Clear it in 3 steps
-
Start the environment
-
Investigate the target
-
Submit the flag
events.jsonl interleaves randomly ordered events from many services and traces. Starting from the marked auth.failed event, follow the parent-linked causal DAG and concatenate reachable worker.decrypt fragments by logical clock.
Build a parent-to-children graph rather than trusting line order or trace name alone
Collect only worker.decrypt events reachable from auth.failed with marker=causal-root
Concatenate parts by clock and verify against the reachable digest.commit SHA-256