This page runs the Echelon security engine from DirectHearth's approved specification (Rev 2, §1–§12) live in your browser — every check is executed for real on this page, and every event lands in a tamper-evident audit chain (each entry hash-linked to the one before it). The same engine is live on DirectHearth's production API, verified against this exact matrix (18/18), with enforcement switched off by default — so existing users and devices are unaffected until the operator enables it.
Matrix checks
not run
Audit chain events
0
Crisis flags
none
Chain tail hash
—
#01
Emulator user-agent
An attacker running the app inside an Android emulator (SDK build UA) hits any route.
expect 403 · SEC_EMULATOR_DETECTED
#02
Rooted device → Auth
A jailbroken device claims a rooted environment while calling a sensitive endpoint.
expect 403 · SEC_DEVICE_ROOTED
#03
Rooted device → public route
The same rooted claim on a NON-sensitive route — the platform still serves public content.
expect 200 · OK_NON_SENSITIVE
#04
No integrity token
A stripped client calls /v1/wealth-vault with no X-App-Integrity header at all.
expect 403 · SEC_NONCE_INVALID
#05
Forged HMAC (wrong secret)
An attacker reconstructs the header format but signs with a guessed secret.
expect 403 · SEC_INTEGRITY_INVALID
#06
Replayed request
The exact same signed request is captured and sent again — the nonce must be single-use.
expect 403 · SEC_NONCE_INVALID
#07
Out-of-order sequence
Replay or packet reordering — a sequence number ≤ the last one accepted.
expect 403 · SEC_SEQ_INVALID
#08
Sequence leap (9999)
A jump beyond the allowed gap trips crisis mode — sensitive ops freeze.
expect 403 · SEC_CRISIS + crisis flag
#09
Hostile device metadata
The device says it is not rooted but its metadata claims rooted + mock, with no attestation.
expect 403 · SEC_RISK_HIGH
#10
Sensitive-route sweep
No token on every /auth and /personas endpoint — all must refuse.
expect 3 × 403
#11
Legitimate client
A genuine, enrolled client: fresh nonce, correct HMAC, monotonic sequence.
expect 200 · OK
Audit chain (append-only, hash-linked)
— no events yet. Run the matrix to watch the chain build.