CAIN-42 · economic guard

Three-signature settlement and a velocity circuit breaker

Deterministic drill at 2026-11-10T12:00:00Z. Reproduce with python3 -m cain.econ.drill.

scenario	outcome
S1-honest	SETTLED
S2-two-signatures	REFUSED 2 valid distinct custodian signature(s); settlement requires 3
S3-tampered-after-signing	REFUSED bad signature from econ/custodian-0; bad signature from econ/custodian-1; bad signature from econ/custodian-2; bad signature from econ/custodian-3; 0 valid distinct custodian signature(s); settlement requires 3
S4-replay	REFUSED nonce 'pkg-0004' was already settled (replay refused)
S5-fanout-drain	TRIPPED at payment #21
S6-slow-value-drain	TRIPPED at payment #7

Scenarios passed: 6/6 · per-transaction cap $500.00

Why scenario 5 matters

Every payment in the fan-out drain is legal on its own: under the per-transaction cap, correctly signed by a quorum, unique nonce. Only the aggregate is an attack. A per-transaction cap cannot see it; a sliding window across the swarm can, and revocation is what stops it.

Honest limits. The ledger is in-process; a production rail would persist it. No bank, card network, chain or wallet is contacted — this decides, it does not move money. Wallet revocation is ledger state, not key-custody. Same-operator evidence: no third-party audit, no customer run.

live status · capability matrix