The ledger, rendered
Findings, not vibes.
Rendered from your real JSON.
Point this dashboard at any labs/crashledger.json (or a run blob from a CI artifact): it normalizes the artifact, computes the section 7 gate with the exact functions the CLI uses, breaks findings down by module, and draws the cost-economics bars. All of it runs in your browser against a JSON the CLI wrote - the CLI collects nothing and makes no calls, and neither does the dashboard.
What you see is not sample data - it is crashtest eating its own cooking: the committed CI ledger of our own hardened demo app, baked into this page at build time. Point the loader below at your own labs/crashledger.json or a CI run blob to see yours instead.
CI hold - exit 0PASS
No new EXPLOITED findings, no REFUSED->EXPLOITED regressions. - same rule the CLI applies via
exit(diff).49attacks
49🛡 refused
0âš¡ exploited
0🔒 bounded
842backend ops
647in-process requests
Findings by module
Every row below is a receipt of an attack that did not land.
section auth3
auth/identity-spoof-headersall 54 identity-header spoofs denied or ignored on "admin"
auth/secret-watermark12 routes x 3 error-path probes: no fake secret ever left the env
auth/privilege-escalationownership mutations rejected by "device" (baseline 403)
section authz3
authz/method-matrix-privileged5 methods (bare + bodies where the method carries one) all denied on "admin" - the gate is method-blind
authz/role-body-spoof-family8 role-word claims x 3 methods all denied on "admin" - identity lives in the request the server derives, not in the body the attacker owns
authz/handler-alias-confusionalias "dev-check" denies identically to "admin" - no unauthenticated grant, no identity-header trapdoor (3 spoof vectors probed)
section governance10
governance/succession-trust-floorskipped - no coverage gradedvocabulary knob(s) "grantsRoute", "resolveRoute" not declared on this target - governance skipped (export moduleCtx['governance'].grantsRoute/resolveRoute for coverage)
governance/succession-single-heirskipped - no coverage gradedvocabulary knob(s) "grantsRoute", "resolveRoute" not declared on this target - governance skipped (export moduleCtx['governance'].grantsRoute/resolveRoute for coverage)
governance/succession-revocation-carryskipped - no coverage gradedvocabulary knob(s) "grantsRoute", "resolveRoute" not declared on this target - governance skipped (export moduleCtx['governance'].grantsRoute/resolveRoute for coverage)
governance/escrow-two-key-releaseskipped - no coverage gradedvocabulary knob(s) "escrowRoute" not declared on this target - escrow skipped (export moduleCtx['governance'].escrowRoute for coverage)
governance/escrow-expiry-is-fail-closedskipped - no coverage gradedvocabulary knob(s) "escrowRoute" not declared on this target - escrow skipped (export moduleCtx['governance'].escrowRoute for coverage)
governance/escrow-refusal-is-typedskipped - no coverage gradedvocabulary knob(s) "escrowRoute" not declared on this target - escrow skipped (export moduleCtx['governance'].escrowRoute for coverage)
governance/grant-conflict-deterministicskipped - no coverage gradedvocabulary knob(s) "grantsRoute", "resolveRoute" not declared on this target - governance skipped (export moduleCtx['governance'].grantsRoute/resolveRoute for coverage)
governance/capability-no-sidewaysskipped - no coverage gradedvocabulary knob(s) "grantsRoute", "resolveRoute" not declared on this target - governance skipped (export moduleCtx['governance'].grantsRoute/resolveRoute for coverage)
governance/lock-ttl-honestyskipped - no coverage gradedgovernance knob(s) "locksRoute", "ttlMode" not declared on this target - lock-ttl-honesty skipped (declare locksRoute + the DOCUMENTED ttlMode for coverage)
governance/lock-owner-fencingskipped - no coverage gradedgovernance knob(s) "locksRoute", "staleToken" not declared on this target - fencing skipped (declare locksRoute + staleToken for coverage)
section guards2
guards/hygiene-no-store"enroll" write responses marked no-store
guards/burst-wallno wall under 50-burst on "burst" (0 client errors) - wall presence optional, breakage none
section input3
input/proto-pollution-bodypayload to "enroll" did not pollute state (status 400)
input/never-fail-mutations64 hostile bodies all under the floor on "enroll" (seed 3650991062)
input/oversized-fieldoversized body handled on "enroll" (status 400)
section memory9
memory/drift-silent-overwriteskipped - no coverage gradedvocabulary knob(s) "writeRoute", "readRoute" not declared on this target - memory skipped (export moduleCtx['memory'].writeRoute/readRoute for coverage)
