We ran FALSEWORK and KEYSTONE on our own codebase. Here are the honest results.

FALSEWORK scanned 2,948 Python files of the CAIN-42 ecosystem for code that fakes a result: random numbers presented as measurements, success messages written in rather than computed, verdicts returned without a check, errors silently swallowed, leftover placeholders.

178 findings, by kind:

KEYSTONE so far: 16 file(s) run through the full loop (FALSEWORK finds → Claude fixes → sandboxed tests must fail on the original and pass on the fix → Ed25519-signed record): 3 fix(es) proved, 13 not proved, 0 nothing to fix, 12 not run (the Claude API was unavailable; retried automatically). 111 flagged file(s) still to go; this section updates as the campaign continues.

Found by applying a proved fix: Applying KEYSTONE's benchmark fix replaced a hard-coded 'blocked' verdict with the real outcome and exposed a real security gap: the interop bridge accepted an authorization signed under a different policy version. It is now refused (POLICY_VERSION_MISMATCH), commit 1342208f.

What we excluded, and why: 159 files of FALSEWORK’s own test material (scripts/falsework/sample_project (a deliberately fake demo) and benchmark/corpus (planted and copied defects used to measure FALSEWORK); all 4 CRITICAL findings of the raw scan were there), and 1 finding reviewed by hand as a false alarm (a random fault-injection target in a soak test).

What this scan cannot see: FALSEWORK looks for fabricated results, swallowed errors, placeholder markers and unconditional verdicts. It does not find security, performance or design defects.

The 42-second self-check, on the record: 68 checks since 2026-10-15T20:45:48Z, each one a line in ticks.jsonl that carries the SHA-256 of the line before it, so a skipped or edited check breaks the chain. A check re-scans with FALSEWORK the files that changed; it does not re-run KEYSTONE.

Check it yourself: the signed evidence bundle and its verify_bundle.py (no CAIN code) recompute every number above.

Every finding