{
 "capabilities_built_2026_11_09": [
  "Signed SCITT-shaped statements (COSE_Sign1) registered on the validator quorum",
  "Receiver-attested receipts in MCPGate",
  "AIUC-1 evidence map from verified artifacts",
  "Delegation chains with enforced attenuation",
  "Byte-level hashes of what crossed the jail exit",
  "Redaction receipts with selective disclosure; one signed statement per refusal",
  "Replay bundles: re-run a recorded agent run and compare",
  "Package watch: install and start packages in the jail, catch phone-home; version drift; egress index",
  "OpenSSF model-signature verification before weights load",
  "Measured AI bill of materials (CycloneDX)",
  "SLSA provenance registration",
  "RewardGuard: no-reward-hacking certificate for coding agents",
  "Witness confirmations bound to the finding's own line",
  "Fact-checked AI triage",
  "Missing-authorization (CWE-862) detector and witness",
  "Variant hunting on published fixes",
  "AI-code provenance bound to commits; cross-lab review rule",
  "Per-commit FALSEWORK grades, signed",
  "Z3 proofs attached to fixes",
  "Signed evaluation runs; held-out test vault; contamination certificates; regression checks",
  "Deterministic trajectory checks (no model judge); measured model cards",
  "Incident timelines; Article 12 logging self-check; quarterly evidence packs; questionnaire answers from evidence",
  "Article 50 AI-content transparency receipts; human-oversight approvals enforced by the jail",
  "Open signed-record spec with test vectors; browser verifier; KEYSTONE over MCP; CI action; factory self-audit"
 ],
 "contact": "firmeai2026@gmail.com",
 "date": "2026-11-09",
 "definition": "CAIN-42 is a Byzantine trust fabric that has become a factory of proof. It runs AI agents inside a governed boundary, records what they actually do, and turns every result (a bug, a fix, an agent run, an evaluation score) into a signed record that anyone can check without trusting us. An independent validator quorum (4 hosts in 4 regions, any 3 must agree) notarizes the evidence. Scanners sell suspicions and models sell opinions; CAIN-42 sells proof.",
 "isolation": {
  "firecracker_microvm": "built; first boot pending a KVM host",
  "gvisor": "live (all 80 jail-based tests pass on it)",
  "namespaces": "live"
 },
 "measured": [
  {
   "evidence": "https://cainstudio.online/evidence/proofloop-precision/fresh-js-3.json",
   "value": "0 false confirmations",
   "what": "on two signed, untouched JavaScript/TypeScript test sets (60 public repos), labels written before the witness ran"
  },
  {
   "evidence": "https://cainstudio.online/evidence/factory-self-audit/latest.json",
   "value": "18 of 18",
   "what": "public verifiers pass against our own published records (factory self-audit)"
  },
  {
   "evidence": "https://cainstudio.online/evidence/factory-of-proof/record.json",
   "value": "80 tests",
   "what": "every jail-based product passes with gVisor underneath"
  },
  {
   "evidence": "https://cainstudio.online/evidence/factory-of-proof/record.json",
   "value": "48 new proof capabilities",
   "what": "built and tested on 2026-11-09, listed in the signed record"
  }
 ],
 "not_claimed": [
  "third-party audit of CAIN-42",
  "SOC 2",
  "AIUC-1 certification",
  "a hypervisor"
 ],
 "offers": [
  {
   "n": "1",
   "offer": "Proof per engagement",
   "price": "$1,500 to $7,500 per engagement",
   "status": "AVAILABLE NOW",
   "what": "Fabrication audit, MCP / agent security review with a live run of your server inside the jail, RewardGuard certificate that a coding agent did not game the tests, confirmed-bug reports."
  },
  {
   "n": "2",
   "offer": "Continuous proof subscription",
   "price": "$1,500 to $4,000 per month",
   "status": "AFTER AN AUDIT",
   "what": "Every new version of your MCP servers re-run in the jail, every pull request proved, a signed evidence pack each quarter."
