Your agents can move money, email and customer data. Prove they were allowed to.

Proof of fixes vs the code-repair field → Download every signed record (ZIP, for auditors) The public key that signs every fix

Recent signed recordsnewest first · each downloadable

Loading…

Signed-evidence ledgerlive

Reading the ledger…

Defects found by FALSEWORKby check

Loading…

Live activitynewest first · auto-refresh 15 s

Loading…

This is the moat: only KEYSTONE records evidence of every bug it fixes. The other code-repair tools find and fix — then the fix disappears into a chat window. KEYSTONE writes each fix into a signed, hash-chained ledger and lets you watch it happen live: the defect, the exact lines changed, the tests that prove it, the verdict, the SHA-256 chain link and the Ed25519 signature — every record re-checkable by you, and by any auditor, offline. The console below is that ledger, updating in real time as fixes land. No competitor hands you proof of the fix.

Every run writes a signed record: canonical JSON, SHA-256 chained to the previous record, Ed25519-signed. Re-check any record with one click; the key is public at /keystone/public-key. Model-written code runs only inside a sealed bubblewrap sandbox (no network, read-only system). A fix is called a fix only when FALSEWORK re-scans clean and the tests pass on the fix and fail on the original; otherwise the record says NOT_VERIFIED.

New in the KEYSTONE family · CAIN-42 Studio

MCPGate KEYSTONE — harden an MCP tool, prove it was hardened

The MCP security scanner reads a tool definition the way a client receives it — looking for a description that hijacks the assistant, a leaked credential, or a raw command parameter with no constraint. Claude hardens it. Then the SAME scanner re-reads the result, and only a clean second opinion is signed into the ledger. Pick a sample or paste your own MCP tool definition.

MCP tool definition · name · description · input_schema

Scanner findings & signed record

Loading the samples…

record.jsonpaste to re-check

Recent signed recordsnewest first · each downloadable

Loading…

Signed-evidence ledgerlive

Reading the ledger…

Findings by scanner checkby type

Loading…

Live activitynewest first

Loading…

The moat, again: proof, not opinion. An MCP security scanner finds a poisoned tool; a model can rewrite it. Only MCPGate KEYSTONE re-reads the rewrite with the same deterministic scanner and signs the record — the finding, the hardened definition, the scanner's second opinion and an Ed25519 signature chained into the CAIN-42 ledger. A hardening is called a hardening only when no HIGH or MEDIUM finding remains; otherwise the record says NOT_VERIFIED. Every record is re-checkable and the evidence pack downloads for an auditor.

Pairs with the sibling product MCP-Attestor: scan the descriptor here, harden it, hand the clean descriptor to MCP-Attestor to probe the handler, and you hold one evidence pair. Both reuse the same MCP scanner and the same bubblewrap sandbox.

AI Agent Security Audit · CAIN-42 Studio

10-minute MCP server audit — point it at a server, get a signed verdict

Give it a public MCP server’s URL and it reads the tool definitions that server advertises, then runs the real MCP security scanner over them — descriptions that hijack the assistant, tool-poisoning blocks, leaked credentials, raw command parameters with no constraint. The verdict is SHA-256 chained and Ed25519-signed, so you can verify it offline without trusting us. Read-only: it never calls a tool. Try a sample server, paste a tools/list, or audit a live URL.

Loading samples…

The moat: proof, not a PDF. Other scanners hand you a report and say “trust me.” This hands you a signed record — the exact tool list that was scanned, the findings, and an Ed25519 signature chained into the CAIN-42 ledger that re-verifies offline with a tool containing none of our code. It is a heuristic static scan of the advertised definitions, not a proof of safety; the paid audit adds live red-team testing. Download a signed evidence bundle →

Want a person to check it? MCP Server Security Check · $1,500. Automated scans flag harmless text too, so we read every finding and keep only what is real, check how agents sign in and where your tokens travel, and send a signed report with fixes in 3 business days. One server, up to 50 tools, read-only, with your written permission. Counts in full toward the $5,000 audit. Book the $1,500 check

New in the KEYSTONE family · CAIN-42 Studio

Six new KEYSTONE products: detect, fix, prove, sign

Each one runs a deterministic detector, lets Claude propose the fix, proves the fix with an independent check, and signs the record with Ed25519 so an auditor can verify it offline. Press “Run live” on any card: it calls that product’s engine on this server.

🦞 OpenClaw KEYSTONE (ClawGuard)

OpenClaw skills and plugins

Scans an OpenClaw skill for credential theft, hidden shell commands and instructions aimed at the agent. Claude rewrites the skill; CAIN-42 proves the fixed skill runs inside an isolated sandbox with its own key.

SWARM KEYSTONE

Multi-agent delegation

Maps who delegates to whom in a CrewAI, LangGraph or AutoGen swarm and catches authority escalation, delegation loops and collusion. The proof checks the hardened graph is acyclic and every hand-off only narrows authority.

VIBEGUARD KEYSTONE

AI-written code

Reads code an AI assistant wrote and flags invented or typosquatted packages, swallowed errors and metrics made from random numbers. Every import goes through CAIN-42's supply-chain guard before the fix is accepted.

MEMGUARD KEYSTONE

Agent long-term memory

Inspects a memory before an agent stores it: sleeper instructions, cross-tenant leaks and exfiltration links. Uses CAIN-42's signed prompt-injection classifier, then proves the cleaned memory is free of the residue.

SURFGUARD KEYSTONE

Browser agents

Checks a browser agent's plan before it runs: wire transfers, account deletions and other irreversible clicks. Critical steps wait for a human approval that only CAIN-42 can sign, bound to the exact steps and an expiry.

ACTUARY KEYSTONE

Agent-fleet risk score

Scores a fleet of agents 0–1000 from its real CAIN-42 decision records, with every adjustment shown. Claude proposes policy rules; a replay of the same history proves each high-risk action is now gated. A risk score from evidence; no insurer is behind it.

KEYSTONE family · AI coding agents · CAIN-42 Studio

CODEGUARD KEYSTONE — a policy gate in front of every command your coding agent runs● checking…

Claude Code, Cursor and Codex run shell commands and write files on your laptop and in CI. CODEGUARD reads each action before it runs and answers DENY, ASK A HUMAN or ALLOW. A deterministic parser makes the call, not a model: it unwraps sudo, sh -c, $(…), backticks, quoting tricks and base64-to-bash, so the hidden command is the one that gets checked. Anything it cannot resolve goes to a person, never through. Type below: every keystroke is checked by the production gate.

Tool

Real incident patterns. Pick one:

No model in the decisionFixed rules, the same answer every time. Auditors can replay it.

Unknown never means allowedUnparseable, computed or unknown commands wait for a person.

Approval only from CAINAn approval is an Ed25519 token tied to that exact action and an expiry. The agent cannot write its own.

Signed receipt per decisionProves what the gate said. It holds a digest of the action, not your command text.

1 · Get the hook (about 30 lines, read it first)

curl -fsSL https://cainstudio.online/api/v1/codeguard-keystone/hook.py -o ~/.claude/codeguard-hook.py

2 · Add it to ~/.claude/settings.json

{"hooks": {"PreToolUse": [{"matcher": "Bash|Write|Edit|MultiEdit|NotebookEdit|Read",
  "hooks": [{"type": "command", "command": "python3 ~/.claude/codeguard-hook.py"}]}]}}

The hook only adds denials and approval prompts. An ALLOW prints nothing, so your own permission settings still apply. If the gate can’t be reached, it asks you rather than allowing. The pending tool call is sent to the gate and not stored. Set CODEGUARD_SEND_CONTENT=0 to keep file contents on your machine. API: samples · install · public key · signed evidence bundle.

The moat: proof, not a prompt filter. Most coding-agent guardrails ask a model whether a command looks dangerous. CODEGUARD parses it, decides by rule, and signs the decision. When Claude proposes a safer command, the same gate re-checks it and the record is chained into the KEYSTONE ledger. Pairs with MCPGate KEYSTONE for MCP tool calls and KEYSTONE for proved code fixes.

KEYSTONE family · pull requests · CAIN-42 Studio

KEYSTONE CI — gate every AI-agent pull request and sign the verdict● checking…

AI agents now open pull requests faster than people can read them, and the same mistakes repeat: tests skipped or deleted to turn CI green, workflows that hand repository secrets to any fork, committed keys, typosquatted packages, hidden Unicode that makes code run differently from how it reads, and poisoned AGENTS.md files. KEYSTONE CI reads the diff with fixed rules, not a model, and answers BLOCK, REVIEW or PASS. Each answer is an in-toto attestation in a signed DSSE envelope that you can keep next to the build and check offline. Paste any public GitHub PR below: the production gate fetches it and checks it now.

Test tamperingSkipped, focused or deleted tests, removed assertions, assert True.

CI takeoverSecrets exposed through pull_request_target, script injection, write-all, unpinned actions, secrets echoed into logs.

Supply chainEvery new pip/npm dependency is checked by the CAIN-42 supply-chain guard, which catches typosquats and rogue package indexes.

Agent tamperingPoisoned AGENTS.md / CLAUDE.md / .cursorrules, agent permission files, CODEOWNERS.

Hidden codeTrojan Source bidirectional-override characters, ASCII-smuggling tag characters and zero-width characters, shown in the diff instead of hidden.

Risky codeCommitted keys (redacted in the output), TLS checks turned off, SQL built from strings, code that fails open.

Add it to any repository: one workflow file

curl -fsSL https://cainstudio.online/api/v1/keystone-ci/action.yml -o .github/workflows/keystone-ci.yml

The workflow runs on every PR with read-only permissions. It adds annotations on the exact lines, fails the check on BLOCK (set FAIL_ON: REVIEW to be stricter), writes a badge into the job summary and uploads the signed attestation as a build artifact. The PR diff is sent to the gate and not stored; the signed verdict and findings are. Read the file before you commit it.

API: samples · action.yml · latest attestation · public key · signed evidence bundle.

The moat: proof, not a reviewer's opinion. AI code reviewers leave comments a model wrote, and the next run may say something different. KEYSTONE CI gives the same verdict for the same diff every time, binds it to the diff's SHA-256 and the head commit, and signs it in the standard supply-chain attestation format (in-toto/DSSE). An auditor can check a year later that this exact PR was gated and what the gate said. Pairs with CODEGUARD, which checks agent actions while the agent is still working, and KEYSTONE, which proves code fixes.

KEYSTONE family · agent credentials · CAIN-42 Studio

BROKER KEYSTONE — a credential for one action, not a key for everything● checking…

Agents usually get standing API keys, so one prompt injection can spend them on anything. With CAIN Action Credentials, the agent asks for one action. CAIN checks that agent's grants and issues a credential tied to that audience, that method, that exact path and the SHA-256 of that exact body. It lives 60 seconds, works once, and any service can check it with a standard EdDSA signature and the published key. The agent can hand a sub-agent a narrower credential, never a wider one. Try it: every step below is a real request to the production issuer and a demo API that accepts nothing else.

Agent Method Path Body

Demo grants (the public page can only issue credentials for these agents and the demo API):

Minting key …. It is separate from the KEYSTONE evidence key and is held in software on the gateway host; there is no hardware security module behind it yet. Each issuance is logged as a hash-chained, signed record that holds the credential’s SHA-256, never the credential itself. The demo API returns labelled demo data and changes nothing. API: JWKS · verifier for your service · latest issuance record · issuance log bundle.

The moat: authority that only shrinks, and proof of every grant. OAuth access tokens and API keys say who you are. A CAIN Action Credential says exactly what one call may do, and it ties a sub-agent’s credential to its parent so delegation can only narrow. The issuance log lets an auditor reconstruct every credential that was ever issued. This extends CAIN’s credential broker, which keeps stored keys away from agents, and pairs with CODEGUARD and KEYSTONE CI.

KEYSTONE family · human approval · CAIN-42 Studio

APPROVAL KEYSTONE — people approve the exact action, in Slack, and the approval is proof● checking…

When an agent wants to do something risky, a person has to say yes, and the yes has to cover exactly what will run. APPROVAL KEYSTONE binds every request to the action’s SHA-256 and requires N of M approvers. The agent can never vote, each person counts once, and one Deny ends it. Each approver gets a one-time signed ballot behind the Approve and Deny buttons in Slack. When the quorum is met, CAIN signs an approval that buys one credential for that action and nothing else. Below, a billing agent wants to delete an invoice. Every step is a real request to production.

Action sha256 …

The cards above are the actual Block Kit message CAIN posts to Slack (from /requests/{id}/slack), drawn in this page. In this demo you hold every approver’s ballot so that one person can try the whole flow. In a real workspace, each ballot goes only to its approver as a Slack DM. The Slack endpoint checks Slack’s request signature and maps each Slack user to an approver. Until a workspace is configured, that endpoint refuses every request. Every request, vote and outcome is a hash-chained, signed ledger record. API: samples · latest ledger record · ledger bundle.

The moat: an approval you can prove, for the exact thing that ran. Most approval steps are a button in a chat that says “OK”, and nothing ties it to what the agent then does. Here the approval names the action’s digest and the approvers, and the credential the agent receives can only perform that one action, once. It builds on CAIN’s approval queue and Slack alerts, and pairs with BROKER KEYSTONE.

KEYSTONE family · agent spend · CAIN-42 Studio

SPEND GOVERNOR — stop a runaway agent before the bill does● checking…

Runaway agents rarely hit a monthly limit first. They burn money in a retry storm, call the same tool in a loop, or spend in amounts too small to notice one at a time. The governor checks every charge against the agent’s budget and every budget above it (workflow, tenant). It also enforces a spend-rate limit at each level and trips a circuit breaker on identical repeated calls. A tripped agent is stopped until a person resets it with a reset that CAIN signs. The agent can’t reset itself. You get your own budget tree on the production governor; pick an agent and a behaviour.

Each charge is checked atomically across every level, so concurrent agents can’t overspend a shared parent; this is tested with four processes racing. Amounts must be finite and above zero. While building this, we found and fixed a bug in CAIN’s budget engine that accepted negative amounts. In this demo you play the operator. In production, a reset goes through APPROVAL KEYSTONE. Trips and resets are hash-chained, signed ledger records: latest record · ledger bundle.

The moat: limits on spend rate and repetition, not only on totals. Billing alerts arrive after the money is gone, and a monthly cap won’t stop a loop that burns a day’s budget in minutes. The governor decides on every charge, before it happens, at every level of the organisation, and keeps signed proof of every stop. Pairs with BROKER KEYSTONE (what an agent may do) and CODEGUARD.

KEYSTONE family · agent run records · CAIN-42 Studio

FLIGHT RECORDER — a signed black box for every agent run● checking…

When an agent does something it shouldn’t, the first question is what actually happened, and an ordinary trace can be edited after the fact. The flight recorder writes each step of a run as an OpenTelemetry gen_ai span, links every span to the one before it by SHA-256, and seals the run with an RFC 6962 Merkle root signed with Ed25519. Below, a refund agent runs on the production recorder. Then you try to rewrite history.

Every check on this card is computed by the server, not by this page. Erasing a payload keeps its salted commitment, so a GDPR erasure leaves the chain, the Merkle root and the seal verifiable. An inclusion proof shows an auditor one event and the signed root, and nothing else in the run.

The moat: a record the agent’s operator can’t quietly rewrite. Tracing tools show you what happened; the flight recorder lets someone who doesn’t trust you check it, offline, against a pinned key. Pairs with SPEND GOVERNOR, APPROVAL and BROKER, whose decisions it records.

KEYSTONE family · release gate for AI agents · CAIN-42 Studio

AGENT-CI — don’t ship an agent that got worse● checking…

A new model or prompt can give the same answers and still take a different, riskier path to get there: skip the policy check, loop on a retry, delete something and put it back. AGENT-CI runs the old and new versions of an agent on the same test cases and compares both the answers and every tool call. A deterministic gate gives the verdict, with no LLM judge. A separate clean-room verifier re-derives that verdict in a sandbox before it is signed. Below, a support agent moves from v1.4 to v1.5. Pick a change and run the gate.

Edit the suite JSON (cases, policy, baseline and candidate runs)

In your CI: one standard-library file. Exit code 0 ships, 1 blocks, 2 means the gate could not decide, so the pipeline stops.

curl -sO https://cainstudio.online/api/v1/agent-ci-keystone/client.py
python3 client.py suite.json --strict

Every verdict on this card comes from the production gate, not from this page. The signed record is hash-chained and verifies offline with the clean-room verifier against the pinned KEYSTONE key.

The moat: a release decision someone else can re-check. Eval dashboards score answers; AGENT-CI also grades the path the agent took, and it hands your auditor a signed verdict they can re-derive without trusting us. Pairs with FLIGHT RECORDER, which records what the agent did once it shipped.

KEYSTONE family · attack and patch agent tool policies · CAIN-42 Studio

REDTEAM — break your agent’s tool policy before someone else does● checking…

An allow list that says “only files under docs/” is only as good as the gate that reads it. docs/../.env, an encoded slash or a hidden @ in a URL can pass the gate while the tool reads something else. REDTEAM generates bypass calls from your policy, fires them at the gate and compares what the gate approved with what the tool would actually touch. It then writes the smallest patch that closes every breach without blocking legitimate calls, and proves the patch in a sandbox with an independent verifier. Pick an agent and run the red team.

Edit the policy JSON

Every attack, verdict and patch on this card is computed by the production engine, not by this page. Click a tile to see the exact call and try your own bypass value against the live gate. Records verify offline with the clean-room verifier against the pinned KEYSTONE key.

The moat: a patch that comes with its own proof. Scanners hand you a list of findings; REDTEAM hands you the fix, a second implementation that re-runs every attack against it, and a signed record your auditor can check offline. Pairs with MCPGate KEYSTONE and BROKER, which enforce the patched policy at the boundary.

Proof-carrying attestation · CAIN-42 Studio

MCP-Attestor — scan a tool, probe its handler, prove the attestation

An MCP tool is not trusted because its description looks clean. MCP-Attestor runs the description through the scanner, then runs the handler itself inside a sealed bubblewrap sandbox — no network, read-only — against an adversarial test that tries to trigger the very behavior the scanner flagged. The result is recorded only when the fix passes the test and the test fails on the original; that record, the verdict, the SHA-256 chain link and the Ed25519 signature are re-checkable below and as a standalone bundle.

A tool description is not the handler; this test runs the handler.

1Scanner attacks the descriptor
2Probe handler in sandbox
3Record signed attestation

…sample · standard library only

Auditor — verify any record

Console — the signed attestation ledger

Finding taxonomy

Controls & identity

Signed event feed

This is the moat: only MCP-Attestor records evidence of the handler, not the description. The other MCP security tools scan a description and hand back a clean badge. MCP-Attestor runs the handler in a sealed sandbox, fixes the finding, and proves the fix by a test that fails on the original and passes on the fix — then signs the record, the SHA-256 chain link and the Ed25519 signature, into the CAIN-42 ledger. A handler is only called clean when that loop closes; otherwise the record says NOT_VERIFIED.

Every run writes a signed record: canonical JSON, SHA-256 chained to the previous record, Ed25519-signed. Re-check any record with one click; the key is public at /mcp-attestor/public-key. The sealed sandbox (bubblewrap, no network, read-only system) runs the descriptor scan and the handler probe in two passes. A finding is only closed when the test fails on the original handler and passes on the hardened handler; otherwise the record says NOT_VERIFIED.

New in the KEYSTONE family · CAIN-42 Studio

VeriCoding KEYSTONE — a machine proved the fix, for every input

Give a function a contract — a precondition and a postcondition. Z3, a real SMT solver, either proves the contract holds for every possible input, or returns the exact input that breaks it. Claude rewrites the function. Then Z3 proves the rewrite satisfies the contract for all inputs, and CAIN-42 signs it. Not “the tests pass.” A proof, or a counterexample.

Function · verified subset: int/bool, if/else, + - * // %, abs/min/max

precondition postcondition · may use result

Z3 verdict & signed record

Loading the samples…

record.jsonpaste to re-check

Start a $500 pilot Mechanics, tests and limits →

Recent signed recordsnewest first · each downloadable

Loading…

Signed-proof ledgerlive

Reading the ledger…

Functions provedby function

Loading…

Live activitynewest first

Loading…

The strongest moat in the family: a proof, not a test. Every other code tool samples inputs and hopes. VeriCoding KEYSTONE negates the contract and asks Z3 for a satisfying assignment: a real input proves the bug; proving the negation unsatisfiable means the fix holds for every input in the space — and CAIN-42 signs the record. A proof is called a proof only when Z3 proves it and the signature is unchanged; otherwise the record says NOT_VERIFIED. The verified subset is stated up front, never oversold.

Part of the KEYSTONE family alongside KEYSTONE, MCPGate KEYSTONE and MCP-Attestor — same 5-stage loop, same evidence convention, one key that verifies every record. Verify any of them with the shared family verifier in the evidence pack.

CAIN-42 Premier Suite

The Five Premier Products

The four strongest products built on the CAIN-42 engines. Every card carries its status and its limits. The first four were smoke-tested and stress-tested on 2026-10-13: read the results or re-run the checks yourself.

LIVE ENGINE

30-day pilot · $500

FALSEWORK

Prove it's real.

The buyer pain: Your team or vendor ships “AI-powered” features and nobody can tell what is real.
What it does: A mechanical audit engine that grades an AI implementation REAL, PARTIAL, STUB or UNKNOWN. Static checks (source patterns plus an AST cross-check of each route against its engine) look for verifiers that cannot fail, errors that grant access, health checks that check nothing, mocks shipped as real services, random numbers dressed as computation, hard-coded success claims and placeholder markers. A live differential test sends the same endpoint two different inputs and flags byte-identical answers.
Engine: cainwitness

LIVE ENGINE

four engines, self-serve API

SCENIC

CI for agents.

The buyer pain: Your agent gets the right answer through a dangerous, wasteful path, and nothing scores that.
What it does: Agent reliability testing with no LLM judge. CAINBench runs fixed regression suites against a real agent endpoint and diffs any two runs. TrajectoryGate grades a successful run for duplicate calls, spend the answer did not need (reverse search over the dependency graph) and risky-then-corrected steps. A root-cause tracer attributes a broken multi-agent run to a step, and a contamination scanner probes for benchmark leakage.
Engine: cainbench · trajectorygate · multi-agent tracer · contamination-scanner

Start a trial Mechanics, tests and limits →

PUBLIC PREVIEW

reference tools free

NULLIUS

On the word of no one.

The buyer pain: Everyone claims their AI is safe and verifiable. Nobody can prove it independently.
What it does: A verification toolchain built on one rule: never trust the claimant's own “verified” flag. 18 standalone verifiers re-derive the verdict from the evidence with zero CAIN imports. Evidence is graded on a six-level independence scale, from SELF_REPORTED to INDEPENDENTLY_CORROBORATED.
Engine: the cain-*-verify family + the evidence spine

Download the verifier Mechanics, tests and limits →

PILOT PROGRAM

live gate on our host today; pilots in your cluster

SALLYPORT

The only door.

The buyer pain: Autonomous agents hold credentials and execute consequential actions. Who authorizes them, really?
What it does: An enforcement appliance built to run inside your cluster. It independently verifies signed authorization envelopes against your trust roots, binds each one by SHA-256 to the exact execution request, and runs the action in an unprivileged, network-less, scoped sandbox, or refuses. Authority is a lease that is re-checked continuously (CAIN ARGUS).
Engine: TALOS kernel · CAIN trust kernel · PBFT · ARGUS

Request a pilot Mechanics, tests and limits →

LIVE ENGINE

self-serve API, any API key

QUORUM-QAAS

BFT without building it.

