From f08df8ffea5be590ebc255e7d1945351c14674eb Mon Sep 17 00:00:00 2001 From: suhani Date: Tue, 25 Aug 2026 23:47:09 +0530 Subject: [PATCH 1/3] Correct screen and button names in the demo script and one-pager --- docs/DEMO_SCRIPT.md | 10 +++++----- docs/ONE_PAGER.md | 9 +++++---- docs/RESPONSIBLE_AI.md | 2 +- docs/images/.gitkeep | 0 docs/images/README.md | 15 +++++++++++++++ 5 files changed, 26 insertions(+), 10 deletions(-) create mode 100644 docs/images/.gitkeep create mode 100644 docs/images/README.md diff --git a/docs/DEMO_SCRIPT.md b/docs/DEMO_SCRIPT.md index cde4b75..9d8b3e7 100644 --- a/docs/DEMO_SCRIPT.md +++ b/docs/DEMO_SCRIPT.md @@ -19,33 +19,33 @@ snapshot and an "offline" badge; the demo still works. ## Beat 1 - the premise (30s) -On the **Arena** screen, click **JUDGE DEMO MODE**. Read the first caption aloud: autonomous +On the **Arena** screen, click **Caption walkthrough**. Read the first caption aloud: autonomous agents now initiate payments, so fraud becomes an adaptive, machine-speed adversary. Point at the KPI bar: escape rate and attacker ROI are the two numbers that matter, and both should fall. ## Beat 2 - the loop runs (45s) -Let demo mode advance, or press **RUN CO-EVOLUTION** for a live run. Narrate: the red team +Let the caption walkthrough advance, or press **Start live loop** for a live run. Narrate: the red team escapes through specific modes (call them out from the ticker), the blue team retrains from immune memory, and the **regression gauntlet** blocks a model that would have regressed. That rollback is the point: we never ship a weaker defence. ## Beat 3 - the attack, in plain English (30s) -Open **Threat Board**, filter to **Agentic Commerce**. These four scenarios model +Open **Threats**, filter to **Agentic Commerce**. These four scenarios model agent-initiated fraud: mandate drift, checkout takeover, agent-swarm probing, destination redirection - all behavioural-metadata-only, no recipes. Open **Lineage**, click a node, and read the one-paragraph brief so judges see the attack described in words, not just genes. ## Beat 4 - the defence is explainable (20s) -Open **Investigation**. Pick a flagged transaction. Show the SHAP reason codes and the +Open **Cases**. Pick a flagged transaction. Show the SHAP reason codes and the counterfactual: "if the payee were not new, risk drops by N points." This is what an analyst would act on. ## Beat 5 - it is honest (25s) -Open **Governance**. The run history is a hash chain. Click **Verify chain**: green. Say that +Open **Audit**. The run history is a hash chain. Click **Verify chain**: green. Say that any edit to history would break the chain on the next verification. Then mention the data credibility benchmark (`python -m hydraloop bench`) that reports discriminator AUC and TSTR / TRTS against a shifted or real reference, so we measure fidelity instead of asserting it. diff --git a/docs/ONE_PAGER.md b/docs/ONE_PAGER.md index cbcd561..4911186 100644 --- a/docs/ONE_PAGER.md +++ b/docs/ONE_PAGER.md @@ -33,10 +33,11 @@ security. It has three parts locked in a closed loop. ## What you can see in three minutes -Arena (the loop running live), Threat Board (28 abstracted scenarios across 7 families), -Attack Genome Lineage (the mutation trail with plain-English briefs), Investigation (SHAP -reason codes plus a counterfactual), Scoreboard (escape rate and recall by generation), and -Governance (verify the hash chain on stage). +Lab (type any threat description and watch Identify to Detect run step by step), +Arena (the loop running live), Threats (28 abstracted scenarios across 7 families), +Lineage (the mutation trail with plain-English briefs), Cases (SHAP reason codes plus a +counterfactual), Metrics (escape rate and recall by generation), and Audit +(verify the hash chain on stage). ## Results to point at diff --git a/docs/RESPONSIBLE_AI.md b/docs/RESPONSIBLE_AI.md index 6ce7493..8f30d12 100644 --- a/docs/RESPONSIBLE_AI.md +++ b/docs/RESPONSIBLE_AI.md @@ -61,7 +61,7 @@ invalid, so the generator cannot emit anything outside the abstraction policy. Each generation is written to an append-only, hash-chained ledger. Every entry embeds the previous entry's digest, so any edit to run history is detectable on the next verification. The -Governance screen recomputes the chain live and reports a break if one exists. The +Audit screen recomputes the chain live and reports a break if one exists. The `run_manifest.json` records the config hash so results trace back to the exact configuration. ## Human oversight of the defence diff --git a/docs/images/.gitkeep b/docs/images/.gitkeep new file mode 100644 index 0000000..e69de29 diff --git a/docs/images/README.md b/docs/images/README.md new file mode 100644 index 0000000..269f1b4 --- /dev/null +++ b/docs/images/README.md @@ -0,0 +1,15 @@ +# Demo assets + +Place judge-facing UI assets here before opening the PR: + +- 2 to 3 screenshots (PNG/JPG) +- 1 short Lab run GIF + +Recommended names used by the main README: + +- lab-live-run.gif +- arena-loop.png +- cases-explainability.png +- audit-chain.png + +You can rename these, but update the image links in ../README.md to match. From 450ec3edbb0acb15b25ebdf5fe6cc4132da68b92 Mon Sep 17 00:00:00 2001 From: suhani Date: Tue, 25 Aug 2026 23:49:07 +0530 Subject: [PATCH 2/3] Add screenshots and a Lab run gif to the readme --- README.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/README.md b/README.md index 5fa1e83..3c21883 100644 --- a/README.md +++ b/README.md @@ -5,6 +5,16 @@ HydraLoop is a synthetic, sandboxed, co-evolutionary adversarial payment security lab for the era of **agentic commerce**. +## Visual demo + +Add the assets below in `docs/images/` before merging this branch so judges can see +the UI immediately when they open the repository. + +![Lab live run (streaming)](docs/images/lab-live-run.gif) +![Arena loop view](docs/images/arena-loop.png) +![Cases explainability view](docs/images/cases-explainability.png) +![Audit hash-chain verification](docs/images/audit-chain.png) + ## Why now Autonomous agents are starting to make payments on people's behalf. That collapses the From 5cc17031692a7a39b570c0ca4655c445d04ce332 Mon Sep 17 00:00:00 2001 From: suhani Date: Tue, 25 Aug 2026 23:50:24 +0530 Subject: [PATCH 3/3] Explain both causes when a Lab run cannot reach the API --- ui/components/Lab.tsx | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/ui/components/Lab.tsx b/ui/components/Lab.tsx index c67a3d4..39db0df 100644 --- a/ui/components/Lab.tsx +++ b/ui/components/Lab.tsx @@ -56,7 +56,12 @@ function unreachableBackendHint(): string { typeof window !== "undefined" && ["localhost", "127.0.0.1"].includes(window.location.hostname); if (local) { - return "The API is not running. In a second terminal: activate .venv, then run python -m hydraloop api"; + return ( + "The Lab could not reach the API. Usually this is either (1) the API is not running, or " + + "(2) the browser blocked the request because the UI is on a different localhost port. " + + "Check the UI URL port in the address bar, then open http://127.0.0.1:8000/api/health in a new tab. " + + "If health fails, start the API in a second terminal: activate .venv, then run python -m hydraloop api." + ); } return ( "This deployment has no live backend attached, so the pipeline cannot run here. " +