Forged receipts, fired at the verifier this project ships

Try to get one past it.

Each attack below builds a genuinely signed receipt — real P-256 keys, real signatures — and then edits it the way a coordinator with a motive would. An attack that changes what the receipt means must be rejected. Seven of these were accepted until an external audit found them, and the two that matter most are the ones that made a deleted charge look like a commitment that never happened.

These run in this tab, against the same concord/receipt.mjs the coordinator and npx concord-verify use. Nothing is sent anywhere. The same forge runs headless in CI as npm run attacks, and a single acceptance fails the build.