CAIN-42 Auditor Kit 8.0.1

Superseded. Auditor Kit 8.0.1 has been replaced by Auditor Kit 8.1.0. This page and its files are kept unchanged for the record; its evidence ages out on 2026-10-25.

Lets an engineer who has never seen CAIN-42 check what its developer publishes, without trusting the developer's success messages. This page is published by the developer. This page is not an independent audit.

Kit status: AUDITOR_KIT_RELEASE_READY · CAIN-42 platform status: RELEASE_GATE_BLOCKED, production_ready = false
These are separate decisions. A ready kit does not make the platform ready. Independent reproduction: NOT_INDEPENDENTLY_REPRODUCED · External review: PENDING_EXTERNAL_REVIEW

Download

File	SHA-256
cain42-auditor-kit-8.0.1.zip (433,286 bytes)	`583ea6912f6c08741972596d87f17544f93728cf42e50f76d6f028b97ae64db2`
cain42-auditor-kit-8.0.1.zip.sha256	—
cain42_verify.py (standalone verifier, standard library only, identical to the copy inside the ZIP)	`0c9f2e3c846397fa095c8de0a15cc734daccf2fba7ead2968626b836e2f50534`
RELEASE_MANIFEST.json · signature	—
auditor_kit_release_status.json · cain42_platform_release_status.json	—
benchmark-8.0.1.json · challenge-8.0.1.json · expected_verdict.json	—

The same bytes are published on cainstudio.online, mcpgate.online and clawx.click. All three run on one server, so they are not independent copies.

Release signing key (authenticate it out of band)

Key id cain42-auditor-kit-release-2026-10 · Ed25519 · created 2026-10-11, expires 2027-10-11
Public key XhK+pwJlsTymjoA8rnJBiGP344rTKK1qD5xTtbkbZlY=
Fingerprint (SHA-256) d0f5f17ca2be05600042f4dd336b8e9a55f58ef14c83dc717f13bfb85e0afa20

Key rotation: the previous key cain-root-release-key-2026 could not be located and did not sign this key. Continuity is not cryptographically proven. Treat this key as new, and confirm the fingerprint through a channel this website does not control (see KEYS_AND_TRUST.md).

42-Second Initial Evidence Verdict

One paste in any terminal (Linux, macOS, Windows WSL, Android Termux). It downloads the verifier and the ZIP into the current folder, then checks them offline. On Termux the first run installs Python (about a minute).

(command -v python3 >/dev/null || pkg install -y python) && (curl -fsSLO https://cainstudio.online/evidence/auditor-kit/8.0.1/cain42_verify.py -O https://cainstudio.online/evidence/auditor-kit/8.0.1/cain42-auditor-kit-8.0.1.zip || python3 -c "import urllib.request as u;[u.urlretrieve('https://cainstudio.online/evidence/auditor-kit/8.0.1/'+f,f) for f in ('cain42_verify.py','cain42-auditor-kit-8.0.1.zip')]") && python3 -I cain42_verify.py cain42-auditor-kit-8.0.1.zip --trust-anchor XhK+pwJlsTymjoA8rnJBiGP344rTKK1qD5xTtbkbZlY= --expect-sha256 583ea6912f6c08741972596d87f17544f93728cf42e50f76d6f028b97ae64db2 --expect-version 8.0.1 --human

Already have both files in one folder? Run only the check:

python3 -I cain42_verify.py cain42-auditor-kit-8.0.1.zip --trust-anchor XhK+pwJlsTymjoA8rnJBiGP344rTKK1qD5xTtbkbZlY= --expect-sha256 583ea6912f6c08741972596d87f17544f93728cf42e50f76d6f028b97ae64db2 --expect-version 8.0.1 --human

Expected verdict: PASS_INTEGRITY (exit 0) while the evidence is fresh. The gate snapshot ages out after 14 days, and the verdict then becomes STALE_EVIDENCE. That is intended.

