CAIN-42 invariant · E33

E33-DISCOVERY-proof: proof discovery records must be signed

Held · CAIN-42 Evolution 33 -- Governed Agentic Operating Fabric

Last reviewed 2026-10-01

held   niche Tools, MCP, protocols & adapters · family discovery

What this rule means

CAIN-42 must always satisfy: proof discovery records must be signed. It is one of 581 invariants checked for CAIN-42 Evolution 33 -- Governed Agentic Operating Fabric. An invariant is a rule the system may never break, whatever an agent or attacker does; the test suite tries to break it across many scenarios and records the result.

Recorded detail

{'scenarios': 20, 'not_held': []}

Verify it in your browser

Your browser downloads the bundle's SHA256SUMS manifest and the file(s) behind this page, hashes them with SHA-256 locally (WebCrypto), and compares. A match shows the record you are reading is the published one; it does not by itself prove who published it (see the signed claims registry and the bundle verifier for that).

Check it yourself

Browse the raw bundle · How to reproduce it · SHA-256 manifest

Related rules

• E33-KIND-send_message: send_message is executed only through E8
• E33-KIND-invoke_tool: invoke_tool is executed only through E8
• E33-KIND-call_api: call_api is executed only through E8
• E33-KIND-modify_policy: modify_policy is routed to E32 CAINEvolutionPromotionGate
• E33-KIND-change_runtime: change_runtime is routed to E32 CAINSwapGovernance
• E33-KIND-control_physical_actuator: control_physical_actuator is executed only through E8
• E33-KIND-create_organization: create_organization is routed to E29 MachineOrganizationBudget (human)
• E33-KIND-propose_governance_evolution: propose_governance_evolution is routed to E32 CAINEvolutionPromotionGate

← E33-DISCOVERY-verification · all 581 · E33-DISCOVERY-conformance →