Attest → the attack battery
Twenty-three attempts.
Every one named — even the one that wins.
"Tamper-evident" is a claim; this page is the test. Each row
below is a real attempt executed against the same store the
shipped sample pack exported from — inside a
transaction that is never committed, so the store is byte-identical after.
Verdicts rendered verbatim from the run; nothing on this page is
hand-written prose about what would happen. The one row no
in-process check can catch — a forged row plus its covering
journal entry — is listed too, marked EXPECTED MISS: an honest battery
names its own edge, and the fix (attest anchor --publish)
is on this site.
A SKIPPED row means the store lacked that attack's
precondition (e.g. nothing to forge) — it is reported, never counted.
EXPECTED MISS is a documented detection boundary, not a defense failure.
Reproduce: attest demo then attest attack-demo
in the checkout; the battery exits non-zero on any MISSED or ERROR.
| attack | how it was caught | |
|---|---|---|
| CAUGHT | forge a visit row (state -> attended_verified) | visits:vis_8243499a3a78 content changed after seq 50 |
| CAUGHT | delete an evidence row | evidence:ev_4a0a24e3a5a2 journaled 'put' but row vanished |
| CAUGHT | erase a journal entry mid-chain (hide a past write) | journal gap at seq 4 |
| CAUGHT | truncate the journal tail (erase the log's end) | journal tail removed: pinned head 7a87b8bd0a0a... absent |
| CAUGHT | re-sign a receipt with a different key (key swap) | journal: flagged; chain verify: receipt #447: signed by a different key than this issuer |
| CAUGHT | forge a key_rotation pivot to an attacker key | pivot hop: rejected; chain verify: receipt #448: signed by a different key than this issuer |
| CAUGHT | forge a key_revocation against the live issuer | non-tip revocation ignored |
| CAUGHT | graft a sequence-0 key_revocation ahead of the chain | grafted root ignored — authority stayed on the verified lineage |
| CAUGHT | replay a delivered webhook request_id | replayed request_id ava1.ring.account.SA... accepted=False |
| CAUGHT | insert a row out-of-band (bypass the journal) | untracked rows: 0 -> 1 |
| CAUGHT | corrupt a stored row's body (crash the read surfaces) | read refused with StoreCorrupt; journal flagged=True |
| CAUGHT | corrupt a settings row (non-dict body) | settings read refused: settings row 'attack_demo' is not a dict — the store is corrupt |
| CAUGHT | inject duplicate + traversal member names into a pack zip | name check: duplicate member name: manifest.json; loader: C:\Users\JOSEPH~1\AppData\Local\Temp\attest-attack-ewffk7lk.zip: duplicate member name: manifest.json |
| CAUGHT | ship a forged always-green verifier inside a genuine pack | verify.html: bytes differ from the issuer-signed pin — a verifier script modified after export cannot be trusted |
| CAUGHT | drop the last review statement off a packed bundle | export_pin.json: signed review count 1 != packed 0 — the chain was trimmed |
| EXPECTED MISS | forge a row AND its covering journal entry (detection boundary) | verify_journal stayed green over a forged row + self-consistent covering entry — the journal is unkeyed; this is the documented boundary only external anchoring closes |
| CAUGHT | graft a genuinely-signed receipt the deployment never logged | log_checkpoint.json: receipt rcpt_e43b3e2d8c594a63b3a11fa9e2ec19bb has no inclusion proof — never committed to the deployment log |
| CAUGHT | re-send a delivered request_id with different bytes | refused: request id reused with different content |
| CAUGHT | retimestamp a lifecycle row's index column (re-explain a gap) | coverage_events:cov_45b9b866a63a index column at diverges from signed body |
| CAUGHT | retimestamp a live-view session (move human attention) | liveview_sessions:lv_14e9fad67f14 index column opened_at diverges from signed body |
| CAUGHT | forge a resolution's reason code post-signature | journal: flagged; bundle verify: refused |
| CAUGHT | graft a forged predecessor key onto the issuer | graft refused — successor never countersigned |
| CAUGHT | swap media bytes on disk after signing | first_observation.48155a6412fb.png: serve-time digest check refused the swapped bytes |