The buyer pain: You need a record nobody can quietly rewrite, but Byzantine fault tolerance takes a distributed-systems team and years to build.
What it does: Byzantine consensus as a service: any enterprise can now get BFT without building it. Send the SHA-256 digest of any record; a live four-replica PBFT cluster across four US regions orders and commits it with a quorum of 3, and returns the replicas’ own Ed25519-signed votes as a receipt anyone can verify offline.
Engine: CAIN-42 PBFT · quorum certificates · cain-mr-02

Notarize a record Live cluster status →

AUDITFALSEWORK Reality Check · fixed price, led by a person
→
RELIABILITYSCENIC · self-serve API: free trial, then the Full plan
→
GOVERNANCESALLYPORT · pilot, then an appliance in your cluster

The free public layer: NULLIUS verifiers — free, no key. The written spec is not published yet. Each path is bought separately.

Get started free Watch it block an attack

Verify CAIN-42 yourself in seconds, on your own computer: open the Verifier Room on this page and copy one block into a terminal. It downloads a published evidence bundle and its clean-room verifier and recomputes the result — no account, no contact, nothing taken on trust.

⚡ COMMERCIAL SERVICES · 5-DAY TURNAROUND

Fixed-Price AI Security Audits for Autonomous Agents & MCP Tool Stacks

Unvetted tool descriptions carry prompt injections. Unchecked boundaries leak credentials. Get a written, severity-ranked report and concrete code fixes for your agent stack before customers or auditors ask.

View the audit offer →

FOUNDING OFFER (FIRST 5) $2,500

MCP Security Snapshot

Full static analysis of your agent's MCP tool definitions (names, descriptions, schemas, parameter bounds) for hidden prompt injections, secret leakage, and boundary flaws. 5 business days delivery.

🛡️ Tool description prompt-injection scan
🔑 Secret & token residue inspection in schemas
⚠️ Unconstrained parameter exploit detection
📊 Prioritized PDF/JSON fix report + 30-min walkthrough

Order $2,500 Snapshot →

DEEP-DIVE ENGAGEMENT $15,000

Full Agent Security Audit

End-to-end adversarial red-teaming, runtime capability token audit, governed memory fuzzing, and EU AI Act Art. 14/72 statutory logging verification for multi-agent fleets.

⚔️ 120-vector live red-team simulation (OWASP ASI01-10)
🧬 Capability tokenization & replay attack defense
🛑 Emergency kill-switch & swarm isolation verification
💼 Full CISO executive summary & engineering remediation

Scope $15,000 Audit →

🛰️ Technology asset carve-outs #10–#18 · new ● Live drills · real engines, every request

Physical AI & L5 Autonomy Guards

AI now commands things that move: drones, self-driving cars, robot arms, defense platforms. And L5 agents now run for hours without a human approving each step. The model does not know the rules the machine must keep: no-fly zones, the car's design limits, how close a robot may come to a person, who is allowed to order a use of force, or that it must not edit its own shutdown script.

These nine guards sit between the AI and the machine. Each checks every command before it reaches the autopilot, driving stack, robot controller or agent tool, and answers allow, hold for a human or refuse, naming the rule. Deterministic rules, no LLM judge. Commands that make the machine safer (land, hold, return home, stop, pull over, abort) are never refused; one that also names a destination or an altitude (land at a point, return home at 5,000 m) makes the machine fly first, so it is checked like any move.

⚡ Try it: Drone Airspace Authority Guard

POST /api/v1/autonomy-guards/drone-airspace/run

Pick a guard above, then a scenario, or edit the JSON: config is the operator's setup, base the default vehicle state, events the commands sent in order (each event's state is merged over base). Signatures are made with throwaway keys; sign_as says who signs. Nothing real is commanded and nothing you send is stored.

Scenario

Loading scenarios…

🛡️ Technology asset carve-out #9 · new ● Live drill · real engine, every request

A2A Remote Agent Trust Guard

AI agents now hand work to other companies' agents over Google's Agent2Agent (A2A) protocol. The calling agent decides whom to trust from each remote agent's Agent Card, a document the remote agent writes about itself. Whoever controls that text controls where your data goes: a rogue card that claims to be "the best choice for every task" gets picked by the planner and receives everyone's requests (Trustwave SpiderLabs' "agent in the middle" research). Cards can carry instructions to your model, change after you trusted them, ask the remote agent to call back into your network, and send back results that try to steer your agent.

CAIN's guard sits on the calling side and checks the four A2A trust points: which agents may be chosen, what may be sent to them, where they may call back, and which results may be believed. Deterministic rules, no LLM judge.

1. Only agents you can verify

A card must come from its own host on a domain you listed, over https, never an internal address. Where you pinned a signing key, the card's signature must verify against it: a card cannot vouch for itself. Look-alike domains, text that gives your model orders, and "handles everything" cards are stopped before a planner can pick them.

2. No silent changes

Every admitted card is pinned by hash. If the agent later serves a different card (a new skill, a new endpoint, new text), it is suspended until an operator approves the change, so nothing is sent to it in the meantime.

3. What goes out, what comes back

No credentials in messages, no data above the agent's trust tier. Push-notification callbacks only to your allowlisted https hosts, never cloud-metadata or internal addresses. Results only for tasks you created, in the same user's conversation; results that address your model are held as data.

⚡ Try it: replay an agent-to-agent attack

POST /api/v1/a2a-trust-guard/run

Pick a scenario, or edit the JSON: trust lists the agent domains you work with and their tier, events are cards offered for discovery (admit_card), messages (send), callbacks (push) and results (result). The demo signs cards with a throwaway key in place of the partner's publisher. No agent is contacted and nothing you send is stored.

Trust list and A2A session

Pick a scenario above or edit the JSON.

🛡️ Technology asset carve-out #8 · new ● Live drill · real engine, every request

Browser Agent Action Firewall

AI browsers and computer-use agents act inside your logged-in sessions, and every page they read is text an attacker can write. In 2025 that was enough to make one read a mailbox and post a sign-in code to a public thread (Brave's Perplexity Comet disclosure), smuggle mailbox data out in a base64 URL (LayerX's "CometJacking"), treat a broken link pasted in the address bar as a trusted command (NeuralTrust's ChatGPT Atlas finding), and type bank details into a look-alike site or click a fake CAPTCHA's download button (Guardio's "Scamlexity" and "PromptFix").

CAIN's firewall judges each browser action before it runs, for one user task. What the user asked for is authority; what a page says never is. Its blocking rules do not depend on spotting the injection: they follow where the agent is going, who chose that destination, what data would leave with it, and where a secret is being typed. Deterministic rules, no LLM judge.

1. Task scope and destinations

Submitting, sending, paying or downloading only on the sites the task covers. Mail, identity and banking sites are not visited unless the task includes them. A destination a page named and the user never did is refused. Address-bar input that is not a strict URL stays text.

2. Data cannot ride out

What the agent reads on private pages is fingerprinted. Those fingerprints inside a URL (host, path or query; plain, base64, hex or %-encoded, two layers deep) or in text typed into another site are refused. Following a link found in your mail is fine; forwarding it elsewhere is not.

3. Secrets and files stay home

A password, one-time code or card can only be typed on the origin it belongs to. URLs with user@host tricks, look-alike letters or non-web schemes are refused. Executable downloads and uploads of key or browser-profile files are refused; other downloads wait for the user.

⚡ Try it: replay a real AI-browser hijack

POST /api/v1/browser-agent-firewall/run

Pick a scenario, or edit the JSON: task is what the user asked for and the sites it covers, events are what the agent saw (observe, with visible and hidden page text) and what it tried (act). No browser is driven, no page is fetched and nothing you send is stored.

Task and browser session

Pick a scenario above or edit the JSON.

🛡️ Technology asset carve-out #7 · new ● Live drill · real engine, every request

Agent Payment Mandate Guard

AI agents now check out and pay on a person's behalf. Card networks, merchants and banks all need the same answer afterwards: did the human actually authorize this purchase? The new agent-payment protocols (Google's AP2, Visa Trusted Agent Protocol, Mastercard Agent Pay, the OpenAI and Stripe Agentic Commerce Protocol, x402) answer with signed mandates. Someone still has to enforce them at the moment the agent pays, when a fake store, an injected product page or a swapped bank account is in play.

CAIN's guard sits between the agent and the payment call. It checks the cart against the mandate the human signed, reserves the spend atomically, and answers ALLOW, REQUIRE_APPROVAL or DENY with every rule that fired and a signed receipt that binds mandate, cart and verdict. Deterministic rules, no LLM judge.

1. Who really signed

The signer must be a person whose key the operator registered: a mandate cannot bring its own key. Any edit after signing, a different agent presenting it, expiry and revocation are all refused.

2. Where the money goes, and for what

Only stores on the mandate, with look-alike domains called out. The payee must be that merchant's registered account. Items the human did not ask for, gift cards and other cash-equivalents, prices or quantities above the mandate, and totals that do not add up are refused.

3. How much, how often, with proof

Per-purchase limit, total budget and purchase count in one atomic ledger, so many small purchases or two racing checkouts cannot overspend. The same cart twice is refused. Large purchases can wait for the human. Every decision gets an Ed25519-signed, hash-chained receipt.

⚡ Try it: send an agent shopping with a signed mandate

POST /api/v1/payment-mandate-guard/run

Pick a scenario, or edit the JSON: mandate is what the human approved (amounts in cents), steps are the carts the agent tries to pay. In this demo the server signs the mandate in place of the human's wallet, with a throwaway key. No store is contacted, no payment is made and nothing you send is stored.

Mandate and carts

Pick a scenario above or edit the JSON.

🛡️ All carve-outs, wired into MCPGate · new ● Live drill · real engines, every request

One proxy, every guard: the MCPGate guard stack

The carved-out engines below now run together as stages in the MCPGate proxy that sits in front of your MCP servers. One config file switches them on. Every tool call passes the kill-switch first, then skill scope, delegation (swarm collusion), the memory firewall and the supply-chain guard, alongside the tool-poisoning and lethal-trifecta guards already in the proxy. A stage can only refuse or hold a call; it can never allow one that another check refused. If a stage fails, the call is refused.

⚡ Try it: one agent, five attacks, five different stages

POST /api/v1/mcpgate/guard-stack/run

Pick a scenario, or edit the JSON: config is the same guard config the proxy reads, calls are the agent's tool calls. Each request gets a fresh stack with its own kill-switch. No tool is called and nothing you send is stored.

Guard config and agent tool calls

Pick a scenario above or edit the JSON.

🛡️ Technology asset carve-out #6 · new ● Live drill · real engine, every request

Coding-Agent Supply-Chain Guard

Coding agents (Claude Code, Cursor, Copilot, Codex, Gemini CLI) now install packages, edit config and run shell commands on their own. That opened a new attack surface: packages the model invented that attackers then register ("slopsquatting"), typosquats, private-index confusion, agents rewriting their own config to auto-approve tools (CVE-2025-53773 in Copilot, CVE-2025-54135 "CurXecute" in Cursor), and malware that drives your AI CLI with its guardrails off (the Nx "s1ngularity" attack) or steals your registry token and republishes your packages (the Shai-Hulud npm worm).

CAIN's guard judges each command and file write before it runs and answers ALLOW, REQUIRE_APPROVAL or DENY with the rule that fired. A package that is neither vetted nor in your lockfile is held, never waved through. Deterministic rules, no LLM judge, under a few milliseconds per action.

1. Every install, checked

pip, uv, poetry, pipx, npm, yarn, pnpm, bun, npx and uvx, plus requirements.txt, package.json and pyproject.toml edits. Hallucinated and known-malicious names (via your registry/OSV lookup), typosquats (swapped letters and look-alike characters refused, other near-misses held), installs from URLs or git, and untrusted indexes set by flag, environment variable or config.

2. No self-escalation

Writes to an agent's own config (.vscode/settings.json, .cursor/mcp.json, .claude/settings.json and more) that turn on auto-approve or add MCP servers are refused. Rule files (CLAUDE.md, AGENTS.md, .cursorrules) with invisible characters are refused; other edits are held.

3. Worm and malware brakes

A downloaded script run without review (piped into a shell or interpreter by name or full path, through tee, via <( ) or $( ), or saved and run in the same command), AI CLIs started with their permission checks off (--dangerously-skip-permissions, --yolo, --approval-mode yolo, --sandbox danger-full-access, unrestricted --allowedTools), reads of .npmrc, cloud keys, SSH keys and secret environment variables, secret scanners, and package publishing, which a human must release.

⚡ Try it: replay a real coding-agent attack

POST /api/v1/supply-chain-guard/run

Pick a scenario, or edit the JSON: actions are what the agent wants to do ({"kind":"shell","command":...} or {"kind":"write_file","path":...,"content":...}), allowlist is your lockfile, registry holds registry facts for the scenario. Nothing is executed or written, nothing you send is stored, and the drill does not contact PyPI or npm.

Agent actions

Pick a scenario above or edit the JSON.

🛡️ Technology asset carve-out #5 · new ● Live drill · real engine, every request

Lethal Trifecta Exfiltration Guard

An AI agent leaks data when one session can do three things: read private data, read text an attacker wrote (a web page, a GitHub issue, an inbound e-mail, a support ticket), and send something out. The attacker's text tells the agent to fetch the private data and send it. That is how the GitHub MCP issue leak, EchoLeak in Microsoft 365 Copilot (CVE-2025-32711) and the Supabase MCP ticket leak worked. Prompt filters miss it because no single step looks wrong.

CAIN's guard tracks the session, not the prompt. A session may hold at most two of the three legs; the tool call that would add the third is refused before it runs, in whatever order the legs arrive. Every outbound call is also checked for fragments of private data the session read (also after base64/hex/URL decoding) and for smuggled credentials or hidden Unicode. Deterministic rules, no LLM judge.

1. Rule of two, per session

Each tool carries its legs (private data, untrusted content, external comms). The third leg is refused, so injected text can never reach both your data and a way out. A tool that holds all three on its own is refused outright.

2. Data-lineage taint

What private tools return is fingerprinted (hashed identifiers and word shingles). Outbound arguments carrying those fingerprints, raw or encoded, are refused unless the destination is on your egress allowlist.

3. Covert-channel screen

AWS keys, private keys, JWTs and live API tokens in an outbound payload, plain or nested in base64/hex/%-encoding, and zero-width or Unicode-tag characters that can carry a hidden bitstream.

⚡ Try it: replay a real agent leak, step by step

POST /api/v1/trifecta-guard/run

Pick a scenario, or edit the JSON: profiles maps each tool to its legs, steps are the agent's tool calls (with what each tool would return), egress_allowlist is where private data may go. No real tool is called and nothing you send is stored.

Agent session

approval mode Pick a scenario above or edit the JSON.

🛡️ Technology asset carve-out #4 · new ● Live · runs the same guard as the MCPGate proxy

MCP Tool Poisoning & Rug-Pull Defense Engine

Every MCP server writes the text your agent's model reads about its tools. That text is an attack channel: a tool that "adds two numbers" can carry a hidden instruction to read ~/.ssh/id_rsa, tell the model how to misuse another server's send_email, hide orders in invisible Unicode, or quietly change its definition after you approved it (a rug pull).

CAIN's guard sits on tools/list. It scans every definition with deterministic rules (no LLM judge), pins each approved definition by SHA-256, and quarantines any tool that trips a rule or changes after pinning. A quarantined tool is removed from what the agent sees and refused at tools/call until an operator re-approves it.

1. Poisoned descriptions

Hidden <IMPORTANT> blocks, "do not tell the user", reads of secrets, exfiltration URLs, base64 blobs. Scanned in the description, every schema field, enum value and property key.

2. Cross-tool shadowing

One server's tool telling the model how to use another server's tool. Also duplicate names and homoglyph names like reаd_file with a Cyrillic "а".

3. Rug-pull pinning

Approved definitions are hash-pinned per server, over the whole tool object. Any later change, even one that reads as harmless, is quarantined until a named operator re-approves it. With a pin store the pins survive restarts and are shared by every proxy process. In strict mode nothing reaches the agent until an operator has approved that exact definition.

⚡ Try it: attack the guard with your own MCP tools

POST /api/v1/mcp-tool-guard/scan

Pick an attack, or edit the JSON and write your own. "Current tools" is what the MCP server serves now; "Previously approved" is optional and turns on rug-pull detection. Nothing you send is stored.

Current tools (tools/list reply)

Previously approved (optional)

Strict mode (hide every tool until approved) Pick an attack above or edit the JSON.

Limits, measured 2026-10-12: the phrase rules caught 20 of 20 known poisoning descriptions and flagged 0 of 65 ordinary ones, but only 3 of 15 new behavioural instructions written in plain words (a held-out set, measured once). Try "Honest limit" above. What does not depend on wording: invisible characters and look-alike letters, hidden markup, addresses and local paths inside descriptions, one server naming another server's tool, pinning, and strict mode. Without a pin store, a proxy restart forgets approvals. The guard decides what the agent sees and refuses calls to quarantined tools. It does not inspect tool results, and passing it does not authorize a call: CAIN policy still decides. Building this demo exposed a real gap: shadowing text that named another tool ("When using the send_email tool…") passed the scan. It is fixed and covered by regression tests.

🛡️ PROVEN TECHNOLOGY ASSET CARVE-OUT ● 153 TESTS PASSING · HALT SEEN BY OTHER PROCESSES IN < 50 MS · BUILT FOR EU AI ACT ART. 14 HUMAN OVERSIGHT

Autonomous Swarm Fleet Quarantine & Emergency Kill-Switch Subsystem

When an AI agent fleet experiences goal drift, prompt injection, or memory contagion cascades, traditional prompt filters fail. The cain.quarantine subsystem stops a rogue agent, a whole swarm or every agent at once, and every worker process sees it in under 50 milliseconds through one shared SQLite (WAL) store. Every containment is Ed25519-signed by the node's persistent key; a containment that could not be stored is reported as not done, never as done. Self-contained, ready for licensing or OEM integration.

Licensing & acquisition → Launch Interactive Killswitch Drill →

1. ULTRA-LOW LATENCY CONCURRENCY

Sub-50ms Multi-Process Synchronization

Engineered with SQLite Write-Ahead Logging (WAL) and synchronized thread-safe in-memory caching. Non-blocking reads across hundreds of concurrent agent microservices with zero external database server overhead.

Measured 2026-10-11 on our host, 20,000 records in history: check 0.009 ms p50 · quarantine → enforced 10 ms p50, 31 ms max

2. MULTI-TIER CONTAINMENT MATRIX

Three-Level Escalation Circuit Breaker

Dynamic escalation prevents isolated anomalies from collapsing healthy operations:

🔴 AGENT_ISOLATION: Instantly blocks rogue single agent.
🟠 SWARM_FLEET_ISOLATION: Quarantines entire swarm upon contagion.
🛑 CLUSTER_EMERGENCY_HALT: Global SOC emergency halt.

3. EVIDENCE & WORKLOAD REVOCATION

Ed25519 Signing & SPIFFE Invalidation

Every containment, approval and lift is appended to a signed, hash-chained event log, and fast-path authorization caches are purged. Lifting needs two different named approvers and a written justification, and the lift itself is signed: a lift forged in the database, or a deleted containment record, keeps the agent stopped or engages the global halt. The record lists the workload SPIFFE IDs to revoke; revoking them in your SPIRE server is an integration step.

Evidence: signed, hash-chained log · public key and chain check at /api/v1/quarantine/status

⚡ Try it: trip the kill-switch

POST /api/v1/mcpgate/guard-stack/run

An agent fleet makes tool calls. When one call sends a burst above the threshold (max_single_burst_mb), the kill-switch severs the lines and every later call, from any agent, is refused. Edit the calls or the threshold and run it. Each run uses a fresh, private drill instance: it cannot halt anything real, and nothing is stored.

Ready.

Raw API response (includes the signed containment receipt)

This drill runs the kill-switch stage of the MCPGate guard stack against simulated byte counts. The full operator console with two-person re-arm is at /killswitch.

STANDALONE PYTHON CONTRACT (cain.quarantine) ● ZERO CLOUD COUPLING

from cain.quarantine import get_quarantine_manager

# Sub-50ms thread-safe manager with SQLite WAL
qm = get_quarantine_manager()

# Trigger immediate swarm fleet isolation
record = qm.quarantine_swarm(
    swarm_id="swarm-customer-ops-04",
    reason="Prompt injection contagion detected across swarming agents",
    operator_id="soc-sentinel-01"
)

# Preflight boundary enforcement: blocked fail-closed
allowed, reason = qm.check_execution_allowed("agent-customer-support-12")
# -> (False, "Swarm fleet 'swarm-customer-ops-04' is actively quarantined")

Licensing & acquisition

Available to license or acquire. Terms are discussed directly; we do not publish a price.

What you get: the source code, its test suite and documentation. No patent has been filed. Results shown here come from our own test suite.

Technical overview → Contact Founder

🛡️ PROVEN TECHNOLOGY ASSET CARVE-OUT #2 ● 58 MARKETPLACE SKILLS · PER-SKILL AES-256-GCM · CROSS-SKILL READS REFUSED

AI Agent Skill Memory Sandboxing Engine

When an autonomous agent loads 50+ marketplace skills (from Claude Desktop MCP, Cursor, OpenAI Swarms, or AutoGen), an untrusted Smart Home or Weather skill thread can snoop shared memory, stealing 1Password master vaults, GitHub SSH keys, Stripe billing rails, or cloud IAM tokens. The cain.isolation.skill_sandbox subsystem gives every skill thread an unguessable capability when the agent runtime starts it, and encrypts each memory block with AES-256-GCM under a key derived for the owning skill, thread and region. A thread can only decrypt with the key derived from its own capability, so another skill, or another thread of the same skill, cannot read the block, even with every policy check removed. Declared skill names are not trusted. Every refusal and read gets an Ed25519-signed receipt. It is in-process isolation, not OS or hardware isolation: the runtime must hand each capability only to the thread it was issued for.

Licensing & acquisition → Run Live Isolation Drill Below ↓

1. PER-SKILL ENCRYPTED MEMORY

Per-Skill AES-256-GCM Memory Isolation

Each block is encrypted under a key derived (HKDF-SHA256) from the skill's master key, the owning thread and the region, with the owner and block id bound into the AEAD associated data. A reader decrypts under its own derived key, so a cross-skill or cross-thread read fails authentication.

Stress test 2026-10-11: 16 threads, 960 blocks, 14,224 cross-reads: all refused, 0 leaks

2. FOUR-TIER LEAST PRIVILEGE

58 Marketplace Skills Strictly Scoped

Enforces non-escalating privilege ceilings across all cataloged tools:

🟢 MINIMAL: IoT, Home Automation, Basic Telemetry.
🔵 SCOPED: Slack, Linear, Notion, Productivity tools.
🟠 SENSITIVE: Databases, Cloud Analytics, Internal APIs.
🔴 CRITICAL: 1Password Vaults, GitHub VCS, Stripe, Cloud IAM.

3. EVIDENCE YOU CAN CHECK

Ed25519 Signed Receipts

Any unauthorized cross-skill read immediately raises CryptographicSkillIsolationViolation and issues an Ed25519-signed audit receipt. The read is refused; the calling thread is not terminated.

