Zodiac Simulator

PROTOTYPE NOTES · FOR REFINEMENT

Color language: blue = policies and allowed execution · light-blue dashed = governance signatures · sand = risk and attack (the pre-handover direct-rule path stays sand-dashed, wordlessly) · violet = the guardian (council node, veto and exit edges, previewed in ghost state).
Cluster boxes contain each policy's members and targets, so internal lines never cross the canvas; the three gate edges leave the boxes and land on the treasury without touching anything.
Custom instant tooltips replace native ones; every text is state-aware (budgets, durations, edited settings appear live). Copy inventory lives in tipFor() in the script.
Editor modals tag only the v3 parameters, so the tag reads as "this is new" rather than as a version stamp on everything; untagged rows are Roles v2, in production today, and no tag appears in any tooltip or log line. Saving is instant before the timelock exists and queued after. Every add or signed edit glows the owners who signed it, then pings the timelock while it queues.
Threat simulator: eight vectors beside the graph, two of which are nobody's attack (a decimals bug of your own making, a protocol exploited somewhere else), which is why the panel is not called an attack simulator any more; each choreographed on the graph itself (alarms, timelock pings, violet veto flash). Every vector is always runnable and every one of them costs the bare setup: what changes is how much, and which piece stops it. The hint line says what is missing. Each scenario runs 3 to 6 beats with its own rhythm (escalating attempts, retries, a realization); per-beat delay is one number in runAttack.
The Emergency exit is the fourth policy and the argument for giving a machine a key: a monitoring service (Hypernative and the like) holds a role whose only capability is withdraw() with the destination pinned to the vault. It runs with no quorum and no queue, which is the whole point, and it is safe for exactly the same reason the other roles are. It also answers the objection to the timelock: a delay that protects you from your owners cannot rush them when a protocol you are in starts bleeding.
The Security Council plugs into the Timelock: the veto edge is drawn to it in every state, dashed until both pieces exist, so the preview says what a council is for before anyone builds one. The exit edge to the treasury is drawn the same way.
Wiring shown: the Timelock node is the Delay modifier plus, in reality, the operator Safe that sits behind it. That second Safe is deliberately hidden: one click installs "everything the owners sign now queues in public". Once it exists, the Security Council (4/7) is the treasury's 1/1 owner (exit = owner path, veto = owner-signed setTxNonce on the Delay) and the owners act only as a module through the Delay. Verify the v3 mapping of every tagged parameter. Numbers illustrative.
Start state: a single key (1/1), no roles, so whoever holds it can do anything alone. The One key node pulses a slow white glow until it is upgraded, as the cue for the first click. The upgrade makes it a 2-of-5 owner Safe, and that click is the only thing that changes the owner set: building a policy never touches it, except Payroll, which takes Mia out of it (she does payroll, so she stops holding a key that can do everything, and the Safe goes to 4 owners; built before the upgrade, Payroll simply never gives her a seat). Deposits ships with Ana and Ben as members, so their most frequent transaction stops needing an owner key or a second signature. On that start state every vector lands: key theft, a tricked signature, the DeFi app hack and the wallet front-end hack drain everything; address poisoning walks off with an engineer's $25,000 payday; the decimals bug loses $18M to price impact. Building Ben, External, Morpho or Lido auto-builds Deposits.
The Zodiac wordmark (brand SVG paths, no mark) fades into the top-left of the graph when the first Zodiac component is built and leaves on start over.
"Lazarus infiltrated your organization" replaces the plain owner-key-stolen vector (SEAL: DPRK IT workers section, DPRK playbook): same threshold-one mechanics, infiltrator narrative, quorum ending points at the complacency vector. No vector is ever greyed out: each one reads the setup and finds the weakest thing that is actually there. "Key gets stolen" first tests a setting the reader opened (withdrawals or swap proceeds not pinned to the vault cost the position or a week of budget), then walks payroll → deposits → agent session key → owner key, and every owner-signature vector runs the same three endings (no timelock, timelock without a council, timelock plus council) whether the threshold is 1 or 2; no tile is marked as the expected one: the list is flat on purpose, so nothing tells the reader which attack their setup is currently losing to.
Three vectors that no amount of governance fixes, only a policy. Address poisoning: a dust transfer from a look-alike address seeds the history, and a queue plus a veto is human review, which is exactly what the attack is built to pass; only the Team wallets whitelist reverts it. Amount encoded with wrong decimals: the org's own rebalancing agent encodes a USDC amount with 12 decimal places instead of 6, so a $25 order goes out as a $25,000,000 one, and no council catches that, because the transaction is a legitimate swap to an allowed venue whose only tell is a number of zeros nobody can eyeball at 03:12; only the Rebalance budget and the WithinRatio bound revert it. Its verdict stamps LOST, not HACKER GOT: nobody attacked. Protocol smart contract exploit: the bug is in someone else's contract and the only defence is speed, which humans do not have; the Emergency exit role does.
Verdict colours: green for $0, red for anything gone (a full drain stamps REKT, a partial loss stamps the amount, and the vault's own numbers go red with it), sand only for the third verdict, AT RISK (sand): the vault stays full but is "one careless signature away"; used by the Lazarus run, by a stolen owner key under a bare quorum, and by the wallet-app hack once policies exist (the daily flow is off the app, the owner path is not). Only the timelock plus council turns it green.
Sharing: the bar under the cards and "share this run" in the console. After a run the bar shows a PNG card of the result, drawn on a canvas at 2x (1200x675 CSS px) from the page's own fonts and the wordmark paths: three lines only, the threat, the verdict as large as it fits, and the setup in one mono line, so it still reads at phone width in a timeline. "Share on X" and "Share on LinkedIn" copy that image to the clipboard (ClipboardItem) and open the intent, so one paste attaches it; on touch devices the Web Share API hands image, text and link to the share sheet instead; "Save image" is the fallback everywhere. X intent text follows the last outcome ($0 / drained / payroll leak). The card is dropped as soon as the setup changes (the verdict is stale then), on back, and on start over. Deep link = page URL + #simulator (also ?simulator), which lands on the cards, not the headline.