Six tool calls, one boundary - an interactive replay of the financial-services example

[zohebk8s]

I wanted to see the credit-risk example as a sequence rather than as terminal output, so I built a browser replay of it. Single HTML file, attached - no build, no server, works offline.

What you can do with it:

• Run the three scenarios (clean SME, large exposure, sanctions hit) and watch the six calls resolve one at a time at the boundary
• Toggle attestation evidence off and see the mnpi tool denied before the assessment even starts
• Toggle the workflow registration off and watch default-deny do its job
• Read the Cedar rule that fired, with the reason code and the regulation it cites, highlighted in policy declaration order
• Tamper with any entry in the audit chain and watch the Trust Record stop verifying

The one I find most worth showing people is the sanctions scenario. Step 2 is allowed - screening has to run - and it comes back with a UBO match, so CDD never clears. Steps 3 through 5 carry on and produce a rating, an exposure position, an IFRS 9 stage. Then step 6 is denied, on the state those steps produced rather than on anything in the request. The agent still attempts the write. It doesn't matter. That's the part that's hard to convey in a log.

What's real and what isn't:

Worth being precise about, since a simulator that quietly overstates itself is worse than no simulator:

• Genuinely computed in your browser: the LEI and IBAN check digits (ISO 7064 MOD 97-10), and the SHA-256 audit chain. The tamper test breaks a real hash chain and recomputes it forward from genesis - it isn't a scripted animation, which is why one edit invalidates that entry and every entry after it.

• Not real: the tool responses are the repo's fixtures. The Trust Record signature is simulated, not hardware-rooted, and attestation runs in dev-mode. The page says so inline in all three places rather than in a footnote.

Scenarios, thresholds, and regulation citations follow the financial-services

Sharing in case it's useful to anyone explaining this to a non-engineering audience - that's what I built it for.

Happy to hear if I've got any of the policy semantics wrong.

[zohebk8s]

cmcp-simulator.html