OODA-HTTP / Engine & lab

Demonstration

Explore a fictional application scenario and a separate assessment and reporting flow.

Browser illustration. The controls explain scenarios using fixed examples. They do not execute the C engine or replay a recorded run. See documented local evidence →
Application security demonstration

Who denied the request?

Choose an illustrative scenario. These examples run entirely in your browser; they do not send attacks, call the engine, or replay preserved test results.

Alice requests a record.

The fictional application allows users to read their own records. Change the resource to inspect application authorization. The separate assessment and reporting walkthrough below explains assessment scenarios.

Illustrative rules and explanations. No defensive-benefit claim.

Illustrative outcome

200 · Application permits the read

Actor: alice · Target: alice's record

Authority: the application checks ownership.

Assessment: evidence can be examined separately; this browser example does not produce an engine verdict.

Optional local reporting experiment

What reaches the recipient?

This selector explains documented scenarios. It does not run C, establish TLS, send requests, or replay captured evidence.

  1. CLI recipient → HTTPS sender: mTLS POST /attempt with an exchange ID.
  2. Sender → separate HTTP scene: run GET /public; the response completes and journals close.
  3. Pinned controller → frozen C subprocess: project evidence, then receive the selection or diagnostics.
  4. Sender → CLI recipient: return a later HTTP response bound to the exchange and original scene run/request.

Select a reporting scenario.

Explanatory display of Revision 3 outcomes; not a live experiment.

Documented scenario / explanatory display

Clean

Enforcement-Action field absent

Agreement; no additional proposal. This is not ALLOW.

Recipient: parses and records. No forwarding or control execution.

monitor communicates a selected fixture proposal. It does not mean monitoring began. The original GET /public response already completed; the field belongs to the later reporting response.