Superseded by 8.0.1. 8.0.0 is valid and signed, but its online challenge stage counted the platform fact "all three domains are one server" as a release failure. Files on this page are kept unchanged for the record.

CAIN-42 Auditor Kit 8.0.0

Lets an engineer who has never seen CAIN-42 check what its developer publishes, without trusting the developer's success messages. This page is published by the developer. This page is not an independent audit.

Kit status: AUDITOR_KIT_RELEASE_READY · CAIN-42 platform status: RELEASE_GATE_BLOCKED, production_ready = false
These are separate decisions. A ready kit does not make the platform ready. Independent reproduction: NOT_INDEPENDENTLY_REPRODUCED · External review: PENDING_EXTERNAL_REVIEW

Download

File	SHA-256
cain42-auditor-kit-8.0.0.zip (432,637 bytes)	`07b66a4ea2660936d1ce3625c26ad5986b8ce18ed4bf6d6ff3a8f3881b4f1543`
cain42-auditor-kit-8.0.0.zip.sha256	—
cain42_verify.py (standalone verifier, standard library only, identical to the copy inside the ZIP)	`acbb280c440afd88225f9b488f2ded6a4f60d604efc9aa583709f09dda76565a`
RELEASE_MANIFEST.json · signature	—
auditor_kit_release_status.json · cain42_platform_release_status.json	—
benchmark-8.0.0.json · challenge-8.0.0.json · expected_verdict.json	—

The same bytes are published on cainstudio.online, mcpgate.online and clawx.click. All three run on one server, so they are not independent copies.

Release signing key (authenticate it out of band)

Key id cain42-auditor-kit-release-2026-10 · Ed25519 · created 2026-10-11, expires 2027-10-11
Public key XhK+pwJlsTymjoA8rnJBiGP344rTKK1qD5xTtbkbZlY=
Fingerprint (SHA-256) d0f5f17ca2be05600042f4dd336b8e9a55f58ef14c83dc717f13bfb85e0afa20

Key rotation: the previous key cain-root-release-key-2026 could not be located and did not sign this key. Continuity is not cryptographically proven. Treat this key as new, and confirm the fingerprint through a channel this website does not control (see KEYS_AND_TRUST.md).

42-Second Initial Evidence Verdict

python3 -I cain42_verify.py cain42-auditor-kit-8.0.0.zip \
  --trust-anchor XhK+pwJlsTymjoA8rnJBiGP344rTKK1qD5xTtbkbZlY= \
  --expect-sha256 07b66a4ea2660936d1ce3625c26ad5986b8ce18ed4bf6d6ff3a8f3881b4f1543 --expect-version 8.0.0 --human

Expected verdict: PASS_INTEGRITY (exit 0) while the evidence is fresh. The gate snapshot ages out after 14 days, and the verdict then becomes STALE_EVIDENCE. That is intended.

Everything the kit can check, under one timer: extract the ZIP, then from inside it run python3 -I CHALLENGE_42S.py ../cain42-auditor-kit-8.0.0.zip --trust-anchor XhK+pwJlsTymjoA8rnJBiGP344rTKK1qD5xTtbkbZlY= --expect-sha256 07b66a4ea2660936d1ce3625c26ad5986b8ce18ed4bf6d6ff3a8f3881b4f1543 --online.

Measured on the developer's machine: initial verdict 30 runs, 0 failures · median 0.162 s · p95 0.1989 s · max 0.2743 s · network isolated: True · partially cold (ZIP + verifier evicted; interpreter cached) · Intel Xeon Processor (Cascadelake).
42-second challenge: PASS_42S in 11.487 s (budget 42.0 s); online stage: False

What a PASS does not prove: that the key belongs to who you think it does; that any CAIN-42 claim is true; that the source commit exists (the repository is private); that anyone independent reviewed anything; consensus safety; that enforcement cannot be bypassed; or that the platform is production ready. This is an initial integrity check, not a security audit. Assurance model · Known limitations · Claim–evidence matrix

Kit release gates (K1–K10)

Gate	Requirement	Status	Blockers
K1	authoritative source commit and version identified	PASS	—
K2	manifest, hashes, signature and contents agree	PASS	—
K3	verifier source and runtime reproducible	PASS	—
K4	positive and negative fixtures pass	PASS	—
K5	offline verification under declared conditions	PASS	—
K6	42-second initial verdict meets threshold	PASS	—
K7	auditor documentation complete and consistent	PASS	—
K8	all three sites link to the correct current kit	PASS	—
K9	safe to distribute; no secrets; no implementation source	PASS	—
K10	limitations, unsupported claims and defects documented	PASS	—

Evaluated 2026-10-11T03:30:42Z for ZIP 07b66a4ea2660936…, source commit c109245678d5.

CAIN-42 platform release gates (unchanged by this kit)

Gate	Name	Status	Blocking reasons
GATE-1	Byzantine Fault Tolerant Consensus Quorum Liveness & Safety	PASSED_TESTED_SCOPE	—
GATE-2	Multi-Region Geographic Isolation & Multi-Provider Resilience	BLOCKED	Current live cluster cain-mr-01 co-locates Node-2 and Node-3 on host vultr-lax-1 (3 physical hosts total); fails single-host outage survival.; Both live clusters cain-mr-01 and cain-mr-02 are 100% hosted on Vultr; fails multi-cloud provider diversity requirement.; Multi-cloud deployment templates (AWS, GCP, Azure, Vultr in multicloud_mesh.tf) remain unprovisioned due to absence of cloud provider credentials in environment.
GATE-3	Transparent Non-Bypassable Execution Enforcement	PASSED_TESTED_SCOPE	—
GATE-4	Ephemeral Action Capability Tokens & Anti-Replay	PASSED_TESTED_SCOPE	—
GATE-5	RFC 6962 Merkle Proof Integrity & WORM Audit Storage	PASSED_TESTED_SCOPE	—
GATE-6	Independent Clean-Room Reproducibility & Third-Party Audit	BLOCKED	Absence of signed third-party attestation in verification/reports/THIRD_PARTY_ATTESTATION.json; Self-attestation by authors, founders, or automated agents is strictly prohibited by CAIN doctrine
GATE-7	Public Truth & Documentation Parity	PASSED_TESTED_SCOPE	—

Source: the developer's gate engine, snapshot 2026-10-11T02:57:59Z. PASSED_TESTED_SCOPE means the developer's own tests passed. It does not mean an independent party verified the gate.