Replay archive

Signed Replay Archive

Recorded agent actions with Pipelock decisions, outcome notes, and signed Audit Packets you can verify offline.

Run the live demo Verify a receipt

Proof packs

Recorded agent actions

Each replay shows the agent action, the Pipelock mediator decision, and a signed Audit Packet you can download and verify.

Allowed by policy

Allowed: a safe read passes

Pipelock allowed the action and signed the decision.

Attempt: url-benign-api-call-001
Decision: allow
Proof: 2 signed receipts

Secret exfiltration

Blocked: secret exfiltration over a URL

Pipelock blocked the unsafe exchange and signed the decision.

Attempt: url-dlp-aws-key-001
Decision: block
Proof: 2 signed receipts

Prompt injection

Blocked: a hijack hidden in fetched content

Pipelock blocked the unsafe exchange and signed the decision.

Attempt: response-injection-ignore-002
Decision: block
Proof: 2 signed receipts

SSRF / internal target

Blocked: a reach for cloud metadata

Pipelock blocked the unsafe exchange and signed the decision.

Attempt: url-ssrf-metadata-009
Decision: block
Proof: 2 signed receipts

Operation-aware policy

Blocked: destructive API mutation

Pipelock blocked the unsafe exchange and signed the decision.

Attempt: local-lab-request-policy-graphql-mutation-001
Decision: block
Proof: 3 signed receipts

Secret exfiltration

Blocked: poisoned ticket webhook exfiltration

Pipelock blocked the unsafe exchange and signed the decision.

Attempt: local-lab-body-dlp-private-key-001
Decision: block
Proof: 2 signed receipts

Secret exfiltration

Blocked: poisoned README key paste

Pipelock blocked the unsafe exchange and signed the decision.

Attempt: local-lab-body-dlp-openai-key-001
Decision: block
Proof: 2 signed receipts

Secret exfiltration

Blocked: hostile page session key exfiltration

Pipelock blocked the unsafe exchange and signed the decision.

Attempt: local-lab-body-dlp-jwt-session-001
Decision: block
Proof: 2 signed receipts

Observe before enforcing

Warned: suspicious payload observed

Pipelock observed the finding, forwarded the lab action, and signed the warning.

Attempt: local-lab-body-dlp-warn-001
Decision: warn
Proof: 2 signed receipts

WebSocket exfiltration

Blocked: a secret split across WebSocket frames

Pipelock blocked the unsafe exchange and signed the decision.

Attempt: local-lab-websocket-fragmented-dlp-001
Decision: block
Proof: 2 signed receipts

MCP tool poisoning

Blocked: poisoned MCP tool instructions

Pipelock blocked the unsafe exchange and signed the decision.

Attempt: local-lab-mcp-tool-poison-001
Decision: block
Proof: 2 signed receipts

Multi-step evidence

Chain: two safe actions, then a blocked write

Pipelock blocked the unsafe exchange and signed the decision.

Attempt: local-lab-multi-step-policy-chain-001
Decision: block
Proof: 4 signed receipts

Make It Leak episodes

Captured leak attempts, each blocked and signed. Verify the Audit Packets offline.

Format: signed replay
Verify: offline, published key

Contrast

When the evidence doesn’t hold up.

Not every assurance envelope survives the appraiser. Each replay above wraps a valid lab receipt, so its panel still confirms a narrow set of claims. This one does not.

Downgraded example

A maximal claim list under an untrusted key

This envelope claims everything: mediated, transparency-log inclusion, and complete mediation under a real Ed25519 signature. But the signing key is not in the trust file, so the signature is unknown_key, the assertion is unsigned, and not one claim verifies. It sounds strong. It proves nothing.

assertion_signed: false · verified_claims: none

This is a fixture from the public Evidence Theater kill suite. Its appraisal is reproducible with the AARP verifier:

pipelock-verifier aarp k02-untrusted-issuer-overclaim.aarp.json --trust killsuite-trust.json --json

k02-untrusted-issuer-overclaim.aarp.json: the envelope
appraisal.json: the appraisal a correct verifier must emit
expect.json: the attack class and what must not verify
killsuite-trust.json: the pinned test trust

Scope

Signed mediated decisions, not a trust-me badge.

A verified chain proves the included mediated decisions were signed by the mediator and untampered. It does NOT prove session completeness, that no event was missed, that the agent was sandboxed, or that traffic could not bypass Pipelock. The prompts and responses shown are unsigned playback metadata; only the receipt chain of decisions is signed.

Try the live path.

Run the contained demo, inspect the decision, then verify the signed bundle offline.

Open Playground Install Pipelock