Evidence / 0.0.2 testnet alpha

A spending boundary
you can inspect.

The agent followed the malicious instruction. The ledger enforced what its account could reach.

Inspect the records ↓Download evidence JSON ↗

01 / The setup

Separate funds.
Separate authority.

Owner

Vault

Never delegates
to the agent.

Budget

Allowance

Only released funds
are reachable.

Authority

Agent key

Delegated types.
Separate fee float.

Capped, expiring Checks support refills. Exposure includes spendable allowance, reachable refills and the agent's fee float. Unspent releases can accumulate.

02 / The ledger receipts

Three records.
Read them yourself.

From the same recorded run, in ledger order. The agent is scripted to obey the injection every time. This does not measure how often a real model is compromised.

An oversized payment

tecUNFUNDED_PAYMENT

199.999952 XRP requested No payment funds delivered

93430C5A36738E48…ED9EBBCB ↗Validated ledger 21,707,458

The reachable allowance

tesSUCCESS

10.00 XRP requested The attacker receives 10 XRP

D9B097D31C7B2285…9F1E4755 ↗Validated ledger 21,707,465

Owner revokes authority

tesSUCCESS

DelegateSet · no permissions Delegation removed

E0D86B2DBEE60DF7…384D7FDA ↗Validated ledger 21,707,467

An empty delegated permission list confirms the revocation transaction. It does not prove that all future transactions were attempted or validate a general recovery guarantee.

03 / Reproduce the inspection

Check the record.
No wallet needed.

Download the verifier below. This command reads the three transaction records and checks validation, type, engine result and relevant fields. Requires Node.js and curl.

node verify-evidence.mjs

No keys, faucet or ledger writes. Download the read-only verifier ↗

Inspect a transaction directly with curl

curl https://s.altnet.rippletest.net:51234/ \
  -H 'Content-Type: application/json' \
  --data '{"method":"tx","params":[{"transaction":"D9B097D31C7B22850CCE46772C517FF664579FE1B116FB1B24E01E8E9F1E4755","binary":false}]}'

Public testnet history can disappear after resets. A missing record is unverified, not a pass. The evidence JSON preserves the expected fields and check date.

04 / Release verification

Built and checked.
Still early.

118offline tests passed

4npm packages at 0.0.2

0ledger writes in this check

Local build and offline tests checked on 21 October 2026. The release also passed isolated package, CLI, MCP and TypeScript consumer checks. This is internal verification, not an external security review.

Read the check summary ↗

05 / The boundary

What this does
and doesn't show.

The attacker received the reachable 10 XRP. Reins does not judge payment intent.
The 10 XRP figure belongs to this setup. Refills and accumulated balance change exposure.
Toolkit checks can be bypassed by an agent that controls its signing key.
Per-payment caps, payee allowlists and rolling velocity need the planned independent policy co-signer.
This is a testnet alpha. Independent security review remains a gate before mainnet.

Your next step

Start with an allowance.

Run the published CLI and follow the testnet quickstart.

Open the quickstart ↗