "fingerprint_key": "PUT collector.invalid/shared/board",
            "families": 6,
            "sessions": 6,
            "session_ids": [
              "claude_code:session0",
              "claude_code:session1",
              "claude_code:session2",
              "claude_code:session3",
              "claude_code:session4",
              "claude_code:session5"
            ],
            "threshold": 5,
            "first_seen_by_node": null,
            "settle_hours": 24.0,
            "observed": "tool_arguments"
          },
          "first_bad_step": null,
          "participants": [
            "claude_code:session0",
            "claude_code:session1",
            "claude_code:session2",
            "claude_code:session3",
            "claude_code:session4",
            "claude_code:session5"
          ],
          "frameworks": {
            "mapping_version": "2026-09-27.1",
            "owasp_llm": [],
            "owasp_asi": [
              "ASI07",
              "ASI08"
            ],
            "atlas": [],
            "mapped": true,
            "mode": "detect",
            "pre_action_control": false
          }
        }
      ]
    },
    {
      "case": "one-orchestrator-family",
      "inputs": {
        "fingerprints_by_session": {
          "claude_code:session0": [
            [
              "PUT",
              "collector.invalid",
              "/shared/board"
            ]
          ],
          "claude_code:session1": [
            [
              "PUT",
              "collector.invalid",
              "/shared/board"
            ]
          ],
          "claude_code:session2": [
            [
              "PUT",
              "collector.invalid",
              "/shared/board"
            ]
          ],
          "claude_code:session3": [
            [
              "PUT",
              "collector.invalid",
              "/shared/board"
            ]
          ],
          "claude_code:session4": [
            [
              "PUT",
              "collector.invalid",
              "/shared/board"
            ]
          ],
          "claude_code:session5": [
            [
              "PUT",
              "collector.invalid",
              "/shared/board"
            ]
          ]
        },
        "parents": {
          "session0": "parent",
          "session1": "parent",
          "session2": "parent",
          "session3": "parent",
          "session4": "parent",
          "session5": "parent"
        },
        "history": {},
        "history_since_ms": 1799740800000,
        "now": 1800000000.0,
        "min_families": 5,
        "settle_hours": 24
      },
      "expected_severity": null,
      "actual_severity": null,
      "findings": []
    }
  ]
}