Break the verifier — the AEP sandbox CTF

Below is a real, validly-signed Action Evidence Package and the reference verifier that appraises it — the same ordered checks as python3 verify.py, running in your browser. Edit the package, hit Verify, and try to make it say ALLOW for something the mandate never authorised.

The win condition: a verdict of ALLOW for an action outside the reference mandate — a refund over the €1000 cap, a method off the allow-list, or a different issuer, agent or principal than the trust anchor. The private keys are not on this page. That is the whole point.

What is actually running

This page runs a faithful JavaScript port of the reference verifier (github.com/tyche-institute/aep-sandbox): the same canonical JSON, real SHA-256 and real Ed25519 signature verification via the Web Crypto API, and the same ordered guarantees — structure → chain_integrity → aep_signature → measurements → mandate → replay, where the mandate chain is issuer_not_listed → credential_sig_invalid → principal_sig_invalid → agent_binding_mismatch → scope_violation → expired. The verdict reason is the first guarantee that fails.

It is parity-tested. A harness asserts this verifier returns the identical verdict and reason as python3 verify.py on every shipped sample and attack — nine cases, from ALLOW to scope_violation to replayed. A port that diverged would be a published falsehood, so it is checked rather than trusted.

Why you cannot win with an edit. The action, mandate and credential all sit inside the signed receipt. Change any of them and the agent's signature no longer verifies (aep_sig_invalid); recompute the hash and you still cannot forge the signature without the agent's private key (issuer_not_listed if you mint your own). The one break that is not a cryptographic one — a validly-signed action that simply exceeds its scope — is caught by the mandate, not the crypto: that is scope_violation, and it is the point of the whole exercise. The agent is never the final judge of its own mandate.