Synthetic demoNo live systems
API key rotation: authority, execution and evidence.
Replay a synthetic run. See what changed, what was checked, and what remains unproven.
Published sample, not live customer evidence
Key rotation
0 of 6 events replayedPlayback only. This click authorizes nothing and makes no provider call.
Replacement
NOT CREATEDBefore revocationCheck pendingConsumerUsing old key
Recorded step 1 of 6Not replayed yet
Replacement credential created
Create a replacement with a different synthetic fingerprint.
Evidence for this step
· CREATE REPLACEMENT
A distinct synthetic fingerprint becomes ACTIVE. Verifier v1 confirms that the supplied evidence contains no forbidden credential-value fields.
View sample scope
Synthetic credential rotation
One suspected key. One consumer. Six permitted operations. Stop on any deviation.
- Provider
- Northstar API (synthetic)
- Tenant
- sandbox_tenant_001
- Consumer
- billing_worker_demo
- Authority
- Declared approval · 12:00:10Z
- Old key identifier
- sk_demo_old_7F2C91
- Replacement identifier
- sk_demo_new_C3A901
- Suspected fingerprint
- sha256:457612e…dbf06885d5
- Recorded run
- 2026-08-27 · fixed public specimen
Permitted
Create · migrate · probe · revoke · probe · read back
Declared hard stops
Wrong target · readable secret · failed canary · 60s timeout
This is a fixed, hash-pinned synthetic specimen. Its evidence contains fingerprints and key identifiers, never credential values. No real provider, credential, compromise, customer, or production system was used or checked.
Browser verificationVERIFYING EXACT PUBLIC BYTES…
0 pass0 fail0 not checked
Checks cover this synthetic specimen only. No real provider action was checked.
Inspect the evidenceWhat if the evidence changes?
Change one evidence byte. The overall verdict must fail.
The test runs locally. The published specimen stays unchanged.
Agent Action Security Review
Need to review one important agent action?
This synthetic one-action example is historical. It is not a complete sample of the current paid review. Its signed artifacts and verification tools do not become standard review deliverables.
An action map, test results, demonstrated impact, reproduction conditions, mitigation recommendations, explicit gaps, and a written report and readout. Each case is failure demonstrated, resisted under tested conditions, inconclusive, or not tested.
Fixed fee, agreed in a signed SOW before we start.We don't test until you give written authority.
Request a break testNon-secret fit and scoping request first.
Inspect the evidence
The browser checks the pinned bundle digest, receipt signature and manifest-bound evidence with the separately pinned public verifier.
See all verification checks
Hashing and verifying the public specimen…
Inspect hashes and source
- Bundle SHA-256
- bb921133a6d06db471b0a8f5015fd6f7a734c2c1721de4e0007fa34397c11f9c
- Verifier SHA-256
- 7ac872446e384f40d82eaf63e7a0d5ca4604eb06a0fdb8e872a9240400377f41
- Demo signer fingerprint
- sha256:72a03b6fdacaad90dfc58c0e782ec51e111dfecbc1b841b6cb7a68d0a557f6e4
- Source commit
- d4ad234bd815
Browser execution is gated by Subresource Integrity using this displayed pin.
Inspect the fixed source specimen at commit d4ad234bd815The specimen source commit pins the evidence package. The same-origin browser verifier is separately owned by this website and gated by the SHA-256 pin shown above.
Download files and verify offline
Verify the sample offline
Download three files, disconnect networking, and reproduce the same structured verdict with Node’s built-in cryptography. No package install. No WitnessOps API.
node verify.mjs BUNDLE.wops.json DEMO_KEY_REGISTRY.jsonBUNDLE.wops.jsonRequired · signed specimenverify.mjsRequired · verifier sourceDEMO_KEY_REGISTRY.jsonRequired · public keyRECEIPT.jsonOptional · raw receipt
Reproduced with Node 24.19.0. Exit 0 means valid, 1 means invalid or untrusted, and 2 means malformed or unreadable input.