# Quickstart: the 42-Second Initial Evidence Verdict

**Scope.** This step answers one narrow question: *are these the exact, complete, internally consistent bytes that the holder of the CAIN-42 release key signed, and is their mandatory evidence fresh?*
It is **not** a security audit. It does not prove that the consensus protocol is safe, does not validate any product, and does not decide production readiness.

## Fastest path: one paste (phone or computer)

The release page (`https://cainstudio.online/evidence/auditor-kit/8.3.2/`) and the homepage give a one-line command with
**Copy** buttons. Run it in an **empty folder** in any terminal: Linux, macOS, Windows WSL, or Android Termux. It installs
Python on Termux if missing (`pkg install -y python`), downloads `cain42_verify.py` and the ZIP into the folder
(with `curl`, or Python's `urllib` where `curl` is absent), then runs the timed step below. Its shape is:

```sh
(command -v python3 >/dev/null || pkg install -y python) && \
curl -fsSLO <RELEASE_PAGE>cain42_verify.py -O <RELEASE_PAGE>cain42-auditor-kit-8.3.2.zip && \
python3 -I cain42_verify.py cain42-auditor-kit-8.3.2.zip --trust-anchor <ANCHOR> \
  --expect-sha256 <PUBLISHED_SHA256> --expect-version 8.3.2 --human
```

`<PUBLISHED_SHA256>` cannot be printed in this file (it is the hash of the ZIP that contains it); take it from the release
page or `cain42-auditor-kit-8.3.2.zip.sha256`. The one paste is convenient, not independent: the command, the key and the
hash all come from the developer's website. For an independent check, follow the steps below and authenticate the key
yourself. The verifier and the ZIP must be **in the folder you run the command from**.

## Before the timer starts (preparation; may use the network)

1. Download `cain42-auditor-kit-8.3.2.zip` from the release page: `https://cainstudio.online/evidence/auditor-kit/8.3.2/`. The same file is served on mcpgate.online and clawx.click.
2. Write down the published SHA-256 of the ZIP. It is in `cain42-auditor-kit-8.3.2.zip.sha256` on the release page.
3. Obtain the publisher's Ed25519 public key **out of band** by following `KEYS_AND_TRUST.md`. Do **not** copy it from inside the ZIP. Expected value:
   `XhK+pwJlsTymjoA8rnJBiGP344rTKK1qD5xTtbkbZlY=` (SHA-256 fingerprint `d0f5f17ca2be05600042f4dd336b8e9a55f58ef14c83dc717f13bfb85e0afa20`).
   A value printed inside the package proves nothing on its own.
4. Get a verifier you are willing to run. Either read `VERIFIER/cain42_verify.py` after extracting it (about 700 lines, standard library only), or download `cain42_verify.py` separately from the release page and compare the two.
5. Disconnect from the network if you want to confirm the check is offline. The verifier makes no network calls.

## Timed step

```sh
python3 -I cain42_verify.py cain42-auditor-kit-8.3.2.zip \
  --trust-anchor XhK+pwJlsTymjoA8rnJBiGP344rTKK1qD5xTtbkbZlY= \
  --expect-sha256 <PUBLISHED_SHA256> --expect-version 8.3.2 --human
```

Use `--out result.json` (or omit `--human`) to get machine-readable output that follows `SCHEMAS/verdict.schema.json`.

## Reading the verdict

| Verdict | Exit | Meaning |
|---|---|---|
| `PASS_INTEGRITY` | 0 | Every mandatory check passed |
| `PASS_INTEGRITY_WITH_WARNINGS` | 1 | Mandatory checks passed; read each WARN |
| `FAIL_INTEGRITY` | 10 | Bytes, signature, structure, identity or evidence contradict each other. **Stop.** |
| `UNSUPPORTED_SCHEMA` | 20 | Unknown or downgraded schema or algorithm |
| `UNTRUSTED_SIGNING_KEY` | 30 | No anchor supplied, the release is unsigned, or it was signed by a different or revoked key |
| `INCOMPLETE_EVIDENCE` | 40 | A mandatory evidence record is missing or of an unknown mandatory type |
| `STALE_EVIDENCE` | 50 | Mandatory evidence is older than its freshness ceiling (see `ASSURANCE_MODEL.md`) |
| `VERIFICATION_ERROR` | 70 | The verifier could not finish; this is never a pass |

A check that was skipped never counts as passed. The JSON output lists `proves` and `does_not_prove`; read both.
Record your result on `HUMAN_REVIEW/WORKSHEET_42S.md`.

## Everything the kit can check, in 42 seconds

Extract the ZIP (`python3 -m zipfile -e cain42-auditor-kit-8.3.2.zip .` works everywhere Python does), `cd` into
`cain42-auditor-kit-8.3.2/`, then:
```sh
python3 -I -B CHALLENGE_42S.py ../cain42-auditor-kit-8.3.2.zip --trust-anchor <ANCHOR> --expect-sha256 <SHA> [--online]
```
This runs the initial verdict. It then confirms that the extracted files are the bytes it just verified, runs the
51-fixture adversarial suite and the 23-case AI-review validator suite, and, with `--online`, probes all three sites
read-only. The challenge verdict is `PASS_42S` only if every stage passes within 42 s.
It still does **not** establish that CAIN-42's security claims are true. No 42-second procedure can; see `FULL_AUDIT_RUNBOOK.md`.

## The 42-second target

The target covers only the timed step above, on a prepared machine, without network access. The measured times are published next to the ZIP in `benchmark-8.3.2.json`, which is bound to the ZIP's hash. Reproduce them with `BENCHMARKS/run_benchmark.py`.