CAIN-42 Auditor Kit 8.2.0

Lets an engineer who has never seen CAIN-42 check what its developer publishes, without trusting the developer's success messages. This page is published by the developer. This page is not an independent audit.

Kit status: AUDITOR_KIT_RELEASE_READY · CAIN-42 platform status: RELEASE_GATE_BLOCKED, production_ready = false
These are separate decisions. A ready kit does not make the platform ready. Independent reproduction: NOT_INDEPENDENTLY_REPRODUCED · External review: PENDING_EXTERNAL_REVIEW

Download

File	SHA-256
cain42-auditor-kit-8.2.0.zip (2,280,659 bytes)	`f813a079a6181d06297f5abc0376e716a6a53fa022b9427d097e78be0d009ad2`
cain42-auditor-kit-8.2.0.zip.sha256	—
cain42_verify.py (standalone verifier, standard library only, identical to the copy inside the ZIP)	`b9a9ad15dfba28544ed23d438c317edb75eccc9aa56829741c3e01b2a519c144`
RELEASE_MANIFEST.json · signature	—
auditor_kit_release_status.json · cain42_platform_release_status.json	—
benchmark-8.2.0.json · challenge-8.2.0.json · expected_verdict.json	—

The same bytes are published on cainstudio.online, mcpgate.online and clawx.click. All three run on one server, so they are not independent copies.

Release signing key (authenticate it out of band)

Key id cain42-auditor-kit-release-2026-10 · Ed25519 · created 2026-10-11, expires 2027-10-11
Public key XhK+pwJlsTymjoA8rnJBiGP344rTKK1qD5xTtbkbZlY=
Fingerprint (SHA-256) d0f5f17ca2be05600042f4dd336b8e9a55f58ef14c83dc717f13bfb85e0afa20

Key rotation: the previous key cain-root-release-key-2026 could not be located and did not sign this key. Continuity is not cryptographically proven. Treat this key as new, and confirm the fingerprint through a channel this website does not control (see KEYS_AND_TRUST.md).

42-Second Initial Evidence Verdict

One paste in any terminal (Linux, macOS, Windows WSL, Android Termux). It downloads the verifier and the ZIP into the current folder, then checks them offline. On Termux the first run installs Python (about a minute).

(command -v python3 >/dev/null || pkg install -y python) && (curl -fsSLO https://cainstudio.online/evidence/auditor-kit/8.2.0/cain42_verify.py -O https://cainstudio.online/evidence/auditor-kit/8.2.0/cain42-auditor-kit-8.2.0.zip || python3 -c "import urllib.request as u;[u.urlretrieve('https://cainstudio.online/evidence/auditor-kit/8.2.0/'+f,f) for f in ('cain42_verify.py','cain42-auditor-kit-8.2.0.zip')]") && python3 -I cain42_verify.py cain42-auditor-kit-8.2.0.zip --trust-anchor XhK+pwJlsTymjoA8rnJBiGP344rTKK1qD5xTtbkbZlY= --expect-sha256 f813a079a6181d06297f5abc0376e716a6a53fa022b9427d097e78be0d009ad2 --expect-version 8.2.0 --human

Already have both files in one folder? Run only the check:

python3 -I cain42_verify.py cain42-auditor-kit-8.2.0.zip --trust-anchor XhK+pwJlsTymjoA8rnJBiGP344rTKK1qD5xTtbkbZlY= --expect-sha256 f813a079a6181d06297f5abc0376e716a6a53fa022b9427d097e78be0d009ad2 --expect-version 8.2.0 --human

Expected verdict: PASS_INTEGRITY (exit 0) while the evidence is fresh. The gate snapshot ages out after 14 days, and the verdict then becomes STALE_EVIDENCE. That is intended.

Everything the kit can check, under one timer. In the folder that holds the ZIP, this extracts the kit and runs the 42-second challenge:

python3 -m zipfile -e cain42-auditor-kit-8.2.0.zip . && cd cain42-auditor-kit-8.2.0 && python3 -I -B CHALLENGE_42S.py ../cain42-auditor-kit-8.2.0.zip --trust-anchor XhK+pwJlsTymjoA8rnJBiGP344rTKK1qD5xTtbkbZlY= --expect-sha256 f813a079a6181d06297f5abc0376e716a6a53fa022b9427d097e78be0d009ad2 --online

Measured on the developer's machine: initial verdict 30 runs, 0 failures · median 7.6182 s · p95 12.1804 s · max 13.6564 s · network isolated: True · partially cold (ZIP + verifier evicted; interpreter cached) · Intel Xeon Processor (Cascadelake).
42-second challenge: PASS_OVER_BUDGET in 169.377 s (budget 42.0 s); online stage: True

What a PASS does not prove: that the key belongs to who you think it does; that any CAIN-42 claim is true; that the source commit exists (the repository is private); that anyone independent reviewed anything; consensus safety; that enforcement cannot be bypassed; or that the platform is production ready. This is an initial integrity check, not a security audit. Assurance model · Known limitations · Claim–evidence matrix

IP value, FIRME AI value and founder value (USD)

Recomputed by the kit verifier from the signed register in the ZIP; any change to these numbers fails verification. How each figure is derived.

	LOW	BASE	HIGH
CAIN-42 standalone net IP base	$6,342,460	$16,337,650	$28,898,500
FIRME AI company value, investor	$8,824,460	$18,819,650	$31,380,500
FIRME AI company value, strategic acquirer	$9,824,460	$19,819,650	$32,380,500
Founder Vincent Noriega paper equity, investor (100% owner)	$8,824,460	$18,819,650	$31,380,500
Founder Vincent Noriega paper equity, strategic (100% owner)	$9,824,460	$19,819,650	$32,380,500

The register describes these as an internal analytical scenario, not an appraisal, a financing valuation or a guarantee.

