CAIN-42 CAIN StudioAttack lab
Each run records a real session, seals it under a Merkle root, then tries to rewrite history.
4 attacks 1 controls live: nothing pre-recorded
- Pick a preset. Red ones are attacks, green ones are honest requests that must still work.
- Tamper. Choose any field and drop it, null it, change its type, upper-case it, flip one character, or add a field the product never asked for.
- Send and read the real reply, or run every preset and watch the scoreboard fill.
What each preset tests
| Preset | Route | Why it matters | |
|---|---|---|---|
| control | Record, seal, verify | POST /recorder-keystone/recordings → POST /recorder-keystone/recordings/${0.id}/events → POST /recorder-keystone/recordings/${0.id}/seal → GET /recorder-keystone/recordings/${0.id}/verify | A sealed recording verifies. |
| attack | Edit an event after sealing | POST /recorder-keystone/recordings → POST /recorder-keystone/recordings/${0.id}/events → POST /recorder-keystone/recordings/${0.id}/seal → GET /recorder-keystone/recordings/${0.id} → POST /recorder-keystone/verify | Changing one event changes its hash and the root. |
| attack | Drop an event after sealing | POST /recorder-keystone/recordings → POST /recorder-keystone/recordings/${0.id}/events → POST /recorder-keystone/recordings/${0.id}/events → POST /recorder-keystone/recordings/${0.id}/seal → GET /recorder-keystone/recordings/${0.id} → POST /recorder-keystone/verify | Truncation is detected. |
| attack | Add an event after sealing | POST /recorder-keystone/recordings → POST /recorder-keystone/recordings/${0.id}/events → POST /recorder-keystone/recordings/${0.id}/seal → POST /recorder-keystone/recordings/${0.id}/events | A sealed recording accepts nothing more. |
| attack | Inclusion proof against a made-up root | POST /recorder-keystone/verify-inclusion | A proof must lead to the root it claims. |
Tamper with any field and send it again: a verifier must answer no, never crash or say yes. Public demo routes are rate limited per address; a 429 shows as rate limited. Our own lab; no independent test.
FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.