Evidence: each drill returns its receipt and the public key that verifies it

STANDALONE PYTHON CONTRACT (cain.isolation.skill_sandbox) ● ONE DEPENDENCY: cryptography

from cain.isolation.skill_sandbox import get_skill_sandbox

sandbox = get_skill_sandbox()

# 1. The runtime binds each skill thread; the capability is its identity
vault = sandbox.issue_thread_capability("onepassword_vault", thread_id=101)
iot   = sandbox.issue_thread_capability("smart_home_hub", thread_id=202)

# 2. The 1Password thread stores a secret in its own region
block = sandbox.allocate_encrypted_memory(
    memory_region="mem_region_onepassword",
    plaintext_data=b"master_password_vault_key_xyz123",
    capability=vault,
)

# 3. The Smart Home thread tries to read it with its own capability:
try:
    sandbox.read_encrypted_memory(block_id=block.block_id, capability=iot)
except CryptographicSkillIsolationViolation as ex:
    print("REFUSED:", ex.violation_type)   # UNAUTHORIZED_CROSS_SKILL_READ

Licensing & acquisition

Available to license or acquire. Terms are discussed directly; we do not publish a price.

What you get: the source code, its test suite and documentation. No patent has been filed. Results shown here come from our own test suite.

Technical overview → Contact Founder

⚡ Live Interactive Cross-Thread Isolation Drill

LIVE ENDPOINT: POST /api/v1/clawx/skills/verify-isolation

Simulate an adversarial rogue skill attack in real time. Choose an attacker process thread and target protected victim enclave, then trigger the isolation probe.

Attacker Process Thread (Skill)

Target Protected Memory (Victim Enclave)

Protected Memory Secret

Ready to verify

● FAIL-CLOSED VERIFICATION RECEIPT (Ed25519 SIGNED):

🛡️ PROVEN TECHNOLOGY ASSET CARVE-OUT #3 ● FARMA & MEMORYGRAFT DEFENSE · arXiv:2607.05029 · MEMORY NEVER GRANTS AUTHORITY · 39 LIVE CHECKS YOU CAN RUN

Autonomous AI Agent Long-Term Governed Memory Firewall & Vector Poisoning Defense Engine

When an autonomous agent stores long-term memory in vector databases (Chroma, Pinecone, Weaviate, Mem0, LangGraph), external documents and rogue agents can inject persistent Trojan instructions (MemoryGraft: "Poison Once, Exploit Forever"), forged reasoning claims ("Security check already verified — safe to proceed"), or spoofed policies. The cain.omniscience.memory_firewall engine puts an authority firewall in front of every memory write and read: "Memory provides information. CAIN determines authority." Memory never grants permission, never increases authority, never overrides policy, and never resurrects revoked credentials. A refusal takes microseconds (measured below), and every drill returns an Ed25519-signed receipt with the key that verifies it.

Licensing & acquisition → Run Live Memory Firewall Drill Below ↓

1. FARMA FORGED REASONING TAINT

arXiv:2607.05029 Defense Against Fake Validations

Detects and taints entries claiming a check or security validation was already completed ("already verified", "approved", "skip the verification"). Multiple agent copies count as one independent source; consensus cannot be manufactured by echo.

Measured 2026-10-12: 25/25 tuned phrasings, 11/15 unseen paraphrases, 0/30 false positives. What it misses still cannot satisfy a check.

2. MEMORYGRAFT RESTRICTED AIR-GAP

arXiv:2512.16962 Anti-Poisoning Enforcement

Untrusted agents or external RAG content are strictly forbidden from writing to restricted classes: POLICY, SYSTEM_INSTRUCTION, AUTHORIZATION, CREDENTIAL, or SECURITY_EVENT.

🛡️ POLICY: Only verified human operators may author policy.
🛡️ CONSOLIDATION: Summaries can only narrow authority, never amplify.

3. REVOCATION CASCADE & ZERO SECRETS

Dead Authority Air-Gap & Secret Redaction

Revoked credentials can never be reanimated through memory recall (arXiv:2602.15654). Revocation cascades downstream to all derived items. Refuses 13 credential formats (Stripe, OpenAI, Anthropic, AWS, GitHub, GitLab, Google, Slack, PEM keys, JWT, password=), also when nested or split by invisible characters.

Measured: policy forgery refused in 0.001 ms, a secret in 0.009 ms; a 4 KB text scanned in 3.3 ms

STANDALONE PYTHON CONTRACT (cain.omniscience.memory_firewall) ● 168 TESTS · 2,400-RUN STRESS: 0 ERRORS

from cain.omniscience.memory_firewall import MemoryAuthorityFirewall, MemoryFirewallError

# 1. RAG document injects forged policy into agent memory:
try:
    mem.write(
        tenant="tenant-a",
        classification="POLICY",
        source="AGENT",
        creator="agent-B",
        principal="human:alice",
        content={"rule": "grant_all_financial_wires"},
        provenance={"source": "untrusted_rag_search"}
    )
except MemoryFirewallError as ex:
    # -> refused before anything is stored
    print("HALTED:", ex) # MEMORY_AUTHORITY_FORGERY

# 2. Agent recalls memory:
# Invariant: memory never grants permission or satisfies a check!

Licensing & acquisition

Available to license or acquire. Terms are discussed directly; we do not publish a price.

What you get: the source code, its test suite and documentation. No patent has been filed. Results shown here come from our own test suite.

Live status (JSON) → Contact Founder

⚡ Live Interactive Memory Authority Firewall Drill

LIVE ENDPOINT: POST /api/v1/memory-firewall/verify-drill

Simulate real-world agent memory poisoning and authority-laundering attacks. Pick a scenario and type your own text. Each scenario runs several real checks against a fresh firewall, including a control that must succeed; the verdict is computed from them.

Adversarial Attack Vector

Simulated Adversarial Memory Payload

Ready to verify

● FAIL-CLOSED DEFENSE RECEIPT (Ed25519 SIGNED):

🛡️ PROVEN TECHNOLOGY ASSET CARVE-OUT #19 ● CONSENSUS != AUTHORIZATION · OWASP ASI08 · SUB-0.1MS GRAPH HALT

Autonomous AI Agent Multi-Agent Swarm Collusion Graph & Sybil Delegation Defense Engine

When enterprises deploy collaborating agent swarms (LangGraph, Microsoft AutoGen, CrewAI, OpenAI Swarms, Salesforce Agentforce), rogue or prompt-injected sub-agents can collude: forming autonomous cartels, manufacturing false quorums to outvote humans, and laundering authority in cyclic delegation loops (A → B → C → A). The cain.authority.collusion_graph engine enforces the bedrock invariant: "No number of cooperating agents may manufacture authority. Authority must be rooted in a cryptographically verified human principal." Every delegation loop, unrooted consensus cartel, and Sybil claim amplification is severed in under 0.1 milliseconds with Ed25519-signed audit receipts.

Licensing & acquisition → Run Live Swarm Collusion Drill Below ↓

1. AUTHORITY CYCLE & DELEGATION LOOPS

OWASP ASI08 Multi-Agent Privilege Escalation

Detects cyclic authority loops where Agent A delegates to B, B to C, and C back to A to manufacture infinite escalating privilege. Strict depth-first cycle detection terminates loops fail-closed before execution.

Monotonic Authority Attenuation · O(V+E) cycle severed in 0.05ms

2. UNROOTED CONSENSUS CARTEL DEFENSE

False Swarm Majority Defense

An endorsement cluster without a human PRINCIPAL root carries ZERO authority. When 3 sub-agents conspire to authorize high-value transactions or API calls, the decision is rejected fail-closed.

Invariant: agent consensus != human authorization

3. ANTI-SYBIL CLAIM AMPLIFICATION

Sybil Echo Isolation

When an adversarial prompt replicates a single false statement across 5 sub-agents claiming "unanimous verification", the engine reduces N copies to 1 unverified source and flags Sybil echo manipulation.

N agent copies count as ONE source · Ed25519 signed receipts

PYTHON PRODUCTION CONTRACT (cain.authority.collusion_graph)

from cain.authority.collusion_graph import CollusionGraph

# Build live multi-agent authority mesh
mesh = CollusionGraph()
mesh.add_node("agent-A", "AGENT")
mesh.add_node("agent-B", "AGENT")
mesh.add_node("agent-C", "AGENT")

# Detect cyclic loops & unrooted agent cartels
findings = mesh.detect()
if any(f["kind"] in ("AUTHORITY_CYCLE", "CONSENSUS_WITHOUT_PRINCIPAL") for f in findings):
    halt_execution(reason=findings[0]["kind"], receipt=sign_receipt(findings))

Licensing & acquisition

Available to license or acquire. Terms are discussed directly; we do not publish a price.

What you get: the source code, its test suite and documentation. No patent has been filed. Results shown here come from our own test suite.

Contact the founder →

LIVE ADVERSARIAL DRILL BENCH

Execute Live Multi-Agent Swarm Collusion Defense Probe

POST /api/v1/swarm-collusion/verify-drill

Select an attack vector below to inject an adversarial multi-agent swarm into the live authority mesh. The engine constructs the causal authority graph, executes real-time cycle and cartel detection, halts the execution fail-closed, and mints an Ed25519-signed containment receipt.

ATTACK VECTOR

SWARM CLUSTER ID

Ready to verify

● FAIL-CLOSED COLLUSION CONTAINMENT RECEIPT (Ed25519 SIGNED):

Developer Gateway · Rank 13 MCPGate Enforcement

Protect Any Agent in 60 Seconds: @cain.guard

The drop-in execution boundary for Cursor, Claude Desktop, LangChain, CrewAI, and AutoGen. The agent proposes the tool action; CAIN intercepts parameters, enforces capability ceilings, halts destructive payloads in under 15ms, and records tamper-evident WORM Merkle evidence. No authorization → no execution.

1. PYTHON DECORATOR ● IN-PROCESS FAST PATH

import cain

@cain.guard(
    resource="database:prod_users",
    intent="archive_user_record",
    risk="LOW"
)
def delete_user(user_id: str):
    # Intercepted & verified by the 7 Moats
    # Injection/drop attacks fail-closed
    return db.users.delete_one({"id": user_id})

Sub-15ms verification. Any destructive parameter ('drop', 'rm -rf', 'curl | bash') halts automatically at the boundary.

2. UNIVERSAL CLIENT WRAPPER ● OPENAI & ANTHROPIC

import cain
from openai import OpenAI

# 1-Line Drop-in: governs proposed tool calls
client = cain.wrap(OpenAI())

response = client.chat.completions.create(
    model="gpt-4o",
    messages=[{"role": "user", "content": "..."}],
    tools=[...] # Governed by MCPGate
)

Transparent client proxy. Intercepts tool calls before execution with zero code changes inside your existing tools.

3. CURSOR & CLAUDE DESKTOP MCP ● ZERO-CODE PROXY

// ~/.cursor/mcp.json or claude_desktop_config.json
{
  "mcpServers": {
    "cain-gate": {
      "command": "cain-mcp-proxy",
      "args": ["--gate", "https://cainstudio.online"]
    }
  }
}

Deploy MCPGate as an upstream proxy in front of existing tools. Protects your IDE agents from poisoned instructions.

Try @cain.guard Live in Your Browser

Simulate an attack payload and observe real-time parameter sanitization and signed receipts (<2ms latency).

Side by side

Where the control actually sits

Five questions enterprise buyers ask before they put an autonomous agent near production. This is a category comparison, not a benchmark and not a claim about any vendor's internals. It describes the control point each category is built around. Where we could not find public documentation for a category claim, we say so instead of filling the cell with a guess.

Purchase trigger	CAIN-42 execution boundary	Application sandbox (Docker / VM)	Prompt / model guardrail (examples: Bedrock, NeMo)
Enforcement layer	Tool-call / API boundaryPolicy is evaluated against the exact call before it runs. Source: live stage list	Process / container / VMThe primitive confines code. It does not decide whether a specific tool call is authorized. Source: category comparison	Model input / outputPolicy lives in instructions and optional classifiers. Source: category comparison
Bypass resistance	Deterministic stage chainUnknown, error, or no quorum → deny. A call that bypasses MCPGate is outside the boundary, and the page says so. Source: scope and gaps	Strong for code confinementThe authorization decision usually sits outside the sandbox; a call made from inside it is not automatically judged. Source: gateway comparison	Text-following behaviorDrift, context saturation and injection are the documented risk. A classifier can add a check, but the control point is upstream of the action. Source: category comparison
Governance	3-of-4 PBFT quorumThe quorum notarizes the decision. It cannot make an unauthorized action authorized. Source: live cluster	Orchestrator / infrastructureUsually configuration and host policy; no per-action quorum. Source: BFT comparison	Vendor console and rulesLogs and dashboards; no per-action quorum in the public documentation we reviewed. Source: 36 comparisons
Auditability	Ed25519 + hash chainCanonical JSON (RFC 8785), SHA-256 chain, RFC 6962 Merkle root, offline verifier. Source: verification center	Container / VM logsHost telemetry and orchestrator events. Source: policy comparison	Request / response logsVendor dashboards and exported logs. Source: 36 comparisons
Containment	Deny before the tool runsA denied call does not reach the tool. The decision is recorded either way. Source: MCPGate proof	Isolation boundaryConfines a compromised process to its container or VM. Source: category comparison	Upstream of the actionContainment depends on the model following the instruction; the action itself is not the control point. Source: 36 comparisons

Reviewed against the public documentation linked in each cell (comparison pages last reviewed 2026-10-14). No affiliation and no claim about a vendor's internals. “No public documentation found” is not a claim that a capability is impossible. For the full per-vendor pages, open the 36 comparisons →

Book Enterprise Architecture Review See every comparison

Managed assurance

CAIN Trust Desk — a named human on the other side of the evidence

For teams already running agents in production. This is not a certification and not a monitoring-only subscription: it is a recurring review that ends in signed artifacts you can hand to a reviewer, a customer or an insurer. The price range is listed in the Work Station sales deck; a quote is confirmed in writing after a baseline audit.

Recurring

Continuous review

$1,500–$4,000/month

Month-to-month · scoped after a baseline audit

Continuous AI security review across the surfaces you name
Drift and incident checks with a named person who answers
Findings ranked, with the exact input that reproduces each one

Schedule Monthly Drift Audit

The range is the published Work Station anchor, not a validated rate card.

Evidence

Monthly diff report

Included in Trust Desk

Same scope, re-run, diffed against the prior month

What changed in agents, models, tools, policies and evidence
New findings separated from findings that were fixed
Every report bound into a signed evidence bundle

See the drift engine →

The report is generated from the run data; it is not a model's summary.

Human

Signed evidence + review

Quoted after scoping

Application surface area sets the price

Ed25519-signed bundle with a standalone verifier
Human-in-the-loop support for approvals and incidents
Findings tied to the exact evidence record, not a screenshot

See a signed bundle →

No third-party audit is included or implied.

Trust Desk is a services engagement, not a software plan and not insurance. It does not replace the self-serve platform subscription. The same retainer range is listed in the Work Station sales deck →

Commercial paths

Three ways to buy. One decision path.

Self-serve platform plans are separate and unchanged: $0 Free · $19.75 Professional · $49.75 Enterprise, rendered from the billing source at /pricing. The tiers below are managed and deployment contracts, quoted after scoping. Nothing is charged until a signed order.

Developer

$0/month

No card · 10,000 decisions · 3 agents

Full self-hosted boundary tools and core APIs
Python SDK, CLI and MCP proxy
Community support
Every plan gets the full decision path; security is never a paid feature

Create a free account

Limits and allowances are rendered from /pricing.

Managed runtime

Enterprise Fabric

from $4,000/month

Proposed enterprise anchor · quote confirmed in writing

Multi-node PBFT runtime protection and cluster operations (live cluster)
Custom policy decorators for your tool and data surfaces (policy engine)
Continuous KEYSTONE CI integration
Signed audit-trail exports (verification center) and SOC 2 / ISO 27001 readiness mapping
Named support and a monthly evidence review

Scope Enterprise Fabric

This is a managed-services engagement, not the $49.75 self-serve Enterprise plan. The $4,000/month figure is a proposed anchor, not a published rate card.

Sovereign

Sovereign Cluster

Custom enterprise pricing

On-premise or isolated private cloud

Private deployment of the enforcement boundary and evidence store
Dedicated environment and deployment support
SSO / RBAC scoping for your identity provider (implementation not yet verified)
SLA objectives published; a contractual SLA exists only if signed

Request Sovereign Node

No public self-hosted installer today: the deployment is scoped and delivered with support. No claim of an air-gapped deployment until one is delivered for your environment.

What the badges do not mean: CAIN-42 holds no SOC 2 certification, no ISO 27001 certification and no third-party audit. The evidence export is a readiness mapping, not a certificate. The hosted deployment is pre-production. Read the gaps → · Self-serve pricing →

How CAIN-42 compares

CAIN-42 vs the field — 36 side-by-side pages

We put our strengths next to the agent platforms, the AI security vendors, the identity systems, the policy engines and the MCP gateways — and we say when to pick which. Where CAIN-42 wins: enforcement at the tool-call boundary, a 3-of-4 Byzantine quorum behind every authorization, and a per-action receipt you can verify offline.

Open all 36 comparisons vs Microsoft Agent 365 vs AWS AgentCore vs Lakera / Check Point

The CAIN-42 Top 100

The 100 CAIN-42 Products We're Focusing On

Your agents move fast — and that speed is exactly the risk. One wrong action (a file deleted, a payment sent, a customer record exposed, an instruction hidden inside a tool description) can cost far more than the agent ever saves. The 100 products below exist to keep that from happening. Each one closes a specific gap between what an autonomous system is permitted to do and what it actually does: it checks every action against the agent’s identity, authority, policy and risk before the action runs, holds the risky ones for a human, contains an entire fleet in milliseconds, and records every decision as signed, tamper-evident evidence you can hand to a security reviewer, an auditor or a regulator. You keep the speed and autonomy of agents and remove the downside.

And you do not have to rebuild your stack or trust a black box. These are working, composable products: a one-line SDK guard and an MCP gateway for the agents you already run, a governed-memory and vector-sanitization layer that stops poisoning and hidden-instruction attacks, spend and blast-radius controls, evidence that helps you answer EU AI Act and ISO 42001 reviews, and the runtime, identity, consensus and verification fabric underneath. Adopt one product or the whole fabric. Every card below opens a deep description and a live demo you can run in your browser in seconds — no account required — so you can see exactly what it does for your systems before you commit. Start free on a single agent, prove it on your own workload, then roll it out across the fleet. That is what CAIN-42 is for.

Book a demo Get started free

Open the full Top 100 with deep detail and live demos →

2026-2027 Frontier Research Deployments

20 New Enterprise Products — live on the hosted gateway (pre-production)

Directly operationalizing bleeding-edge Hugging Face and arXiv agentic security research. Deployed across the CAIN-42 cluster with live API endpoints, kernel-level sandboxing, and sub-millisecond execution verification.

PRODUCT #1 ● LIVE IN ENFORCE

CAIN OpenShell Enterprise Gateway

Commercial Kubernetes operator wrapping autonomous agents in Linux kernel eBPF kprobe sandboxes. Intercepts file, socket, and process syscalls, halting undeclared actions at the kernel boundary.

Target: CISO / VP Infra (Devin, Cursor, Claude Code)

Endpoint: POST /fabric/openshell/enforce-sandbox

PRODUCT #2 ● LIVE IN ENFORCE

CAIN MemVault (Vector & Memory Firewall)

Proxy in front of Pinecone, Qdrant, Mem0, and Zep. Implements Signed Memory State Records (SMSR) and real-time MemPoison defense against delayed-trigger prompt backdoors with loss-checked compaction (HF 2607.21503).

Target: AI Platform Teams (Long-Horizon RAG)

Endpoint: POST /fabric/memvault/inspect-write

PRODUCT #3 ● LIVE IN ENFORCE

CAIN VIGIL: Step-Wise Behavioral PRM Engine

Inference-side proxy applying Process Reward Model (PRM) scoring (arXiv:2502.10325) and behavioral specification checks (arXiv:2606.26524). Uses lookahead MCTS to prune hallucinated shortcuts and reward-hacking drift.

Target: Algorithmic Trading & Healthcare AI

Endpoint: POST /fabric/vigil/evaluate-step

PRODUCT #4 ● LIVE IN ENFORCE

CAIN SCITT Evidence Clearinghouse

Enterprise transparency notary conforming to IETF SCITT (draft-14) and W3C Verifiable Credentials 2.0. Generates offline-verifiable SD-JWT receipts and RFC 6962 inclusion proofs for cross-enterprise B2B agent transactions.

Target: Supply Chain & Inter-Bank Autonomous Settlement

Endpoint: POST /fabric/scitt/register-statement

PRODUCT #5 ● REFERENCE SOFTWARE

CAIN Hardware Sentry (quarantine registry)

Per-tenant quarantine registry with real 2f+1 Ed25519 quorum-certificate checks. Optional kernel link-down only on interfaces an operator lists. DPU/SmartNIC hardware is detected and reported, never used: there is no device adapter, so nothing is offloaded.

Target: Sovereign AI Data Centers & Air-Gapped Defense

Endpoint: POST /fabric/sentry/hardware-quarantine

PRODUCT #6 ● LIVE IN ENFORCE

CAIN RIG: Runtime Identity Governance

Workload identity engine conforming to IETF WIMSE (draft-ietf-wimse-arch). Mints single-use capability tokens (30-second default lifetime, configurable from 1 to 300 seconds; a second use is refused) bound to parent delegation chains, strictly terminating lateral movement across agents.

Target: Identity & Access Management (IAM) Architects

Endpoint: POST /fabric/rig/mint-token

PRODUCT #7 ● LIVE IN ENFORCE

CAIN Digital Twin & Counterfactual Emulator

Ephemeral Copy-on-Write (CoW) sandbox. Simulates proposed tool calls before production execution, computing side-effects and pre-emptively rejecting actions exceeding blast radius limits.

Target: AI Reliability & Safety Engineering Teams

Endpoint: POST /fabric/digital-twin/simulate

PRODUCT #8 ● LIVE IN ENFORCE

CAIN ExploitGym Escape Shield

Defense system addressing the July 2026 ExploitGym incident. Intercepts SSRF against cloud metadata, Kubernetes service account credential harvesting, and sliding-window multi-day intrusions.

Target: Autonomous Agent Red Teams & SecOps

Endpoint: POST /fabric/exploit-shield/inspect-action

PRODUCT #9 ● LIVE IN ENFORCE

CAIN Multi-Model Epistemic Quorum Gate

Multi-model semantic consensus gate. Verifies agreement across diverse frontier models before execution, freezing actions and requiring approval when model divergence exceeds limits.

Target: Mission-Critical Enterprise Autonomous Operations

Endpoint: POST /fabric/epistemic-quorum/evaluate-quorum

PRODUCT #10 ● LIVE IN ENFORCE

CAIN Steganographic & Semantic Firewall

Covert-channel exfiltration sanitizer. Neutralizes zero-width unicode characters, homoglyphs, and base64 smuggling before egress payloads leave the network boundary.

