Demo transcript — a planted key, caught
Text (and audio-free) transcript of the looping demo recording
on the landing page. Every line below is the real output of the
shipped persist example against a scratch
directory; nothing is staged or mocked.
$ ssh-keygen -q -t ed25519 -N "" -f real_key $ cp real_key.pub authorized_keys $ cargo run --example persist -- \ --scan-dir /tmp/kd-demo --baseline /tmp/kd-demo.baseline.json learned the world; baseline persisted to /tmp/kd-demo.baseline.json $ ssh-keygen -q -t ed25519 -N "" -f rogue # the attacker key $ cat rogue.pub >> authorized_keys $ cargo run --example persist -- \ --scan-dir /tmp/kd-demo --baseline /tmp/kd-demo.baseline.json added private_key /tmp/kd-demo/rogue [SHA256:1Q1d9nQKJNGYVrAFH59K/AaFKbS8FfVeNL38tmuqgq8] added public_key /tmp/kd-demo/rogue.pub [SHA256:1Q1d9nQKJNGYVrAFH59K/AaFKbS8FfVeNL38tmuqgq8] added authorized_keys /tmp/kd-demo/authorized_keys [SHA256:1Q1d9nQKJNGYVrAFH59K/AaFKbS8FfVeNL38tmuqgq8] $ cargo run --example persist -- \ --scan-dir /tmp/kd-demo --baseline /tmp/kd-demo.baseline.json # again no changes since the persisted baseline
One rogue key, three events, one fingerprint: the attacker's
private file, its public half, and the
authorized_keys line it was appended to are all the
same key wearing three paths — each is reported, none is
doubled. The follow-up scan is the point of the product: after
the change is acknowledged, steady state is silent.