# Known limitations (material)

## About this kit
1. **The release key was rotated, and continuity is not proven.** The previous key (`cain-root-release-key-2026`) could not be located on 2026-10-11, so the owner generated `cain42-auditor-kit-release-2026-10`. The old key did not sign the new one. The new key must be authenticated from scratch (KEYS_AND_TRUST.md). A ZIP without `SIGNATURES/RELEASE_MANIFEST.sig.json` yields `UNTRUSTED_SIGNING_KEY` and is not a release.
2. **The trust anchor is asserted by the operator.** All publication channels (three domains, one server) are controlled by the same operator. There is no transparency log and no independent countersigner.
3. **Provenance is declared, not verifiable.** `source_commit` names a commit in a private repository. Outside auditors cannot confirm that it exists or rebuild the kit from it. The deterministic build is reproducible only by someone with repository access.
4. **No independent party has used this kit.** Every result listed with the release (fixtures, benchmark, clean-room run) was produced by the developer's own machine and tools. Clean-room status: `NOT_INDEPENDENTLY_REPRODUCED`.
5. **The developer chose the evidence.** The gate snapshot is the developer's engine running over the developer's files. Several engine summaries are static text (GATE-1 "live cluster ... height 10689+" comes from a Prompt-3 file). The GATE-4 text says "microsecond TTLs" while the code default is 30 seconds (claim CLM-PLAT-06).
6. **The text scan for prompt injection is heuristic.** It catches common patterns only.
7. **Results are not signed.** `--check-result` detects edits and replay against a different archive, but it cannot tell who produced a result. Re-run the verifier yourself.
8. **Freshness is bounded by policy.** This kit becomes `STALE_EVIDENCE` 14 days after the gate snapshot was captured (captured 2026-10-11). This is intended behaviour.

## About the platform (not resolved by this kit)
9. GATE-2 is BLOCKED: every validator runs on one cloud provider (Vultr). Containers and processes on one provider are not independent failure domains.
10. GATE-6 is BLOCKED: no independent third-party audit has taken place.
11. The implementation source is not published, by owner policy. The enforcement, consensus and tenancy deep-audit procedures therefore need source access to be arranged with the owner (see `FULL_AUDIT_RUNBOOK.md`).
12. CAIN-42 has no authoritative platform version number. The gateway reports a hard-coded `1.0.0`, and the platform can be identified only by git commit.

## Defects in earlier kits (superseded; files kept for history)
13. `cain42-verify.zip` (sha256 `521509b263fa3fdded2cb0d35aa99a0c8909647dbd6505a9b6023380bb8e61ae`) was advertised as kit **7.0.0 KIT_RELEASE_READY**. Its own signed manifest says **5.0.0**, source commit `6085b69b` and branch `ironclad-prompt5`.
14. That kit verified its signature with a root key **shipped inside the same ZIP**. An attacker who replaced that key, rewrote the README and re-signed got **exit 0**. An unlisted extra file was also accepted. Measured on 2026-10-11.
15. That kit's verifier hard-coded that GATE-2 and GATE-6 *must* be BLOCKED. A legitimate future improvement would therefore have been reported as a failure.
16. clawx.click returned 404 for that kit, although it was described as available on all three sites.