Everything the kit can check, under one timer. In the folder that holds the ZIP, this extracts the kit and runs the 42-second challenge:

python3 -m zipfile -e cain42-auditor-kit-8.0.1.zip . && cd cain42-auditor-kit-8.0.1 && python3 -I -B CHALLENGE_42S.py ../cain42-auditor-kit-8.0.1.zip --trust-anchor XhK+pwJlsTymjoA8rnJBiGP344rTKK1qD5xTtbkbZlY= --expect-sha256 583ea6912f6c08741972596d87f17544f93728cf42e50f76d6f028b97ae64db2 --online

Measured on the developer's machine: initial verdict 30 runs, 0 failures · median 0.167 s · p95 0.2005 s · max 0.2541 s · network isolated: True · partially cold (ZIP + verifier evicted; interpreter cached) · Intel Xeon Processor (Cascadelake).
42-second challenge: PASS_42S in 12.376 s (budget 42.0 s); online stage: False

What a PASS does not prove: that the key belongs to who you think it does; that any CAIN-42 claim is true; that the source commit exists (the repository is private); that anyone independent reviewed anything; consensus safety; that enforcement cannot be bypassed; or that the platform is production ready. This is an initial integrity check, not a security audit. Assurance model · Known limitations · Claim–evidence matrix

Audit methodology

These documents are byte-identical copies of the files inside the signed ZIP, so the ZIP's signature covers them too:

QUICKSTART.md: the 42-second initial verdict, step by step · 42-second worksheet
FULL_AUDIT_RUNBOOK.md: deep audit of the crypto and supply chain, the authorization path, distributed systems, operations and the three sites · effort plan
ASSURANCE_MODEL.md: nine properties that are not interchangeable · THREAT_MODEL.md
KEYS_AND_TRUST.md: authenticate the signing key yourself · REPRODUCE.md: clean-environment reproduction
CLAIM_EVIDENCE_MATRIX.json: each claim's evidence, limits and what would falsify it · KNOWN_LIMITATIONS.md
AI-assisted review procedure: an AI review must pass the validator in the kit before anyone relies on it

Kit release gates (K1–K10)

Gate	Requirement	Status	Blockers
K1	authoritative source commit and version identified	PASS	—
K2	manifest, hashes, signature and contents agree	PASS	—
K3	verifier source and runtime reproducible	PASS	—
K4	positive and negative fixtures pass	PASS	—
K5	offline verification under declared conditions	PASS	—
K6	42-second initial verdict meets threshold	PASS	—
K7	auditor documentation complete and consistent	PASS	—
K8	all three sites link to the correct current kit	PASS	—
K9	safe to distribute; no secrets; no implementation source	PASS	—
K10	limitations, unsupported claims and defects documented	PASS	—

Evaluated 2026-10-11T03:33:57Z for ZIP 583ea6912f6c0874…, source commit 39f4293bf3f9.

CAIN-42 platform release gates (unchanged by this kit)

Gate	Name	Status	Blocking reasons
GATE-1	Byzantine Fault Tolerant Consensus Quorum Liveness & Safety	PASSED_TESTED_SCOPE	—
GATE-2	Multi-Region Geographic Isolation & Multi-Provider Resilience	BLOCKED	Current live cluster cain-mr-01 co-locates Node-2 and Node-3 on host vultr-lax-1 (3 physical hosts total); fails single-host outage survival.; Both live clusters cain-mr-01 and cain-mr-02 are 100% hosted on Vultr; fails multi-cloud provider diversity requirement.; Multi-cloud deployment templates (AWS, GCP, Azure, Vultr in multicloud_mesh.tf) remain unprovisioned due to absence of cloud provider credentials in environment.
GATE-3	Transparent Non-Bypassable Execution Enforcement	PASSED_TESTED_SCOPE	—
GATE-4	Ephemeral Action Capability Tokens & Anti-Replay	PASSED_TESTED_SCOPE	—
GATE-5	RFC 6962 Merkle Proof Integrity & WORM Audit Storage	PASSED_TESTED_SCOPE	—
GATE-6	Independent Clean-Room Reproducibility & Third-Party Audit	BLOCKED	Absence of signed third-party attestation in verification/reports/THIRD_PARTY_ATTESTATION.json; Self-attestation by authors, founders, or automated agents is strictly prohibited by CAIN doctrine
GATE-7	Public Truth & Documentation Parity	PASSED_TESTED_SCOPE	—

Source: the developer's gate engine, snapshot 2026-10-11T02:57:59Z. PASSED_TESTED_SCOPE means the developer's own tests passed. It does not mean an independent party verified the gate.

Report a finding

Found a defect, an overclaim, or a check that passes when it should fail? Use the form, or follow FINDINGS_TEMPLATE.md. Disclosure terms: /api/v1/audit/disclosure-policy. Do not include secrets, keys or customer data. Submissions that contain key material are rejected.

Submitting a finding records it with the developer; it does not make the finding public or independent. Severity and status are triaged by the developer.