docs/exploit_analysis.md

# Exploit Analysis — 911 Dispatch Supervisor

## Known Attack Vectors Considered & Closed

### 1. Reward Farming via Repeated Dispatch-Cancel Cycles
**Vector:** Agent dispatches a unit, immediately cancels, re-dispatches to collect
partial response_time reward on each cycle without ever resolving incidents.
**Mitigation:** Cancel actions return the unit to AVAILABLE but do NOT reset the
incident survival clock. The incident continues counting down regardless of agent
action, so farming cancel-dispatch cycles accelerates incident escalation and
triggers the Safety Gate, collapsing the score to ≤0.2.

### 2. Safety Gate Bypass via P2-Only Dispatching
**Vector:** Agent ignores all P1 incidents and only resolves P2/P3 incidents to
accumulate triage and response_time rewards without triggering the Safety Gate.
**Mitigation:** The Safety Gate activates if ANY P1 incident existed during the
episode and its survival score is 0.0. The agent cannot avoid P1 incidents
existing — they are spawned deterministically by the scenario fixture.

### 3. Coverage Score Farming via Staging
**Vector:** Agent repeatedly stages all units in one district to maximize coverage
score for that district while ignoring active incidents.
**Mitigation:** Coverage score is computed across ALL districts simultaneously.
Concentrating units in one district reduces coverage elsewhere, and staged units
cannot respond to incidents without an explicit dispatch action, allowing incident
survival clocks to expire and triggering escalation penalties.

### 4. Phraseology Score Inflation via Notes Stuffing
**Vector:** Agent fills the notes field with every possible dispatch phrase to
maximize token overlap with canonical phrases.
**Mitigation:** PhraseologyJudge uses token overlap normalized by notes length.
Stuffing long notes with irrelevant text reduces precision, keeping the score low.
Only notes that match the specific action type and incident type score highly.

### 5. Determinism Exploitation
**Vector:** Agent memorizes the exact incident sequence (seed=42) and hardcodes
optimal actions rather than learning dispatch reasoning.
**Mitigation:** This is intentional for reproducibility. However, the wave spawn
system introduces timing-dependent incident locations with small perturbations,
meaning hardcoded action sequences fail when unit positions vary. The environment
is designed for evaluation, not training-time generalization.

## Conclusion
No reward farming exploit was found that allows an agent to score >0.6 without
genuinely resolving Priority-1 incidents with correct unit types within survival
clock windows.