{
 "product": "Signed decision receipts",
 "slug": "decision-receipts",
 "base": "https://cainstudio.online",
 "page": "https://cainstudio.online/top25-decision-receipts.html",
 "claims": [
  {
   "id": "C01",
   "kind": "control",
   "claim": "Genuine receipt verifies -> A real receipt from the live gate checks out.",
   "requests": [
    {
     "method": "POST",
     "url": "/codeguard-keystone/check",
     "body": {
      "action": {
       "tool": "Bash",
       "cwd": "/home/dev/app",
       "command": "pytest -q"
      }
     }
    },
    {
     "method": "POST",
     "url": "/codeguard-keystone/verify-receipt",
     "body": {
      "receipt": "${0.receipt}"
     }
    }
   ],
   "path": "valid",
   "expect": [
    true
   ]
  },
  {
   "id": "C02",
   "kind": "attack",
   "claim": "Receipt with decision flipped to ALLOW on a DENY -> The signature covers the decision.",
   "requests": [
    {
     "method": "POST",
     "url": "/codeguard-keystone/check",
     "body": {
      "action": {
       "tool": "Bash",
       "cwd": "/",
       "command": "rm -rf ~"
      }
     }
    },
    {
     "method": "POST",
     "url": "/codeguard-keystone/verify-receipt",
     "body": {
      "receipt": "${0.receipt}"
     },
     "set": {
      "receipt.decision": "ALLOW"
     }
    }
   ],
   "path": "valid",
   "expect": [
    false
   ]
  },
  {
   "id": "C03",
   "kind": "attack",
   "claim": "Receipt for a different command -> A receipt is bound to the exact action it decided.",
   "requests": [
    {
     "method": "POST",
     "url": "/codeguard-keystone/check",
     "body": {
      "action": {
       "tool": "Bash",
       "cwd": "/home/dev/app",
       "command": "pytest -q"
      }
     }
    },
    {
     "method": "POST",
     "url": "/codeguard-keystone/verify-receipt",
     "body": {
      "receipt": "${0.receipt}"
     },
     "set": {
      "receipt.command": "rm -rf ~"
     }
    }
   ],
   "path": "valid",
   "expect": [
    false
   ]
  },
  {
   "id": "C04",
   "kind": "attack",
   "claim": "Receipt with the signature removed -> No signature is not a pass.",
   "requests": [
    {
     "method": "POST",
     "url": "/codeguard-keystone/check",
     "body": {
      "action": {
       "tool": "Bash",
       "cwd": "/home/dev/app",
       "command": "pytest -q"
      }
     }
    },
    {
     "method": "POST",
     "url": "/codeguard-keystone/verify-receipt",
     "body": {
      "receipt": "${0.receipt}"
     },
     "set": {
      "receipt.signature": ""
     }
    }
   ],
   "path": "valid",
   "expect": [
    false
   ]
  },
  {
   "id": "C05",
   "kind": "attack",
   "claim": "Receipt that is not a receipt -> Unknown structure is refused.",
   "requests": [
    {
     "method": "POST",
     "url": "/codeguard-keystone/verify-receipt",
     "body": {
      "receipt": {
       "decision": "ALLOW"
      }
     }
    }
   ],
   "path": "",
   "expect": [],
   "expect_status": [
    400,
    422
   ]
  }
 ]
}