  },
  {
   "n": "3",
   "offer": "AI-insurance and audit evidence",
   "price": "$2,000 to $10,000 per pack",
   "status": "AVAILABLE NOW",
   "what": "Your agent receipts and logs mapped onto AIUC-1 evidence items (logging, log integrity, execution safeguards, tool call records), with an EU AI Act Article 12 logging self-check. An evidence package, not a certification."
  },
  {
   "n": "4",
   "offer": "CAIN-verified trust mark",
   "price": "$2,000 to $10,000 per year",
   "status": "COMING",
   "what": "A yearly badge for MCP servers and agents that pass a jailed review with no confirmed findings, re-checked on every release."
  },
  {
   "n": "5",
   "offer": "Metered proofs",
   "price": "priced per call, on request",
   "status": "API LIVE",
   "what": "Pay per notarized receipt, signed evaluation or verified fix, through the CAIN-42 quorum notarization API."
  },
  {
   "n": "6",
   "offer": "Open format, enterprise deployment",
   "price": "on request",
   "status": "SPEC + VERIFIERS FREE",
   "what": "The record format, test vectors and verifiers are open. Enterprises license the jail and the proof engines inside their own cloud, with support."
  }
 ],
 "parts": [
  {
   "name": "FALSEWORK",
   "role": "finds what is fake",
   "what": "A deterministic detector (no model makes its calls) for fabricated results: checks that cannot fail, hard-coded success, security checks rewritten to return True. It now attributes each new finding to the commit that introduced it, in a signed, hash-chained history."
  },
  {
   "name": "KEYSTONE",
   "role": "proves fixes",
   "what": "A model proposes a fix; it is accepted only when an independent test fails on the old code and passes on the new, FALSEWORK re-scans clean and a safety guard passes. New: Z3 proofs for small critical functions (correct for every input, with a counterexample for the original bug), cross-lab review, and KEYSTONE over MCP so any agent can call scan, witness and verify mid-task."
  },
  {
   "name": "PROOFLOOP",
   "role": "proves bugs",
   "what": "Scans whole repositories in Python and JavaScript/TypeScript, follows outside input across files, then runs an exploit witness in a sandbox with no network: a finding is CONFIRMED only when the attack reaches the exact line the finding names. AI triage may dismiss a finding only with program facts a checker verifies. New checks: missing authorization on state-changing routes, and variant hunting on published fixes."
  },
  {
   "name": "The CAIN-42 loop",
   "role": "signs and notarizes",
   "what": "detect -> act -> guard -> prove -> judge -> sign -> anchor on the validator quorum -> export an offline verifier -> audit. No stage promotes its own output; the quorum notarizes and never authorizes."
  },
  {
   "name": "The CAIN-42 agent jail",
   "role": "proves what an agent did",
   "what": "Runs any agent so its only way out is the CAIN egress governor: allow-list, egress byte and connection limits, a log of every attempt to bypass the proxy, and a signed receipt of every host reached, bytes sent, file changed and program run. Isolation levels: Linux namespaces and gVisor's user-space kernel are live; a Firecracker microVM backend is built and in testing on KVM hardware."
  }
 ],
 "record_sha256": "dbe628407ef1787cfb0c177c467e9a035e39f6236f3c015ea95303ddae2c55f2",
 "schema": "cain42.factory-of-proof.v1",
 "signature": {
  "alg": "Ed25519",
  "key_fingerprint": "SHA256:2232b4add9b35d4016e5be270df4ed56e0dc9b39a0530ac69891073253aae90d",
  "public_key_b64": "b6hfA2rpAdV29FOdhNXGkk4t91mCV0AnfFYwq0HO0R8=",
  "sig_b64": "qYaq9x8Cj23aLzTTfIuLrGtgw91ZmnuLBA+aQsevTgcNYz7w+JNF8aqyggqsQopVPXWLk8HYNSavffYjFjBxAA=="
 },
 "source_commit": "da373cbeefc4c5d952bc0145a440a125d9dbb153"
}