CAIN-42 invariant · E28

E28-I31: registration without proof of possession is refused

Held · CAIN-42 Evolution 28 -- Portable Machine Agency & Execution Identity

Last reviewed 2026-10-01

held niche Evidence, receipts & proofs · family registration

What this rule means

CAIN-42 must always satisfy: registration without proof of possession is refused. It is one of 90 invariants checked for CAIN-42 Evolution 28 -- Portable Machine Agency & Execution Identity. An invariant is a rule the system may never break, whatever an agent or attacker does; the test suite tries to break it across many scenarios and records the result.

Recorded detail

['POP_SIGNATURE_INVALID']

Verify it in your browser

Your browser downloads the bundle's SHA256SUMS manifest and the file(s) behind this page, hashes them with SHA-256 locally (WebCrypto), and compares. A match shows the record you are reading is the published one; it does not by itself prove who published it (see the signed claims registry and the bundle verifier for that).

Check it yourself

Browse the raw bundle · How to reproduce it · SHA-256 manifest

Scope: E28 is an in-process library. It is not wired into the hosted gateway, MCPGate or the PBFT clusters; nothing on the three public sites runs it live.

Related rules

E28-I21: identity envelope signed by another key is refused
E28-I22: a tampered envelope field is refused on decode
E28-I23: an envelope for another audience is refused
E28-I24: an expired envelope is refused
E28-I25: a session envelope cannot stand in for a transaction envelope
E28-I26: a transaction envelope cannot live longer than 30 s
E28-I27: the envelope authority field is always NONE, whatever the issuer is asked
E28-I32: a proof-of-possession challenge is single use

← E28-I30 · all 90 · E28-I32 →

Try CAIN-42 on your own agents

Create a free account and every new account starts with a 7-day trial of the full platform. Or try the sandbox first, with no account at all.

Create a free account → · Try the sandbox · See the whole ecosystem