Clear it in 3 steps
Start the environment
Investigate the target
Submit the flag

events.jsonl interleaves randomly ordered events from many services and traces. Starting from the marked auth.failed event, follow the parent-linked causal DAG and concatenate reachable worker.decrypt fragments by logical clock.
Build a parent-to-children graph rather than trusting line order or trace name alone
Collect only worker.decrypt events reachable from auth.failed with marker=causal-root
Concatenate parts by clock and verify against the reachable digest.commit SHA-256