DEMO-HACK: a news API that refuses fossils

DEMO-HACK keeps a familiar REST/JSON news poll surface and changes only the authority object. The client does not hold a reusable news API key. Each call builds a one-shot twin proof bound to the request, then the server burns the nonce before it validates.

On the allow path the transcript tags read canon → challenge → respond → envelope → burn → verdict. Headlines are the toy; verifier-before-application is the curriculum.

Reject stages are how the gate teaches. A retargeted endpoint fails endpoint binding. A loosened policy fails policy-hash against a server-side POLICY_STRING. A byte-identical replay fails at nonce because burn-before-validate already spent the identifier.

You can follow the same story in the site walkthrough at /demos/hack, including placeholder slots for screenshots still being captured from the Compose pack.

When you are ready to falsify your own deployment, ENI6MA Verify packages the same allow and reject checks as a customer-runnable suite, without publishing residual-risk tables on the marketing site.