Attack lab

Every verifier here answers no to a forgery. These are the live counterparts of the offline kits.

4 attacks 1 controls live: nothing pre-recorded

Pick a preset. Red ones are attacks, green ones are honest requests that must still work.
Tamper. Choose any field and drop it, null it, change its type, upper-case it, flip one character, or add a field the product never asked for.
Send and read the real reply, or run every preset and watch the scoreboard fill.

What each preset tests

	Preset	Route	Why it matters
attack	Ledger: latest record with its verdict edited to NOT_VERIFIED	`GET /keystone/runs/latest → POST /keystone/verify`	Changing any signed field breaks the record hash and signature.
attack	Receipt with decision flipped to ALLOW on a DENY	`POST /codeguard-keystone/check → POST /codeguard-keystone/verify-receipt`	The signature covers the decision.
attack	Edit an event after sealing	`POST /recorder-keystone/recordings → POST /recorder-keystone/recordings/${0.id}/events → POST /recorder-keystone/recordings/${0.id}/seal → GET /recorder-keystone/recordings/${0.id} → POST /recorder-keystone/verify`	Changing one event changes its hash and the root.
attack	Digest changed	`GET /verify-yourself-receipt.json → POST /api/v1/quorum/verify`	The quorum signed this digest, not yours.
control	KEYSTONE ledger chain re-verifies	`GET /keystone/ledger/verify`	The whole hash chain, live.

Tamper with any field and send it again: a verifier must answer no, never crash or say yes. Public demo routes are rate limited per address; a 429 shows as rate limited. Our own lab; no independent test.

FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.