THE
FORGERY
Five sealed agent audit trails. Four have been doctored — a broken link, a rewrite, an omission, an insertion. One is innocent and stands accused. You are the forensic examiner, and the verification you run is real SHA-256, live in your browser.
Press → or swipe to begin. The record starts when you do.
A hash chain proves consistency.
It does not prove truth.
Every exhibit is an agent's event log sealed under the append-only invariant — each event hashed against the one before it, back to GENESIS. You have a verifier: it recomputes every link, live. Your job is to find what the verifier can see, and then what it cannot.
"hash = sha256(prev_hash + event) — one altered byte and the chain breaks. Unless the forger recomputes the chain. Then the mathematics is perfect, and the record still lies." Module 05 — The Black Box · The Studio
Run chain verification on every exhibit. It is real SHA-256 against the displayed events. Trust what it tells you — and understand what it doesn't.
Select the doctored event — or attest the chain INTACT if you believe the record is clean. One attempt. A false attest is a miss; so is accusing an innocent log.
Stake your conviction before lodging. MEASURED: +1 right, 0 wrong. HIGH CONVICTION: +2 right, −1 wrong. Forensics without calibration is guesswork with a badge.
Your own run is hash-chained under the same invariant you're examining. Five findings and a clean book earns THE FORENSIC EXAMINER. The chain head goes on your card.
Group format per exhibit: run verification on screen first, then floor debate — "the verifier says X; do you believe the record?" Take the finding vote, then the stake vote. Exhibit A teaches the tool; B through D teach its limits; E teaches that forensics defends the innocent too. Budget 5–6 minutes each.
The Broken Link
Finding: seq 05, wire_executed. The displayed amount ($92,400) was altered without recomputing the chain — verification breaks exactly there. Secondary tell: $92,400 exceeds the $50,000 daily limit passed at seq 02.
Discussion: this is the forger the system was designed to catch. Ask the room: how long did the tamper survive once someone actually ran the verifier? Why do institutions own verifiers nobody runs?
The Rewrite
Finding: seq 03, order_executed. The chain verifies because the forger recomputed it after editing the quantity. The tell is cross-reference: risk_check cleared 500 shares against a 1,000 limit; the execution shows 5,000. A recomputed chain is internally perfect and externally contradicted.
Discussion: what external anchors does your institution keep outside the chain — venue confirms, counterparty records, periodic head-hash notarization? Without an anchor, who holds the pen holds the truth.
The Omission
Finding: seq 03, case_closed. It clears an OFAC SDN potential match "per analyst review AR-2291" — an event that appears nowhere in the trail. The review was deleted and the chain rebuilt with contiguous sequence numbers. Second tell: two minutes between a 0.91-score sanctions hit and closure.
Discussion: deletions are invisible in a renumbered chain — they surface only as dangling references and impossible timings. Does your evidence standard require that every referenced artifact resolve inside the record?
The Insertion
Finding: seq 03, human_approval. The chain verifies — it was rebuilt around a backdated approval. But time runs backwards: the deploy request is stamped 15:02:44 and the "prior" approval 14:41:09, sealed after it in sequence. Hash chains guarantee order of writing, not order of occurrence.
Discussion: temporal monotonicity is a separate, checkable control. Does any of your tooling actually assert it — or would a backdated approval pass your evidence review today?
The Accusation
Finding: ATTEST INTACT. The chain verifies, timestamps are monotonic, every reference resolves, and the query scope ("aggregates only", 48,210 rows) is consistent with a 34-page report to an internal DL. The accusation fails on the evidence. Convicting this log to satisfy the complaint is the examiner's version of sycophancy.
Discussion: the room will want to find something — social pressure is the fifth forger. What does it cost an institution when its examiners can't say "intact" under pressure?
Complete the five examinations to receive your rating.
Valid is not true.
Four forgeries, one innocent, five disciplines. Carry these forward:
Run the verifier first. The naive forger — edit without recompute — is caught in seconds. Most institutions own the instrument and never fire it.
A recomputed chain is internally perfect. VALID means consistent, not true. Cross-references are your external anchors — hunt the contradiction between events.
Deletions leave ghosts. A rebuilt sequence hides the gap; the dangling reference and the impossible timing give it away. Every cited artifact must resolve inside the record.
Hashes have no clock. A chain seals the order of writing, not the order of events. Temporal monotonicity is a separate control — assert it.
Forensics cuts both ways. An intact chain defends the accused. Attest what the mathematics attests — especially when the room wants a conviction.
This is why head hashes get anchored outside the system, why timestamps get asserted, why references must resolve — and why the examiner, not the algorithm, is the last control. Run this drill with your second line. Argue about Exhibit E longest. The argument is the training; the chain is the proof it happened.
THE STUDIO — LIVE FIRE 05 · COMPANION TO MODULE 05: THE BLACK BOX