{
  "kind": "network_egress",
  "product_version": "0.12.897",
  "wheel_sha256": "a9c3bf17b036c5f661df05ba4a02cf3afa834b44c2492f3e60fb3b66061a0a24",
  "method": "Published detector functions evaluated on authored inert events or disposable configuration files.",
  "scope": "No live agent, runtime adapter, daemon ingestion, product UI, external command or network action was exercised.",
  "cases": [
    {
      "case": "new-host",
      "inputs": {
        "events_newest_first": [
          {
            "event_type": "tool_call",
            "ts": "2026-09-27T12:00:00Z",
            "data": {
              "tool": "Bash",
              "args": {
                "command": "curl https://collector.invalid/status"
              }
            }
          }
        ],
        "thresholds": {
          "identical_k": 3,
          "max_cycle": 4,
          "cycle_repeats": 3,
          "no_progress_tools": 30,
          "repeat_fail_m": 3,
          "action_discrepancy_min": 1,
          "blast_files": 25,
          "egress_hosts": 8,
          "rate_limit_min": 2,
          "crash_restarts": 2,
          "crash_window_sec": 900,
          "blocked_wait_sec": 120,
          "runtime": "claude_code",
          "write_tools": [
            "write",
            "edit",
            "apply_patch",
            "applypatch",
            "str_replace",
            "create_file",
            "multiedit",
            "notebookedit",
            "patch_file",
            "write_file",
            "save_file"
          ],
          "no_progress_enabled": true,
          "sources": {
            "identical_k": "static",
            "max_cycle": "static",
            "cycle_repeats": "static",
            "no_progress_tools": "baseline",
            "repeat_fail_m": "static",
            "action_discrepancy_min": "static",
            "blast_files": "static",
            "egress_hosts": "static",
            "rate_limit_min": "static",
            "crash_restarts": "static",
            "crash_window_sec": "static",
            "blocked_wait_sec": "static"
          },
          "baseline": {
            "tool_calls": {
              "n": 50,
              "mean": 20.0,
              "stddev": 5.0
            }
          },
          "known_hosts": [
            "pypi.org"
          ],
          "settling_hosts": [],
          "read_only_hosts": [],
          "egress_settle_hours": 24.0
        }
      },
      "expected_severity": "warning",
      "actual_severity": "warning",
      "findings": [
        {
          "kind": "network_egress",
          "session_id": "claude_code:example",
          "runtime": "claude_code",
          "severity": "warning",
          "title": "claude_code: first contact with collector.invalid",
          "detail": "This agent has not reached collector.invalid in the 1 host(s) its cohort has used for longer than 24h. You can Stop or Pause this agent from the ClawMetry dashboard or device.",
          "evidence": {
            "ground": "first_time",
            "distinct_hosts": 1,
            "hosts": [
              "collector.invalid"
            ],
            "new_hosts": [
              "collector.invalid"
            ],
            "settling_hosts": [],
            "raw_addresses": [],
            "known_host_count": 1,
            "threshold": 8,
            "write_hosts": [],
            "read_only_writes": [],
            "observed": "tool_arguments"
          },
          "first_bad_step": 0,
          "spend_at_risk_usd": 0.0,
          "spend_basis": "unknown",
          "burn_rate_usd_per_min": 0.0,
          "session_cost_usd": 0.0,
          "frameworks": {
            "mapping_version": "2026-09-27.1",
            "owasp_llm": [],
            "owasp_asi": [
              "ASI02"
            ],
            "atlas": [
              "AML.T0086"
            ],
            "mapped": true,
            "mode": "detect",
            "pre_action_control": false
          }
        }
      ]
    },
    {
      "case": "known-host",
      "inputs": {
        "events_newest_first": [
          {
            "event_type": "tool_call",
            "ts": "2026-09-27T12:00:00Z",
            "data": {
              "tool": "Bash",
              "args": {
                "command": "curl https://pypi.org/simple"
              }
            }
          }
        ],
        "thresholds": {
          "identical_k": 3,
          "max_cycle": 4,
          "cycle_repeats": 3,
          "no_progress_tools": 30,
          "repeat_fail_m": 3,
          "action_discrepancy_min": 1,
          "blast_files": 25,
          "egress_hosts": 8,
          "rate_limit_min": 2,
          "crash_restarts": 2,
          "crash_window_sec": 900,
          "blocked_wait_sec": 120,
          "runtime": "claude_code",
          "write_tools": [
            "write",
            "edit",
            "apply_patch",
            "applypatch",
            "str_replace",
            "create_file",
            "multiedit",
            "notebookedit",
            "patch_file",
            "write_file",
            "save_file"
          ],
          "no_progress_enabled": true,
          "sources": {
            "identical_k": "static",
            "max_cycle": "static",
            "cycle_repeats": "static",
            "no_progress_tools": "baseline",
            "repeat_fail_m": "static",
            "action_discrepancy_min": "static",
            "blast_files": "static",
            "egress_hosts": "static",
            "rate_limit_min": "static",
            "crash_restarts": "static",
            "crash_window_sec": "static",
            "blocked_wait_sec": "static"
          },
          "baseline": {
            "tool_calls": {
              "n": 50,
              "mean": 20.0,
              "stddev": 5.0
            }
          },
          "known_hosts": [
            "pypi.org"
          ],
          "settling_hosts": [],
          "read_only_hosts": [],
          "egress_settle_hours": 24.0
        }
      },
      "expected_severity": null,
      "actual_severity": null,
      "findings": []
    }
  ]
}