{"_demo": {"attack_class": "Tampered Registry", "scenario": "Attacker intercepts a federation registry replica in transit and splices in a fraudulent record — granting themselves an Active issuer principal. The hash chain breaks at the splice point.", "expected_rejection": "RegistryChainBreak", "live_check_in_browser": "Walk the records in order. For each record after the first, assert record.body.prev_record_hash equals the previous record's body.record_hash. The splice breaks the chain at record index 2.", "production_check": "qsign_fed_registry::InMemoryRegistry::append() rejects any record whose prev_record_hash does not equal the current tip. The JSONL parser also rejects chain breaks at parse time, not first use — tampering cannot sit undetected in a replica.", "note": "JSONL format: one record per line. First line is this metadata header; lines 2-4 are the actual registry records."}}
{"body": {"schema": "urn:h33:qsign:fed-key-registry-record:v0.1", "org_slug": "acme-bank", "principal_class": "Issuer", "principal_id": "urn:h33:fed:acme-bank:key:nap-issuer-2026-q3", "ml_dsa_87_pubkey_hex": "00", "slh_dsa_256s_pubkey_hex": "00", "falcon_pubkey_hex": "00", "status": "Active", "registered_at_unix_ms": 1780000000000, "prev_record_hash": "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"}, "signatures": {"ml_dsa_87": "00", "slh_dsa_256s": "00", "falcon": "00"}, "record_hash": "a3f7c91e4b8d2061cf5a93e72b4d6f8a01c39e7b5f2a4d6c8e0a1b3d5f7e9c1a2b4d6f8a0c2e4061739b5d8e0f2a4c6e8"}
{"body": {"schema": "urn:h33:qsign:fed-key-registry-record:v0.1", "org_slug": "compliance-desk-zeta", "principal_class": "Verifier", "principal_id": "urn:h33:fed:compliance-desk-zeta:verifier:nightly-batch", "ml_dsa_87_pubkey_hex": "00", "slh_dsa_256s_pubkey_hex": "00", "falcon_pubkey_hex": "00", "status": "Active", "registered_at_unix_ms": 1780000000001, "prev_record_hash": "a3f7c91e4b8d2061cf5a93e72b4d6f8a01c39e7b5f2a4d6c8e0a1b3d5f7e9c1a2b4d6f8a0c2e4061739b5d8e0f2a4c6e8"}, "signatures": {"ml_dsa_87": "00", "slh_dsa_256s": "00", "falcon": "00"}, "record_hash": "b41c6d8e0f2a4c6e89531746a8b9d2c4e6f8a0c2e4f6081a3b5c7d9e1f3a5b7c9d2e4f6a8b0c1d3e5f7091a3b5c7d9e1f"}
{"body": {"schema": "urn:h33:qsign:fed-key-registry-record:v0.1", "org_slug": "attacker-injected-corp", "principal_class": "Issuer", "principal_id": "urn:h33:fed:attacker-injected-corp:key:nap-issuer-2026-q3", "ml_dsa_87_pubkey_hex": "00", "slh_dsa_256s_pubkey_hex": "00", "falcon_pubkey_hex": "00", "status": "Active", "registered_at_unix_ms": 1780000000002, "prev_record_hash": "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef"}, "signatures": {"ml_dsa_87": "00", "slh_dsa_256s": "00", "falcon": "00"}, "record_hash": "ffffeeeeddddccccbbbbaaaa999988887777666655554444333322221111000000000000111122223333444455556666"}