{ "schema": "cain42.public.deployment_manifest.v1", "generated_at_utc": "2026-10-09T16:30:00Z", "publisher": "CAIN-42 operator (FIRME AI; pre-incorporation)", "measurement_source": "operator deploy records + live gateway endpoints (https://cainstudio.online/api/v1/live-cluster/*)", "redaction_notice": "Public host IP addresses are removed from this manifest. Regions, replica ids, providers and pinned Ed25519 public keys are retained. A redacted or operator-signed manifest does NOT independently prove physical or geographic placement.", "clusters": [ { "cluster_id": "cain-mr-01", "status_at_2026-10-09T16:10Z": "DEGRADED (4/4 replicas reachable, agreement false, cain-mr-node-2 quarantined, quorum_state DEGRADED)", "replicas": 4, "distinct_public_hosts": 3, "regions": ["atl", "lax", "mia"], "distinct_regions": 3, "infrastructure_providers": ["vultr"], "deployed_at": "2026-09-26T18:21:54Z", "upgraded_at": "2026-10-05T20:23:33Z", "software_commit": "6047ff1d2bc736538bed109ee8cf5f09c1d17174", "container_image": "cain-cluster-node:mr-6047ff1", "container_image_digest": "sha256:3270c399fe89c79ed642bcad389ad4f83fb5b9d499d464c561fa8d0a9718c92a", "configuration_hash": "51eb143f53b9e31506f7ecc1dd562a9120f56fe7b60f1b5b7338afadb06a3dd4", "host_to_replica_mapping_redacted": [ {"node_id": "cain-mr-node-1", "region": "atl", "host_label": "vultr-atl-1", "public_host": "REDACTED"}, {"node_id": "cain-mr-node-2", "region": "lax", "host_label": "vultr-lax-1", "public_host": "REDACTED"}, {"node_id": "cain-mr-node-3", "region": "lax", "host_label": "vultr-lax-1", "public_host": "REDACTED"}, {"node_id": "cain-mr-node-4", "region": "mia", "host_label": "vultr-mia-1", "public_host": "REDACTED"} ], "shared_failure_domains": [ "cain-mr-node-2 and cain-mr-node-3 are on the SAME host (vultr-lax-1) and the same region (lax): they share a power, network, kernel and operator failure domain.", "All four replicas share ONE infrastructure provider (Vultr) and ONE operator.", "All four replicas share ONE control plane and ONE WireGuard overlay configuration (10.42.0.0/24)." ], "replicas_sharing": { "physical_hosts": "node-2 and node-3", "operator": true, "credentials": "overlay mesh keys differ per node; the evidence-root signing key is a single operator-held key", "storage": "each replica has its own data volume; the evidence root is single-source", "control_plane": true, "network_dependency": "single provider transit + a single WireGuard overlay" } }, { "cluster_id": "cain-mr-02", "status_at_2026-10-09T16:10Z": "operator-attested; not independently measured in this package", "replicas": 4, "distinct_public_hosts": 4, "regions": ["atl", "lax", "mia", "sjc"], "distinct_regions": 4, "infrastructure_providers": ["vultr"], "deployed_at": "2026-09-27T00:05:55Z", "upgraded_at": "2026-10-05T20:26:26Z", "software_commit": "6047ff1d2bc736538bed109ee8cf5f09c1d17174", "container_image": "cain-cluster-node:mr-6047ff1", "container_image_digest": "sha256:3270c399fe89c79ed642bcad389ad4f83fb5b9d499d464c561fa8d0a9718c92a", "host_to_replica_mapping_redacted": [ {"node_id": "cain-mr2-node-1", "region": "atl", "host_label": "vultr-atl-1", "public_host": "REDACTED"}, {"node_id": "cain-mr2-node-2", "region": "lax", "host_label": "vultr-lax-1", "public_host": "REDACTED"}, {"node_id": "cain-mr2-node-3", "region": "mia", "host_label": "vultr-mia-1", "public_host": "REDACTED"}, {"node_id": "cain-mr2-node-4", "region": "sjc", "host_label": "vultr-sjc-1", "public_host": "REDACTED"} ], "shared_failure_domains": [ "One replica per host and per region (no host or region sharing).", "All four replicas share ONE infrastructure provider (Vultr) and ONE operator/control plane." ], "replicas_sharing": { "physical_hosts": false, "operator": true, "credentials": "overlay mesh keys differ per node; evidence-root key is single operator-held", "storage": "separate data volumes; single evidence root", "control_plane": true, "network_dependency": "single provider transit + a single WireGuard overlay" } } ], "historical_vs_current": { "historical_single_host": [ "Before 2026-09-26 the '4-node BFT cluster' was 4 containers on ONE VPS (kind cain-vc-node-1..4).", "deploy/multi-region/pbft_cluster_manifest.json still describes a DECLARED_NOT_PROVISIONED 4-cloud topology (AWS/GCP/Azure/Vultr) whose keys are null and which was never applied. It is retained as the historical declaration, not as a current deployment." ], "current_multi_host": [ "cain-mr-01: 4 replicas on 3 hosts across 3 regions (Vultr).", "cain-mr-02: 4 replicas on 4 hosts across 4 regions (Vultr).", "Both are single-provider and operator-attested." ] }, "operational_meaning_of_four_replicas": "Four independent PBFT replica processes, each with its own Ed25519 node key and its own on-disk WAL, connected over a private WireGuard overlay. Safety (agreement) requires that fewer than one-third are Byzantine; liveness requires a quorum of 2f+1 = 3 reachable. 