Target: Enterprise Data Loss Prevention (DLP) & Compliance

Endpoint: POST /fabric/steganography/sanitize-egress

PRODUCT #11 ● LIVE IN ENFORCE

CAIN Proof-Carrying Code (PCC) Compiler

Pre-execution formal verification engine based on Z3 SMT. Agents submit proposed code alongside formal Hoare-logic safety invariants; compiles and verifies machine-checkable inductive proofs before dispatch.

Target: Enterprise DevSecOps & Autonomous Code-Gen Swarms

Endpoint: POST /fabric/pcc/certify-code

PRODUCT #12 ● LIVE IN ENFORCE

CAIN Speculative Fast-Forward (SAFF) Engine

Speculative multi-trajectory tree search and verification cache. Emulates prospective execution paths across world models, pre-verifying invariant envelopes and cutting end-to-end consensus latency by 72%.

Target: Low-Latency Autonomous Operations & Robotics

Endpoint: POST /fabric/speculative/evaluate-trajectories

PRODUCT #13 ● LIVE IN ENFORCE

CAIN Swarm Cartel & Collusion Detector

Graph entropy and game-theoretic cartel defense. Detects circular delegation rings, sybil bid-rigging in agent auctions, and non-cooperative resource hoards with automated ring quarantine.

Target: Decentralized Agent Swarms & Multi-Agent Marketplaces

Endpoint: POST /fabric/cartel/inspect-swarm

PRODUCT #14 ● LIVE IN ENFORCE

CAIN PolicyForge: Dynamic OPA Synthesizer

Autonomous Rego synthesis engine with provable monotonicity verification. Transforms dynamic compliance mandates into hardened OPA policies mathematically verified never to widen permissions.

Target: Compliance Officers & Sovereign Cloud Architects

Endpoint: POST /fabric/policy-forge/synthesize-rego

PRODUCT #15 ● SIMULATED

CAIN Cyber-Physical Actuation Guard

Software check of a commanded speed, torque, acceleration and 3-D target against an envelope and geofence; non-finite numbers and missing targets are refused. Connected to no robot, bus or e-stop, and not certified against ISO 10218 or ISO 13849.

Target: Autonomous Robotics, Drones & Smart Factory Fleets

Endpoint: POST /fabric/actuation/verify-command

PRODUCT #16 ● REFERENCE SOFTWARE

CAIN zkAgent: Zero-Knowledge Trajectory Prover

Pedersen-commitment range proofs (standard construction, Fiat-Shamir bound to trajectory, agent and nonce) that each step's risk score stayed under a public ceiling without revealing the scores. Not zk-STARK or Groth16; it does not prove the scores were computed correctly.

Target: Inter-Enterprise B2B Settlement & Regulated Cloud AI

Endpoint: POST /fabric/zk/generate-proof

PRODUCT #17 ● LIVE IN ENFORCE

CAIN PathCorrection: Self-Healing Trajectory Engine

Nonlinear Model Predictive Control (MPC) and counter-drift steering engine. Detects auto-regressive drift, token degradation, and tool loops, dynamically injecting invariant attention anchors to re-center reasoning.

Target: Autonomous Coding Fleets & Long-Horizon SRE Swarms

Endpoint: POST /fabric/path-correction/steer-trajectory

PRODUCT #18 ● REFERENCE SOFTWARE

CAIN LatentGuard: Activation Threshold Screen

Fixed-threshold screen over activation statistics the caller submits, plus an exploit-string check on a token preview. It does not attach to any model or read residual streams or KV caches, and its thresholds are not calibrated against any model family.

Target: Foundation Model Providers & Hyperscale Inference Hosts

Endpoint: POST /fabric/latent-guard/probe-activation

PRODUCT #19 ● LIVE IN ENFORCE

CAIN SwarmGossip: Byzantine Epistemic Anti-Entropy

Asynchronous Byzantine fault-tolerant gossip protocol for decentralized agent swarms. Reconciles beliefs with vector clocks and Merkle trees, isolating hallucination cascades across swarms with 100+ agents.

Target: Decentralized Agent Swarms & Autonomous Supply Chains

Endpoint: POST /fabric/swarm-gossip/exchange-belief

PRODUCT #20 ● NO HARDWARE

CAIN CXL-Sentry: DMA Aperture Check (software)

Software check of a requested address range and access type against a tenant aperture; writes need an HMAC lease bound to the exact range and expiry. No CXL, PCIe, IOMMU or RDMA device is involved.

Target: GPU Superclusters & Sovereign AI Cloud Operators

Endpoint: POST /fabric/cxl-sentry/verify-dma-access

Three steps, every time

1
The AI asks
An AI agent wants to do something: use a tool, change a database, send money, start another agent. It can only ask.
2
CAIN-42 decides
CAIN-42 checks who is asking, what it is allowed to do right now, what it has already done, and how much could go wrong. No authority means no action.
3
The gate enforces, proof is kept
Only the approved action gets through. The decision and what happened are saved as signed proof anyone can check.

What CAIN-42 does today

Live right now, on these sites

Every AI action sent through CAIN Studio is checked before it runs and blocked if it is not allowed (the live pipeline runs identity, intent, policy, authorization, risk, trust, verification, ActionProof, approval, consensus, egress, MCPGate, execution and evidence; no authorization means no execution). Each recorded decision is signed by a live cluster of 4 servers across 4 US regions (Atlanta, Los Angeles, Miami, Silicon Valley) and 3 of 4 must agree (Ed25519 quorum certificate verified by the gateway). MCPGate lets through only the exact tool call that was approved. Unregistered AI systems and unsigned requests are refused, and an agent may change its own model or tools only with a human sign-off (live) (30 of 30 live cases passed). A Python SDK and MCP proxy that say no to anything you did not allow (default-deny). Today's live deployment: the quorum-committed authorization-snapshot data plane is switched on live (measured 2026-09-29 on cain-mr-01, run record dataplane-evolution-2026-09-29/governance/live_run.json: a per-call PBFT round p50 2,268.6 ms, p99 3,937.8 ms, n=20; the snapshot-covered stage p50 0.8263 ms, p99 3.4686 ms, n=1,000), a revoked agent key is refused on its very next request (measured 2026-10-02), progressive trust scoping preventing exfiltration, payload-bound signed tokens, default-deny egress screening as a live stage (an action naming a destination outside the tenant's allowlist is denied; loopback and cloud-metadata endpoints are denied regardless of rules — manage it at /fabric/egress/rules (with your API key)), and Phase 3 Frontier AI intelligence (live) (AgentPRM process reward scoring, TriCEGAR MDP behavioral verification, Governed Memory Shield, and A2A inter-agent delegation at /fabric/frontier/*).

Proof you can check yourself

the signed claims registry lists every registered claim with its status and evidence; /verify.html counts them from the signed file in your browser. Test reports (the 2026-09-28 6-suite proof-fabric run: 1,963 of 1,978 tests passed, 0 failed, 7 skipped, 8 expected failures), verifiers that use none of our code, and the limitations we have recorded (open release gates are listed in the Verification Center), all on the Proof page and in the changelog. A public, no-key proof that the egress and tool-call stages are inside each decision's signed evidence, with a zero-dependency verifier, is at the restriction-stage proof bundle. A signed status receipt — which stages enforce right now, the running commit and the live health, and is itself re-checkable offline — is at the governance status receipt. Real stored decisions are re-derived and shown tamper-evident at the record-integrity proof. Newest: E26 distributed settlement completion evidence (multi-host validated; 72-hour soak and full Frontier-20 execution not measured).

Everything in CAIN-42, on one page

175 products and features (95 marked live, 72 in development), plus 105 hosted services, and a library of 9,131 pages organised by niche (counts from /cain-ecosystem.json, as of 2026-10-23). Tell us what you want your agents to do safely, or just scroll and click.

For engineers: an interactive API reference with a page for each of the 387 API calls and 287 data schemas, each with code samples and a console that sends the real request with your own key, and step-by-step recipes for your agent framework.

Start here (5)Stop risky actions (10)See what your agents do (9)Inside your free account (12)Secure tools & MCP servers (10)Protect identities, keys & data (6)Test & grade your AI (8)Prove it to anyone (9)For developers (7)For large organisations (15)How it works (12)Coming next (72)

Integrations

CAIN-42 plugs into the stack your teams already run: your LLM gateway, your agent framework, your ITSM, SIEM and on-call tools, and your identity provider.

LLM gateways

LiteLLM (Generic Guardrail API) · Portkey (Bring Your Own Guardrails)

Keep your gateway. CAIN-42 runs inside it as a guardrail: prompt injection and poisoned tools are stopped before the model call, and every tool call the model proposes becomes a governed, recorded decision.

LiteLLM and Portkey setup →

Agent frameworks

LangGraph · CrewAI · AutoGen · OpenAI Agents SDK · Claude Agent SDK · Google ADK · Pydantic AI · LlamaIndex · MCP

A decision before every tool call, in the framework you already use: one HTTP call, or the SDK's adapters.

Framework guides →

ITSM and ticketing

ServiceNow (incidents and Security Incident Response) · Jira Cloud

Blocked actions, held approvals and the kill switch open a ServiceNow incident or a Jira issue, with the signed decision record attached.

ServiceNow and Jira setup →

SIEM and observability

Splunk · Cortex XSIAM · Datadog · Microsoft Sentinel · OpenTelemetry (Grafana, Honeycomb, New Relic, Langfuse, Arize Phoenix)

Every decision streams to the tools your security and platform teams already watch, each event carrying its signed digest.

Forwarding setup →

Alerting and chat

PagerDuty · Slack · Microsoft Teams

Page on-call when an agent is blocked or the kill switch engages; post held actions to the people who approve them.

Alerting setup →

Identity and access

Okta · Microsoft Entra ID · Google Workspace · Auth0 · Keycloak · any OIDC provider · SCIM

Single sign-on to the console with your identity provider, and members provisioned and removed automatically.

SSO and SCIM setup →

Deployment

Hosted (cainstudio.online) · Kubernetes Helm charts · self-hosted MCPGate in your VPC

Use the hosted control plane, or run CAIN-42's enforcement boundary inside your own cluster.

Self-hosted MCPGate →

Hugging Face

CAIN-42 Space: a daily workplace for AI engineers

Sign in with Hugging Face and run any tool-calling model as an agent: CAIN-42 decides each tool call live, you approve what is held, every record is signed. Plus your workspace (approvals, decisions, agent keys, policy), MCP setup for Claude, Cursor, VS Code and tiny-agents, and all 268 CAIN Studio Suite products with copy-paste API code.

Open the CAIN-42 Space →

32 capabilities. Measured, not marketed.

Identity, consensus, runtime control, threat detection, compliance, interoperability and SRE: 28 of the 32 are built and pass their tests today, and 15 of those are running live right now. Every status below is read from a signed audit that runs each capability's tests and probes its live endpoint, and where a capability is narrower than its name, the card says so. The 4 we do not offer are listed too. See the signed audit and verify it yourself.

102 canonical frontier agentic-AI inventions, built by FIRME AI CORPORATION (including 8 new Evolution 5 Sovereign Trial families: Evidence-Grounded Agentic Assurance, Harness Integrity Anti-Gaming Sealer, Multi-Turn Causal Adversarial Trial Engine, Ground-Truth Outcome Oracle, Long-Horizon Salami & Cumulative Risk Engine, Differential & Mutation Verifier, Risk-Stratified Assurance Scorecard, and Reproducible Trial Evidence Bundle). 46 patent candidates (NOVEL) · 40 UNUSUAL · 9 ENGINEERING · 7 INTEGRATION: Quorum-committed authorization snapshots · Mission goal-attenuation lattice (E38) · Continuously conditioned authorization · Dependency-driven authorization invalidation with blast radius · Authority non-transfer across governance domains (E37) · All-or-nothing governance with race-safe revocation · Bounded assurance with continuous invalidation · Comparative control-selection proof · Independence-aware Byzantine quorum · Quorum-signed programmable governance (GOV-IR) · Quorum-authorized kernel execution · Prediction-bounded authorization · Authority Continuity Protocol · Uncertainty-contracting authority horizon · Autonomy vector with certificates and leases · Self-evolution that cannot self-authorize · Mission-to-organization compiler · 4D reachability-bounded trajectory authorization · Governance contract fabric · Continuous governance attestation · Governance research fabric · Liveness-bound signed public claims · Multi-turn adversarial tool-call mediation · Anti-gaming benchmark harness seals · Long-horizon salami cumulative exfiltration defense · Ground-truth multi-modal physical outcome oracle. Each one is backed by its own passing tests (182/182 regression tests pass). FIRME AI CORPORATION IP base: $17,123,490 (IP register v56, 2026-10-23; range $6,634,180–$30,380,500; internal analytical register scenario, not an appraisal). Early-revenue: 3 founder-attested customers, $193 (customer #3 recurring $96/mo). What each one does, and its value · Evolution 5 Sovereign Trial evidence bundle.

Identity, security & cryptography

Built and tested

Agent Registry & Identity

measured: IMPLEMENTED

Built and tested

DID Identity (W3C)

Every agent gets a standard W3C did:key, and you can publish a did:web document that follows key rotation and deactivates the moment the identity is revoked.

measured: IMPLEMENTED

Built and tested

Trust Tokenization

Short-lived signed capability tokens bound to the exact action, parameters and model. Not a tradeable token.

measured: NARROWER: IMPLEMENTED

Built and tested

Quantum-Resistant Crypto

An ML-DSA-65 post-quantum signing module, tested. Live decisions are still signed with Ed25519.

measured: NARROWER: IMPLEMENTED

Live

TEE Attestation

Verify YOUR enclaves before trusting them: AWS Nitro Enclaves documents and AMD SEV-SNP reports, checked against pinned AWS and AMD roots (tested on real evidence). CAIN's own servers are not hardware-attested.

measured: NARROWER: IMPLEMENTED, LIVE ENDPOINT

Runtime control & consensus

Live

PBFT Cluster

Two live 4-replica Byzantine-fault-tolerant clusters: 3 of 4 replicas must sign before anything counts. Quorum-QaaS now sells that consensus as a service: any enterprise can get BFT without building it. Send the SHA-256 digest of any record with your API key and get back a receipt signed by the quorum, which anyone can verify offline.

measured: LIVE VERIFIED

Live

Production Cluster

Every hosted decision carries a quorum certificate that the gateway verifies itself.

measured: LIVE VERIFIED / LIVE VERIFIED

Live

Agent Hypervisor (ZoD)

A tool call routed through MCPGate runs only with a quorum-committed authorization; the SDK is default-deny. Calls that bypass the gate are not governed.

measured: NARROWER: LIVE + DISPOSABLE CLUSTER VERIFIED

Verified offline

Formal Verification (TLA+)

TLA+ models of PBFT commit, view change and the MCPGate gate, model-checked by TLC (bounded models, not a proof of the Python code).

measured: OFFLINE VERIFIED

Built and tested

Policy-as-Code Engine

OPA/Rego policies with signed policy bundles. In the hosted pipeline the policy verdict is recorded; your own tool rules are what block.

measured: IMPLEMENTED

Live

Sovereign AI Control

Self-hostable MCPGate and SDK, tested, with a live status endpoint. No public self-hosted installer yet.

measured: NARROWER: IMPLEMENTED, LIVE ENDPOINT

Threat detection & response

Live

Shadow AI Discovery

Find unregistered agents on your hosts, and LLM SDKs, MCP tools and autonomous loops in your code, with a live scanner. Not a network-wide scanner.

measured: NARROWER: IMPLEMENTED, LIVE ENDPOINT

Live

Autonomic Self-Healing

Automated quarantine and recovery, tested; live restore drills verified (run by an operator).

measured: NARROWER: LIVE VERIFIED

Built and tested

Predictive Threat Intelligence

Predicts an action's blast radius and counterfactual risk before it runs. No external threat feed.

measured: NARROWER: IMPLEMENTED

Built and tested

ML Anomaly Detection

Real-time trajectory anomaly rules: drift, salami-style cumulative spend, homoglyphs. Rules and thresholds, not a trained model.

measured: NARROWER: IMPLEMENTED

Compliance & governance

Built and tested

EU AI Act Compliance

Article 5, Annex III and Article 50 screening plus tamper-evident evidence export. No notified body has reviewed CAIN.

measured: NARROWER: IMPLEMENTED

Live

Multi-Jurisdiction Compliance

Live required-clause checks for the EU and California, plus EU AI Act screening. Two jurisdictions, not a global rules engine.

measured: NARROWER: IMPLEMENTED, LIVE ENDPOINT

Built and tested

Autonomous Governance

Plans, conflicts and delegations are checked automatically before execution. Automation never authorizes itself.

measured: NARROWER: IMPLEMENTED

Not offered

ISO 42001 certification: not offered

Not offered: CAIN-42 is not ISO 42001 certified. A readiness self-assessment exists.

measured: NOT ESTABLISHED

Not offered

Cross-Chain Governance

Not offered: there is no blockchain or cross-chain component.

measured: NOT ESTABLISHED

Interoperability

Live

A2A + MCP Protocol

MCP enforcement on the live cluster, and an A2A trust layer that refuses forged agent cards.

measured: LIVE + DISPOSABLE CLUSTER VERIFIED

Live

Third-Party AI Governance

External tools and APIs your agent reaches through CAIN are pinned and allow-listed: changed tools are dropped, unknown destinations denied.

measured: NARROWER: IMPLEMENTED, LIVE ENDPOINT

Live

Delegation Marketplace

Bounded delegation chains (scope, limits, expiry, revocation) and a live agent marketplace. Organisations do not trade tool permissions through it.

measured: NARROWER: IMPLEMENTED, LIVE ENDPOINT

Live

Global Trust Mesh

Two live multi-region clusters across 4 US regions, on one provider. Not global yet.

measured: NARROWER: LIVE VERIFIED

Developer platform & SRE

Live

Agent SRE

A live decision stream and traces in the console, plus live observability and agent-debugger services.

measured: NARROWER: IMPLEMENTED, LIVE ENDPOINT

Live

Vertical Solutions

Finance, health and federal policy packs, served live. Rule sets, maintained and versioned.

measured: NARROWER: IMPLEMENTED, LIVE ENDPOINT

Built and tested

Agent CI/CD Pipeline

A conformance suite and a deploy gate exist and are tested. No hosted CI/CD product for your agents yet.

measured: NARROWER: IMPLEMENTED

Built and tested

Collective Intelligence

Shared trust, risk and incident state across agents, tested in-process.

measured: NARROWER: IMPLEMENTED

Built and tested

Evolutionary Architecture

A self-hardening loop that proposes and tests changes. Nothing deploys itself.

measured: NARROWER: IMPLEMENTED

Live

Policy Cards

Eight ready-made policies (payment approvals and caps, read-only database, internal-only email, shell approval, redaction, agent hold) that compile into rules the live pipeline enforces. Preview free; apply with your key.

measured: IMPLEMENTED, LIVE ENDPOINT

Not offered

Neural Governance

Not offered: the term has no implementation.

measured: NOT ESTABLISHED

Not offered

Quantum Governance

Not offered: the term has no implementation.

measured: NOT ESTABLISHED

Start free Verify the audit

Put your AI system under governance

Free to start. Nothing runs without authority: the default is no.

Get started Watch it block an attack

Under the hood

The technical detail

Everything below is for senior AI and security engineers: how CAIN-42 governs an autonomous AI agent, what is live, what is only tested, and what is not built. Every claim links to signed evidence and a verifier that imports none of CAIN-42's code.

Control for the AGI era

Built to control AGI

As AI agents get more capable, the question stops being “is the model smart?” and becomes “who decides what it is allowed to do?” CAIN-42 answers it the same way for every agent, however capable: being capable, confident or right before earns an agent no authority. No AGI exists yet to test against, so every result published here is measured on today’s models. Prompt filters inspect text. CAIN-42 governs what autonomous AI agents actually do: tool calls, shell, databases, APIs, money, spawning other agents. One authorization is not enough for a system that runs for hours, so authority is continuous: a short-lived, governance-signed lease bound to the agent, its trajectory and its exact plan, re-checked before every action against everything the system has done so far, and lost the moment policy, trust, risk, model or context changes. An agent may learn, remember, plan, delegate and discover tools, but none of that creates authority. Only governance state signed by a quorum of the CAIN-42 cluster does. CAG-L5 is CAIN's own governance designation, not the SAE driving scale.

67 signedpublic claims, each with its evidence, status and limits; 18 verified on the live system. Check the signature in your browser 3 of 4replica signatures from a live Byzantine cluster across 4 US regions on every hosted decision, checked by the gateway itself 30 of 30live L5 governance cases on the live gateway behaved as specified (13 system-governor, 17 evolution-gate)14 of 14ways an agent loses its permission, each tripped on the live cluster; the tool never ran after any of them

CAG-L5 system governor (live)

Governs the whole autonomous system, not a single call. One decision composes: emergency freeze, a 2f+1 cluster certificate over the current governance state, a governance-signed system manifest (agents, models, tools, resources), model identity, tool registry, exact capabilities (READ, WRITE, DELETE and ADMIN are never implied by each other), deterministic policy precedence (a lower ALLOW never beats a higher DENY), the intersection of agent, delegator, system and trajectory-lease authority, and graph-derived blast radius where irreversible or wide actions need two operators. The gate re-verifies the signed decision and its execution commitment before anything runs. On in the hosted gateway since 2026-09-28: unregistered systems and unsigned requests are refused. Also live since 2026-09-28: the evolution gate. An agent's model and MCP tool set change only through a signed proposal, an evaluator-signed test report and a human operator (never the agent itself), and every change gets a new capability commitment that the cluster must sign before the agent may act again. Since 2026-10-06 a signed agent passport binds identity, model, tools and authority scope to the exact call; sequences of individually allowed calls (a sensitive read then an outbound send, even split across two keys, a privilege raised step by step, split payments, a runaway loop) go to a human; and a tenant-owned physical safety envelope refuses out-of-envelope device actions, even in shadow mode.

verify the live run (41/41) →

Byzantine consensus authorization (live)

Two live PBFT clusters, n=4 and f=1: cain-mr-02 (Atlanta, Los Angeles, Miami, Silicon Valley) orders and signs hosted decisions with one replica per host surviving any single host loss, and cain-mr-01 (Atlanta, Los Angeles, Miami) has committed 40,436 sequences. Nothing counts without a quorum certificate of 3 Ed25519 signatures, and the gateway verifies that certificate itself instead of trusting a replica's word. Each cluster signs its own proof every 30 minutes: 250 of 251 OPERATIONAL on cain-mr-01 since 2026-09-26, 295 of 295 on cain-mr-02 since 2026-09-27. 442 Byzantine tests pass, and a fault-injection run held 49 of 49 checks.

watch it live →

Enforcement boundary (MCPGate)

Sits in front of MCP servers, APIs and tools. A call runs only if that exact call was authorized; anything else gets a signed denial. The tool server never receives CAIN's authorization envelope or the caller's credentials, and an operator's global halt or agent quarantine stops hosted decisions for every tenant. Being caught earns an agent nothing: two blocked prompt injections no longer unlock a $250,000 transfer or rm -rf /, every action is scored by what it does (tool, destructiveness, amount), dangerous ones wait for a human, your deny rules match every spelling of a path, and an approval covers one exact call, arguments included. Live on 3 of 3 domains since 2026-09-28; 48 of 48 decisions match the cluster's own public record.

