CAIN-42 CAIN StudioAttack lab
The same live checks as the verify-yourself page, one at a time, with every request editable.
3 attacks 2 controls live: nothing pre-recorded
- Pick a preset. Red ones are attacks, green ones are honest requests that must still work.
- Tamper. Choose any field and drop it, null it, change its type, upper-case it, flip one character, or add a field the product never asked for.
- Send and read the real reply, or run every preset and watch the scoreboard fill.
What each preset tests
| Preset | Route | Why it matters | |
|---|---|---|---|
| control | Published receipt verifies | GET /verify-yourself-receipt.json → POST /api/v1/quorum/verify | Signed by a quorum of the pinned cluster. |
| attack | Digest changed | GET /verify-yourself-receipt.json → POST /api/v1/quorum/verify | The quorum signed this digest, not yours. |
| control | AETHER-33 invariants run now | GET /aether33/api/invariants | 33 invariants against a real SQLite file, live. |
| attack | CODEGUARD: curl piped to sh | POST /codeguard-keystone/check | Denied live. |
| attack | FlowGate: cyclic plan | POST /suite/flowgate/v1/validate | Recomputable by hand. |
Tamper with any field and send it again: a verifier must answer no, never crash or say yes. Public demo routes are rate limited per address; a 429 shows as rate limited. Our own lab; no independent test.
FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.