The ledger, rendered

Findings, not vibes.
Rendered from your real JSON.

Point this dashboard at any labs/crashledger.json (or a run blob from a CI artifact): it normalizes the artifact, computes the §7 gate with the exact functions the CLI uses, breaks findings down by module, and draws the cost-economics bars. All of it runs in your browser against a JSON the CLI wrote — the CLI collects nothing and makes no calls, and neither does the dashboard.

CI hold — exit 0PASS
No new EXPLOITED findings, no REFUSED→EXPLOITED regressions. — same rule the CLI applies via exit(diff).
13attacks
13🛡 refused
0⚡ exploited
0🔒 bounded
397backend ops
599in-process requests
2026-10-20 02:02:43 UTCcrashtest dogfood baseline · v0.1.0 · seed 12648430

Findings by module

Every row below is a receipt of an attack that did not land.

§auth3

auth/identity-spoof-headersall 54 identity-header spoofs denied or ignored on "admin"
auth/secret-watermark4 routes × 3 error-path probes: no fake secret ever left the env
auth/privilege-escalationownership mutations rejected by "device" (baseline 403)

§guards2

guards/hygiene-no-store"enroll" write responses marked no-store
guards/burst-wallno wall under 50-burst on "burst" (0 client errors) — wall presence optional, breakage none

§input3

input/proto-pollution-bodypayload to "enroll" did not pollute state (status 400)
input/never-fail-mutations64 hostile bodies all under the floor on "enroll" (seed 3650991062)
input/oversized-fieldoversized body handled on "enroll" (status 400)

§state2

state/enumeration-oracleno mustDenyIds configured — declare ids the CURRENT identity must never read to arm the oracle
state/id-collision-aliasowner-b's claim on [alias-48430] by "enroll" stayed separate (status 409; owner-a row intact)

§volume3

volume/credential-stuffingenroll held 60 stuffing attempts (1 admitted, 59 refused) · 121 ops total · ~2.02 ops/request
volume/storage-fillroute "kvwrite" not declared on this target — fill check skipped (declare a KV-writing route)
volume/cost-amplification"enroll" held the amplification bound: 2.02 ops/request over 40 identical replays (bound 12)

Cost economics

Cost economics — every request is accounted in backend ops. Amplification is bounded by config, not vibes.

auth/identity-spoof-headers55 ops · 55 req
auth/secret-watermark12 ops · 67 req
auth/privilege-escalation4 ops · 71 req
guards/hygiene-no-store3 ops · 1 req
guards/burst-wall50 ops · 51 req
input/proto-pollution-body1 ops · 1 req
input/never-fail-mutations64 ops · 65 req
input/oversized-field1 ops · 66 req
state/enumeration-oracle0 ops · 0 req
state/id-collision-alias5 ops · 2 req
volume/credential-stuffing121 ops · 60 req
volume/storage-fill0 ops · 60 req
volume/cost-amplification81 ops · 100 req

Accepted risks

Owner + bound on file. Accepted risks never re-alarm — they are reported, not failed.

No accepted risks on file — nothing finds its way around an owner + bound.

Want the gate in CI instead of on a page? That is the same verdict, computed inside npx crashtest run — see the exit rules and the ledger format. CI can emit exactly this artifact with npx crashtest run --json (the last stdout line is the same blob this page renders) — the pipeline recipe lives at run roots & recipes.