Validate a redacted operation

Use this guide when you already have a redacted authenticated-user record and you want to test it.

Create the input file

Start from examples/authenticated-user-baseline.json.

Keep only these fields:

• version
• service
• httpStatus
• apiSuccessClaim
• identityResultObserved
• identityIdPresent
• variant
• retrievedContent
• retrievalAuthority
• terminalFault

Do not add credentials, headers, raw response bodies, or personal data.

Validate one record

node dist/cli.js validate path/to/operation.json

Add --json if another tool needs machine output.

The command exits with status 0 only when the record validates as trusted.

Check the full adverse set

Use check only with a baseline record that has "variant": "baseline".

node dist/cli.js check path/to/operation.json

This command validates the baseline. It then derives the hostile-retrieval, false-success, and terminal-fault variants and confirms that none of them become trusted.

Use a custom Wasm file

node dist/cli.js validate path/to/operation.json --wasm path/to/agent_adversary.wasm

Use this form when you test a locally built candidate instead of the bundled release Wasm.