Economic Wind Tunnel
Attack the economy’s own validators with seeded campaigns, and sign a matrix of what held before any money depends on them.
On this page
An agent economy is held together by validators: a reputation tier that gates credit, a bid flow that checks each reservation, a breaker that refuses a diverging oracle, a fee threshold that calls a person. Each one does exactly what it was written to do. An economic adversary does not need a call that escapes the kernel; it needs a sequence of admitted calls whose sum is the attack, such as one feed repeated until a score looks earned, or a large fee sliced into many small ones.
The wind tunnel replays such campaigns against the production validators that hold money, from a recorded seed over a fixed corpus, and records for each one whether the validator failed closed. A matrix of the results is signed only when every campaign held.
Each campaign attacks named production validators
Six scenario classes make up profile econsim-v1, and each names the validators it attacks and the assertion it qualifies. A class can be held only for the assertion its targets implement.
- 1tier gate
- 2credit limit
- 3bid checks
- 4credit admission
- 5divergence breaker
- 6rate freshness
- 7cumulative approval
- 8retry bound
oracle-divergence-seed-180749 · Held
Over-threshold divergence and future or stale exchange-rate evidence fail closed.
- Targets
ensure_within_threshold,ensure_fresh- Requirements
- AE-ORACLE-DIVERGENCE-1, AE-ORACLE-FRESHNESS-1
- Limit
- Does not establish oracle availability or source independence.
- Matrix
- signed as a SignedExportEnvelope over all six cases
econsim-v1 against the validators each campaign attacks, with their seeds and severities. The breach and missing-target runs are illustrative; corpora, harness provenance, and the CI facet are left out.Every case carries its explicit limits beside its assertion, so the class name cannot imply a broader control. collusion-bid-ring qualifies the integrity of each bid and acceptance; it does not claim to detect collusion. settlement-dos qualifies one receipt’s retry sequence; it does not bound queue size or worker throughput.
Attacks on a sum meet an account that admits atomically
Two campaigns attack totals rather than requests. credit-exhaustion races many small obligations against one facility, and fee-structuring slices a fee that needs a person into calls that each stay under the line. A per-request check passes every step of both, so each class targets an account that admits inside one transaction.
Credit admission keeps one account per debtor, scope, and currency, and reserves a new obligation only when open plus reserved plus the proposed amount stays within the smallest applicable signed ceiling. Cumulative approval keeps one account per budget authority: RequireCumulativeApprovalAbove adds each call to the authorized total in the transaction that reserves its hold, and the first call that reaches the threshold waits in PendingApproval for a person. The per-request RequireApprovalAbove constraint never counts toward that account.
The campaigns race both accounts. Two requests of 60 against a ceiling of 100 admit one, and among concurrent sub-threshold calls exactly one crosses into pending approval.
A run is a function of its seed and corpus
A scenario file names its class, a nonzero seed, the requirements it defends, its assertion and limits, and the severity a breach carries:
profile_id = "econsim-v1"
corpus_manifest = "corpus-manifest.json"
[[scenario]]
class = "oracle-divergence"
seed = 180749
requirement_ids = ["AE-ORACLE-DIVERGENCE-1", "AE-ORACLE-FRESHNESS-1"]
assertion_scope = "over-threshold divergence and future or stale exchange-rate evidence fail closed"
explicit_limits = ["does not establish oracle availability", "internal qualification only"]
finding_severity = "critical"The engine draws from a ChaCha20 generator seeded with that value and runs on a virtual clock, with no wall-clock, thread-local, or network reads. Money is integer minor units and basis points, and checked arithmetic fails closed on overflow. The corpus is addressed by the SHA-256 of its canonical manifest, and one changed byte refuses the run. Run the profile and sign the matrix:
chio arena run ./econsim-v1.toml --matrix ./qualification-matrix.signed.json \
--signing-seed-file ./runner.seedprofile econsim-v1, corpus 2b71…0e9c, 6 scenario classes held sybil-pricing-ring-seed-104729 tier gate, credit limit held collusion-bid-ring-seed-130363 bid checks held credit-exhaustion-seed-155921 credit admission held oracle-divergence-seed-180749 divergence breaker, rate freshness held fee-structuring-seed-205759 cumulative approval held settlement-dos-seed-230761 retry bound matrix chio.econsim.qualification-matrix.v1, signed by runner key 7c41…d02e wrote ./qualification-matrix.signed.json
Replaying the profile reruns every campaign and compares the bytes:
chio arena replay econsim-v1replayed 6 scenarios from target/arena/econsim-v1/ matrix body 8e3a…51f0, byte-identical to the recorded run
Every case is Held, Finding, or TargetMissing
Held requires a bound target and an observed fail-closed disposition, with no severity. Finding requires an observed breach at the class’s fixed severity. TargetMissing requires an unbound target, no observed disposition, and severity high; it is never a pass and never a fabricated breach. A validator that panics on adversarial input is a critical finding whatever the class. Any other combination is rejected.
A finding is a bug in the workstream that owns the validator, filed against it. If a change to the divergence breaker let an over-threshold rate through, the same command would report:
finding oracle-divergence-seed-180749 critical breach at ensure_within_threshold
refused no matrix signed: unresolved critical finding
exit 1The matrix signs only what held
The signing boundary refuses a matrix that is missing a class, contains a TargetMissing case, or carries an unresolved high or critical finding. Before signing, the runner recomputes the digests of the source tree, the executable, the lockfile, the scenario manifest, and the corpus, and refuses with bound provenance changed before signing if any moved:
{
"schema": "chio.econsim.qualification-matrix.v1",
"profileId": "econsim-v1",
"harnessProvenance": {
"gitCommit": "6d29…49a0",
"sourceTreeState": "clean",
"executableDigest": "c09e…71b4",
"corpusManifestDigest": "2b71…0e9c",
"runnerKeyId": "7c41…d02e"
},
"cases": [
{
"scenarioId": "oracle-divergence-seed-180749",
"expectedDisposition": "fail-closed",
"observedDisposition": "fail-closed",
"targetStatus": "bound",
"outcome": "held"
}
]
}The matrix is a SignedExportEnvelope. Its signature authenticates the runner and binds the digests it declared, and it is internal qualification: it supplies no independent observation of what executed, and underwriting does not accept it as evidence.
Evolve searches for the campaign that breaks a validator
A fixed seed qualifies one campaign. chio arena evolve breeds a population of campaigns for one class across generations, keeping the fittest, crossing and mutating the rest, and scores each by how far it gets past the validator. A breach it finds is a finding at the class’s severity, recorded with the seed that reproduces it:
chio arena evolve ./fee-structuring.toml --generations 20generation 20 of 20, gate bounded:200_generations_or_30_minutes best survival 0.00, every campaign reached pending approval outcome held, no breach found in 20 generations leaderboard target/arena/fee-structuring/leaderboard.json
The bounded-budget gate stops a search at 200 generations or 30 minutes, whichever comes first. The security arena uses the same loop against the guard pipeline; the arena covers its replay contract and promotion path.