# Quickstart: the 42-Second Initial Evidence Verdict

**Scope.** This step answers one narrow question: *are these the exact, complete, internally consistent bytes that the holder of the CAIN-42 release key signed, and is their mandatory evidence fresh?*
It is **not** a security audit. It does not prove that the consensus protocol is safe, does not validate any product, and does not decide production readiness.

## Before the timer starts (preparation; may use the network)

1. Download `cain42-auditor-kit-8.0.1.zip` from the release page: `https://cainstudio.online/evidence/auditor-kit/8.0.1/`. The same file is served on mcpgate.online and clawx.click.
2. Write down the published SHA-256 of the ZIP. It is in `cain42-auditor-kit-8.0.1.zip.sha256` on the release page.
3. Obtain the publisher's Ed25519 public key **out of band** by following `KEYS_AND_TRUST.md`. Do **not** copy it from inside the ZIP. Expected value:
   `XhK+pwJlsTymjoA8rnJBiGP344rTKK1qD5xTtbkbZlY=` (SHA-256 fingerprint `d0f5f17ca2be05600042f4dd336b8e9a55f58ef14c83dc717f13bfb85e0afa20`).
   A value printed inside the package proves nothing on its own.
4. Get a verifier you are willing to run. Either read `VERIFIER/cain42_verify.py` after extracting it (about 700 lines, standard library only), or download `cain42_verify.py` separately from the release page and compare the two.
5. Disconnect from the network if you want to confirm the check is offline. The verifier makes no network calls.

## Timed step

```sh
python3 -I cain42_verify.py cain42-auditor-kit-8.0.1.zip \
  --trust-anchor XhK+pwJlsTymjoA8rnJBiGP344rTKK1qD5xTtbkbZlY= \
  --expect-sha256 <PUBLISHED_SHA256> --expect-version 8.0.1 --human
```

Use `--out result.json` (or omit `--human`) to get machine-readable output that follows `SCHEMAS/verdict.schema.json`.

## Reading the verdict

| Verdict | Exit | Meaning |
|---|---|---|
| `PASS_INTEGRITY` | 0 | Every mandatory check passed |
| `PASS_INTEGRITY_WITH_WARNINGS` | 1 | Mandatory checks passed; read each WARN |
| `FAIL_INTEGRITY` | 10 | Bytes, signature, structure, identity or evidence contradict each other. **Stop.** |
| `UNSUPPORTED_SCHEMA` | 20 | Unknown or downgraded schema or algorithm |
| `UNTRUSTED_SIGNING_KEY` | 30 | No anchor supplied, the release is unsigned, or it was signed by a different or revoked key |
| `INCOMPLETE_EVIDENCE` | 40 | A mandatory evidence record is missing or of an unknown mandatory type |
| `STALE_EVIDENCE` | 50 | Mandatory evidence is older than its freshness ceiling (see `ASSURANCE_MODEL.md`) |
| `VERIFICATION_ERROR` | 70 | The verifier could not finish; this is never a pass |

A check that was skipped never counts as passed. The JSON output lists `proves` and `does_not_prove`; read both.
Record your result on `HUMAN_REVIEW/WORKSHEET_42S.md`.

## Everything the kit can check, in 42 seconds

From the extracted kit directory:
```sh
python3 -I CHALLENGE_42S.py ../cain42-auditor-kit-8.0.1.zip --trust-anchor <ANCHOR> --expect-sha256 <SHA> [--online]
```
This runs the initial verdict. It then confirms that the extracted files are the bytes it just verified, runs the
46-fixture adversarial suite and the 23-case AI-review validator suite, and, with `--online`, probes all three sites
read-only. The challenge verdict is `PASS_42S` only if every stage passes within 42 s.
It still does **not** establish that CAIN-42's security claims are true. No 42-second procedure can; see `FULL_AUDIT_RUNBOOK.md`.

## The 42-second target

The target covers only the timed step above, on a prepared machine, without network access. The measured times are published next to the ZIP in `benchmark-8.0.1.json`, which is bound to the ZIP's hash. Reproduce them with `BENCHMARKS/run_benchmark.py`.