{"attack_count":14,"attacks_caught":14,"attacks_missed":0,"benchmark_version":"0.2.0","coverage_ratio":1.0,"duration_ms":30,"generated_at":"2026-08-03","results":[{"actual_verifier_ok":false,"category":"chain-integrity","description":"An attacker who has direct database access edits the row_hash of a chain row after the fact. The intent is to alter the content commitment for that event without leaving a trace. The offline verifier should catch the resulting break in the prev_hash linkage on the next row.","duration_ms":0,"expected_verifier_ok":false,"id":"silent-row-edit","mutation_error":null,"passed":true,"title":"Silent row edit","verifier_category":"prev_hash_break","verifier_detail":"row seq 6 prev_hash does not match previous row_hash","verifier_error":null},{"actual_verifier_ok":false,"category":"chain-integrity","description":"An attacker with direct database access deletes a chain row after the fact. Row count and chain linkage no longer agree with the closed epoch that used to bound the deleted row. The offline verifier detects this either through the prev_hash break at the next row or through the epoch boundary reference to a missing seq.","duration_ms":0,"expected_verifier_ok":false,"id":"silent-row-deletion","mutation_error":null,"passed":true,"title":"Silent row deletion","verifier_category":"prev_hash_break","verifier_detail":"row seq 5 prev_hash does not match previous row_hash","verifier_error":null},{"actual_verifier_ok":false,"category":"chain-integrity","description":"An attacker inserts a fabricated row into the log. The attacker may set the row hash and prev_hash to plausible looking sha256 shapes but has no way to reproduce the hash of a legitimate predecessor row that already exists at the target seq. The offline verifier detects the resulting prev_hash break as it walks forward.","duration_ms":0,"expected_verifier_ok":false,"id":"row-insertion","mutation_error":null,"passed":true,"title":"Row insertion (forgery)","verifier_category":"prev_hash_break","verifier_detail":"row seq 100 prev_hash does not match previous row_hash","verifier_error":null},{"actual_verifier_ok":false,"category":"chain-integrity","description":"An attacker modifies the prev_hash field of a middle row. The chain linkage now claims the row followed a different predecessor. The offline verifier catches the mismatch when the walk reaches that row.","duration_ms":0,"expected_verifier_ok":false,"id":"prev-hash-tamper","mutation_error":null,"passed":true,"title":"Prev hash tamper","verifier_category":"prev_hash_break","verifier_detail":"row seq 7 prev_hash does not match previous row_hash","verifier_error":null},{"actual_verifier_ok":false,"category":"epoch","description":"An attacker rewrites the merkle_root of a closed epoch. Even the shape check fails because the field no longer carries a valid sha256 identifier. A cryptographic envelope re verification would also fail because the envelope was signed over the original root.","duration_ms":0,"expected_verifier_ok":false,"id":"merkle-root-tamper","mutation_error":null,"passed":true,"title":"Merkle root tamper","verifier_category":"merkle_root_shape","verifier_detail":"epoch 1 has missing or bad merkle_root","verifier_error":null},{"actual_verifier_ok":false,"category":"epoch","description":"An attacker removes the signature envelope from a closed epoch. The signed head no longer commits to the epoch content. The offline verifier catches the missing envelope field.","duration_ms":0,"expected_verifier_ok":false,"id":"signature-strip","mutation_error":null,"passed":true,"title":"Signature envelope strip","verifier_category":"signature_envelope_missing","verifier_detail":"epoch 1 has no signature envelope","verifier_error":null},{"actual_verifier_ok":false,"category":"epoch","description":"An attacker with a broken classical primitive replaces the hybrid signature envelope with an envelope that carries only the Ed25519 signature. A verifier that requires both classical AND post quantum components rejects the envelope. This is the specific reason Etch ships hybrid signing rather than classical only.","duration_ms":0,"expected_verifier_ok":false,"id":"signature-forgery-ed25519-only","mutation_error":null,"passed":true,"title":"Signature forgery (Ed25519 only, no PQ)","verifier_category":"envelope_missing_slh_dsa","verifier_detail":"epoch 1 envelope missing slh_dsa (post quantum