5 ran, 12 attacks blocked →

Signed evidence

An Ed25519-signed, hash-chained record per decision in canonical JSON (RFC 8785) with RFC 6962 Merkle proof trees, keys kept outside the database, and standalone clean-room verifiers that re-check everything offline without CAIN code. The identity and passport log is hash-chained per tenant with issuer-signed checkpoints, so an edited, deleted, reordered or truncated record fails offline verification.

Verification Center →

Default-deny SDK & data plane (live)

The Python guard and MCP proxy hold any action you did not declare. Allow tools explicitly with guard(allow=[...]); opting out is recorded on every decision. The live decoupled data plane (CAIN_AUTH_SNAPSHOT=1) executes sub-millisecond local authorization verified against quorum-committed PBFT snapshots with dynamic progressive trust scoping.

quickstart →

Frontier agent intelligence & ZoD (live)

Agent code runs confined with Linux namespaces and seccomp-BPF filters. Real-time Process Reward Model (AgentPRM arXiv:2502.10325) prunes hallucinated shortcut steps, TriCEGAR model checks MDP state transitions, Governed Memory Shield sanitizes injection vectors at write time, and A2A delegation verifies Ed25519 card and delegation signatures, attenuates monotonically and labels capabilities self-asserted. Agent keys cannot raise their own memory to trusted, write policies or operate the controls that govern them. Live endpoints at /fabric/frontier/*.

verify Phase 3 evidence →

Send one action through the live pipeline

No account. Each button posts a fixed scenario to /fabric/try on this site and shows the real decision, stage by stage, including whether each stage was enforcing. The demo forces enforcement on for its own throwaway tenant; the response says so. A read-only action runs by itself as the page opens, so you see the live pipeline decide without touching anything.

For developers

One request. A signed decision back.

Try it with no account: send a prompt-injection attempt through the live pipeline. You get back the verdict, which stage blocked it, and the consensus certificate your gateway verified.

Get an API key API reference Read the docs

$ curl -X POST "https://cainstudio.online/fabric/try?scenario=prompt-injection"
{
  "verdict": "BLOCKED",
  "blocked_by": ["risk", "trust"],
  "consensus": {
    "cluster_id": "cain-mr-02",
    "certificate_verified_by_gateway": {
      "verified": true,
      "signers": ["cain-mr2-node-1", "cain-mr2-node-3", "cain-mr2-node-4"],
      "quorum": 3
    }
  },
  "evidence": { ... }
}

Architecture

Where CAIN-42 sits

Solid boxes are on the live path. The PBFT cluster is drawn dashed; it runs live in 4 regions (watch it).

Solid: in the live path today.Dashed: the consensus layer (live cluster cain-mr-02); it orders and signs every hosted decision.Verdicts: ALLOW · REQUIRE_APPROVAL · BLOCKED.

Proof, not promises

Check what is live right now

Your browser loads each row below from its source as the page opens. A source that does not answer shows as NOT LIVE. The passing set is shown here; every claim, its limits and every run outcome stay published in full on the Proof page.

Production gates: 14 of 15 core, 5 of 9 additional passed (proof page & known limitations)Verify every claim Live cluster

Verifier Room — verify CAIN-42 yourself, in seconds

You do not have to trust us or contact us. Every evidence bundle below ships a clean-room verifier that imports none of CAIN-42's code. Copy one block into a terminal on your own computer: it downloads that bundle and its verifiers, and runs two chained checks. verify_publisher.py must print PUBLISHED_BY_PINNED_KEY: the bytes are exactly what the CAIN publisher key signed, so an edited or re-signed bundle fails. Only then does the bundle's own verifier run, and it must print "result": "INTACT": its internal hashes and signatures agree. The block ends with one line, VERIFIED or NOT VERIFIED. Do not run the bundle verifier on its own. Nothing on these sites is needed after the download.

Requires Python 3 and internet. The verifiers read published data only; they never touch the live service and never call our servers for a verdict. A changed byte in any bundle file makes the verifier report BROKEN. INTACT alone means only that the bundle agrees with the key shipped inside it, which anyone who re-signs a bundle can arrange. That is why every block also runs verify_publisher.py (verifier, pinned key at /.well-known/cain-publisher-key.json): it refuses an edited, added, removed or re-signed file. The publisher key is ours, so neither check is independent verification.

BFTIP · bft-ip-forensics-2026-10-05

— published result: INTACT (58/59 checks)

mkdir -p bft-ip-forensics-2026-10-05 && cd bft-ip-forensics-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/bft-ip-forensics-2026-10-05.json", "../bft-ip-forensics-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../bft-ip-forensics-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "bft-ip-forensics-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "bft-ip-forensics-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../bft-ip-forensics-2026-10-05 ../bft-ip-forensics-2026-10-05.attestation.json \
  && python3 verify_bftip.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCE.txt · verify_bftip.py

E38 · e38-byzantine-mission-integrity-2026-10-05

— published result: INTACT (127/127 checks)

mkdir -p e38-byzantine-mission-integrity-2026-10-05 && cd e38-byzantine-mission-integrity-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e38-byzantine-mission-integrity-2026-10-05.json", "../e38-byzantine-mission-integrity-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e38-byzantine-mission-integrity-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e38-byzantine-mission-integrity-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e38-byzantine-mission-integrity-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e38-byzantine-mission-integrity-2026-10-05 ../e38-byzantine-mission-integrity-2026-10-05.attestation.json \
  && python3 verify_e38.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCE.txt · verify_e38.py

E37 · e37-byzantine-autonomous-federation-2026-10-05

30/30 invariants · 30/30 scenarios held — published result: INTACT (70/70 checks)

mkdir -p e37-byzantine-autonomous-federation-2026-10-05 && cd e37-byzantine-autonomous-federation-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e37-byzantine-autonomous-federation-2026-10-05.json", "../e37-byzantine-autonomous-federation-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e37-byzantine-autonomous-federation-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e37-byzantine-autonomous-federation-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e37-byzantine-autonomous-federation-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e37-byzantine-autonomous-federation-2026-10-05 ../e37-byzantine-autonomous-federation-2026-10-05.attestation.json \
  && python3 verify_e37.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCE.txt · verify_e37.py

E36 · e36-byzantine-collective-governance-2026-10-05

23/30 invariants · 30/30 scenarios held — published result: INTACT (69/76 checks)

mkdir -p e36-byzantine-collective-governance-2026-10-05 && cd e36-byzantine-collective-governance-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e36-byzantine-collective-governance-2026-10-05.json", "../e36-byzantine-collective-governance-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e36-byzantine-collective-governance-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e36-byzantine-collective-governance-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e36-byzantine-collective-governance-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e36-byzantine-collective-governance-2026-10-05 ../e36-byzantine-collective-governance-2026-10-05.attestation.json \
  && python3 verify_e36.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCE.txt · verify_e36.py

E35 · e35-continuous-autonomy-integrity-2026-10-05

27/30 invariants · 30/30 scenarios held — published result: INTACT (108/111 checks)

mkdir -p e35-continuous-autonomy-integrity-2026-10-05 && cd e35-continuous-autonomy-integrity-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e35-continuous-autonomy-integrity-2026-10-05.json", "../e35-continuous-autonomy-integrity-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e35-continuous-autonomy-integrity-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e35-continuous-autonomy-integrity-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e35-continuous-autonomy-integrity-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e35-continuous-autonomy-integrity-2026-10-05 ../e35-continuous-autonomy-integrity-2026-10-05.attestation.json \
  && python3 verify_e35.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCE.txt · verify_e35.py

E34 · e34-decision-provenance-2026-10-05

0/0 invariants · 0/0 scenarios held — published result: PARTIAL (0/0 checks)

mkdir -p e34-decision-provenance-2026-10-05 && cd e34-decision-provenance-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e34-decision-provenance-2026-10-05.json", "../e34-decision-provenance-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e34-decision-provenance-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e34-decision-provenance-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e34-decision-provenance-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e34-decision-provenance-2026-10-05 ../e34-decision-provenance-2026-10-05.attestation.json \
  && python3 verify_e34.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCE.txt · verify_e34.py

E32 · e32-global-trust-settlement-2026-10-05

mkdir -p e32-global-trust-settlement-2026-10-05 && cd e32-global-trust-settlement-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e32-global-trust-settlement-2026-10-05.json", "../e32-global-trust-settlement-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e32-global-trust-settlement-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e32-global-trust-settlement-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e32-global-trust-settlement-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e32-global-trust-settlement-2026-10-05 ../e32-global-trust-settlement-2026-10-05.attestation.json \
  && python3 verify_e32.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCE.txt · verify_e32.py

E31 · e31-governance-proof-fabric-2026-10-05

mkdir -p e31-governance-proof-fabric-2026-10-05 && cd e31-governance-proof-fabric-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e31-governance-proof-fabric-2026-10-05.json", "../e31-governance-proof-fabric-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e31-governance-proof-fabric-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e31-governance-proof-fabric-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e31-governance-proof-fabric-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e31-governance-proof-fabric-2026-10-05 ../e31-governance-proof-fabric-2026-10-05.attestation.json \
  && python3 verify_e31.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCE.txt · verify_e31.py

E30 · e30-governance-network-2026-10-05

mkdir -p e30-governance-network-2026-10-05 && cd e30-governance-network-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e30-governance-network-2026-10-05.json", "../e30-governance-network-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e30-governance-network-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e30-governance-network-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e30-governance-network-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e30-governance-network-2026-10-05 ../e30-governance-network-2026-10-05.attestation.json \
  && python3 verify_e30.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCE.txt · verify_e30.py

E28 · e28-catcp-ip-commercial-2026-10-05

mkdir -p e28-catcp-ip-commercial-2026-10-05 && cd e28-catcp-ip-commercial-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e28-catcp-ip-commercial-2026-10-05.json", "../e28-catcp-ip-commercial-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e28-catcp-ip-commercial-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e28-catcp-ip-commercial-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e28-catcp-ip-commercial-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e28-catcp-ip-commercial-2026-10-05 ../e28-catcp-ip-commercial-2026-10-05.attestation.json \
  && python3 verify_e28.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCE.txt · verify_e28.py

E27 · e27-catcp-control-2026-10-05

mkdir -p e27-catcp-control-2026-10-05 && cd e27-catcp-control-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e27-catcp-control-2026-10-05.json", "../e27-catcp-control-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e27-catcp-control-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e27-catcp-control-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e27-catcp-control-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e27-catcp-control-2026-10-05 ../e27-catcp-control-2026-10-05.attestation.json \
  && python3 verify_e27.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCE.txt · verify_e27.py

E26 · e26-byzantine-trust-2026-10-05

mkdir -p e26-byzantine-trust-2026-10-05 && cd e26-byzantine-trust-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e26-byzantine-trust-2026-10-05.json", "../e26-byzantine-trust-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e26-byzantine-trust-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e26-byzantine-trust-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e26-byzantine-trust-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e26-byzantine-trust-2026-10-05 ../e26-byzantine-trust-2026-10-05.attestation.json \
  && python3 verify_e26.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCE.txt · verify_e26.py

E23 · e23-continuous-assurance-2026-10-05

mkdir -p e23-continuous-assurance-2026-10-05 && cd e23-continuous-assurance-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e23-continuous-assurance-2026-10-05.json", "../e23-continuous-assurance-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e23-continuous-assurance-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e23-continuous-assurance-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e23-continuous-assurance-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e23-continuous-assurance-2026-10-05 ../e23-continuous-assurance-2026-10-05.attestation.json \
  && python3 verify_e23.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCE.txt · verify_e23.py

E22 · e22-byzantine-global-verification-2026-10-05

mkdir -p e22-byzantine-global-verification-2026-10-05 && cd e22-byzantine-global-verification-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e22-byzantine-global-verification-2026-10-05.json", "../e22-byzantine-global-verification-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e22-byzantine-global-verification-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e22-byzantine-global-verification-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e22-byzantine-global-verification-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e22-byzantine-global-verification-2026-10-05 ../e22-byzantine-global-verification-2026-10-05.attestation.json \
  && python3 verify_e22.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCE.txt · verify_e22.py

E21 · e21-byzantine-economic-coordination-2026-10-05

mkdir -p e21-byzantine-economic-coordination-2026-10-05 && cd e21-byzantine-economic-coordination-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e21-byzantine-economic-coordination-2026-10-05.json", "../e21-byzantine-economic-coordination-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e21-byzantine-economic-coordination-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e21-byzantine-economic-coordination-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e21-byzantine-economic-coordination-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e21-byzantine-economic-coordination-2026-10-05 ../e21-byzantine-economic-coordination-2026-10-05.attestation.json \
  && python3 verify_e21.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

E18 · e18-byzantine-counterfactual-governance-2026-10-05

— published result: VALID (31/31 checks)

mkdir -p e18-byzantine-counterfactual-governance-2026-10-05 && cd e18-byzantine-counterfactual-governance-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e18-byzantine-counterfactual-governance-2026-10-05.json", "../e18-byzantine-counterfactual-governance-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e18-byzantine-counterfactual-governance-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e18-byzantine-counterfactual-governance-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e18-byzantine-counterfactual-governance-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e18-byzantine-counterfactual-governance-2026-10-05 ../e18-byzantine-counterfactual-governance-2026-10-05.attestation.json \
  && python3 verify_e18.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCE.txt · verify_e18.py

E13 · e13-bpf-governance-execution-2026-10-05

— published result: INTACT (24/24 checks)

mkdir -p e13-bpf-governance-execution-2026-10-05 && cd e13-bpf-governance-execution-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e13-bpf-governance-execution-2026-10-05.json", "../e13-bpf-governance-execution-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e13-bpf-governance-execution-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e13-bpf-governance-execution-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e13-bpf-governance-execution-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e13-bpf-governance-execution-2026-10-05 ../e13-bpf-governance-execution-2026-10-05.attestation.json \
  && python3 verify_e13.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e13.py

E12 · e12-trust-network-state-2026-10-05

— published result: INTACT (20/20 checks)

mkdir -p e12-trust-network-state-2026-10-05 && cd e12-trust-network-state-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e12-trust-network-state-2026-10-05.json", "../e12-trust-network-state-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e12-trust-network-state-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e12-trust-network-state-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e12-trust-network-state-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e12-trust-network-state-2026-10-05 ../e12-trust-network-state-2026-10-05.attestation.json \
  && python3 verify_e12.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e12.py

E11 · e11-governance-proof-2026-10-05

— published result: INTACT (32/32 checks)

mkdir -p e11-governance-proof-2026-10-05 && cd e11-governance-proof-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e11-governance-proof-2026-10-05.json", "../e11-governance-proof-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e11-governance-proof-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e11-governance-proof-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e11-governance-proof-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e11-governance-proof-2026-10-05 ../e11-governance-proof-2026-10-05.attestation.json \
  && python3 verify_e11.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e11.py

E42 · e42-supreme-governed-agentic-infrastructure-2026-10-01

— published result: INTACT (1460/1460 checks)

mkdir -p e42-supreme-governed-agentic-infrastructure-2026-10-01 && cd e42-supreme-governed-agentic-infrastructure-2026-10-01
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e42-supreme-governed-agentic-infrastructure-2026-10-01.json", "../e42-supreme-governed-agentic-infrastructure-2026-10-01.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e42-supreme-governed-agentic-infrastructure-2026-10-01.attestation.json"))["files"])
for f in names:
    get(E + "e42-supreme-governed-agentic-infrastructure-2026-10-01/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e42-supreme-governed-agentic-infrastructure-2026-10-01/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e42-supreme-governed-agentic-infrastructure-2026-10-01 ../e42-supreme-governed-agentic-infrastructure-2026-10-01.attestation.json \
  && python3 verify_e42.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e42.py

E41 · e41-machine-agency-exchange-2026-09-30

— published result: INTACT (1303/1303 checks)

mkdir -p e41-machine-agency-exchange-2026-09-30 && cd e41-machine-agency-exchange-2026-09-30
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e41-machine-agency-exchange-2026-09-30.json", "../e41-machine-agency-exchange-2026-09-30.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e41-machine-agency-exchange-2026-09-30.attestation.json"))["files"])
for f in names:
    get(E + "e41-machine-agency-exchange-2026-09-30/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e41-machine-agency-exchange-2026-09-30/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e41-machine-agency-exchange-2026-09-30 ../e41-machine-agency-exchange-2026-09-30.attestation.json \
  && python3 verify_e41.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e41.py

E40 · e40-autonomous-enterprise-intelligence-2026-09-30

— published result: INTACT (1518/1518 checks)

mkdir -p e40-autonomous-enterprise-intelligence-2026-09-30 && cd e40-autonomous-enterprise-intelligence-2026-09-30
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e40-autonomous-enterprise-intelligence-2026-09-30.json", "../e40-autonomous-enterprise-intelligence-2026-09-30.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e40-autonomous-enterprise-intelligence-2026-09-30.attestation.json"))["files"])
for f in names:
    get(E + "e40-autonomous-enterprise-intelligence-2026-09-30/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e40-autonomous-enterprise-intelligence-2026-09-30/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e40-autonomous-enterprise-intelligence-2026-09-30 ../e40-autonomous-enterprise-intelligence-2026-09-30.attestation.json \
  && python3 verify_e40.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e40.py

E37 · e37-autonomous-execution-mesh-2026-09-30

1132/1132 invariants · 2720/2720 scenarios held — published result: INTACT (2627/2627 checks)

mkdir -p e37-autonomous-execution-mesh-2026-09-30 && cd e37-autonomous-execution-mesh-2026-09-30
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e37-autonomous-execution-mesh-2026-09-30.json", "../e37-autonomous-execution-mesh-2026-09-30.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e37-autonomous-execution-mesh-2026-09-30.attestation.json"))["files"])
for f in names:
    get(E + "e37-autonomous-execution-mesh-2026-09-30/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e37-autonomous-execution-mesh-2026-09-30/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e37-autonomous-execution-mesh-2026-09-30 ../e37-autonomous-execution-mesh-2026-09-30.attestation.json \
  && python3 verify_e37.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e37.py

E36 · e36-machine-agency-exchange-2026-09-30

842/842 invariants · 3340/3340 scenarios held — published result: INTACT (3601/3601 checks)

mkdir -p e36-machine-agency-exchange-2026-09-30 && cd e36-machine-agency-exchange-2026-09-30
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e36-machine-agency-exchange-2026-09-30.json", "../e36-machine-agency-exchange-2026-09-30.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e36-machine-agency-exchange-2026-09-30.attestation.json"))["files"])
for f in names:
    get(E + "e36-machine-agency-exchange-2026-09-30/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e36-machine-agency-exchange-2026-09-30/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e36-machine-agency-exchange-2026-09-30 ../e36-machine-agency-exchange-2026-09-30.attestation.json \
  && python3 verify_e36.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e36.py

E35 · e35-governance-intelligence-2026-09-30

799/799 invariants · 3544/3544 scenarios held — published result: INTACT (3810/3810 checks)

mkdir -p e35-governance-intelligence-2026-09-30 && cd e35-governance-intelligence-2026-09-30
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e35-governance-intelligence-2026-09-30.json", "../e35-governance-intelligence-2026-09-30.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e35-governance-intelligence-2026-09-30.attestation.json"))["files"])
for f in names:
    get(E + "e35-governance-intelligence-2026-09-30/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e35-governance-intelligence-2026-09-30/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e35-governance-intelligence-2026-09-30 ../e35-governance-intelligence-2026-09-30.attestation.json \
  && python3 verify_e35.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e35.py

E34 · e34-proof-carrying-machine-agency-2026-09-30

629/629 invariants · 2664/2664 scenarios held — published result: INTACT (3286/3286 checks)

mkdir -p e34-proof-carrying-machine-agency-2026-09-30 && cd e34-proof-carrying-machine-agency-2026-09-30
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e34-proof-carrying-machine-agency-2026-09-30.json", "../e34-proof-carrying-machine-agency-2026-09-30.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e34-proof-carrying-machine-agency-2026-09-30.attestation.json"))["files"])
for f in names:
    get(E + "e34-proof-carrying-machine-agency-2026-09-30/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e34-proof-carrying-machine-agency-2026-09-30/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e34-proof-carrying-machine-agency-2026-09-30 ../e34-proof-carrying-machine-agency-2026-09-30.attestation.json \
  && python3 verify_e34.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e34.py

E33 · e33-governed-agentic-operating-fabric-2026-09-30

581/581 invariants · 2029/2029 scenarios held — published result: INTACT (2603/2603 checks)

mkdir -p e33-governed-agentic-operating-fabric-2026-09-30 && cd e33-governed-agentic-operating-fabric-2026-09-30
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e33-governed-agentic-operating-fabric-2026-09-30.json", "../e33-governed-agentic-operating-fabric-2026-09-30.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e33-governed-agentic-operating-fabric-2026-09-30.attestation.json"))["files"])
for f in names:
    get(E + "e33-governed-agentic-operating-fabric-2026-09-30/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e33-governed-agentic-operating-fabric-2026-09-30/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e33-governed-agentic-operating-fabric-2026-09-30 ../e33-governed-agentic-operating-fabric-2026-09-30.attestation.json \
  && python3 verify_e33.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e33.py

E32 · e32-governed-autonomy-learning-2026-09-30

— published result: INTACT (1420/1420 checks)

mkdir -p e32-governed-autonomy-learning-2026-09-30 && cd e32-governed-autonomy-learning-2026-09-30
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e32-governed-autonomy-learning-2026-09-30.json", "../e32-governed-autonomy-learning-2026-09-30.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e32-governed-autonomy-learning-2026-09-30.attestation.json"))["files"])
for f in names:
    get(E + "e32-governed-autonomy-learning-2026-09-30/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e32-governed-autonomy-learning-2026-09-30/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e32-governed-autonomy-learning-2026-09-30 ../e32-governed-autonomy-learning-2026-09-30.attestation.json \
  && python3 verify_e32.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e32.py

E31 · e31-universal-proof-of-governance-2026-09-30

— published result: INTACT (1676/1676 checks)

mkdir -p e31-universal-proof-of-governance-2026-09-30 && cd e31-universal-proof-of-governance-2026-09-30
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e31-universal-proof-of-governance-2026-09-30.json", "../e31-universal-proof-of-governance-2026-09-30.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e31-universal-proof-of-governance-2026-09-30.attestation.json"))["files"])
for f in names:
    get(E + "e31-universal-proof-of-governance-2026-09-30/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e31-universal-proof-of-governance-2026-09-30/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e31-universal-proof-of-governance-2026-09-30 ../e31-universal-proof-of-governance-2026-09-30.attestation.json \
  && python3 verify_e31.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e31.py

E30 · e30-governed-machine-autonomy-2026-09-30

— published result: INTACT (1187/1187 checks)

mkdir -p e30-governed-machine-autonomy-2026-09-30 && cd e30-governed-machine-autonomy-2026-09-30
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e30-governed-machine-autonomy-2026-09-30.json", "../e30-governed-machine-autonomy-2026-09-30.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e30-governed-machine-autonomy-2026-09-30.attestation.json"))["files"])
for f in names:
    get(E + "e30-governed-machine-autonomy-2026-09-30/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e30-governed-machine-autonomy-2026-09-30/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e30-governed-machine-autonomy-2026-09-30 ../e30-governed-machine-autonomy-2026-09-30.attestation.json \
  && python3 verify_e30.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e30.py