memory/drift-stale-poisons-freshskipped - no coverage gradedvocabulary knob(s) "writeRoute", "readRoute" not declared on this target - memory skipped (export moduleCtx['memory'].writeRoute/readRoute for coverage)
memory/drift-contradiction-carryskipped - no coverage gradedvocabulary knob(s) "writeRoute", "readRoute" not declared on this target - memory skipped (export moduleCtx['memory'].writeRoute/readRoute for coverage)
memory/hallucinated-fact-probeskipped - no coverage gradedvocabulary knob(s) "writeRoute", "readRoute" not declared on this target - memory skipped (export moduleCtx['memory'].writeRoute/readRoute for coverage)
memory/citation-driftskipped - no coverage gradedvocabulary knob(s) "writeRoute", "readRoute", "deleteRoute" not declared on this target - citation drift skipped (export moduleCtx['memory'].writeRoute/readRoute/deleteRoute for coverage)
memory/phantom-scopeskipped - no coverage gradedvocabulary knob(s) "writeRoute", "readRoute" not declared on this target - memory skipped (export moduleCtx['memory'].writeRoute/readRoute for coverage)
memory/identity-merge-collisionskipped - no coverage gradedvocabulary knob(s) "writeRoute", "readRoute" not declared on this target - memory skipped (export moduleCtx['memory'].writeRoute/readRoute for coverage)
memory/resolution-order-stabilityskipped - no coverage gradedvocabulary knob(s) "writeRoute", "readRoute" not declared on this target - memory skipped (export moduleCtx['memory'].writeRoute/readRoute for coverage)
memory/delete-is-loudskipped - no coverage gradedvocabulary knob(s) "writeRoute", "readRoute", "deleteRoute" not declared on this target - delete skip (export moduleCtx['memory'].writeRoute/readRoute/deleteRoute for coverage)
section proto-hygiene2
proto-hygiene/head-get-parity12 route(s): HEAD mirrors GET (no throws, no status drift beyond honest 405) + 11 info note(s)
proto-hygiene/request-shape-flood12 route(s) x 18 bare shapes (query chaos, path shapes, header casings) all landed 4xx-or-cleaner with case-parity intact
section race2
race/double-submit-idempotency3-way same-key burst on "charge" landed exactly one acknowledged effect + 2 honest 409(s); the store held 1 row(s)
race/concurrent-write-lost-updateconcurrent field-split pair both landed on "profile" - all four submitted fields present in the store; no silent stomp
section recursion2
recursion/deep-nest-stack-overflowdeep-nested body (12000 levels) answered honestly on "enroll" (400) - a depth guard or flat processing refused it
recursion/redos-catastrophic-pattern2 evil/benign backtracking pairs walked linearly through "validate" - no self-relative ratio crossed the bucket
section session4
session/cookie-hygienelogin cookie on "login" carries the full hygiene set: Secure + HttpOnly + SameSite policy
session/session-fixationsession rotation + forged-id rejection hold on "login"/"me" (two distinct sids, forged sid denied with 401)
session/token-replay-deny4 logins across 3 accounts minted pairwise-distinct sids on "login" - no token is ever re-issued, so expired-and-known tokens cannot replay
session/logout-invalidateslogout invalidation holds on "logout" - me() with the logged-out sid denies (status 401)
section state2
state/enumeration-oracleno mustDenyIds configured - declare ids the CURRENT identity must never read to arm the oracle
state/id-collision-aliasowner-b's claim on [alias-48430] by "enroll" stayed separate (status 409; owner-a row intact)
section taxonomy2
taxonomy/abuse-not-5xx10 abuse shapes answered honestly on "enroll" (statuses: 400/201)
taxonomy/errors-stay-impersonal10 abuse shapes answered impersonally on "enroll" - no canary echo, no stack frames
section upload2
upload/filename-traversal-family9 hostile filename shapes through "upload" left nothing but safe basenames (or honest 4xx refusals) in "UPLOADS"
upload/mime-polyglot-family2 polyglot shapes (svg+script, text/html) refused honestly through "upload" - an allow-list discipline holds
section volume3
volume/credential-stuffingenroll held 60 stuffing attempts (1 admitted, 59 refused) / 121 ops total / ~2.02 ops/request
volume/storage-fillskipped - no coverage gradedroute "kvwrite" not declared on this target - fill check skipped (declare a KV-writing route)
volume/cost-amplification"enroll" held the amplification bound: 2.02 ops/request over 40 identical replays (bound 12)
Cost economics
Cost economics - every request is accounted in backend ops. Amplification is bounded by config, not vibes.
