{ "slug": "crewai", "status": "passed", "checkedAt": "2026-10-02T04:41:36.138831+00:00", "label": "CrewAI Flows local control-flow verification", "scope": "CrewAI 1.15.23: deterministic Python Flows, synthetic typed state, @start/@router/@listen dispatch; no LLM, vendor account or paid API.", "conclusion": "Approved input produced one output; unapproved input and missing evidence selected separate no-output branches; missing input and a listener error propagated to the caller without running dependent output; separate Flow instances retained isolated state. The runtime attempted 10 PyPI version-check DNS lookups, all blocked before resolution by the test audit guard; no external connection was attempted.", "artifact": "/evidence/crewai-control-flow.json", "package": { "name": "crewai", "version": "1.15.23", "source": "https://pypi.org/simple", "relatedCoreVersion": "1.15.23" }, "runtime": "Python 3.13.3", "networkPolicy": { "policy": "Python process audit hook denies non-loopback socket connections, external DNS, child processes and dotenv file reads. Loopback is allowed for Windows asyncio self-wakeup sockets.", "telemetryEnv": { "OTEL_SDK_DISABLED": "true", "CREWAI_DISABLE_TELEMETRY": "true", "CREWAI_DISABLE_TRACKING": "true", "CREWAI_TRACING_ENABLED": "false", "ANONYMIZED_TELEMETRY": "false", "PYTHON_DOTENV_DISABLED": "1", "HF_HUB_OFFLINE": "1", "TOKENIZERS_PARALLELISM": "false" }, "crewaiTelemetryDisabled": true, "crewaiTelemetryReady": false, "audit": { "selfCheckBlocked": 1, "externalConnectionAttempts": 0, "externalDnsAttempts": 10, "subprocessAttempts": 0, "dotenvReadAttempts": 0, "allowedLoopbackConnections": 7 }, "blockedDnsCallers": [ { "event": "socket.getaddrinfo", "phase": "flow_runtime", "callers": [ { "file": "version.py", "function": "check_version", "line": 180 }, { "file": "version.py", "function": "get_latest_version_from_pypi", "line": 125 }, { "file": "request.py", "function": "urlopen", "line": 189 }, { "file": "request.py", "function": "open", "line": 489 }, { "file": "request.py", "function": "_open", "line": 506 }, { "file": "request.py", "function": "_call_chain", "line": 466 }, { "file": "request.py", "function": "https_open", "line": 1367 }, { "file": "request.py", "function": "do_open", "line": 1319 }, { "file": "client.py", "function": "request", "line": 1338 }, { "file": "client.py", "function": "_send_request", "line": 1384 }, { "file": "client.py", "function": "endheaders", "line": 1333 }, { "file": "client.py", "function": "_send_output", "line": 1093 }, { "file": "client.py", "function": "send", "line": 1037 }, { "file": "client.py", "function": "connect", "line": 1472 }, { "file": "client.py", "function": "connect", "line": 1003 }, { "file": "socket.py", "function": "create_connection", "line": 840 }, { "file": "socket.py", "function": "getaddrinfo", "line": 977 } ] }, { "event": "socket.getaddrinfo", "phase": "flow_runtime", "callers": [ { "file": "version.py", "function": "is_current_version_yanked", "line": 165 }, { "file": "version.py", "function": "get_latest_version_from_pypi", "line": 125 }, { "file": "request.py", "function": "urlopen", "line": 189 }, { "file": "request.py", "function": "open", "line": 489 }, { "file": "request.py", "function": "_open", "line": 506 }, { "file": "request.py", "function": "_call_chain", "line": 466 }, { "file": "request.py", "function": "https_open", "line": 1367 }, { "file": "request.py", "function": "do_open", "line": 1319 }, { "file": "client.py", "function": "request", "line": 1338 }, { "file": "client.py", "function": "_send_request", "line": 1384 }, { "file": "client.py", "function": "endheaders", "line": 1333 }, { "file": "client.py", "function": "_send_output", "line": 1093 }, { "file": "client.py", "function": "send", "line": 1037 }, { "file": "client.py", "function": "connect", "line": 1472 }, { "file": "client.py", "function": "connect", "line": 1003 }, { "file": "socket.py", "function": "create_connection", "line": 840 }, { "file": "socket.py", "function": "getaddrinfo", "line": 977 } ] }, { "event": "socket.getaddrinfo", "phase": "flow_runtime", "callers": [ { "file": "version.py", "function": "check_version", "line": 180 }, { "file": "version.py", "function": "get_latest_version_from_pypi", "line": 125 }, { "file": "request.py", "function": "urlopen", "line": 189 }, { "file": "request.py", "function": "open", "line": 489 }, { "file": "request.py", "function": "_open", "line": 