CAIN-42 invariant · E28

E28-I39: same identity presented with another key is IDENTITY_CLONE

Held · CAIN-42 Evolution 28 -- Portable Machine Agency & Execution Identity

Last reviewed 2026-10-01

held   niche Autonomy, control loops & recovery · family continuity

What this rule means

CAIN-42 must always satisfy: same identity presented with another key is IDENTITY_CLONE. It is one of 90 invariants checked for CAIN-42 Evolution 28 -- Portable Machine Agency & Execution Identity. An invariant is a rule the system may never break, whatever an agent or attacker does; the test suite tries to break it across many scenarios and records the result.

Recorded detail

{'same': 'SAME_GOVERNED_AGENT', 'clone': 'IDENTITY_CLONE', 'fork': 'UNVERIFIED_FORK', 'unknown': 'UNKNOWN_ACTOR'}

Verify it in your browser

Your browser downloads the bundle's SHA256SUMS manifest and the file(s) behind this page, hashes them with SHA-256 locally (WebCrypto), and compares. A match shows the record you are reading is the published one; it does not by itself prove who published it (see the signed claims registry and the bundle verifier for that).

Check it yourself

Browse the raw bundle · How to reproduce it · SHA-256 manifest

Related rules

• E28-I38: an unchanged agent is SAME_GOVERNED_AGENT and keeps its live authority
• E28-I40: a signed succession gives CONTROLLED_SUCCESSOR with no retained authority
• E28-I41: a succession signed by the agent itself is not accepted
• E28-I42: a revoked identity presenting again is REVOKED_RESURRECTION
• E28-I43: an actor claiming an unknown identity is UNKNOWN_ACTOR
• E28-I44: a new key with a parent claim and no registration is UNVERIFIED_FORK
• E28-I45: a quarantine decision quarantines identity and E25 instance
• E28-I83: a self-improvement candidate cannot approve itself

← E28-I38 · all 90 · E28-I40 →