CAIN-42 invariant · E30

E30-BOM-dependency: a changed or known-malicious 'dependency' is detected

Held · CAIN-42 Evolution 30 -- Governed Machine Autonomy Fabric

Last reviewed 2026-10-01

held   niche Evidence, receipts & proofs · family supply_chain

What this rule means

CAIN-42 must always satisfy: a changed or known-malicious 'dependency' is detected. It is one of 166 invariants checked for CAIN-42 Evolution 30 -- Governed Machine Autonomy Fabric. An invariant is a rule the system may never break, whatever an agent or attacker does; the test suite tries to break it across many scenarios and records the result.

Recorded detail

[]

Verify it in your browser

Your browser downloads the bundle's SHA256SUMS manifest and the file(s) behind this page, hashes them with SHA-256 locally (WebCrypto), and compares. A match shows the record you are reading is the published one; it does not by itself prove who published it (see the signed claims registry and the bundle verifier for that).

Check it yourself

Browse the raw bundle · How to reproduce it · SHA-256 manifest

Related rules

• E30-BOM-model: a changed or known-malicious 'model' is detected
• E30-BOM-weights: a changed or known-malicious 'weights' is detected
• E30-BOM-runtime: a changed or known-malicious 'runtime' is detected
• E30-BOM-package: a changed or known-malicious 'package' is detected
• E30-BOM-tool: a changed or known-malicious 'tool' is detected
• E30-BOM-mcp_server: a changed or known-malicious 'mcp_server' is detected
• E30-BOM-skill: a changed or known-malicious 'skill' is detected
• E30-BOM-plugin: a changed or known-malicious 'plugin' is detected

← E30-BOM-container · all 166 · E30-MARKET-policy_pack →