swarm audit board
Four read-only K3 subagents audited the agentflows repo on disjoint scopes — core+schema, providers+adapters, evals+rubrics, tests-vs-src. Every top citation was then spot-verified against source by the conductor. Expand a row for the claim and its verification.
3P0 defects
8P1 defects
4agents · read-only
6/6citations verified
16 minwall-clock
P0 — fix first
P0·1Read-only claude lanes can mutate the repoclaude.ts:64
--disallowedTools Edit,Write,NotebookEdit omits Bash, so a "read-only" claude worker can sed -i or rm at repo root — the pi provider correctly excludes bash from READONLY_TOOLS; the claude path is asymmetric.✓ verified — flag list verbatim at src/providers/claude.ts:64
P0·2SIGKILL escalation is dead code — SIGTERM-ignoring child hangs the run foreverclaude.ts:195 · pi.ts:262 · gemini.ts:107
proc.kill("SIGTERM") sets proc.killed = true immediately (it means the signal was sent, not that the process died), so the setTimeout(() => if (!proc.killed) kill("SIGKILL")) never fires. No close event, no promise resolution, run hangs permanently.✓ verified — kill() + guarded SIGKILL present in all three providers
P0·3Abort is misclassified as successclaude.ts:167 · pi.ts:242 · gemini.ts:88
code ?? 0 coerces a signal-killed child (exit code null) to exit 0, so an aborted run walks the dispatch success path and completeTask fires on partial output. Observed live later the same day: the M3 cross-review 404'd and the run reported exitCode: 0.✓ verified —
code ?? 0 at all three cited lines; reproduced during the M3 outageP1 — error paths and eval integrity
P1·4Runs wedge forever when envelope/prompt building throwsdispatch.ts:250-258
buildEnvelope/assemblePrompt sit outside any try — e.g. --token-mode bogus or --files <directory> throws through dispatchAll, leaving run running and tasks claimed forever.✓ verified — no try/catch around the cited build calls
P1·5Gate pass-mode is fail-open on unparseable outputflow.ts:106-119
needsReview outcomes count as a clean pass — a gate can "pass" with zero parsed findings, inconsistent with approve-mode which correctly fails closed.· reported by swarm; consistent with the pass-gate semantics seen in runs
P1·6needs_review is a graph trapgraph.ts
No transition out of
✓ verified — needs_review is terminal-set at graph.ts:125 with no exit edge
needs_review: completeTask only accepts claimed/in_progress, releaseTask excludes it, and dependents require done — they sit pending forever, invisible to blockedTasks.✓ verified — needs_review is terminal-set at graph.ts:125 with no exit edge
P1·7Failure scorecards blame the wrong model, corrupting routingdispatch.ts:377
On early-break failures the scorecard records
· reported by two subagents independently (core + evals)
chain[chain.length - 1] — the last chain entry, not the last attempted model. A model that never ran absorbs the failure; the leaderboard learns inverted signal.· reported by two subagents independently (core + evals)
P1·8Unreviewed broken work auto-commits to the integration branchdispatch.ts:324-327
commitWorktreeIfDirty runs even when output parsing failed (needsReview), landing unreviewable agent work on the shared branch that the verify stage then reviews as-is.· reported by swarm
P1·9validateFlow misses foreach orderingflow.ts:62-64
foreach is checked only for a .plan suffix, not that the referenced stage is earlier. A forward reference validates clean, then extractPlan returns null at runtime and the stage is silently skipped forever.· reported by swarm
P1·10EPIPE can kill the orchestratorclaude.ts:82-83
No
✓ verified — stdin written with no error handler attached
proc.stdin.on("error") — if the child exits early while a >64KiB prompt is flushing, the uncaught EPIPE crashes the whole process.✓ verified — stdin written with no error handler attached
P1·11Prompt-as-argv can hit E2BIG for pi/geminipi.ts:111 · gemini.ts:62
The prompt is passed as a single argv string against the 128KiB
✓ verified — argv prompt in pi/gemini; stdin in claude
MAX_ARG_STRLEN; the envelope budget (60k diff + N×20k files) makes it reachable. Claude is immune (stdin).✓ verified — argv prompt in pi/gemini; stdin in claude
Full report with P2 clusters (test-coverage gaps, cooldown-key divergence, judge NaN paths, worktree leaks) lives in the private repo at docs/SWARM_AUDIT_2026-07-17.md. Working evidence — what the swarm verified as correct — includes the cooldown store, output-contract parse/repair, gate ordering, ε-greedy routing, and the model-aware caveman skip.