INTERACTIVE / BOUNDED / SYNTHETIC

Explore a policy expectation. Then test real evidence-integrity checks.

Two distinct activities: the CVE control is a browser-only educational model of an existing Pack; the evidence challenge calls the unchanged PayGod browser verifier v0.4 against a prepared synthetic bundle.

← Back to the site

01 / CVE policy explorer

Change a prepared single-vulnerability observation. This is an illustrative expected outcome, NOT a Kernel execution, authenticated scanner result, or permission to deploy.

CVSS score (×10 integer): 9.5 Installed remediation state Scanner finished successfully; all required fields present (illustrative admission)

Expected Pack outcome, not executed

DENY An unpatched critical finding with CVSS ≥ 9.0 meets the first Pack rule.

The upstream Trivy status fixed means a fix is available, not necessarily installed. This demo's Patched choice explicitly assumes separately confirmed installed-version evidence.

Inspect actual Pack YAML ↗ Read source fixtures ↗

02 / Byte-change challenge

Run the unchanged browser verifier on a synthetic transfer. Compare the intact sample against the same bundle after altering its measurement file. No new receipt, manifest, hash, or verdict is invented by this page.

Verifier result

NOT RUN Ready. Select a challenge to run the verifier.

Integrity verification does not prove the source measurement was true, policy was correct, signature authority, replay, trusted time, or downstream permission. Issuer trust keys are deliberately not loaded in this small challenge.

Open original producer demo ↗ Open standalone recipient verifier ↗ Canonical claim limits ↗

SOURCE / BOUNDARY

The CVE slider never calls Kernel. The integrity challenge imports the exact existing v0.4 verifier module as an unchanged static asset and uses an existing generated synthetic bundle; it is not a new independent institution or financial release gate.