ok   each documented event exits 0 and prints nothing to stdout
ok   the session record verifies  {"FORMAT":"PASS","KEY_PIN":"PASS","CHAIN_ORDER":"PASS","ENTRY_HASH":"PASS","SIGNATURE":"PASS","PQ_SIGNATURE":"NONE","SEAL":"PASS","ADMISSION":"NONE","WITNESS":"NONE","TIMESTAMP":"NONE"}
ok   record has key line, 11 events and 2 seals  14 lines
ok   record ends sealed
ok   summary: 4 asked, 2 completed, 1 failed
ok   summary: the refund call was asked with no outcome
ok   summary: MCP tool name kept
ok   no prompt, input, output, path or message text in the record
ok   reveal: the real refund command matches its fingerprint  MATCH  line 7 input: the value you supplied is what the record fingerprinted.
ok   reveal: a different amount does not match
ok   unwritable storage: still exits 0, prints nothing  exit 0
ok   malformed input: still exits 0, prints nothing
ok   40 parallel hooks: all exit 0, one valid chain of 41 lines  41 lines in 1833 ms
ok   median hook time under 250 ms  median 82 ms, p90 89 ms
ok   witness: signed at the start, before every tool call and at every seal, by both witnesses  12 of 12 null
ok   witness: every line, up to the last, is covered (--full-coverage)
ok   witness: two different witnesses required and present (--min-witnesses 2)
ok   witness: only one of two required witnesses is rejected at WITNESS  only 1 different witnesses signed, and this check requires 2
ok   witness: statements signed within 30 s of each line pass --max-lag 30
ok   witness: a statement signed later than allowed is rejected (a record rebuilt later gets late statements)  line 1 was witnessed 0 s after it was written, more than the -1 s allowed
ok   witness: a record handed over without its statements fails when witnessing is required
ok   timestamp: RFC 3161 tokens from a public authority verify with openssl and cover heads in the chain  [{"count":2,"at":"2026-10-10T17:27:14.000Z","tsa":"http://timestamp.digicert.com"},{"count":12,"at":"2026-10-10T17:27:15.000Z","tsa":"http://timestamp.digicert.com"}] 2
ok   timestamp: an authority time far from the line's own time is rejected at TIMESTAMP  the timestamp authority's time for line 2 is 3600 s from the time the line claims
ok   witness refuses any field beyond the four fingerprints
ok   tamper refund-call-deleted: rejected at CHAIN_ORDER  CHAIN_ORDER, expected seq 7, found 8
ok   tamper failure-rewritten: rejected at ENTRY_HASH  ENTRY_HASH, line 4 changed after it was signed
ok   tamper tool-renamed: rejected at ENTRY_HASH  ENTRY_HASH, line 7 changed after it was signed
ok   tamper time-moved: rejected at ENTRY_HASH  ENTRY_HASH, line 7 changed after it was signed
ok   tamper lines-swapped: rejected at CHAIN_ORDER  CHAIN_ORDER, expected seq 3, found 4
ok   tamper fingerprint-swapped: rejected at ENTRY_HASH  ENTRY_HASH, line 7 changed after it was signed
ok   tamper signature-forged: rejected at SIGNATURE  SIGNATURE, line 2 signature does not verify
ok   tamper seal-moved: rejected at ENTRY_HASH  ENTRY_HASH, line 11 changed after it was signed
ok   tamper rewritten-dropped-refund: rejected at WITNESS  WITNESS, witness statement signed by an unpinned witness key
ok   tamper rewritten-other-key: rejected at KEY_PIN  KEY_PIN, record was signed by a key other than the pinned one
ok   hosts read from a Bash command: git, URL and ssh  huggingface.co github.com prod.acme.io
ok   admission session verifies, ML-DSA-65 and admission gates pass  {"FORMAT":"PASS","KEY_PIN":"PASS","CHAIN_ORDER":"PASS","ENTRY_HASH":"PASS","SIGNATURE":"PASS","PQ_SIGNATURE":"PASS","SEAL":"PASS","ADMISSION":"PASS","WITNESS":"NONE","TIMESTAMP":"NONE"}
ok   the admission is line 1, signed before any tool call
ok   outside admission: the huggingface.co call, /etc/passwd and the Write tool, nothing else  [{"tool":false,"paths":[],"hosts":["huggingface.co"]},{"tool":false,"paths":["/etc/passwd"],"hosts":[]},{"tool":true,"paths":[],"hosts":[]}]
ok   purpose text never enters the record
ok   verifier exits 3 when the record holds but calls fell outside the admission  exit 3
ok   --admission with the policy the reviewer was given passes
ok   --admission with a different policy is rejected at ADMISSION
ok   ML-DSA-65 signature removed from one line: rejected at PQ_SIGNATURE  line 4 ML-DSA-65 signature is missing or does not verify
ok   scope check rewritten and fully re-signed with both recorder keys: rejected at ADMISSION  line 5 scope check does not match the admission
ok   median hook time with ML-DSA-65 under 400 ms  median 128 ms
ok   datasets: a pull from a dataset outside the admission is flagged, one inside is not  [{"seq":5,"tool":"mcp__market-data__get_records","use_id":"d2","ran":true,"failed":false,"outside":{"tool":false,"paths":[],"hosts":[],"datasets":["mortgage.loan-level"]}}]
ok   datasets: the record names the dataset but keeps none of the data
ok   slow witness: the hook returns after its wait, and the statement still arrives afterwards  423 ms
ok   memory: the witness remembers every statement it signed for the session  6 remembered, 6 saved locally
ok   memory: a record handed over with no statements at all passes against what the witness remembers  null
ok   memory: the end cut off, statements withheld: rejected, the witness remembers more lines  the witness saw 12 lines for this session, and this record has only 9
ok   memory: nobody without the recorder key can add to a session's memory  false 400 null
ok   memory: a call deleted, re-signed with the recorder key, fresh signed statements obtained: passes on its own statements, rejected once the witness is asked  the witness saw 4 lines ending in e916a492d3fb, and this record no longer has that
ok   memory: a session the witness never saw fails when memory is required
ok   memory: the witness only answers for a full recorder key and session fingerprint
ok   service mode: the record and signing keys live with recorderd, the agent's side has neither
ok   service mode: recorderd signs its own admission as line 1 and flags the call outside it
ok   service mode: no content reaches recorderd
ok   service mode: recorderd refuses a description carrying any field beyond fingerprints and names

59 of 59 checks passed. 10 of 10 tamper cases rejected.
Node v20.20.1, linux x64, 2026-10-10T17:27:40.005Z
