Exploit Lab

The Lab is an HTTP service. Every capability below has a matching endpoint; the CLI and SDK both talk to the same routes.

• POST/api/v1/lab/exploit/run

  Run exploit

  Execute an attack path against a fork runtime. Returns a sealed capsule with per-step side-effects and a reproducer.

• POST/api/v1/lab/governance/simulate-compromise

  Simulate governance compromise

  Compromise a privileged role and exercise every registered capability under threshold-policy rules; blast radius reported per action.

• POST/api/v1/lab/zk/forge-proof

  Forge ZK proof

  Run the soundness fuzzer over an R1CS constraint set; reports witnesses that satisfy constraints while forging target outputs.

• POST/api/v1/lab/cross-runtime/admin-impact

  Cross-runtime admin impact

  Propagate a compromised admin key across EVM/SVM bindings and bridge edges. Returns the full blast-radius graph.

• POST/api/v1/lab/paths/suggest

  Suggest attack paths

  Synthesize runnable attack paths from a batch of findings. Each suggestion is ready to hand to /exploit/run.

• GET/api/v1/lab/capsules/{fingerprint}

  Fetch capsule

  Retrieve a previously sealed capsule by fingerprint. Tenant-scoped — cross-tenant reads return 404 indistinguishably.