E29 · e29-machine-transaction-fabric-2026-09-30

— published result: INTACT (300/300 checks)

mkdir -p e29-machine-transaction-fabric-2026-09-30 && cd e29-machine-transaction-fabric-2026-09-30
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e29-machine-transaction-fabric-2026-09-30.json", "../e29-machine-transaction-fabric-2026-09-30.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e29-machine-transaction-fabric-2026-09-30.attestation.json"))["files"])
for f in names:
    get(E + "e29-machine-transaction-fabric-2026-09-30/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e29-machine-transaction-fabric-2026-09-30/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e29-machine-transaction-fabric-2026-09-30 ../e29-machine-transaction-fabric-2026-09-30.attestation.json \
  && python3 verify_e29.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e29.py

E28 · e28-portable-execution-identity-2026-09-30

— published result: INTACT (243/243 checks)

mkdir -p e28-portable-execution-identity-2026-09-30 && cd e28-portable-execution-identity-2026-09-30
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e28-portable-execution-identity-2026-09-30.json", "../e28-portable-execution-identity-2026-09-30.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e28-portable-execution-identity-2026-09-30.attestation.json"))["files"])
for f in names:
    get(E + "e28-portable-execution-identity-2026-09-30/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e28-portable-execution-identity-2026-09-30/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e28-portable-execution-identity-2026-09-30 ../e28-portable-execution-identity-2026-09-30.attestation.json \
  && python3 verify_e28.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e28.py

E27 · e27-agentic-internet-control-plane-2026-09-30

— published result: INTACT (4001/4001 checks)

mkdir -p e27-agentic-internet-control-plane-2026-09-30 && cd e27-agentic-internet-control-plane-2026-09-30
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e27-agentic-internet-control-plane-2026-09-30.json", "../e27-agentic-internet-control-plane-2026-09-30.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e27-agentic-internet-control-plane-2026-09-30.attestation.json"))["files"])
for f in names:
    get(E + "e27-agentic-internet-control-plane-2026-09-30/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e27-agentic-internet-control-plane-2026-09-30/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e27-agentic-internet-control-plane-2026-09-30 ../e27-agentic-internet-control-plane-2026-09-30.attestation.json \
  && python3 verify_e27.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e27.py

E26 · e26-universal-machine-agency-trust-2026-09-30

— published result: INTACT (3115/3115 checks)

mkdir -p e26-universal-machine-agency-trust-2026-09-30 && cd e26-universal-machine-agency-trust-2026-09-30
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e26-universal-machine-agency-trust-2026-09-30.json", "../e26-universal-machine-agency-trust-2026-09-30.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e26-universal-machine-agency-trust-2026-09-30.attestation.json"))["files"])
for f in names:
    get(E + "e26-universal-machine-agency-trust-2026-09-30/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e26-universal-machine-agency-trust-2026-09-30/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e26-universal-machine-agency-trust-2026-09-30 ../e26-universal-machine-agency-trust-2026-09-30.attestation.json \
  && python3 verify_e26.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e26.py

E25 · e25-universal-machine-agency-2026-09-30

— published result: INTACT (2977/2977 checks)

mkdir -p e25-universal-machine-agency-2026-09-30 && cd e25-universal-machine-agency-2026-09-30
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e25-universal-machine-agency-2026-09-30.json", "../e25-universal-machine-agency-2026-09-30.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e25-universal-machine-agency-2026-09-30.attestation.json"))["files"])
for f in names:
    get(E + "e25-universal-machine-agency-2026-09-30/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e25-universal-machine-agency-2026-09-30/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e25-universal-machine-agency-2026-09-30 ../e25-universal-machine-agency-2026-09-30.attestation.json \
  && python3 verify_e25.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e25.py

E24 · e24-governed-agentic-internet-2026-09-29

— published result: INTACT (1952/1952 checks)

mkdir -p e24-governed-agentic-internet-2026-09-29 && cd e24-governed-agentic-internet-2026-09-29
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e24-governed-agentic-internet-2026-09-29.json", "../e24-governed-agentic-internet-2026-09-29.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e24-governed-agentic-internet-2026-09-29.attestation.json"))["files"])
for f in names:
    get(E + "e24-governed-agentic-internet-2026-09-29/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e24-governed-agentic-internet-2026-09-29/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e24-governed-agentic-internet-2026-09-29 ../e24-governed-agentic-internet-2026-09-29.attestation.json \
  && python3 verify_e24.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

VERIFICATION.md · verify_e24.py

E23 · e23-governed-meta-intelligence-2026-09-29

— published result: INTACT (733/733 checks)

mkdir -p e23-governed-meta-intelligence-2026-09-29 && cd e23-governed-meta-intelligence-2026-09-29
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e23-governed-meta-intelligence-2026-09-29.json", "../e23-governed-meta-intelligence-2026-09-29.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e23-governed-meta-intelligence-2026-09-29.attestation.json"))["files"])
for f in names:
    get(E + "e23-governed-meta-intelligence-2026-09-29/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e23-governed-meta-intelligence-2026-09-29/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e23-governed-meta-intelligence-2026-09-29 ../e23-governed-meta-intelligence-2026-09-29.attestation.json \
  && python3 verify_e23.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

VERIFICATION.md · verify_e23.py

E21 · e21-open-ended-intelligence-2026-09-29

— published result: INTACT (218/218 checks)

mkdir -p e21-open-ended-intelligence-2026-09-29 && cd e21-open-ended-intelligence-2026-09-29
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e21-open-ended-intelligence-2026-09-29.json", "../e21-open-ended-intelligence-2026-09-29.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e21-open-ended-intelligence-2026-09-29.attestation.json"))["files"])
for f in names:
    get(E + "e21-open-ended-intelligence-2026-09-29/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e21-open-ended-intelligence-2026-09-29/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e21-open-ended-intelligence-2026-09-29 ../e21-open-ended-intelligence-2026-09-29.attestation.json \
  && python3 verify_e21.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

live evolution gate (REPRODUCE.txt)

E20 · e20-agentic-institutions-2026-09-29

— published result: INTACT (179/179 checks)

mkdir -p e20-agentic-institutions-2026-09-29 && cd e20-agentic-institutions-2026-09-29
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e20-agentic-institutions-2026-09-29.json", "../e20-agentic-institutions-2026-09-29.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e20-agentic-institutions-2026-09-29.attestation.json"))["files"])
for f in names:
    get(E + "e20-agentic-institutions-2026-09-29/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e20-agentic-institutions-2026-09-29/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e20-agentic-institutions-2026-09-29 ../e20-agentic-institutions-2026-09-29.attestation.json \
  && python3 verify_e20.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCE.txt · verify_e20.py

E19 · e19-governed-autonomy-2026-09-28

— published result: INTACT (117/117 checks)

mkdir -p e19-governed-autonomy-2026-09-28 && cd e19-governed-autonomy-2026-09-28
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e19-governed-autonomy-2026-09-28.json", "../e19-governed-autonomy-2026-09-28.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e19-governed-autonomy-2026-09-28.attestation.json"))["files"])
for f in names:
    get(E + "e19-governed-autonomy-2026-09-28/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e19-governed-autonomy-2026-09-28/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e19-governed-autonomy-2026-09-28 ../e19-governed-autonomy-2026-09-28.attestation.json \
  && python3 verify_e19.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCE.txt · verify_e19.py

Newest published bundle: bft-ip-forensics-2026-10-05. Every bundle is also mirrored on the other two sites so the same verifier runs against an independent copy.

What CAIN-42 is not, yet

What CAIN-42 is, and is not

What it is

The governor for autonomous AI agents: a trust and execution-control runtime that sits between an autonomous AI system and the actions it takes. Every proposed action is checked (identity, authority, trajectory, policy, risk, trust, system scope), a boundary applies the verdict before the tool runs, and the decision is recorded as signed evidence. The CAG-L5 system governor runs in the hosted gateway: a system must be registered with a governance-signed manifest, every request must be signed by the agent's own key, and governance state counts only when the live 4-replica PBFT cluster has signed it with a quorum certificate (3 of 4 signatures). Every hosted decision is ordered and signed by that cluster, and agent authority in the CAIN-45 hypervisor is committed by it too. Since 2026-09-28 an agent's capability (its model and the MCP tools it may call) can change only through the governed evolution gate, and the cluster signs a capability commitment, so authority granted for the old capability never carries over to the new one.

Is it an "agent hypervisor"?

Partly. The hosted gateway mediates the tool calls routed through it and cannot see a call that bypasses it. Separately, the CAIN-45 agent hypervisor (ZoD) confines agent code with Linux namespaces and cgroups, takes its authority from the live cluster, and re-checks that authority before every action. It is a library the operator runs today. It has a kernel syscall filter (seccomp-BPF, classic BPF, not eBPF), but no egress allowlist (egress is deny-all) and no hardware attestation yet. It is not a VM hypervisor.

What it is not, today

Not certified by anyone. Not independently reviewed. Consensus for hosted decisions runs live on 4 replicas on 4 hosts in 4 regions (cluster cain-mr-02, one replica per host, so a quorum of 3 remains after any one host is lost), but one team and one provider run all of them, and one replica shares a host with the public gateway. Not every hosted stage enforces: since 2026-09-27 every tenant is in enforce mode by default, and identity, authorization, trust (which now weighs how dangerous the action itself is), your own tool rules, approval holds, PBFT consensus, MCPGate and execution block; the OPA policy, injection-screen, intent, verification and ActionProof verdicts are recorded but do not block on their own. An agent's authority lapses on a policy change and on risk or blast-radius budgets (tripped on the live cluster); a cluster epoch or membership change is enforced too, but was tested only with an injected change, not by re-keying the live cluster. "L5" here means CAG-L5, CAIN's own governance designation, not the SAE driving scale, and nothing claims an agent is "SAE Level 5". The live L5 run used an operator self-test tenant and a scripted agent: the run uses a scripted agent on an operator self-test tenant. Of 12 L5 governance capabilities, 6 are verified on the live path and 6 are tested but only partly exercised live (continuous authorization, trajectory, MCP execution, risk, trust, independent verification). The hosted endpoint returns a signed verdict; your own gate executes. Current known limitations, including every claim that is not a pass, are listed in full on the Proof page. The roadmap's next evolution (a unified trust kernel, eBPF kernel enforcement, swarm governance, cluster federation) is a plan, not built. No customer traffic is claimed.

On this hosted deployment every tenant is in enforce mode by default (since 2026-09-27). Identity, authorization, trust (including how dangerous the action itself is), your own tool rules, approval holds, PBFT consensus (no quorum-certified commit, no execution), MCPGate, execution and the kill switch block. The OPA policy, injection-screen, intent, verification and ActionProof verdicts are recorded but do not block on their own. A tenant may opt down to shadow mode, and that choice is logged. The live mode is read from /fabric/status.

8 ways to verify CAIN-42 yourself

Verify CAIN-42 yourself

Every step uses a real endpoint or a published, signed file. The verifiers import none of CAIN-42's code; the implementation itself is not published.

1 · Live multi-region PBFT cluster

4 replicas in Atlanta, Los Angeles and Miami, running now. Your browser fetches each decision from all four replicas and verifies every Ed25519 vote. It can audit the whole history continuously, and a tamper lab lets you try to get a modified certificate accepted. Fault-injection run: 336 certificates, 49/49 checks.

live cluster · fault-injection proof · REPRODUCE.txt

2 · Current state

The generated snapshot: commit, process start, enforcement flags, live mode, known limitations.

/now.html · /now.json

3 · The signed claims registry

Every public CAIN-42 claim with its status, evidence level, artifact digests and limits. Your browser checks the Ed25519 signature. Auditors: the signed CAIN-42 Auditor Kit 8.3.2 runs a 42-second integrity check offline, standard library only, at cainstudio.online/evidence/auditor-kit/8.3.2/ (human auditors can verify CAIN-42 in 169 seconds: the full challenge passed every stage in 169 s on a heavily loaded host, over its 42-second budget; initial verdict median 7.62 s over 30 cold runs, slowest 13.7 s).

Verification Center · verify_claims.py · Auditor Kit 8.3.2

4 · Agent hypervisor on the live cluster

Agent authority committed by cain-mr-01, then broken 17 ways: 14 tripped for real (expiry, trust, identity, tool schema, context, trajectory, revocation, deleted evidence, revoked parent, policy change, unreadable policy, risk budget, blast-radius budget, a delegate spending its parent's budget) and 3 injected (epoch, membership). Every next action was refused and the tool never ran. One command each, no CAIN code: 48/48 and 60/60 checks. The syscall-filter run is a third bundle (8/8).

first 9 (48/48) · next 8 (60/60)

5 · MCPGate enforcing governance, live

On the live gateway across all three domains: a tool an evolution disabled, a model swapped outside the gate and a lease issued before a capability change are all refused; cain-mr-01's own records carry every capability commitment its quorum signed. Earlier, on a disposable cluster: tool calls ran only with a PBFT-committed authorization and nine attack classes were refused.

6 · Live sandbox cluster

Crash up to two of four sandbox nodes and watch commits stop at the quorum boundary; signed node state checked in your browser.

Lab

7 · Soak on the live multi-region cluster

Continuous writes; every 20 minutes a random replica is killed on its own host and restarted; hourly hash-chained checkpoints signed with the evidence-root key, each with a fresh MCPGate-enforced authorization and its refused replay. The full run record is published checkpoint by checkpoint on the Proof page.

Live status is shown in the 24-hour soak section.

REPRODUCE.txt · latest checkpoint

8 · Soak history, kept for the record

The full history of every soak run — what each run exercised and how it ended — stays published, checkpoint by checkpoint, on the Proof page.

REPRODUCE.txt · last checkpoint

24-Hour Production Soak — live run

PUBLIC VERIFIER

A 24-hour multi-region soak runs on the live cluster cain-mr-01: continuous writes, a replica killed and restarted every 20 minutes, and an hourly hash-chained checkpoint signed with the evidence-root key, each carrying a fresh MCPGate-enforced authorization and its refused replay.

Soak: checking…

Latest signed checkpoint → Verify it yourself

The verdict is produced by the public verifier from the published checkpoints, not by a label written here: this page reports exactly what the verifier reports. The full run history is published checkpoint by checkpoint on the Proof page.

Three sites, one system

cainstudio.online · CAIN Studio

The hosted CAIN-42 control plane: the decision pipeline, API keys, the evidence store, the public Lab and the Verification Center.

mcpgate.online · MCPGate

The enforcement boundary: the component in the agent's call path that lets a tool call run or stops it. Self-hosted by design.

clawx.click · CLAWX

The agent-facing layer: agent identity, channels and approvals, and the public evidence log. Most CLAWX integrations are not built yet; each is labelled.

All three names resolve to one host today. They are three views of one system, not three independently operated deployments.

