// reproducibility bench
proof bench
Every forensic engine output below is pinned to a committed golden file. On every commit, npm run check:flagship re-runs each engine against the same fixed synthetic inputs and fails the build if a single byte of output drifts. This page is that gate, made public — a skeptic’s view of exactly what is proven.
- 728goldens re-verified / commit
- 107reference scenarios
- 294distinct forensic tools
how this stays honest
Two layers of determinism, both gated in CI:
- engine layer — these 728 goldens. Same build SHA + same inputs → byte-identical output, or the build fails. This table is generated from the goldens and drift-checked by
npm run forensics:verify-proof-bench, so it can never overstate what is tested. - session layer — a case can export a
case.replay.jsonrecipe (tool · version · build SHA · input + expected output SHA-256). See validation methodology. - parser layer — renaming or removing a recognized vendor field, or regressing a fidelity verdict, fails CI via the drift detector. Honest per-parser grades live on the parser-grade ledger.
Scope: all inputs are synthetic. Goldens prove the engines are deterministic and unchanged — they are not a claim that an engine is exhaustive. The fidelity ledger is where coverage is graded honestly.
scenario goldens (107)
sorted by golden count — the most-exercised scenarios first. each engine run is re-verified against the scenario’s pinned synthetic evidence.
- arias-deepfake-investigation — anchor impersonation deepfake8 goldens13 evidence files
- ashby-equity-grant-audit — off-cycle grant to terminated employee8 goldens9 evidence files
- carta-equity-cap-table-export-forensic-analyzer
- case-report-generator
- cross-equity-payroll-exercise-correlator
- equity-409a-manipulation-detector
- equity-unauthorized-grant-change-detector
- equity-vesting-backdate-detector
- multi-equity-platform-timeline-correlator
- shareworks-equity-admin-audit-log-forensic-analyzer
- ashford-ddos-investigation — edge SYN flood + access log burst8 goldens3 evidence files
- bec-sterling — reference investigation8 goldens3 evidence files
- brennan-payroll-fraud — ghost employee + routing swap cluster8 goldens9 evidence files
- brenner-api-key-leak — git leak → cloud abuse chain8 goldens5 evidence files
- brightwater-ransomware — Akira at a water utility8 goldens7 evidence files
- brooks-ipv-tech — partner tracking / coercive tech trail8 goldens8 evidence files
- android-google-timeline-artifact-forensic-extractor
- android-gps-location-history-forensic-extractor
- bluetooth-pairing-history-forensic-extractor
- ios-frequent-locations-artifact-analyzer
- ios-location-history
- ios-location-history-reconstructor
- ios-significant-locations-forensic-extractor
- wifi-connection-history-forensic-extractor
- chen-ai-content-dispute — campaign AI authorship dispute8 goldens8 evidence files
- ai-generated-code-provenance-analyzer
- ai-generated-image-metadata-stripper-detector
- ai-generated-image-provenance-analyzer
- ai-generated-text-fingerprint-analyzer
- automatic1111-artifact-forensic-extractor
- comfyui-workflow-forensic-analyzer
- gan-fingerprint-detector
- stable-diffusion-generation-metadata-extractor
- chen-ipv-tech — employee location corroboration bundle8 goldens8 evidence files
- android-google-timeline-artifact-forensic-extractor
- android-gps-location-history-forensic-extractor
- bluetooth-pairing-history-forensic-extractor
- ios-frequent-locations-artifact-analyzer
- ios-location-history
- ios-location-history-reconstructor
- ios-significant-locations-forensic-extractor
- wifi-connection-history-forensic-extractor
- cobalt-phishing-campaign — university credential lure8 goldens6 evidence files
- cole-invoice-fraud — vendor lookalike + tampered invoice PDF8 goldens6 evidence files
- coleman-deepfake-investigation — executive impersonation cluster8 goldens13 evidence files
- delacroix-insider-exfil — departing analyst genomic IP theft8 goldens11 evidence files
- delgado-vendor-bec — vendor impersonation wire fraud8 goldens3 evidence files
- diaz-gig-payout-fraud — phantom delivery payout redirect8 goldens9 evidence files
- case-report-generator