auth/identity-spoof-headers55 ops / 55 req
auth/secret-watermark36 ops / 36 req
auth/privilege-escalation4 ops / 4 req
authz/method-matrix-privileged9 ops / 9 req
authz/role-body-spoof-family24 ops / 24 req
authz/handler-alias-confusion8 ops / 8 req
governance/succession-trust-floor0 ops / 0 req
governance/succession-single-heir0 ops / 0 req
governance/succession-revocation-carry0 ops / 0 req
governance/escrow-two-key-release0 ops / 0 req
governance/escrow-expiry-is-fail-closed0 ops / 0 req
governance/escrow-refusal-is-typed0 ops / 0 req
governance/grant-conflict-deterministic0 ops / 0 req
governance/capability-no-sideways0 ops / 0 req
governance/lock-ttl-honesty0 ops / 0 req
governance/lock-owner-fencing0 ops / 0 req
guards/hygiene-no-store3 ops / 1 req
guards/burst-wall50 ops / 50 req
input/proto-pollution-body1 ops / 1 req
input/never-fail-mutations64 ops / 64 req
input/oversized-field1 ops / 1 req
memory/drift-silent-overwrite0 ops / 0 req
memory/drift-stale-poisons-fresh0 ops / 0 req
memory/drift-contradiction-carry0 ops / 0 req
memory/hallucinated-fact-probe0 ops / 0 req
memory/citation-drift0 ops / 0 req
memory/phantom-scope0 ops / 0 req
memory/identity-merge-collision0 ops / 0 req
memory/resolution-order-stability0 ops / 0 req
memory/delete-is-loud0 ops / 0 req
proto-hygiene/head-get-parity24 ops / 24 req
proto-hygiene/request-shape-flood216 ops / 216 req
race/double-submit-idempotency9 ops / 3 req
race/concurrent-write-lost-update20 ops / 2 req
recursion/deep-nest-stack-overflow1 ops / 1 req
recursion/redos-catastrophic-pattern4 ops / 4 req
session/cookie-hygiene7 ops / 1 req
session/session-fixation16 ops / 3 req
session/token-replay-deny28 ops / 4 req
session/logout-invalidates12 ops / 3 req
state/enumeration-oracle0 ops / 0 req
state/id-collision-alias5 ops / 2 req
taxonomy/abuse-not-5xx12 ops / 10 req
taxonomy/errors-stay-impersonal11 ops / 10 req
upload/filename-traversal-family18 ops / 9 req
upload/mime-polyglot-family2 ops / 2 req
volume/credential-stuffing121 ops / 60 req
volume/storage-fill0 ops / 0 req
volume/cost-amplification81 ops / 40 req
Accepted risks
Owner + bound on file. Accepted risks never re-alarm - they are reported, not failed.
No accepted risks on file - nothing finds its way around an owner + bound.
Want the gate in CI instead of on a page? That is the same verdict, computed inside npx crashtest run - see the exit rules and the ledger format. CI can emit exactly this artifact with npx crashtest run --json (the last stdout line is the same blob this page renders) - the pipeline recipe lives at run roots & recipes.