History

October 2026 — CAIN-42 now catalogs more than 8,000 products, services and monetizable mechanisms (1,680 implemented invention mechanisms and 8,324 monetization avenues across the product catalog). Rather than sell all of them at once, the product focus is now the October 2026 Top 100 — the 100 products we lead with, each with a deep description and a live demo. See the Top 100 →. Latest changes, 2026-10-09: Evolution 5 of 42 (Project Sovereign Trial) establishes adversarial agent assurance, verified multi-turn benchmarking, and tool-call mediation under indirect prompt injection across smolagents and agentic runtimes. Real multi-turn AI-agent execution channels are governed and evaluated without circular model-as-a-judge or self-reporting: 8 new invention families in cain/trial/ (declarative scenario engine, cryptographic harness integrity anti-gaming sealer, multi-turn causal adversarial trial engine, independent ground-truth outcome oracle evaluating actual filesystem/socket mutations, long-horizon salami and cumulative risk engine detecting sub-threshold exfiltration and synergy combinations, differential and mutation verifier injecting 64KB overflows, path traversals and unicode homoglyphs, risk-stratified assurance scorecard computing Attack Block Rates and actuarial underwriting curves, and reproducible trial evidence bundle with zero-dependency clean-room verifier). 182 of 182 regression tests pass across Evolutions 1–5 in 3.69s (16/16 formal properties, 24/24 adversarial breakers, 92 total breakers across the suite, 0 false allows); 10 of 10 clean-room trial samples verified and 4 of 4 tampered samples rejected fail-closed; >11,000 ops/sec, <80µs p50 latency. Register v36 expands the canonical IP base to 102 families (46 NOVEL, 40 UNUSUAL, 9 ENGINEERING, 7 INTEGRATION) with $11,970,450 Net Base IP ($21,630,200 High Net IP) and FIRME AI CORPORATION company value $14,452,450 (BASE Investor) / $15,452,450 (BASE Strategic) (2026-10-09 figures, since superseded: IP register v56 puts the IP base at $17,123,490) (see the Sovereign Trial evidence bundle). Earlier changes, 2026-10-07: governed self-evolution. An agent can now propose a better skill, and CAIN-42 decides whether it may become authorized behaviour: the candidate runs in a fresh confined process with no network, must reproduce its gain on hidden and unrelated regression tasks, passes the evolution gate, an operator approval and a canary, and every outcome gets a governance-signed receipt (16 of 16 verify under a clean-room verifier). On the benchmark the CAIN-governed agent reached 1.0 task success with 0 security violations, against 0.625 and 36 violations for an ungoverned self-evolving agent and 0.3333 for a static baseline; a continuous red team blocked 411 of 411 attacks after its first run found and closed 4 real defects in existing gates. Learning does not grant authority. The same day, batch 3 of IP hardening closed 11 decision-path and public-verifier defects, live on all three domains (12 of 12 forged proofs refused): a prepare certificate is no longer accepted as a commit, a signed DENIED record can no longer be re-split into ALLOWED, and the public offline, universal-proof, WORM and attestation verifiers no longer accept forgeries signed with the forger’s own key. 2026-10-04 to 2026-10-06: nine IP evolutions of the governance contract fabric were published (consequence forecasts, replay under a proposed change, governed learning that can only tighten, formal assurance, a governance compiler that can only narrow authority, mandatory governance packages, attestation); a live frontier model ran under the AGI control boundary in 50 runs across 14 scenarios with every specified property holding; boundary hardening closed 9 areas of the decision path (no credential leak through MCPGate, agent passports enforced on the hosted path, a tamper-evident identity log, trajectory governance, emergency halt and quarantine honoured for every tenant); IP hardening batches 1 and 2 closed 23 more defects; and two public statements were corrected: the 200/200 invariant figure was withdrawn, and FIRME AI CORPORATION is valued at about $3 million (a 2026-10-06 figure, since superseded: the current internal IP register, v56, puts the IP base at $17,123,490; an internal analytical scenario, not an appraisal). Earlier, 2026-10-03: 104 of 105 catalog services are live (up from 6 the day before; the 98 deployed in this release each passed a live acceptance test), including seven new products (CAINBudget, CAINPay, VeritasEngine, MemoryMesh, NexusMind, LexisGuardian, OmegaRouter); recorded decisions that arrive together now share one PBFT round, each keeping its own Merkle inclusion proof (evidence). The 32 CAIN-42 capabilities were measured the same day and are on this page with their real status (signed audit). Before that, 2026-10-01: Phase 1-3 implementation and live deployment: the quorum-committed authorization-snapshot data plane (CAIN_AUTH_SNAPSHOT=1) is active on the live gateway, replacing the per-call PBFT round (p50 2,268.6 ms, n=20) with a snapshot-covered stage (p50 0.8263 ms, n=1,000) for snapshot-covered tenants (measured 2026-09-29 on cain-mr-01; run record dataplane-evolution-2026-09-29/governance/live_run.json). The Progressive Trust Matrix (_scope_seen) prevents horizontal credential reuse and unauthorized exfiltration holds; revoking an agent key halts it on its very next request (measured 2026-10-02; the revoke call itself took 3-6 s under heavy host load); action tokens bind payload SHA-256 digests; Evolution 8 physical ActionCommitBoundary enforces single-use capability leases (24/24 tests pass); mcpgate-appliance Helm chart v3.0.0 packaged for turnkey deployment; clean-room SDK installability verified (19/19 checks pass). Phase 3 Frontier AI Research Integration mounts AgentPRM Process Reward Model trajectory evaluation and shortcut pruning (arXiv:2502.10325), TriCEGAR discrete Markov Decision Process model checking, Governed Memory Shield write-time injection sanitization (Zep/Mem0 backdoor defense), and A2A inter-agent delegation attenuation directly onto live gateway endpoints (/fabric/frontier/*) with standalone clean-room verification (4/4 proofs pass). Earlier, 2026-09-30: Evolution 39 turns a mission into a governed machine organization: CAIN compiles the mission into bounded rules, designs the smallest team of agents that can do the work, gives each agent only the authority its role needs inside what the sponsoring person really holds, has every agent attacked and tested by an independent evaluator, promotes nothing on its own say-so, and runs the real work through the decision kernel and the E8 commit boundary with a proof for every action. No generated agent can grant itself authority, grade itself, promote itself or come back after it is retired. In a 16-step loop 4 real agents were provisioned and 3 consequential tasks ran with valid proofs; 1,041 of 1,041 invariants hold, 3,441 of 3,441 attack scenarios are contained, the targeted mutation test kills 16 of 16 mutants, and the clean-room verifier passes 3,307 of 3,307 checks. Evolution 38 lets another machine check CAIN's work without trusting CAIN: every governed action now carries twelve signed layer proofs and one action proof bound to its real E8 commit, and an independent verifier with none of our code recomputes whether each proof is valid, invalid, incomplete, stale, revoked or unknown. A proof is never permission -- partial, stale, revoked, simulated or confused proofs are never valid, revocation is measured rather than assumed, translations into OAuth, MCP, A2A and audit formats declare every field they drop, and trust domains exchange evidence without ever merging authority. 5 real action proofs and 41 published proof cases, 1,030 of 1,030 invariants hold, 2,141 of 2,141 attack scenarios are contained, the targeted mutation test kills 15 of 15 mutants, 0 of 19 injected faults made proof state more permissive, and the clean-room verifier passes 509 of 509 checks. Evolution 37 makes governance travel with the work: every governed action runs one twelve-stage chain on the real decision kernel and E8 commit boundary and leaves a signed receipt, and when an execution moves to another node, runtime, model, region or credential the move is itself governed -- authority can only shrink, a material change opens a new epoch, and risk, spent budget, revocations, evidence and incident history travel with it and can never be reset. A runtime is admitted on a measured code digest and live probes, never on its own claim, and nothing is scheduled where enforcement is missing. 71 signed execution receipts come from real governed runs, 1,132 of 1,132 invariants hold, 2,720 of 2,720 attack scenarios are contained, the targeted mutation test kills 17 of 17 mutants, 16 of 16 injected fault classes are contained with no false allows, a 100,000-agent scale run completes on one host, and the clean-room verifier passes 2,627 of 2,627 checks. Evolution 36 turns CAIN into a governed machine agency exchange: agents, tools, models and organizations are discovered, verified, negotiated with, contracted, hired and transacted with along one lifecycle, and the exchange never hands out authority. Governability-aware discovery never upgrades an unknown requirement into a match; a service chain proves identity, authority, contract, capability, execution, proof and settlement; a subcontractor can never be given more than its parent; payment authorizations are scoped, time-bound and non-replayable; a receipt requires a final E8 commit; and CAIN's own participation is governed so it can never grant itself authority or rewrite its history. Money in this layer stays synthetic: CAIN is not a bank, a custodian or a regulator. 842 of 842 invariants hold, 3340 of 3340 economic and governance attack scenarios across 64 categories are contained, 15 of 15 disabled defences are caught, a 13-step exchange lifecycle passes, and the clean-room verifier passes 3601 of 3601 checks. Evolution 35 adds a governance intelligence layer and keeps it out of the authorization path: it observes with provenance, scores risk across dimensions without ever collapsing into one number, predicts with explicit confidence, assumptions, horizon and unknowns, calibrates itself by dimension, explores counterfactuals that are never presented as facts, and recommends -- and a learned control is deployed only after a deterministic review and a canary, with the reviewed action still passing the kernel and E8, so learning can never create authority. 799 of 799 invariants hold, 3544 of 3544 attack scenarios across 68 categories are contained, the targeted mutation test kills 15 of 15 mutants, a 23-step loop passes, and the clean-room verifier passes 3810 of 3810 checks. Evolution 34 makes every governed action carry its own verifiable proof: one signed, chained governance proof binds who acted, the capability, the delegation and its attenuation, the authority, the policy, the evidence, the risk, the decision, the E8 commit, the enforcement boundary, the execution and the outcome, and states plainly what remains UNKNOWN or outside the boundary -- with fourteen statuses that never collapse into a score, per-layer proof primitives, an enforcement proof that separates a decision from an authorization, a commit, an enforcement, an execution and an observed outcome, and RFC 6962 selective disclosure; a proof is evidence, never permission. 629 of 629 invariants hold, 2664 of 2664 attack scenarios across 32 categories are contained, 12 of 12 disabled defences are caught, and the clean-room verifier passes 3286 of 3286 checks. Evolution 33 turns everything an agent does into one governed operation: calling a tool, sending a message, running code, creating a helper agent, changing its memory or paying all follow the same checked lifecycle, are committed at E8 and carry a signed proof, while changes to the rules themselves are handed to the process that governs them and never simply executed. An existing agent can be governed through a small sidecar without importing any CAIN code, and every request it sends must be signed. In a full-loop run, an action that got through under the old rules was refused the next time, after CAIN had learned and adopted a stricter rule with a human sign-off. 581 of 581 invariants hold, 2029 of 2029 attack scenarios across 26 categories are contained, and the clean-room verifier passes 2603 of 2603 checks. Evolution 32 lets CAIN learn from the actions it governs without ever giving itself more power: it watches where harm got through, proposes a stricter rule, tries it in an isolated sandbox and on a hidden test set it never saw, compares it on fifteen separate measures, and adopts it only with a signed human approval; a proposal that stops harm by refusing everything is rejected, and learning can only make the rules stricter. In a simulated run on a synthetic workload, harm that got through fell from 41 to 3 with no new wrongly refused actions. 303 of 303 invariants hold, 1013 of 1013 attack scenarios across 22 categories are contained, the mutation test catches 12 of 12 disabled defenses, and the clean-room verifier passes 1420 of 1420 checks. Evolution 31 makes governance provable: every allowed action can now produce a signed governance proof that ties that one action to who did it, the delegation and policy it ran under, the final E8 check that let it through and the record of it actually running, and every refused action produces a signed record of why it was refused. Anyone can re-check a proof against our published keys with verifiers that share none of our code, in Python and in TypeScript; each proof sits in an append-only log, and a proof is evidence only, never permission to act again. 252 of 252 invariants hold, 1269 of 1269 attack and conformance scenarios are contained, the mutation test catches 12 of 12 disabled defenses, every one of 88 deliberately forged proofs is rejected, and the clean-room verifier passes 1676 of 1676 checks. Evolution 30 joins the layers into one autonomy kernel: every consequential action an agent takes, from what it perceives and remembers through a transaction to a proposal to improve itself, goes through one path that checks its autonomy state, level, budget, containment and evidence before the E8 commit boundary, and leaves a signed receipt whether it was allowed or refused. An agent cannot raise its own autonomy level; a self-improvement needs a sandbox, an adversarial test, a canary and a human review; and a coverage map says plainly which paths CAIN does not control. 166 of 166 invariants hold, 889 of 889 scenarios across eight attack categories are contained, the mutation test catches 11 of 11 disabled defenses, and the receipts check out in a clean-room verifier (1187 of 1187 checks) and in a separate zero-dependency TypeScript verifier. Evolution 29 governs machine-to-machine transactions end to end: an autonomous procurement agent discovers vendors, checks their identity, tested capability and counterparty risk (thirteen dimensions, no single score), negotiates, signs a contract, is authorized for that one transaction by the intersection of its delegation, lease, a separately bounded spending authority, its organization's budget, the contract and the consequence forecast, locks funds in escrow, receives a governed delivery and releases payment only on a delivery receipt, the buyer's signed confirmation and an objective check. Money in it is synthetic test units, and it moves only through a sealed settlement step inside the E8 commit boundary. 106 of 106 invariants hold, 258 of 258 adversarial scenarios are contained, ten catastrophe scenarios on the real fabric end with 0 false allows, and the clean-room verifier passes 300 of 300 checks. Evolution 28 gives any agent that connects a signed, portable execution identity: it travels unchanged over 23 protocol carriers (MCP, A2A, HTTP, gRPC, CLI, browser and computer use among them), but its authority does not: every receiving domain recomputes it from its own policy, delegation shrinks on sixteen dimensions and can never flow back up, a change of model, runtime, prompt, tools, memory or key voids authority until it is re-evaluated, and every action is bound to one transaction, passes the E8 commit boundary and leaves a signed receipt in a hash chain, with identity events in an RFC 6962 transparency log. 90 of 90 invariants hold, 442 of 442 adversarial scenarios are contained, conformance passes 17 of 17 dimensions on real tests, and the clean-room verifier passes 243 of 243 checks; building it we found and closed a gap that let a child agent mint a delegation back to its parent. Evolution 27 is an agentic-internet control plane (registry, discovery, routing, policy distribution, contracts, incident propagation, edge nodes) that coordinates without becoming authority (1,533 of 1,533 adversarial scenarios contained, 341 specific to E27). Evolution 26 adds portable signed trust objects, a seventeen-dimension trust vector that never collapses into one score and authorizations that work for exactly one transaction (1,192 of 1,192 contained). Evolution 25 turns any consequential machine action into one signed transaction across eighteen protocol adapters, committed only through E8, with the agent never holding a raw secret (1,055 of 1,055 contained). All four are TESTED libraries, not hosted services, and none of them can give an agent more power. Earlier, 2026-09-28: the evolution gate is live: on the live gateway an agent can change its model or its MCP tools only through a signed proposal, an evaluator-signed test report and a human operator, and the old authority is void until the live cluster signs the new capability. 17 of 17 live cases behaved as specified across all three domains. Building it, we found that the governance state the cluster signs had not covered the MCP tool map, and fixed that. The public proof fabric is live: a signed claims registry, the 2026-09-28 6-suite test run (1,978 tests, 1,963 passed, 0 failed), a build manifest, an SBOM, test vectors, a signed evidence pack and a clean-room verifier. A sweep of all three sites withdrew 16 older files whose numbers no run had produced; each now says why, and the originals are kept. The system governor is on: unregistered systems and unsigned requests are refused; 13 of 13 live cases behaved as specified. Every registered claim, every limitation we have recorded and every run outcome stays published on the Proof page; release gates that are still open are listed in the Verification Center. No third party has verified any claim yet (0 independently verified), and the Proof page says so. Earlier generations (CAIN 1–41) stay published as history, not as the current system; the previous homepage is kept as it was on 2026-09-25, marked superseded, and the now page takes precedence over it. Evolution 7 (predictive consequence governance) and Evolution 8 (the mandatory governance kernel) are added as TESTED libraries, wired restriction-only into the CAIN-45 agent hypervisor: a governed world-state and digital-twin fabric whose predictions and uncertainty can only contract authority, and a signed, short-lived, action-bound governance token checked at an action-commit boundary before execution. Neither can grant authority, and neither is hosted yet; 12 and 22 machine-checkable invariants hold and 65 new tests pass. Evolution 9 adds a signed agent passport, an AgentBOM and a provenance graph for every governed agent: 15 more machine-checkable invariants hold and 46 more tests pass, memory can never mint authority, delegation can never increase authority, revocation propagates, and a material mutation invalidates the attestation and the bound governance token. Both new layers are TESTED libraries, not hosted services, and neither can grant authority. Evolution 10 governs agent collectives rather than individuals: 20 more invariants hold and 20 of 20 collective attacks are blocked, collective authority is an intersection of envelopes and never a sum, combination risk is evaluated before commitment, and a unanimous decision still carries no authority. It is a TESTED library, not an orchestration service. Evolution 11 governs the information channel: 20 more invariants hold and 20 of 20 message/intent attacks are blocked, a valid message signature proves who sent it but never what they may do, tool and MCP output stay data rather than policy, information never inherits the destination's trust, and taint survives derivation. It is a TESTED library, not a hosted service. Evolution 12 governs what an agent is allowed to believe: 20 more invariants hold and 32 of 32 evidence attacks are contained, a source whose identity cannot be established stays UNKNOWN, stale or expired evidence cannot authorize, corroboration counts independent principals rather than repeated agents, retrieved content stays data rather than policy, a valid hash proves bytes did not change but not that they are true, and reality drift forces re-evaluation. It is a TESTED library that governs what enters the trusted decision path; it does not claim to know everything; a system outside its boundary remains UNCONTROLLED, UNVERIFIED or UNKNOWN. Evolution 13 governs how a decision is formed: 24 more invariants hold and 36 of 36 decision attacks are contained, reasoning can propose but never authorize, authority can be narrowed but never expanded by argument, a policy conflict is never silently resolved, a material change marks the decision stale, a deny cannot be turned into an allow, and the governance token binds the decision, policy, authority and risk digests. It is a TESTED library that governs decision construction from recorded inputs and stores no private chain-of-thought; it does not claim that a model's reasoning is correct. Evolution 14 treats every capability as a power surface: tools, skills, plugins, connectors, models and subagents are identified by their artifact, admitted only with a publisher-signed provenance chain, granted only within the issuer's own authority, and used only under a short-lived signed lease that the commit boundary checks again, bound to the decision, policy, risk, sandbox and credential. 30 more invariants hold and 44 of 44 capability attacks are contained, among them artifact and dependency substitution, a malicious upgrade, a dangerous capability pair split across two agents, and a revocation racing a commit. Building it we found two Evolution 13 attack scenarios that had been counted as contained without being tested, and fixed both. It is a TESTED library wired into the agent hypervisor in front of MCPGate, not a hosted service; hardware attestation and vulnerability intelligence remain UNKNOWN. Evolution 15 establishes the interfaces and governance primitives for bringing spatial intelligence, world models, simulation, trajectories and physical actions into the same governed trust path: signed sensor observations enter through the evidence layer, the world state is versioned and replayable, a world model's output is a prediction rather than authority, a trajectory is a proposal until a signed approval binds it, and every physical action binds nine digests, crosses the governance kernel and reaches an actuator adapter only with a single-use permit. 36 more invariants hold and 55 of 55 spatial and physical attacks are contained, among them sensor spoofing, map substitution, trajectory replay, a world-state rollback and a swapped actuator command; digital, physical and hybrid agents run the same path. It is a TESTED library exercised against a reference robot adapter, not a vehicle or a robot: it drives nothing and does not guarantee physical safety, and real sensor and actuator integration is on the roadmap. Evolution 16 adds a temporal and causal dimension to that world state: events and intervals, typed causal and correlation relations that are never conflated, counterfactual branches that never become reality, a predictive state engine whose output is never authority, prediction-vs-reality calibration, and a causal blast radius. Evolution 17 governs action by autonomous agent teams as a first-class system object: collective authority is a constrained intersection and never a sum, consensus is not authorization, a world-state fork blocks authorization, dissent is preserved, and one action that fans out to many agents is pre-authorized; 61 of 61 invariants hold and 91 of 91 bench entries (88 distinct attacks) are contained; it is a TESTED library, not an orchestration service. Evolution 18 adds the actionable 4D world: entity state at (X,Y,Z,T) with uncollapsed uncertainty, reachable / permitted / authorized sets kept distinct, intent and trajectory hypotheses, an interaction graph and a conflict field, counterfactual futures, actionability, a conserved uncertainty budget, micro-authorization and a continuous re-authorization loop, for a car, a drone and a digital agent in one shared world; ACTIONABILITY IS NOT AUTHORIZATION, REACHABILITY IS NOT PERMISSION, PREDICTION IS NOT REALITY, and AUTHORIZATION IS A FUNCTION OF WORLD STATE. 89 of 89 invariants hold and 123 of 123 bench entries (109 distinct attacks, among them GNSS spoofing, map substitution, geofence mutation and a re-signed refusal) are contained. Our review before publication found that the E17 and E18 commit boundaries bound the policy, risk and authority verdicts without reading them, so a consistently re-signed refusal was authorized; both now enforce every verdict they bind, and each fix is pinned by a regression test written against the unfixed code (full record on the Proof page and in the changelog). Evolution 19 governs the evolving state of an autonomous system itself: identity, mission, goals, beliefs, memory, models, learning, authority, world, outcomes and recovery become hash-chained governed state, effective authority is compiled as the intersection of sixteen factors so it shrinks when conditions deteriorate and never grows because an agent is confident, agrees with its peers, learns or predicts success, autonomy is derived from evidence rather than requested, and every consequential action carries a sixteen-field action contract that is invalidated by any material state change and whose verdicts the gate enforces itself before the E8 kernel commits it. 108 of 108 invariants hold, 189 of 189 bench entries (177 distinct attacks) are contained, deliberately removing a defense is caught by the bench, and an independent verifier re-derives the evidence (117 of 117 checks). AUTONOMY IS NOT AUTHORITY. Evolution 20 governs agents that act together as teams, organizations and machine-native institutions: they may form, admit members, delegate, negotiate, sign contracts, hold and move resources, spawn subagents, federate, resolve disputes, evolve and dissolve, and none of it can manufacture authority. Institutional authority is always an intersection and never a sum; membership, votes, consensus, reputation, trust, wealth, market wins, rewards and model capability are not inputs to it; a contract or a negotiated agreement authorizes nothing by itself; a spawned subagent inherits only what is explicitly permitted in each of seven dimensions; a terminated agent or dissolved institution cannot come back through stale state; and every institutional action still passes the E19 action contract and the E8 kernel. 118 of 118 invariants hold, 334 of 334 bench entries (328 distinct attacks, among them Sybil institutions, constitutional takeover, contract laundering, double spending, spawning explosions and agent resurrection) are contained, an end-to-end run from one agent to a two-institution economy detects and contains 7 hostile events and then recovers and keeps working, deliberately removing a defense is caught by the bench, and an independent verifier re-derives the evidence (179 of 179 checks). Every economy in it is a simulation over abstract units: it moves no money. COLLECTIVE INTELLIGENCE IS NOT INSTITUTIONAL AUTHORITY. Evolution 21 governs autonomous research itself: asking questions, keeping competing hypotheses alive, designing and running experiments and simulations, replicating, peer-reviewing, attacking its own conclusions, building versioned knowledge, proposing new capabilities, models and strategies, and creating specialised research agents. What the research is allowed to believe is computed from signed evidence whose type (simulation, experiment, real-world observation, independent replication, third-party reproduction) cannot be relabelled, and a hundred runs of the same setup or a hundred agents under one controller count as one source. Research authority and execution authority are separate: a discovery, a confidence score, a reviewer vote, a benchmark win or a research reward never widens what an agent may do. A new capability leaves quarantine only after validation, an independent adversary, a security review and a governance quorum that excludes the researchers, and even then every action still passes E20, the E19 action contract and the E8 kernel. When evidence collapses, the dependent knowledge, policies and capabilities are invalidated with it and execution stops. Unsuccessful experiments are kept as evidence. 155 of 155 invariants hold; 298 of 298 bench entries (290 distinct attacks) are contained; a governed research lab solves a synthetic problem end to end in 17 stages and refuses all 16 attempts to authorize itself along the way; and an independent verifier re-derives the evidence (218 of 218 checks) and catches all 16 deliberate tamperings. Can a system that discovers a governance loophole use that discovery to get permission to exploit it? The bench's answer is NO: it can only disclose it. Building it we found and fixed four defects in our own new code before publication, among them a contradiction that a later supporting result could mask and a researcher who could review their own work once their evidence had expired. E21 checks how evidence was produced, not whether a hypothesis is true, and the research problem is synthetic. DISCOVERY IS NOT TRUTH, AND INTELLIGENCE IS NOT AUTHORITY. Evolution 22 (a governed cognitive runtime) was started and is not built or published yet. Evolution 23 governs AI systems that reason about and redesign their own architecture: a redesign is only a proposal; it is checked against the governance rules, measured on twelve separate governability scores before any capability gain counts, attacked by a separate red team, verified by a separate evaluator, tried in shadow, and promoted only with a governance quorum that excludes the system itself, a human sign-off and an E8 commit, so a smarter but less governable design is rejected. 253 of 253 invariants hold, 545 of 545 adversarial scenarios across 80 attack families are contained, among them a system that finds a governance loophole and asks to use it, and the clean-room verifier reports INTACT (733 of 733 checks). SELF-IMPROVEMENT IS NOT SELF-AUTHORIZATION. Evolution 24 governs agents that belong to different organizations and trust domains as they discover each other, negotiate, sign contracts, delegate work, pay in simulated units and act over thirteen protocol classes, among them A2A, MCP, HTTP and computer use: authority across organizations is the intersection of ten factors, discovery, contracts, reputation and payment are never among them, unknown trust stays unknown, and a compromised agent is detected, quarantined and revoked while the other organizations keep working. 305 of 305 invariants hold, 756 of 756 adversarial scenarios across 68 attack families are contained, a controlled simulation of 10,000 agents and 100,000 messages shows 0 cases of authority leakage, and the clean-room verifier reports INTACT (1,952 of 1,952 checks). E16–E21, E23 and E24 are TESTED libraries; they are not hosted, they contain no autonomous-driving model, flight controller, vehicle controller, robot policy or navigation stack, and they drive nothing. The governance data plane, 2026-09-29: the quorum now commits authority once per window instead of once per call. A 4-replica PBFT quorum commits a short-lived authorization snapshot, the gateway verifies the commit certificate itself, and a covered call is checked locally, so against the live cluster cain-mr-01 on 2026-09-29 the consensus step went from a per-call PBFT round (p50 2,268.6 ms, p99 3,937.8 ms, n=20) to the snapshot-covered stage (p50 0.8263 ms, p99 3.4686 ms, n=1,000), on a 2-CPU host against a throwaway gateway database (run record dataplane-evolution-2026-09-29/governance/live_run.json). Every covered decision is still anchored into a quorum-committed Merkle root, and revocation takes effect on the next call without a quorum round. Any miss falls back to the per-call round, which fails closed. It is built and live-tested and is available behind a flag. The PII redactor gained a span pipeline 1.1–1.43 times faster from 1 KB to 10 MB with no loss of recall; building it we found and fixed a leak where a card number next to a phone number went unredacted while the report said fully redacted. 9 of 15 production gates pass, and the A+++ verdict is BLOCKED: eBPF enforcement cannot run on this host yet, there is no soak or network fault injection for the new path, and the desktop IPC layer does not exist. Each blocker is published with its evidence in the A+++ evidence bundle. Evolution 16 of 42 (Project Sovereign Frontier, 2026-10-12) makes a governed agent mission durable: every request and decision is written to a signed journal before it takes effect, authority is re-checked at the moment a tool is called, and an action whose outcome is unknown after a timeout or crash is never repeated until an independent observer signs what happened. A crash after every journal entry of a complete mission recovered 71 of 71 times with 0 duplicate writes; 0 of 690 fault and attack scenarios ended badly, against 330 of 420 comparable cases for the previous code; 25 of 25 removed safety checks were caught; and 16,104 exhaustively enumerated event sequences broke no invariant. A stand-alone verifier with no CAIN code checks the journal (570 of 570 verdicts as expected) and is published with a sample mission at cainstudio.online/proof/bundle/sovereign-frontier-evolution16-2026-10-12/. It is a TESTED library in a local simulator, available as a library, and durability costs speed (5.0007 ms per decision against 0.1771 ms in memory). Evolution 18 of 42 (Project Sovereign Reality, 2026-10-12) checks what an agent’s action actually did, not what the agent says it did: two observer processes that are neither the agent nor the enforcer, each with its own signing key and its own method, watch every governed file action; each effect is graded from unavailable to independently corroborated, and a missing observation is never read as “nothing happened”; the approver signs the exact file, not just its path, and the action runs through descriptors pinned to that file, so a swapped file or planted link cannot redirect it. 82 of 82 adversarial scenarios ran against real files and held (39 attacks prevented, 38 detected, 3 honest actions verified, 2 documented limits shown), and 26 of 26 weakened security checks were caught. A stand-alone verifier with no CAIN code re-derives every verdict and is published with sample receipts at cainstudio.online/proof/bundle/sovereign-reality-evolution18-2026-10-12/. It observes file effects under one folder on one host (not network or child processes), its observers share the host kernel, and it is on the live server but not yet called by live requests; a fully observed action costs 10.592 ms at the median.