- cross-payroll-wfm-timesheet-correlator
- fatcousin-cross-export-ioc-hash-correlator
- payment-processor-subpoena-response-normalizer-paypal
- payment-processor-subpoena-response-normalizer-stripe
- payroll-unauthorized-adjustment-detector
- screening-identity-mismatch-detector
- venmo-transaction-export-forensic-analyzer
- elliot-election-integrity — election-night spoof + ballot tampering trail8 goldens8 evidence files
- ellis-cyberstalking — multi-platform harassment and doxing8 goldens13 evidence files
- fischer-healthcare-breach — PHI exfil + audit gap cluster8 goldens7 evidence files
- foster-romance-scam — Bumble-to-payment grooming8 goldens8 evidence files
- ai-generated-image-provenance-analyzer
- android-telegram-database-forensic-extractor
- android-whatsapp-database-forensic-analyzer
- ios-cash-app-artifact-forensic-extractor
- ios-dating-app-artifact-forensic-extractor
- ios-telegram-artifact-forensic-extractor
- ios-venmo-artifact-forensic-extractor
- ios-whatsapp-artifact-forensic-extractor
- grant-election-integrity — election-night spoof + ballot tampering trail8 goldens8 evidence files
- grayson-tech-support-scam — fake Microsoft pop-up remote access8 goldens9 evidence files
- hale-tech-support-scam — fake Amazon Prime Security remote access8 goldens9 evidence files
- harbor-ato — help-desk vishing + MFA-reset takeover8 goldens6 evidence files
- harrington-smart-home-compromise — multi-vendor IoT intrusion cluster8 goldens8 evidence files
- hartley-lost-stolen-device — corporate device post-recovery triage8 goldens13 evidence files
- android-factory-reset-artifact-detector
- ios-app-install-uninstall-timeline-reconstructor
- ios-jailbreak-artifact-detector
- ios-pairing-record-forensic-analyzer
- login-session-reconstructor
- mobile-device-pairing-record-analyzer
- mobile-factory-reset-evidence-artifact-detector
- mobile-remote-wipe-artifact-detector
- hartmann-cloud-compromise — M365 OAuth consent abuse8 goldens7 evidence files
- hayes-sextortion — email + mobile threat + BTC demand8 goldens8 evidence files
- helix-supply-chain-compromise — CI build pipeline poison8 goldens6 evidence files
- hughes-trade-secret-theft — USB/CAD exfil before competitor exit8 goldens11 evidence files
- kim-online-doxxing — paste-site + social amplification doxxing8 goldens7 evidence files
- kim-workplace-harassment — Slack/Teams/email harassment cluster8 goldens10 evidence files
- kline-insider-exfil — departing engineer IP theft8 goldens11 evidence files
- lyons-global-mobility-audit — unauthorized assignment + tax abuse cluster8 goldens9 evidence files
- cartus-relocation-export-forensic-analyzer
- case-report-generator
- cross-mobility-payroll-relocation-correlator
- mobility-relocation-cost-inflation-detector
- mobility-tax-equalization-abuse-detector
- mobility-unauthorized-assignment-change-detector
- multi-mobility-platform-timeline-correlator
- topia-global-mobility-export-forensic-analyzer
- meadowlark-oauth-consent — rogue OAuth consent abuse8 goldens7 evidence files
- mercer-healthcare-breach — PHI exfil + audit gap cluster8 goldens7 evidence files
- meridian-ato — credential spray + SIM swap takeover8 goldens6 evidence files
- meridian-trade-secret-theft — departing engineer exfil trail8 goldens11 evidence files
- miranda-pig-butchering — long-con investment scam8 goldens8 evidence files
- morales-sextortion — email + mobile threat + BTC demand8 goldens8 evidence files
- morgan-whistleblower-retaliation — ethics dismissal + retaliation cluster8 goldens9 evidence files
- case-report-generator
- cross-er-hrsd-case-correlator
- cross-ethics-hcm-retaliation-correlator
- ethics-retaliation-pattern-detector
- ethics-unauthorized-case-dismissal-detector
- hr-acuity-investigation-export-forensic-analyzer
- navex-ethics-hotline-export-forensic-analyzer
- servicenow-hrsd-case-export-forensic-analyzer
- nash-invoice-fraud — vendor lookalike + tampered invoice PDF8 goldens6 evidence files
- nexus-cryptojacking — batch worker NBMiner miner8 goldens5 evidence files
- northwind-ddos-investigation — volumetric DDoS post-event bundle8 goldens3 evidence files
- northwind-phishing-campaign — two-wave credential lure8 goldens6 evidence files
