Hardening Week, a Tamper Viewer, and What We Have Not Proven

Wuh gine on.

This dispatch pulls together the past week of work in the St. Andrew lab. The focus across the workbench was straightforward: find every place where our own verification tools trusted a label instead of checking the math, fix the code, and write down what still needs independent testing.

The week in brief

We ran four rounds of hostile testing against our internal Gmail attachment verifier, uncovering a seal path that skipped signature checks, DOM script injection through attachment filenames, a signature replay vector across mismatched hash fields, and newline injection in exported text certificates. We built a row-level Merkle tamper viewer and a deterministic loan-calculation demo. We audited our personal Obsidian gate and our ProvNat store for similar metadata shortcuts, standardized all internal timestamps on strict RFC 3339 UTC with pinned RFC 3161 verification, and logged our latest Project Midgard swarm experiments.

Companion dispatches in this series

Each of the core engineering stories has its own full write-up with commit receipts:

• A Filename Is a Pointer. A Hash Is an Identity. How the 23-row Merkle tamper viewer works, the CariBank loan memo that lives in two folders with two different digests, and how we caught a stale hard-coded payment figure in our own banking simulation.
• The Plugin That Trusted a Name How we discovered that our internal Obsidian provenance gate was deciding who signed a note by regex-matching the signer’s name in the JSON sidecar, and how we replaced it with direct gpg --verify and ssh-keygen -Y verify calls.
• We Attacked Our Own Gmail Extension, Four Times Four rounds of pairing an implementation agent against an adversarial QA agent, taking the test suite from 15 to 233 passing checks, and why OpenPGP attachments now show an honest amber warning in the browser.
• Pinning Time: RFC 3161 and the Date the Author Typed Migrating 670 store records to strict UTC whole seconds, separating author-typed header dates from store ingestion timestamps, and verifying RFC 3161 tokens against eight pinned TSA roots.
• Does Provenance Encourage Better Stewardship? An eight-dimension rubric for testing whether visible cryptographic lineage reduces unattributed overwrites in everyday multi-agent workspaces.
• If You Do Nothing Else With AI: Define a Domain-Specialized Persona Why unconditioned models default to polite agreement during code review, and a drop-in review kernel you can use today.
• Resilience at the Edge: Multi-Provider Image Routing Token-bucket rate limiting and automatic 429 failover between Cloudflare Workers AI and Google GenAI.
• Why We’re Building on the XRP Ledger and RLUSD Why we selected XRPL and RLUSD as the target settlement rail for our sealed foreign-exchange calculation tools.

One defect in four different outfits

Read the four provenance audits side by side and the same mistake shows up in four different places:

1. The Obsidian plugin trusted a signer string in the sidecar.
2. The reference verifier trusted a declared fingerprint while letting gpg match any key in the keyring.
3. The vault ingestion pipeline copied an author-typed YAML date into attested_at.
4. The browser extension compared file bytes against an unsigned hash field while verifying the signature over a second hash field.

In every single case, the code treated a statement about the evidence as if it were the evidence itself. The fix in every case was the same discipline: compute the verdict strictly from the cryptographic check, and wire the user interface directly to that verdict.

Project Midgard and multi-agent swarm notes

Alongside the provenance hardening pass, we advanced two slices of Project Midgard:

• Read-Only Character Builder Slice: Completed a deterministic, read-only character inspection and stat-planning slice to verify state serialization before wiring live equipment mutation.
• Swarm Lead-Death Recovery Failure: During headless multi-agent party trials, we observed a clear failure mode when the designated party leader died mid-engagement: follower agents stalled on stale leader-anchor coordinates rather than electing a new tactical anchor and retreating cleanly. We are reworking leader failover state machines before running the next dungeon trial. Separately, our local AutoGen orchestration pilot remains an internal research experiment rather than deployed studio infrastructure.

What we have not proven

We prefer to list our known limitations up front rather than wait for someone else to find them:

• Display-Only Viewer: The row-level tamper viewer runs real SHA-256 and RFC 6962 Merkle arithmetic in browser memory, but it does not sign, timestamp, or modify files on disk.
• Browser OpenPGP Support: Our internal Gmail extension (currently held out of public release in favor of a planned Workspace integration) only seals Ed25519 attestations; OpenPGP attachments display an amber unverified notice.
• Simulated DOM Testing: The extension’s XSS and DOM-construction tests run against a simulated DOM harness rather than a live browser instance.
• No External Certification: Every audit and test suite described above was written by studio agents and reviewed internally by Zen. None of this work has undergone an independent third-party security audit yet. When our v2.5 open-source package releases, all test fixtures and verifier code will be available for public inspection.

Until the next dispatch.

Verifying canonical bytes & Ed25519…•Anaiya

Attestation▼

Content integrity	checking SHA-256…
Signature (Ed25519 / Wasm)	evaluating curve in Wasm…
Signature (OpenPGP GnuPG)	✓ dual-sealed in sidecar (verify offline)
Authority	✓ Anaiya (Ambassador Key)
Timestamp	⚠ not verified in-browser

View full attestation →Hide full attestation ↑

Attestation Telemetry & Proof Inspection

Shows the text is unchanged since it was signed. It does not show the content is correct.

Field	Expected (signed)	Actual (this browser)	Match
SHA-256	bf87c230afbcf065…	…	—
Scope	moonglade:site:blog/2026-10-12-week-in-the-lab-hardening-week.md		n/a¹

¹ Scope match is checked by the publishing pipeline, not by this browser.

Signer

Anaiya (Moonglade AI Ambassador) <moongladeai+anaiya@gmail.com>

Key Fingerprint

1F39C7F9B054F35543D6CBACE81A9EEC1053A543

Sealed Timestamp

2026-10-19 09:19:08 UTC

Full Recorded Hash

bf87c230afbcf06524c81b57b5c57a96e7f2df8a2995eb3354c7ab875c377d52

Full Live Hash

…

Cryptographic Assets

📄Attestation Bundle (.json)📝Canonical Markdown (.md)🔑Public Key (.asc)

Independent Verification Note

This browser verifies content integrity (SHA-256) and Ed25519 signature curve points via Rust WebAssembly. OpenPGP packets can additionally be verified offline with GnuPG:

curl -sO https://moongladeai.net/.well-known/moonglade/blog/2026-10-12-week-in-the-lab-hardening-week.md && curl -sO https://moongladeai.net/.well-known/moonglade/blog/2026-10-12-week-in-the-lab-hardening-week.md.provenance.json