506 }, { "file": "request.py", "function": "_call_chain", "line": 466 }, { "file": "request.py", "function": "https_open", "line": 1367 }, { "file": "request.py", "function": "do_open", "line": 1319 }, { "file": "client.py", "function": "request", "line": 1338 }, { "file": "client.py", "function": "_send_request", "line": 1384 }, { "file": "client.py", "function": "endheaders", "line": 1333 }, { "file": "client.py", "function": "_send_output", "line": 1093 }, { "file": "client.py", "function": "send", "line": 1037 }, { "file": "client.py", "function": "connect", "line": 1472 }, { "file": "client.py", "function": "connect", "line": 1003 }, { "file": "socket.py", "function": "create_connection", "line": 840 }, { "file": "socket.py", "function": "getaddrinfo", "line": 977 } ] }, { "event": "socket.getaddrinfo", "phase": "flow_runtime", "callers": [ { "file": "version.py", "function": "is_current_version_yanked", "line": 165 }, { "file": "version.py", "function": "get_latest_version_from_pypi", "line": 125 }, { "file": "request.py", "function": "urlopen", "line": 189 }, { "file": "request.py", "function": "open", "line": 489 }, { "file": "request.py", "function": "_open", "line": 506 }, { "file": "request.py", "function": "_call_chain", "line": 466 }, { "file": "request.py", "function": "https_open", "line": 1367 }, { "file": "request.py", "function": "do_open", "line": 1319 }, { "file": "client.py", "function": "request", "line": 1338 }, { "file": "client.py", "function": "_send_request", "line": 1384 }, { "file": "client.py", "function": "endheaders", "line": 1333 }, { "file": "client.py", "function": "_send_output", "line": 1093 }, { "file": "client.py", "function": "send", "line": 1037 }, { "file": "client.py", "function": "connect", "line": 1472 }, { "file": "client.py", "function": "connect", "line": 1003 }, { "file": "socket.py", "function": "create_connection", "line": 840 }, { "file": "socket.py", "function": "getaddrinfo", "line": 977 } ] }, { "event": "socket.getaddrinfo", "phase": "flow_runtime", "callers": [ { "file": "version.py", "function": "check_version", "line": 180 }, { "file": "version.py", "function": "get_latest_version_from_pypi", "line": 125 }, { "file": "request.py", "function": "urlopen", "line": 189 }, { "file": "request.py", "function": "open", "line": 489 }, { "file": "request.py", "function": "_open", "line": 506 }, { "file": "request.py", "function": "_call_chain", "line": 466 }, { "file": "request.py", "function": "https_open", "line": 1367 }, { "file": "request.py", "function": "do_open", "line": 1319 }, { "file": "client.py", "function": "request", "line": 1338 }, { "file": "client.py", "function": "_send_request", "line": 1384 }, { "file": "client.py", "function": "endheaders", "line": 1333 }, { "file": "client.py", "function": "_send_output", "line": 1093 }, { "file": "client.py", "function": "send", "line": 1037 }, { "file": "client.py", "function": "connect", "line": 1472 }, { "file": "client.py", "function": "connect", "line": 1003 }, { "file": "socket.py", "function": "create_connection", "line": 840 }, { "file": "socket.py", "function": "getaddrinfo", "line": 977 } ] }, { "event": "socket.getaddrinfo", "phase": "flow_runtime", "callers": [ { "file": "version.py", "function": "is_current_version_yanked", "line": 165 }, { "file": "version.py", "function": "get_latest_version_from_pypi", "line": 125 }, { "file": "request.py", "function": "urlopen", "line": 189 }, { "file": "request.py", "function": "open", "line": 489 }, { "file": "request.py", "function": "_open", "line": 506 }, { "file": "request.py", "function": "_call_chain", "line": 466 }, { "file": "request.py", "function": "https_open", "line": 1367 }, { "file": "request.py", "function": "do_open", "line": 1319 }, { "file": "client.py", "function": "request", "line": 1338 }, { "file": "client.py", "function": "_send_request", "line": 1384 }, { "file": "client.py", "function": "endheaders", "line": 1333 }, { "file": "client.py", "function": "_send_output", "line": 1093 }, { "file": "client.py", "function": "send", "line": 1037 }, { "file": "client.py", "function": "connect", "line": 1472 }, { "file": "client.py", "function": "connect", "line": 1003 }, { "file": "socket.py", "function": "create_connection", "line": 840 }, { "file": "socket.py", "function": "getaddrinfo", "line": 977 } ] }, { "event": "socket.getaddrinfo", "phase": "flow_runtime", "callers": [ { "file": "version.py", "function": "check_version", "line": 180 }, { "file": "version.py", "function": "get_latest_version_from_pypi", "line": 125 }, { "file": "request.py", "function": "urlopen", "line": 189 }, { "file": "request.py", "function": "open", "line": 489 }, { "file": "request.py", "function": "_open", "line": 506 }, { "file": "request.py", "function": "_call_chain", "line": 466 }, { "file": "request.py", "function": "https_open", "line": 1367 }, { "file": "request.py", "function": "do_open", "line": 1319 }, { "file": "client.py", "function": "request", "line": 1338 }, { "file": "client.py", "function": "_send_request", "line": 1384 }, { "file": "client.py", "function": "endheaders", "line": 1333 }, { "file": "client.py", "function": "_send_output", "line": 1093 }, { "file": "client.py", "function": "send", "line": 1037 }, { "file": "client.py", "function": "connect", "line": 1472 }, { "file": "client.py", "function": "connect", "line": 1003 }, { "file": "socket.py", "function": "create_connection", "line": 840 }, { "file": "socket.py", "function": "getaddrinfo", "line": 977 } ] }, { "event": "socket.getaddrinfo", "phase": "flow_runtime", "callers": [ { "file": "version.py", "function": "is_current_version_yanked", "line": 165 }, { "file": "version.py", "function": "get_latest_version_from_pypi", "line": 125 }, { "file": "request.py", "function": "urlopen", "line": 189 }, { "file": "request.py", "function": "open", "line": 489 }, { "file": "request.py", "function": "_open", "line": 506 }, { "file": "request.py", "function": "_call_chain", "line": 466 }, { "file": "request.py", "function": "https_open", "line": 1367 }, { "file": "request.py", "function": "do_open", "line": 1319 }, { "file": "client.py", "function": "request", "line": 1338 }, { "file": "client.py", "function": "_send_request", "line": 1384 }, { "file": "client.py", "function": "endheaders", "line": 1333 }, { "file": "client.py", "function": "_send_output", "line": 1093 }, { "file": "client.py", "function": "send", "line": 1037 }, { "file": "client.py", "function": "connect", "line": 1472 }, { "file": "client.py", "function": "connect", "line": 1003 }, { "file": "socket.py", "function": "create_connection", "line": 840 }, { "file": "socket.py", "function": "getaddrinfo", "line": 977 } ] }, { "event": "socket.getaddrinfo", "phase": "flow_runtime", "callers": [ { "file": "version.py", "function": "check_version", "line": 180 }, { "file": "version.py", "function": "get_latest_version_from_pypi", "line": 125 }, { "file": "request.py", "function": "urlopen", "line": 189 }, { "file": "request.py", "function": "open", "line": 489 }, { "file": "request.py", "function": "_open", "line": 506 }, { "file": "request.py", "function": "_call_chain", "line": 466 }, { "file": "request.py", "function": "https_open", "line": 1367 }, { "file": "request.py", "function": "do_open", "line": 1319 }, { "file": "client.py", "function": "request", "line": 1338 }, { "file": "client.py", "function": "_send_request", "line": 1384 }, { "file": "client.py", "function": "endheaders", "line": 1333 }, { "file": "client.py", "function": "_send_output", "line": 1093 }, { "file": "client.py", "function": "send", "line": 1037 }, { "file": "client.py", "function": "connect", "line": 1472 }, { "file": "client.py", "function": "connect", "line": 1003 }, { "file": "socket.py", "function": "create_connection", "line": 840 }, { "file": "socket.py", "function": "getaddrinfo", "line": 977 } ] }, { "event": "socket.getaddrinfo", "phase": "flow_runtime", "callers": [ { "file": "version.py", "function": "is_current_version_yanked", "line": 165 }, { "file": "version.py", "function": "get_latest_version_from_pypi", "line": 125 }, { "file": "request.py", "function": "urlopen", "line": 189 }, { "file": "request.py", "function": "open", "line": 489 }, { "file": "request.py", "function": "_open", "line": 506 }, { "file": "request.py", "function": "_call_chain", "line": 466 }, { "file": "request.py", "function": "https_open", "line": 1367 }, { "file": "request.py", "function": "do_open", "line": 1319 }, { "file": "client.py", "function": "request", "line": 1338 }, { "file": "client.py", "function": "_send_request", "line": 1384 }, { "file": "client.py", "function": "endheaders", "line": 1333 }, { "file": "client.py", "function": "_send_output", "line": 1093 }, { "file": "client.py", "function": "send", "line": 1037 }, { "file": "client.py", "function": "connect", "line": 