attack_class: Tampered Registry

scenario: Attacker intercepts a federation registry replica in transit and splices in a fraudulent record — granting themselves an Active issuer principal. The hash chain breaks at the splice point.

expected_rejection: RegistryChainBreak

live_check_in_browser: Walk the records in order. For each record after the first, assert record.body.prev_record_hash equals the previous record's body.record_hash. The splice breaks the chain at record index 2.

production_check: qsign_fed_registry::InMemoryRegistry::append() rejects any record whose prev_record_hash does not equal the current tip. The JSONL parser also rejects chain breaks at parse time, not first use — tampering cannot sit undetected in a replica.

note: JSONL format: one record per line. First line is this metadata header; lines 2-4 are the actual registry records.