- novak-api-key-leak — git leak → cloud abuse chain8 goldens5 evidence files
- okafor-global-mobility-audit — unauthorized assignment + tax abuse cluster8 goldens9 evidence files
- cartus-relocation-export-forensic-analyzer
- case-report-generator
- cross-mobility-payroll-relocation-correlator
- mobility-relocation-cost-inflation-detector
- mobility-tax-equalization-abuse-detector
- mobility-unauthorized-assignment-change-detector
- multi-mobility-platform-timeline-correlator
- topia-global-mobility-export-forensic-analyzer
- okonkwo-whistleblower-retaliation — ethics report adverse-action cluster8 goldens9 evidence files
- case-report-generator
- cross-er-hrsd-case-correlator
- cross-ethics-hcm-retaliation-correlator
- ethics-retaliation-pattern-detector
- ethics-unauthorized-case-dismissal-detector
- hr-acuity-investigation-export-forensic-analyzer
- navex-ethics-hotline-export-forensic-analyzer
- servicenow-hrsd-case-export-forensic-analyzer
- ortiz-ai-content-dispute — influencer AI authorship dispute8 goldens8 evidence files
- ai-generated-code-provenance-analyzer
- ai-generated-image-metadata-stripper-detector
- ai-generated-image-provenance-analyzer
- ai-generated-text-fingerprint-analyzer
- automatic1111-artifact-forensic-extractor
- comfyui-workflow-forensic-analyzer
- gan-fingerprint-detector
- stable-diffusion-generation-metadata-extractor
- osborne-pig-butchering — long-con investment scam8 goldens8 evidence files
- park-disgruntled-exit — last-day endpoint sabotage8 goldens11 evidence files
- parker-workplace-harassment — Slack/Teams/email harassment cluster8 goldens10 evidence files
- perez-mobile-triage — homicide-assist mobile bundle8 goldens10 evidence files
- quinn-equity-grant-audit — unauthorized grant + 409A manipulation cluster8 goldens9 evidence files
- carta-equity-cap-table-export-forensic-analyzer
- case-report-generator
- cross-equity-payroll-exercise-correlator
- equity-409a-manipulation-detector
- equity-unauthorized-grant-change-detector
- equity-vesting-backdate-detector
- multi-equity-platform-timeline-correlator
- shareworks-equity-admin-audit-log-forensic-analyzer
- ransomware-acme-corp — reference investigation8 goldens7 evidence files
- reed-smart-home-compromise — multi-vendor IoT intrusion cluster8 goldens8 evidence files
- rivera-mobile-triage — consent-based phone triage8 goldens10 evidence files
- rivers-romance-scam — Bumble-to-payment grooming8 goldens8 evidence files
- ai-generated-image-provenance-analyzer
- android-telegram-database-forensic-extractor
- android-whatsapp-database-forensic-analyzer
- ios-cash-app-artifact-forensic-extractor
- ios-dating-app-artifact-forensic-extractor
- ios-telegram-artifact-forensic-extractor
- ios-venmo-artifact-forensic-extractor
- ios-whatsapp-artifact-forensic-extractor
- sable-hr-platform-audit — after-hours HCM admin abuse8 goldens9 evidence files
- case-report-generator
- cross-hcm-payroll-headcount-correlator
- hcm-unauthorized-job-change-detector
- multi-hcm-platform-timeline-correlator
- onboarding-unauthorized-task-skip-detector
- oracle-hcm-cloud-audit-log-forensic-analyzer
- sap-successfactors-ec-export-forensic-analyzer
- workday-hcm-audit-log-forensic-analyzer
- sutter-disgruntled-exit — last-day endpoint sabotage8 goldens11 evidence files
- tanaka-payroll-fraud — ghost employee + routing swap cluster8 goldens9 evidence files
- thorne-document-forgery — contract authenticity dispute8 goldens4 evidence files
- tran-online-doxxing — paste-site + social amplification doxxing8 goldens7 evidence files
- vance-hr-platform-audit — unauthorized HCM job changes + onboarding skip8 goldens9 evidence files
- case-report-generator
- cross-hcm-payroll-headcount-correlator
- hcm-unauthorized-job-change-detector
- multi-hcm-platform-timeline-correlator
- onboarding-unauthorized-task-skip-detector
- oracle-hcm-cloud-audit-log-forensic-analyzer
- sap-successfactors-ec-export-forensic-analyzer
- workday-hcm-audit-log-forensic-analyzer
- vega-cryptojacking — dev server XMRig miner8 goldens5 evidence files
- voss-wallet-drain — approve-for-all drainer + sweeper8 goldens9 evidence files