signature required)","verifier_error":null},{"actual_verifier_ok":false,"category":"epoch","description":"An attacker adjusts an epoch's first_entry_seq or last_entry_seq so a range of rows falls outside the signed epoch. The rows are still on the log but appear to have never been sealed. The structural verifier catches the boundary reference to a non existent seq.","duration_ms":0,"expected_verifier_ok":false,"id":"epoch-boundary-shift","mutation_error":null,"passed":true,"title":"Epoch boundary shift","verifier_category":"epoch_entry_count_mismatch","verifier_detail":"epoch 1 claims entry_count 8 but boundary implies 99","verifier_error":null},{"actual_verifier_ok":false,"category":"epoch","description":"An attacker preserves the epoch boundary fields but changes the declared entry_count to a smaller number. The structural verifier catches the mismatch.","duration_ms":0,"expected_verifier_ok":false,"id":"epoch-entry-count-tamper","mutation_error":null,"passed":true,"title":"Epoch entry_count tamper","verifier_category":"epoch_entry_count_mismatch","verifier_detail":"epoch 1 claims entry_count 2 but boundary implies 8","verifier_error":null},{"actual_verifier_ok":false,"category":"etch-chain-integrity","description":"An attacker with direct database access rewrites the row_hash of an Etch parallel chain row. The Etch chain carries the same prev_hash walk invariant as the OSS chain, so the offline verifier catches the mismatch on the next row.","duration_ms":0,"expected_verifier_ok":false,"id":"etch-chain-row-tamper","mutation_error":null,"passed":true,"title":"Etch chain row tamper","verifier_category":"etch_prev_hash_break","verifier_detail":"etch row seq 4 prev_hash does not match previous row_hash","verifier_error":null},{"actual_verifier_ok":false,"category":"etch-chain-integrity","description":"An attacker deletes an Etch chain row after the fact. The prev_hash of the next row no longer matches the surviving predecessor's row_hash. The offline verifier catches the break on the walk.","duration_ms":0,"expected_verifier_ok":false,"id":"etch-row-deletion","mutation_error":null,"passed":true,"title":"Etch chain row deletion","verifier_category":"etch_prev_hash_break","verifier_detail":"etch row seq 5 prev_hash does not match previous row_hash","verifier_error":null},{"actual_verifier_ok":false,"category":"governance","description":"An attacker rewrites the kind field of a benign chain row to postmortem, fabricating a retroactive corrective action that was never attested. The row_hash was computed over the original kind so a downstream cryptographic re verify would catch the mutation, and the field level check catches the mismatch directly.","duration_ms":0,"expected_verifier_ok":false,"id":"kind-swap-to-postmortem","mutation_error":null,"passed":true,"title":"Kind swap: benign row flipped to postmortem","verifier_category":"kind_swapped","verifier_detail":"etch chain seq 2 kind is 'postmortem', expected 'hsm_attestation'","verifier_error":null},{"actual_verifier_ok":false,"category":"cross-chain-federation","description":"An attacker inserts a row into the cross chain reference projection index that claims an etch_chain_seq for which no chain row exists. The projection would report a phantom cross chain reference to any reader that trusts the projection without cross checking against the chain. The verifier detects the missing chain row and rejects the projection state.","duration_ms":0,"expected_verifier_ok":false,"id":"cross-chain-index-phantom","mutation_error":null,"passed":true,"title":"Cross chain projection phantom row","verifier_category":"index_missing_chain_row","verifier_detail":"index row references etch_chain_seq 999 which does not exist on the chain","verifier_error":null},{"actual_verifier_ok":false,"category":"cross-chain-federation","description":"An attacker mutates a cross chain reference row's target_chain_id to a value that does not match the sha256 shape emitted by compute_chain_id. The verifier rejects the row because no derived chain identifier could produce that string.","duration_ms":0,"expected_verifier_ok":false,"id":"cross-chain-id-shape-forgery","mutation_error":null,"passed":true,"title":"Cross chain target_chain_id shape forgery","verifier_category":"chain_id_shape","verifier_detail":"index row 3 target_chain_id has invalid shape (must be sha256:64hex)","verifier_error":null}]}