1472 }, { "file": "client.py", "function": "connect", "line": 1003 }, { "file": "socket.py", "function": "create_connection", "line": 840 }, { "file": "socket.py", "function": "getaddrinfo", "line": 977 } ] } ], "dnsScopeNote": "All 10 blocked non-loopback DNS attempts originated from the installed package version-freshness checker (get_latest_version_from_pypi). Each was denied before resolution; no external connection was permitted. Host names and address values are excluded from evidence." }, "checks": [ { "case": "Approved normal flow", "input": { "item": "SYNTHETIC-APPROVED", "approved": true, "evidence_present": true }, "passConditions": [ "Only the selected route listener executes.", "Trace equals ['prepare', 'decide', 'output'].", "Output count equals 1." ], "observed": { "state": { "item": "SYNTHETIC-APPROVED", "approved": true, "evidence_present": true, "trace": [ "prepare", "decide", "output" ], "outputs": [ "Synthetic draft: SYNTHETIC-APPROVED" ], "route": "accepted" }, "result": "Synthetic draft: SYNTHETIC-APPROVED" }, "status": "passed" }, { "case": "Unapproved input routes to rejection", "input": { "item": "SYNTHETIC-REJECTED", "approved": false, "evidence_present": true }, "passConditions": [ "Only the selected route listener executes.", "Trace equals ['prepare', 'decide', 'reject'].", "Output count equals 0." ], "observed": { "state": { "item": "SYNTHETIC-REJECTED", "approved": false, "evidence_present": true, "trace": [ "prepare", "decide", "reject" ], "outputs": [], "route": "rejected" }, "result": "Rejected without output." }, "status": "passed" }, { "case": "Missing evidence routes to review", "input": { "item": "SYNTHETIC-REVIEW", "approved": true, "evidence_present": false }, "passConditions": [ "Only the selected route listener executes.", "Trace equals ['prepare', 'decide', 'review'].", "Output count equals 0." ], "observed": { "state": { "item": "SYNTHETIC-REVIEW", "approved": true, "evidence_present": false, "trace": [ "prepare", "decide", "review" ], "outputs": [], "route": "needs_review" }, "result": "Evidence missing; human review required." }, "status": "passed" }, { "case": "Empty required input stops before router", "input": { "item": " ", "approved": true }, "passConditions": [ "ValueError reaches the caller.", "Dependent output listener does not execute.", "No output is created." ], "observed": { "errorType": "ValueError", "errorMessage": "Synthetic input is required.", "state": { "item": " ", "approved": true, "evidence_present": true, "trace": [ "prepare" ], "outputs": [], "route": "" } }, "status": "passed" }, { "case": "Listener failure stops dependent output", "input": {}, "passConditions": [ "RuntimeError reaches the caller.", "Dependent output listener does not execute.", "No output is created." ], "observed": { "errorType": "RuntimeError", "errorMessage": "Synthetic transformation failure.", "state": { "trace": [ "prepare", "transform" ], "outputs": [] } }, "status": "passed" }, { "case": "Independent Flow instances retain isolated state", "input": { "instances": 3 }, "passConditions": [ "New instances have distinct generated state IDs.", "Approved output is absent from rejected and review instances.", "Running another instance does not mutate the earlier accepted output." ], "observed": { "distinctStateIds": true, "outputCounts": [ 1, 0, 0 ] }, "status": "passed" } ], "limits": [ "No language-model agent, Crew task, vendor account or paid API was operated.", "This verifies the supplied Flow dispatch and state/error boundaries, not model output quality or business results.", "The network policy is a Python process audit hook, not an OS firewall or native-extension security audit.", "No persisted recovery, external-action idempotency, production scalability, latency or security audit was assessed." ], "reproduce": [ "uv --no-config venv --python 3.13 outputs/product-tests/crewai/.venv", "uv --no-config pip install --python outputs/product-tests/crewai/.venv/Scripts/python.exe --index-url https://pypi.org/simple -r outputs/product-tests/crewai/requirements-lock.txt", "outputs/product-tests/crewai/.venv/Scripts/python.exe outputs/product-tests/crewai/check-crewai.py" ], "apiEvidence": [ "https://docs.crewai.com/en/concepts/flows", "Installed crewai.flow.flow re-export surface", "Installed crewai.flow.runtime kickoff(inputs=...) and tracing field", "Installed crewai_core.telemetry._is_telemetry_disabled()" ] }