- walden-document-forgery — contract authenticity dispute8 goldens4 evidence files
- walsh-lost-stolen-device — post-recovery device triage8 goldens13 evidence files
- android-factory-reset-artifact-detector
- ios-app-install-uninstall-timeline-reconstructor
- ios-jailbreak-artifact-detector
- ios-pairing-record-forensic-analyzer
- login-session-reconstructor
- mobile-device-pairing-record-analyzer
- mobile-factory-reset-evidence-artifact-detector
- mobile-remote-wipe-artifact-detector
- walton-crypto-theft — approve-for-all drainer + sweeper8 goldens9 evidence files
- kepler-runaway-agent — sre-deployed agent scope creep + s3 exfil7 goldens7 evidence files
- morgan-cyberstalking — multi-platform harassment and doxing7 goldens12 evidence files
- orion-runaway-agent — sre-deployed agent scope creep + s3 exfil7 goldens7 evidence files
- pacifica-dark-maritime — AIS dark period + STS transfer near sanctioned port7 goldens8 evidence files
- vessel-dark-maritime — AIS dark period + STS transfer near sanctioned port7 goldens8 evidence files
- apex-prompt-injection — indirect injection via RAG-retrieved document6 goldens5 evidence files
- cedar-medical-device-tamper — insulin pump config change + alarm suppression6 goldens5 evidence files
- lindqvist-medical-device-tamper — insulin pump config change + alarm suppression6 goldens5 evidence files
- orchid-mcp-server-compromise — supply-chain tamper on self-hosted MCP6 goldens6 evidence files
- summit-mcp-server-compromise — supply-chain tamper on self-hosted MCP6 goldens6 evidence files
- vertex-prompt-injection — indirect injection via RAG-retrieved document6 goldens5 evidence files
- ashley-creator-safety — NCII leak + stalker DM trail5 goldens5 evidence files
- cascade-livestream-impersonation — Twitch OAuth grant abuse + deepfake stream5 goldens6 evidence files
- flatridge-minor-sextortion — financial sextortion targeting a 16-year-old5 goldens5 evidence files
- nova-livestream-impersonation — Twitch OAuth grant abuse + deepfake stream5 goldens6 evidence files
- oakridge-minor-sextortion — financial sextortion targeting a 15-year-old5 goldens5 evidence files
- patel-report-fraud — tech-support scam → IC3 + FTC prep kit5 goldens3 evidence files
- reese-creator-safety — NCII leak + stalker DM trail5 goldens5 evidence files
- sarah-android — sideloaded accessibility-abuse stalkerware5 goldens3 evidence files
- walters-report-fraud — tech-support scam → IC3 + FTC prep kit5 goldens3 evidence files
- cascade-idp-breach — cloud IdP org compromise → OAuth persistence4 goldens4 evidence files
- kestrel-transfer-exfil — managed-file-transfer SQLi exfil4 goldens5 evidence files
- nguyen-source-protection — Signal + SIM-swap compromise of a leak channel4 goldens4 evidence files
- oakwood-vacant-lot-deed-forgery — corelogic deed chain + spoofed seller thread4 goldens5 evidence files
- reyes-source-protection — Signal + SIM-swap compromise of a leak channel4 goldens4 evidence files
- ridgeline-transfer-exfil — MFT exploit → mass exfil4 goldens5 evidence files
- summit-idp-breach — cloud IdP org compromise → OAuth persistence4 goldens4 evidence files
- whitfield-deed-forgery — corelogic deed chain + spoofed seller thread4 goldens5 evidence files
- cedar-nursing-home-records-audit — PCC/MatrixCare/ALIS exploitation cluster3 goldens3 evidence files
- chen-gig-payout-fraud — DoorDash payout redirect via ghost driver3 goldens3 evidence files
- k12-cyberbullying-flatridge-middle — gaggle/bark/powerschool IR cluster3 goldens3 evidence files
- ltc-ombudsman-referral-riverside-manor — PCC/MatrixCare/ALIS exploitation cluster3 goldens3 evidence files
- meadowbrook-cyberbullying-middle — gaggle/bark/powerschool IR cluster3 goldens3 evidence files
- ridgeview-wire-fraud-closing — qualia/docusign/MT103 closing cluster3 goldens3 evidence files
- sarah-ios — iOS pairing + profile abuse3 goldens3 evidence files
- wire-fraud-at-closing-oakwood-estates — qualia/docusign/MT103 closing cluster3 goldens3 evidence files
- cruz-labor-trafficking — agricultural crew wage withholding2 goldens2 evidence files
- santos-labor-trafficking — WhatsApp recruitment trail + payroll withholding2 goldens2 evidence files