CAIN-42 CAIN StudioCEFV · Module 4 of 5 · 11 min
Independent (clean-room) verification
A verifier that imports the vendor's own code inherits the vendor's bugs and backdoors. CAIN ships standalone verifiers that import no CAIN code, so a third party can audit a short script instead of a platform.
Independence has grades: self-reported, self-tested, re-derived by a standalone tool, re-derived by a third party, independently corroborated.
When you verify, record which tool, which version, which pinned key, and the exact command.
Key points
- No vendor imports in the verifier.
- Independence is graded.
- Record tool, version, key, command.
In the CAIN-42 codebase
keystone/family_verify.py— zero-CAIN-import verifierscripts/cain42_bft/— standalone QC verifiers
Practice check
Practice 1 · choose one
Why should a verifier import no vendor code?
Practice 2 · true or false