# Assurance model

## Nine properties that are not interchangeable

| # | Property | What establishes it | Established by this kit? |
|---|---|---|---|
| 1 | **Artifact integrity**: bytes match a stated digest | SHA-256 over the ZIP and over every file | **Yes**, by the verifier |
| 2 | **Publisher authenticity**: a signature validates under an identified key | Ed25519 over the exact `RELEASE_MANIFEST.json` bytes, checked against a key **you** supply | **Yes, relative to the key you supply.** Whether that key belongs to the publisher is up to your trust bootstrap (`KEYS_AND_TRUST.md`) |
| 3 | **Release provenance**: bytes are bound to a source revision and build | The manifest names `source_commit`; the build is deterministic | **Declared only.** The repository is private, so you cannot check that the commit exists or rebuild from it |
| 4 | **Test reproducibility**: you can rerun the tests and compare | `TESTS/run_fixture_suite.py` regenerates all 51 fixtures byte-for-byte and re-runs them | **Yes for the kit's own tests.** Platform test suites need repository access |
| 5 | **Claim substantiation**: evidence supports a specific technical claim | `CLAIM_EVIDENCE_MATRIX.json`; machine-checkable assertions are contradiction-checked | **Partially.** See each claim's status. Most platform claims are `PARTIALLY_SUPPORTED` or `NOT_VERIFIED` |
| 6 | **Independent reproduction**: an outside party reproduces a result without relying on the developer's assertion | A reproduction record signed by a reviewer key you trust (`independent_review_record`) | **No.** `NOT_INDEPENDENTLY_REPRODUCED` |
| 7 | **Independent human review**: a qualified auditor evaluates evidence, assumptions and limits | `HUMAN_REVIEW/` templates plus a signed reviewer declaration | **No.** `PENDING_EXTERNAL_REVIEW` |
| 8 | **Independent AI-assisted review**: an AI analyses the evidence with recorded methods and limits | `AI_REVIEW/` schema plus `validate_ai_review.py` | **Not by an independent party.** A review run by the developer's own AI is not independent |
| 9 | **Platform production readiness**: all mandatory platform gates passed | `EVIDENCE/platform_release_gates.json` (gate engine output) | **No.** `RELEASE_GATE_BLOCKED`: GATE-2 and GATE-6 are BLOCKED |

Rules that follow from the table:

- A valid signature proves neither that a statement is true nor that an independent auditor checked it. Fixture `publisher_signed_unsupported_assertion` is a correctly signed package whose claim contradicts its own evidence, and the verifier fails it.
- A passing test suite does not establish that a distributed system is correct.
- Two AI models reading the same developer report are **one** source, not two confirmations.
- Kit status (`auditor_kit_release_status.json`) and platform status (`cain42_platform_release_status.json`) are separate records with separate gates. Neither one may be derived from the other.

## Assurance boundary

```
  YOU (auditor)                                          DEVELOPER-CONTROLLED
  ─────────────                                          ────────────────────
  trust anchor (obtained out of band) ──┐                three websites (one server, one operator)
  published ZIP SHA-256 ────────────────┤                release key holder (signs the manifest)
  verifier you read or obtained ────────┤                gate engine + its evidence files (private repo)
                                        ▼                cluster replica keys (self-published)
                    ┌──────────── cain42_verify.py ──────────────┐
                    │ archive safety → manifest → signature      │  ← ESTABLISHED: integrity, authenticity
                    │ → files → identity → evidence → claims     │     relative to YOUR anchor, consistency,
                    └────────────────────────────────────────────┘     freshness
                                        │
            NOT ESTABLISHED: key ownership, source provenance, truth of claims, consensus safety,
            enforcement non-bypassability, independence of hosts, independent review, production readiness
```

## Freshness policy (verifier ceilings; a package may only be stricter)

| Evidence type | Maximum age |
|---|---|
| `platform_release_gate_snapshot` | 14 days |
| `kit_build_record` | 30 days |
| `quorum_certificate_sample` | 90 days |
| `merkle_fixture_set` | 365 days |
| `independent_review_record` | 365 days |
| `ip_valuation_record` | 60 days |
| `operational_proof_chain` | 365 days (a historical record) |

Age is measured from `observed_at_utc` to the evaluation time. Pass `--now` to make a run reproducible. When evidence is stale the verdict becomes `STALE_EVIDENCE`. Run the kit again later and it will go stale: that is intended.

## Provenance labels

`DEVELOPER_SELF_ATTESTED` (the developer says so) · `DEVELOPER_MEASURED` (the developer's tooling measured it) · `TEST_VECTOR` (reference data, not observations) · `INDEPENDENTLY_REPRODUCED` and `INDEPENDENT_REVIEW` (allowed only with a record signed by a reviewer key that **you** pass with `--auditor-key`; otherwise the verifier treats the record as forged and fails it).