'Four replicas' does NOT mean four independent power/network/operator failure domains: cain-mr-01 places two replicas on one host, and both clusters share one provider and one operator.", "consensus_protocol": { "algorithm": "PBFT (Castro-Liskov), CAIN-hardened, Ed25519 quorum certificates", "fault_model": "N = 3f + 1 = 4 replicas; up to f = 1 Byzantine replica. Crashes are deterministic omissions; Byzantine faults include equivocation (signing conflicting decisions).", "quorum_calculation": "Q = 2f + 1 = 3 distinct replica signatures. commit QC requires >= 3 distinct pinned members; a prepare certificate alone is never accepted as a commit.", "safety_assumptions": [ "Fewer than one-third of replicas are Byzantine within a view.", "Ed25519 signatures are unforgeable and the pinned membership keys are the correct trust root.", "Replicas do not leak their private keys; the operator's evidence-root key is not compromised." ], "liveness_assumptions": [ "At least a quorum (3 of 4) of replicas are reachable and correct.", "Partial synchrony: message delays eventually fall within the view-change timeout (view_change_timeout_ms = 2500 in the declared manifest).", "A correct primary eventually operates (no permanent primary failure loop)." ], "network_and_timing_assumptions": [ "The WireGuard overlay provides authenticated, ordered-enough point-to-point delivery.", "Clock skew beyond the lease/expiry windows can cause expiry; the current deployment depends on host clocks." ], "membership_rules": "Static pinned membership. The member set and each member's Ed25519 public key are fixed at start; a node and every certificate must carry the same recomputed configuration hash.", "view_change_behavior": "A view change is initiated when the primary is unreachable or the view times out; the new primary must bind to reported certificates (the 'ignore reports' rule was a deliberately-broken TLA+ mutant that violates Agreement). A recorded view change requires a VIEW_CHANGE_QC signature quorum.", "recovery_behavior": "A restarted replica replays its write-ahead log and rejoins; production has not been re-verified to preserve replay-protection across a restart from outside (NOT_ESTABLISHED).", "key_management_design": [ "Each replica holds its own Ed25519 node key; public keys are pinned in the membership and published at /.well-known/cain-keys.json.", "An operator-held evidence-root key signs hourly proofs (evidence_root_public_key_b64 = t1I4vBpOasgbBSWYTN2g7xL1En7qZ6lhgbt6n2OpeG8=).", "Rotation/revocation procedures are NOT documented in a public artefact in this package." ], "failure_domain_limitations": [ "Signatures alone do NOT prove distributed consensus, independent infrastructure, or correct placement.", "Single provider, single operator, single control plane, and (for cain-mr-01) a shared host between two replicas mean a common-mode failure can take out more than f replicas." ] }, "current_protocol_configuration": { "n": 4, "f": 1, "quorum": 3, "protocol": "PBFT/Castro-Liskov-1999+CAIN-Hardened", "view_change_join": 2, "watermark_window": 100, "domain": "CAIN42/PBFT/MEMBERSHIP/v1", "epoch": 1, "overlay_subnet": "10.42.0.0/24 (cain-mr-01), 10.88.0.0/24 (cain-mr-02)" }, "replica_public_keys": [ {"cluster_id": "cain-mr-01", "node_id": "cain-mr-node-1", "region": "atl", "ed25519_public_key_b64": "vxjpwp7HlNHusE21m1bcLDy8CwNbErxp9FtJCrctbdE="}, {"cluster_id": "cain-mr-01", "node_id": "cain-mr-node-2", "region": "lax", "ed25519_public_key_b64": "riT7vpUegPEUR8orAqgcpEpdY8YI2mGYXHdkIpju3KE="}, {"cluster_id": "cain-mr-01", "node_id": "cain-mr-node-3", "region": "lax", "ed25519_public_key_b64": "05ABjKsgxxCqhgfZJ9DtjnDENO8kSd82WqLfrRUq6Qw="}, {"cluster_id": "cain-mr-01", "node_id": "cain-mr-node-4", "region": "mia", "ed25519_public_key_b64": "QO/JXphJ858ZBu0wpCXTHcskThjkid68PfsfBjHhaZ0="}, {"cluster_id": "cain-mr-02", "node_id": "cain-mr2-node-1", "region": "atl", "ed25519_public_key_b64": "8P4PCtI04O2rvGpeOufwkU1RJnPdjMjth+L/UcerxI4="}, {"cluster_id": "cain-mr-02", "node_id": "cain-mr2-node-2", "region": "lax", "ed25519_public_key_b64": "u3OhqYRLR2Rys0byPlSE1vHcjPWVSLt3j4XzMv2EwGs="}, {"cluster_id": "cain-mr-02", "node_id": "cain-mr2-node-3", "region": "mia", "ed25519_public_key_b64": "+x/1i4xlleDAdLt6vNaNfFaGVn8yo/N35Ax0mYAv2F8="}, {"cluster_id": "cain-mr-02", "node_id": "cain-mr2-node-4", "region": "sjc", "ed25519_public_key_b64": "SqIx0XEixGU8RzpKPmVxA9P6k4udhRFeMx4CPTedc+o="} ], "evidence_root_public_key_b64": "t1I4vBpOasgbBSWYTN2g7xL1En7qZ6lhgbt6n2OpeG8=", "trust_root": { "how_reviewers_obtain_keys": "Replica public keys are published at https://cainstudio.online/.well-known/cain-keys.json and inside https://cainstudio.online/proof/bundle/hourly-proof/index.json (membership block). The evidence-root key is in the same index and in the proof-fabric PACK_RELEASE.json.", "independently_authenticated": false, "what_a_self_published_key_establishes": "It establishes that the holder of the corresponding private key signed the published bytes. It does NOT establish who that holder is, that the key was not generated by the same operator, or that the operator is trustworthy. There is no external certificate authority or third-party attestation of these keys.", "rotation_and_revocation": "Not published. Treated as NOT_ESTABLISHED." } }