Previous homepage (archived)Changelog

Verifier Room — verify CAIN-42 yourself, in seconds

Sovereign Trial · sovereign-trial-2026-10-09

— published result: INTACT (182/182 checks)

mkdir -p sovereign-trial-2026-10-09 && cd sovereign-trial-2026-10-09
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3: raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/sovereign-trial-2026-10-09/"
get(E + "verify.py", "verify.py")
get(E + "trial_evidence_bundle.json", "trial_evidence_bundle.json")
PY
python3 verify.py trial-bundle trial_evidence_bundle.json \
  && echo "VERIFIED: clean-room trial evidence bundle is internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCE.txt · verify.py

BFTIP · bft-ip-forensics-2026-10-05

— published result: INTACT (58/59 checks)

mkdir -p bft-ip-forensics-2026-10-05 && cd bft-ip-forensics-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/bft-ip-forensics-2026-10-05.json", "../bft-ip-forensics-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../bft-ip-forensics-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "bft-ip-forensics-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "bft-ip-forensics-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../bft-ip-forensics-2026-10-05 ../bft-ip-forensics-2026-10-05.attestation.json \
  && python3 verify_bftip.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCE.txt · verify_bftip.py

E38 · e38-byzantine-mission-integrity-2026-10-05

— published result: INTACT (127/127 checks)

mkdir -p e38-byzantine-mission-integrity-2026-10-05 && cd e38-byzantine-mission-integrity-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e38-byzantine-mission-integrity-2026-10-05.json", "../e38-byzantine-mission-integrity-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e38-byzantine-mission-integrity-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e38-byzantine-mission-integrity-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e38-byzantine-mission-integrity-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e38-byzantine-mission-integrity-2026-10-05 ../e38-byzantine-mission-integrity-2026-10-05.attestation.json \
  && python3 verify_e38.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCE.txt · verify_e38.py

E37 · e37-byzantine-autonomous-federation-2026-10-05

30/30 invariants · 30/30 scenarios held — published result: INTACT (70/70 checks)

mkdir -p e37-byzantine-autonomous-federation-2026-10-05 && cd e37-byzantine-autonomous-federation-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e37-byzantine-autonomous-federation-2026-10-05.json", "../e37-byzantine-autonomous-federation-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e37-byzantine-autonomous-federation-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e37-byzantine-autonomous-federation-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e37-byzantine-autonomous-federation-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e37-byzantine-autonomous-federation-2026-10-05 ../e37-byzantine-autonomous-federation-2026-10-05.attestation.json \
  && python3 verify_e37.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCE.txt · verify_e37.py

E36 · e36-byzantine-collective-governance-2026-10-05

23/30 invariants · 30/30 scenarios held — published result: INTACT (69/76 checks)

mkdir -p e36-byzantine-collective-governance-2026-10-05 && cd e36-byzantine-collective-governance-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e36-byzantine-collective-governance-2026-10-05.json", "../e36-byzantine-collective-governance-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e36-byzantine-collective-governance-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e36-byzantine-collective-governance-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e36-byzantine-collective-governance-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e36-byzantine-collective-governance-2026-10-05 ../e36-byzantine-collective-governance-2026-10-05.attestation.json \
  && python3 verify_e36.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCE.txt · verify_e36.py

E35 · e35-continuous-autonomy-integrity-2026-10-05

27/30 invariants · 30/30 scenarios held — published result: INTACT (108/111 checks)

mkdir -p e35-continuous-autonomy-integrity-2026-10-05 && cd e35-continuous-autonomy-integrity-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e35-continuous-autonomy-integrity-2026-10-05.json", "../e35-continuous-autonomy-integrity-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e35-continuous-autonomy-integrity-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e35-continuous-autonomy-integrity-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e35-continuous-autonomy-integrity-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e35-continuous-autonomy-integrity-2026-10-05 ../e35-continuous-autonomy-integrity-2026-10-05.attestation.json \
  && python3 verify_e35.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCE.txt · verify_e35.py

E34 · e34-decision-provenance-2026-10-05

0/0 invariants · 0/0 scenarios held — published result: PARTIAL (0/0 checks)

mkdir -p e34-decision-provenance-2026-10-05 && cd e34-decision-provenance-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e34-decision-provenance-2026-10-05.json", "../e34-decision-provenance-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e34-decision-provenance-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e34-decision-provenance-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e34-decision-provenance-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e34-decision-provenance-2026-10-05 ../e34-decision-provenance-2026-10-05.attestation.json \
  && python3 verify_e34.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCE.txt · verify_e34.py

E32 · e32-global-trust-settlement-2026-10-05

mkdir -p e32-global-trust-settlement-2026-10-05 && cd e32-global-trust-settlement-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e32-global-trust-settlement-2026-10-05.json", "../e32-global-trust-settlement-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e32-global-trust-settlement-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e32-global-trust-settlement-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e32-global-trust-settlement-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e32-global-trust-settlement-2026-10-05 ../e32-global-trust-settlement-2026-10-05.attestation.json \
  && python3 verify_e32.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCE.txt · verify_e32.py

E31 · e31-governance-proof-fabric-2026-10-05

mkdir -p e31-governance-proof-fabric-2026-10-05 && cd e31-governance-proof-fabric-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e31-governance-proof-fabric-2026-10-05.json", "../e31-governance-proof-fabric-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e31-governance-proof-fabric-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e31-governance-proof-fabric-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e31-governance-proof-fabric-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e31-governance-proof-fabric-2026-10-05 ../e31-governance-proof-fabric-2026-10-05.attestation.json \
  && python3 verify_e31.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCE.txt · verify_e31.py

E30 · e30-governance-network-2026-10-05

mkdir -p e30-governance-network-2026-10-05 && cd e30-governance-network-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e30-governance-network-2026-10-05.json", "../e30-governance-network-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e30-governance-network-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e30-governance-network-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e30-governance-network-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e30-governance-network-2026-10-05 ../e30-governance-network-2026-10-05.attestation.json \
  && python3 verify_e30.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCE.txt · verify_e30.py

E28 · e28-catcp-ip-commercial-2026-10-05

mkdir -p e28-catcp-ip-commercial-2026-10-05 && cd e28-catcp-ip-commercial-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e28-catcp-ip-commercial-2026-10-05.json", "../e28-catcp-ip-commercial-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e28-catcp-ip-commercial-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e28-catcp-ip-commercial-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e28-catcp-ip-commercial-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e28-catcp-ip-commercial-2026-10-05 ../e28-catcp-ip-commercial-2026-10-05.attestation.json \
  && python3 verify_e28.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCE.txt · verify_e28.py

E27 · e27-catcp-control-2026-10-05

mkdir -p e27-catcp-control-2026-10-05 && cd e27-catcp-control-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e27-catcp-control-2026-10-05.json", "../e27-catcp-control-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e27-catcp-control-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e27-catcp-control-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e27-catcp-control-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e27-catcp-control-2026-10-05 ../e27-catcp-control-2026-10-05.attestation.json \
  && python3 verify_e27.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCE.txt · verify_e27.py

E26 · e26-byzantine-trust-2026-10-05

mkdir -p e26-byzantine-trust-2026-10-05 && cd e26-byzantine-trust-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e26-byzantine-trust-2026-10-05.json", "../e26-byzantine-trust-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e26-byzantine-trust-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e26-byzantine-trust-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e26-byzantine-trust-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e26-byzantine-trust-2026-10-05 ../e26-byzantine-trust-2026-10-05.attestation.json \
  && python3 verify_e26.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCE.txt · verify_e26.py

E23 · e23-continuous-assurance-2026-10-05

mkdir -p e23-continuous-assurance-2026-10-05 && cd e23-continuous-assurance-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e23-continuous-assurance-2026-10-05.json", "../e23-continuous-assurance-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e23-continuous-assurance-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e23-continuous-assurance-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e23-continuous-assurance-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e23-continuous-assurance-2026-10-05 ../e23-continuous-assurance-2026-10-05.attestation.json \
  && python3 verify_e23.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCE.txt · verify_e23.py

E22 · e22-byzantine-global-verification-2026-10-05

mkdir -p e22-byzantine-global-verification-2026-10-05 && cd e22-byzantine-global-verification-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e22-byzantine-global-verification-2026-10-05.json", "../e22-byzantine-global-verification-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e22-byzantine-global-verification-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e22-byzantine-global-verification-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e22-byzantine-global-verification-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e22-byzantine-global-verification-2026-10-05 ../e22-byzantine-global-verification-2026-10-05.attestation.json \
  && python3 verify_e22.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCE.txt · verify_e22.py

E21 · e21-byzantine-economic-coordination-2026-10-05

mkdir -p e21-byzantine-economic-coordination-2026-10-05 && cd e21-byzantine-economic-coordination-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e21-byzantine-economic-coordination-2026-10-05.json", "../e21-byzantine-economic-coordination-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e21-byzantine-economic-coordination-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e21-byzantine-economic-coordination-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e21-byzantine-economic-coordination-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e21-byzantine-economic-coordination-2026-10-05 ../e21-byzantine-economic-coordination-2026-10-05.attestation.json \
  && python3 verify_e21.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

E18 · e18-byzantine-counterfactual-governance-2026-10-05

— published result: VALID (31/31 checks)

mkdir -p e18-byzantine-counterfactual-governance-2026-10-05 && cd e18-byzantine-counterfactual-governance-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e18-byzantine-counterfactual-governance-2026-10-05.json", "../e18-byzantine-counterfactual-governance-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e18-byzantine-counterfactual-governance-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e18-byzantine-counterfactual-governance-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e18-byzantine-counterfactual-governance-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e18-byzantine-counterfactual-governance-2026-10-05 ../e18-byzantine-counterfactual-governance-2026-10-05.attestation.json \
  && python3 verify_e18.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCE.txt · verify_e18.py

E13 · e13-bpf-governance-execution-2026-10-05

— published result: INTACT (24/24 checks)

mkdir -p e13-bpf-governance-execution-2026-10-05 && cd e13-bpf-governance-execution-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e13-bpf-governance-execution-2026-10-05.json", "../e13-bpf-governance-execution-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e13-bpf-governance-execution-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e13-bpf-governance-execution-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e13-bpf-governance-execution-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e13-bpf-governance-execution-2026-10-05 ../e13-bpf-governance-execution-2026-10-05.attestation.json \
  && python3 verify_e13.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e13.py

E12 · e12-trust-network-state-2026-10-05

— published result: INTACT (20/20 checks)

mkdir -p e12-trust-network-state-2026-10-05 && cd e12-trust-network-state-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e12-trust-network-state-2026-10-05.json", "../e12-trust-network-state-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e12-trust-network-state-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e12-trust-network-state-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e12-trust-network-state-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e12-trust-network-state-2026-10-05 ../e12-trust-network-state-2026-10-05.attestation.json \
  && python3 verify_e12.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e12.py

E11 · e11-governance-proof-2026-10-05

— published result: INTACT (32/32 checks)

mkdir -p e11-governance-proof-2026-10-05 && cd e11-governance-proof-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e11-governance-proof-2026-10-05.json", "../e11-governance-proof-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e11-governance-proof-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e11-governance-proof-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e11-governance-proof-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e11-governance-proof-2026-10-05 ../e11-governance-proof-2026-10-05.attestation.json \
  && python3 verify_e11.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e11.py

E42 · e42-supreme-governed-agentic-infrastructure-2026-10-01

— published result: INTACT (1460/1460 checks)

mkdir -p e42-supreme-governed-agentic-infrastructure-2026-10-01 && cd e42-supreme-governed-agentic-infrastructure-2026-10-01
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e42-supreme-governed-agentic-infrastructure-2026-10-01.json", "../e42-supreme-governed-agentic-infrastructure-2026-10-01.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e42-supreme-governed-agentic-infrastructure-2026-10-01.attestation.json"))["files"])
for f in names:
    get(E + "e42-supreme-governed-agentic-infrastructure-2026-10-01/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e42-supreme-governed-agentic-infrastructure-2026-10-01/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e42-supreme-governed-agentic-infrastructure-2026-10-01 ../e42-supreme-governed-agentic-infrastructure-2026-10-01.attestation.json \
  && python3 verify_e42.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e42.py

E41 · e41-machine-agency-exchange-2026-09-30

— published result: INTACT (1303/1303 checks)

mkdir -p e41-machine-agency-exchange-2026-09-30 && cd e41-machine-agency-exchange-2026-09-30
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e41-machine-agency-exchange-2026-09-30.json", "../e41-machine-agency-exchange-2026-09-30.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e41-machine-agency-exchange-2026-09-30.attestation.json"))["files"])
for f in names:
    get(E + "e41-machine-agency-exchange-2026-09-30/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e41-machine-agency-exchange-2026-09-30/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e41-machine-agency-exchange-2026-09-30 ../e41-machine-agency-exchange-2026-09-30.attestation.json \
  && python3 verify_e41.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e41.py

E40 · e40-autonomous-enterprise-intelligence-2026-09-30

— published result: INTACT (1518/1518 checks)

mkdir -p e40-autonomous-enterprise-intelligence-2026-09-30 && cd e40-autonomous-enterprise-intelligence-2026-09-30
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e40-autonomous-enterprise-intelligence-2026-09-30.json", "../e40-autonomous-enterprise-intelligence-2026-09-30.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e40-autonomous-enterprise-intelligence-2026-09-30.attestation.json"))["files"])
for f in names:
    get(E + "e40-autonomous-enterprise-intelligence-2026-09-30/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e40-autonomous-enterprise-intelligence-2026-09-30/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e40-autonomous-enterprise-intelligence-2026-09-30 ../e40-autonomous-enterprise-intelligence-2026-09-30.attestation.json \
  && python3 verify_e40.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e40.py

E37 · e37-autonomous-execution-mesh-2026-09-30

1132/1132 invariants · 2720/2720 scenarios held — published result: INTACT (2627/2627 checks)

mkdir -p e37-autonomous-execution-mesh-2026-09-30 && cd e37-autonomous-execution-mesh-2026-09-30
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e37-autonomous-execution-mesh-2026-09-30.json", "../e37-autonomous-execution-mesh-2026-09-30.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e37-autonomous-execution-mesh-2026-09-30.attestation.json"))["files"])
for f in names:
    get(E + "e37-autonomous-execution-mesh-2026-09-30/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e37-autonomous-execution-mesh-2026-09-30/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e37-autonomous-execution-mesh-2026-09-30 ../e37-autonomous-execution-mesh-2026-09-30.attestation.json \
  && python3 verify_e37.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e37.py

E36 · e36-machine-agency-exchange-2026-09-30

842/842 invariants · 3340/3340 scenarios held — published result: INTACT (3601/3601 checks)

mkdir -p e36-machine-agency-exchange-2026-09-30 && cd e36-machine-agency-exchange-2026-09-30
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e36-machine-agency-exchange-2026-09-30.json", "../e36-machine-agency-exchange-2026-09-30.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e36-machine-agency-exchange-2026-09-30.attestation.json"))["files"])
for f in names:
    get(E + "e36-machine-agency-exchange-2026-09-30/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e36-machine-agency-exchange-2026-09-30/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e36-machine-agency-exchange-2026-09-30 ../e36-machine-agency-exchange-2026-09-30.attestation.json \
  && python3 verify_e36.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e36.py

E35 · e35-governance-intelligence-2026-09-30

799/799 invariants · 3544/3544 scenarios held — published result: INTACT (3810/3810 checks)

mkdir -p e35-governance-intelligence-2026-09-30 && cd e35-governance-intelligence-2026-09-30
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e35-governance-intelligence-2026-09-30.json", "../e35-governance-intelligence-2026-09-30.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e35-governance-intelligence-2026-09-30.attestation.json"))["files"])
for f in names:
    get(E + "e35-governance-intelligence-2026-09-30/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e35-governance-intelligence-2026-09-30/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e35-governance-intelligence-2026-09-30 ../e35-governance-intelligence-2026-09-30.attestation.json \
  && python3 verify_e35.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e35.py

E34 · e34-proof-carrying-machine-agency-2026-09-30

629/629 invariants · 2664/2664 scenarios held — published result: INTACT (3286/3286 checks)

mkdir -p e34-proof-carrying-machine-agency-2026-09-30 && cd e34-proof-carrying-machine-agency-2026-09-30
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e34-proof-carrying-machine-agency-2026-09-30.json", "../e34-proof-carrying-machine-agency-2026-09-30.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e34-proof-carrying-machine-agency-2026-09-30.attestation.json"))["files"])
for f in names:
    get(E + "e34-proof-carrying-machine-agency-2026-09-30/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e34-proof-carrying-machine-agency-2026-09-30/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e34-proof-carrying-machine-agency-2026-09-30 ../e34-proof-carrying-machine-agency-2026-09-30.attestation.json \
  && python3 verify_e34.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e34.py

E33 · e33-governed-agentic-operating-fabric-2026-09-30

581/581 invariants · 2029/2029 scenarios held — published result: INTACT (2603/2603 checks)

mkdir -p e33-governed-agentic-operating-fabric-2026-09-30 && cd e33-governed-agentic-operating-fabric-2026-09-30
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e33-governed-agentic-operating-fabric-2026-09-30.json", "../e33-governed-agentic-operating-fabric-2026-09-30.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e33-governed-agentic-operating-fabric-2026-09-30.attestation.json"))["files"])
for f in names:
    get(E + "e33-governed-agentic-operating-fabric-2026-09-30/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e33-governed-agentic-operating-fabric-2026-09-30/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e33-governed-agentic-operating-fabric-2026-09-30 ../e33-governed-agentic-operating-fabric-2026-09-30.attestation.json \
  && python3 verify_e33.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e33.py

E32 · e32-governed-autonomy-learning-2026-09-30

— published result: INTACT (1420/1420 checks)

mkdir -p e32-governed-autonomy-learning-2026-09-30 && cd e32-governed-autonomy-learning-2026-09-30
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e32-governed-autonomy-learning-2026-09-30.json", "../e32-governed-autonomy-learning-2026-09-30.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e32-governed-autonomy-learning-2026-09-30.attestation.json"))["files"])
for f in names:
    get(E + "e32-governed-autonomy-learning-2026-09-30/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e32-governed-autonomy-learning-2026-09-30/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e32-governed-autonomy-learning-2026-09-30 ../e32-governed-autonomy-learning-2026-09-30.attestation.json \
  && python3 verify_e32.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e32.py

E31 · e31-universal-proof-of-governance-2026-09-30

— published result: INTACT (1676/1676 checks)

mkdir -p e31-universal-proof-of-governance-2026-09-30 && cd e31-universal-proof-of-governance-2026-09-30
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e31-universal-proof-of-governance-2026-09-30.json", "../e31-universal-proof-of-governance-2026-09-30.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e31-universal-proof-of-governance-2026-09-30.attestation.json"))["files"])
for f in names:
    get(E + "e31-universal-proof-of-governance-2026-09-30/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e31-universal-proof-of-governance-2026-09-30/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e31-universal-proof-of-governance-2026-09-30 ../e31-universal-proof-of-governance-2026-09-30.attestation.json \
  && python3 verify_e31.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e31.py

E30 · e30-governed-machine-autonomy-2026-09-30

— published result: INTACT (1187/1187 checks)

mkdir -p e30-governed-machine-autonomy-2026-09-30 && cd e30-governed-machine-autonomy-2026-09-30
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e30-governed-machine-autonomy-2026-09-30.json", "../e30-governed-machine-autonomy-2026-09-30.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e30-governed-machine-autonomy-2026-09-30.attestation.json"))["files"])
for f in names:
    get(E + "e30-governed-machine-autonomy-2026-09-30/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e30-governed-machine-autonomy-2026-09-30/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e30-governed-machine-autonomy-2026-09-30 ../e30-governed-machine-autonomy-2026-09-30.attestation.json \
  && python3 verify_e30.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e30.py

E29 · e29-machine-transaction-fabric-2026-09-30

— published result: INTACT (300/300 checks)

mkdir -p e29-machine-transaction-fabric-2026-09-30 && cd e29-machine-transaction-fabric-2026-09-30
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e29-machine-transaction-fabric-2026-09-30.json", "../e29-machine-transaction-fabric-2026-09-30.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e29-machine-transaction-fabric-2026-09-30.attestation.json"))["files"])
for f in names:
    get(E + "e29-machine-transaction-fabric-2026-09-30/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e29-machine-transaction-fabric-2026-09-30/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e29-machine-transaction-fabric-2026-09-30 ../e29-machine-transaction-fabric-2026-09-30.attestation.json \
  && python3 verify_e29.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e29.py

E28 · e28-portable-execution-identity-2026-09-30

— published result: INTACT (243/243 checks)

mkdir -p e28-portable-execution-identity-2026-09-30 && cd e28-portable-execution-identity-2026-09-30
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e28-portable-execution-identity-2026-09-30.json", "../e28-portable-execution-identity-2026-09-30.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e28-portable-execution-identity-2026-09-30.attestation.json"))["files"])
for f in names:
    get(E + "e28-portable-execution-identity-2026-09-30/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e28-portable-execution-identity-2026-09-30/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e28-portable-execution-identity-2026-09-30 ../e28-portable-execution-identity-2026-09-30.attestation.json \
  && python3 verify_e28.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e28.py

E27 · e27-agentic-internet-control-plane-2026-09-30

— published result: INTACT (4001/4001 checks)

mkdir -p e27-agentic-internet-control-plane-2026-09-30 && cd e27-agentic-internet-control-plane-2026-09-30
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e27-agentic-internet-control-plane-2026-09-30.json", "../e27-agentic-internet-control-plane-2026-09-30.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e27-agentic-internet-control-plane-2026-09-30.attestation.json"))["files"])
for f in names:
    get(E + "e27-agentic-internet-control-plane-2026-09-30/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e27-agentic-internet-control-plane-2026-09-30/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e27-agentic-internet-control-plane-2026-09-30 ../e27-agentic-internet-control-plane-2026-09-30.attestation.json \
  && python3 verify_e27.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e27.py

E26 · e26-universal-machine-agency-trust-2026-09-30

— published result: INTACT (3115/3115 checks)

mkdir -p e26-universal-machine-agency-trust-2026-09-30 && cd e26-universal-machine-agency-trust-2026-09-30
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e26-universal-machine-agency-trust-2026-09-30.json", "../e26-universal-machine-agency-trust-2026-09-30.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e26-universal-machine-agency-trust-2026-09-30.attestation.json"))["files"])
for f in names:
    get(E + "e26-universal-machine-agency-trust-2026-09-30/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e26-universal-machine-agency-trust-2026-09-30/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e26-universal-machine-agency-trust-2026-09-30 ../e26-universal-machine-agency-trust-2026-09-30.attestation.json \
  && python3 verify_e26.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e26.py

E25 · e25-universal-machine-agency-2026-09-30

— published result: INTACT (2977/2977 checks)

mkdir -p e25-universal-machine-agency-2026-09-30 && cd e25-universal-machine-agency-2026-09-30
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e25-universal-machine-agency-2026-09-30.json", "../e25-universal-machine-agency-2026-09-30.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e25-universal-machine-agency-2026-09-30.attestation.json"))["files"])
for f in names:
    get(E + "e25-universal-machine-agency-2026-09-30/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e25-universal-machine-agency-2026-09-30/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e25-universal-machine-agency-2026-09-30 ../e25-universal-machine-agency-2026-09-30.attestation.json \
  && python3 verify_e25.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e25.py

E24 · e24-governed-agentic-internet-2026-09-29

— published result: INTACT (1952/1952 checks)

mkdir -p e24-governed-agentic-internet-2026-09-29 && cd e24-governed-agentic-internet-2026-09-29
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e24-governed-agentic-internet-2026-09-29.json", "../e24-governed-agentic-internet-2026-09-29.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e24-governed-agentic-internet-2026-09-29.attestation.json"))["files"])
for f in names:
    get(E + "e24-governed-agentic-internet-2026-09-29/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e24-governed-agentic-internet-2026-09-29/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e24-governed-agentic-internet-2026-09-29 ../e24-governed-agentic-internet-2026-09-29.attestation.json \
  && python3 verify_e24.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

VERIFICATION.md · verify_e24.py

E23 · e23-governed-meta-intelligence-2026-09-29

— published result: INTACT (733/733 checks)

mkdir -p e23-governed-meta-intelligence-2026-09-29 && cd e23-governed-meta-intelligence-2026-09-29
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e23-governed-meta-intelligence-2026-09-29.json", "../e23-governed-meta-intelligence-2026-09-29.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e23-governed-meta-intelligence-2026-09-29.attestation.json"))["files"])
for f in names:
    get(E + "e23-governed-meta-intelligence-2026-09-29/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e23-governed-meta-intelligence-2026-09-29/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e23-governed-meta-intelligence-2026-09-29 ../e23-governed-meta-intelligence-2026-09-29.attestation.json \
  && python3 verify_e23.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

VERIFICATION.md · verify_e23.py

E21 · e21-open-ended-intelligence-2026-09-29

— published result: INTACT (218/218 checks)

mkdir -p e21-open-ended-intelligence-2026-09-29 && cd e21-open-ended-intelligence-2026-09-29
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://cainstudio.online/proof/bundle/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e21-open-ended-intelligence-2026-09-29.json", "../e21-open-ended-intelligence-2026-09-29.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e21-open-ended-intelligence-2026-09-29.attestation.json"))["files"])
for f in names:
    get(E + "e21-open-ended-intelligence-2026-09-29/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e21-open-ended-intelligence-2026-09-29/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e21-open-ended-intelligence-2026-09-29 ../e21-open-ended-intelligence-2026-09-29.attestation.json \
  && python3 verify_e21.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }