# Adversarial Bug Report — plug-stale-task-hole

## Attack Vectors
1. **Clock reset bypass**: Can an attacker manipulate the activity clock to bypass stale detection?
2. **False positives**: Can legitimate activity be misclassified as stale?
3. **Race condition**: What happens if --touch and --can-edit race on the task's timestamp?

## Findings
- The activity clock uses filesystem mtime, which IS manipulable by `touch` — but this is by design (the `--touch` command is the official way to reset)
- The 30-minute threshold gives reasonable headroom for long-running work
- Race conditions are minimal since status.py uses atomic file operations

## Verdict
No exploitable vulnerabilities found.