72-hour evidence

cain-mr-02: 156.3 hours of unbroken operation (2026-09-27T00:49:21Z → 2026-10-03T13:08:31Z), 313 signed hourly proofs verified, commit sequence 34 → 28,887. Every proof’s hash, Ed25519 signature, chain link and replica agreement is checked by the kit. This run was continuous operation with no faults injected; the fault-injection soak on cain-mr-01 is tracked separately.

Public transparency log

Each release's signed manifest is recorded in Sigstore Rekor, a public append-only log run by the Sigstore project, not by the CAIN-42 developer. Check it yourself; the checker asks Rekor directly and uses Python's standard library only:

curl -fsSLO https://cainstudio.online/evidence/auditor-kit/8.2.0/cain42_rekor_check.py && python3 -I cain42_rekor_check.py cain42-auditor-kit-8.2.0.zip --trust-anchor XhK+pwJlsTymjoA8rnJBiGP344rTKK1qD5xTtbkbZlY=

Expected last verdict: LOGGED_AND_CONSISTENT (exit 0). It also lists every entry Rekor holds for the release key, so a release signed with the key but never announced would show up. 8.2.0 is Rekor entry logIndex 3216554798, logged 2026-10-11T23:19:43Z (added after the ZIP was signed, so the ZIP's own KNOWN_LIMITATIONS.md still says there is no transparency log). Receipt: TRANSPARENCY_LOG.json. A log entry proves when the manifest was signed with this key; it does not prove who holds the key.

Audit methodology

These documents are byte-identical copies of the files inside the signed ZIP, so the ZIP's signature covers them too:

QUICKSTART.md: the 42-second initial verdict, step by step · 42-second worksheet
FULL_AUDIT_RUNBOOK.md: deep audit of the crypto and supply chain, the authorization path, distributed systems, operations and the three sites · effort plan
ASSURANCE_MODEL.md: nine properties that are not interchangeable · THREAT_MODEL.md
KEYS_AND_TRUST.md: authenticate the signing key yourself · REPRODUCE.md: clean-environment reproduction
CLAIM_EVIDENCE_MATRIX.json: each claim's evidence, limits and what would falsify it · KNOWN_LIMITATIONS.md
AI-assisted review procedure: an AI review must pass the validator in the kit before anyone relies on it

Kit release gates (K1–K10)

Gate	Requirement	Status	Blockers
K1	authoritative source commit and version identified	PASS	—
K2	manifest, hashes, signature and contents agree	PASS	—
K3	verifier source and runtime reproducible	PASS	—
K4	positive and negative fixtures pass	PASS	—
K5	offline verification under declared conditions	PASS	—
K6	42-second initial verdict meets threshold	PASS	—
K7	auditor documentation complete and consistent	PASS	—
K8	all three sites link to the correct current kit	PASS	—
K9	safe to distribute; no secrets; no implementation source	PASS	—
K10	limitations, unsupported claims and defects documented	PASS	—

Evaluated 2026-10-11T15:32:08Z for ZIP f813a079a6181d06…, source commit 9684fef3d787.

CAIN-42 platform release gates (unchanged by this kit)

Gate	Name	Status	Blocking reasons
GATE-1	Byzantine Fault Tolerant Consensus Quorum Liveness & Safety	PASSED_TESTED_SCOPE	—
GATE-2	Multi-Region Geographic Isolation & Multi-Provider Resilience	BLOCKED	cain-mr-01: replicas share host(s) ['vultr-lax-1']; losing one of them stops the quorum (2026-10-11T15:12:45Z).; cain-mr-01: all replicas on one provider ['vultr']; fails multi-provider diversity (2026-10-11T15:12:45Z).; cain-mr-02: all replicas on one provider ['vultr']; fails multi-provider diversity (2026-10-11T15:12:45Z).; Multi-cloud deployment templates (AWS, GCP, Azure, Vultr in multicloud_mesh.tf) remain unprovisioned due to absence of cloud provider credentials in environment.
GATE-3	Transparent Non-Bypassable Execution Enforcement	PASSED_TESTED_SCOPE	—
GATE-4	Ephemeral Action Capability Tokens & Anti-Replay	PASSED_TESTED_SCOPE	—
GATE-5	RFC 6962 Merkle Proof Integrity & WORM Audit Storage	PASSED_TESTED_SCOPE	—
GATE-6	Independent Clean-Room Reproducibility & Third-Party Audit	BLOCKED	Absence of signed third-party attestation in verification/reports/THIRD_PARTY_ATTESTATION.json; Self-attestation by authors, founders, or automated agents is strictly prohibited by CAIN doctrine
GATE-7	Public Truth & Documentation Parity	PASSED_TESTED_SCOPE	—

Source: the developer's gate engine, snapshot 2026-10-11T15:12:28Z. PASSED_TESTED_SCOPE means the developer's own tests passed. It does not mean an independent party verified the gate.

Report a finding

Found a defect, an overclaim, or a check that passes when it should fail? Use the form, or follow FINDINGS_TEMPLATE.md. Disclosure terms: /api/v1/audit/disclosure-policy. Do not include secrets, keys or customer data. Submissions that contain key material are rejected.

Submitting a finding records it with the developer; it does not make the finding public or independent. Severity and status are triaged by the developer.