CAIN-42 evidence library

CAIN-42 Evolution 35 -- Continuous Governance Intelligence Fabric

Evidence bundle for evolution E35: 7 claims, 799 of 799 invariants held, 3544 attack scenarios held.

Last reviewed 2026-10-01

Browse the raw bundle · How to reproduce it · SHA-256 manifest

Product lines built here

• CAIN Agent Lab — A safe lab to try agent ideas before they touch anything real. TESTED library
• CAIN Governability Index — A score for how governable an AI system is. TESTED library
• CAIN Governance API — One API for every governance question about an agent. TESTED library
• CAIN Governance Cloud — Governance as a managed cloud service. PROPOSED/NOT DEPLOYED
• CAIN Governance SDK — Libraries for building governance into your own products. TESTED library
• CAIN Intelligence — Insights across all your agents' governance data. TESTED library
• CAIN Marketplace — A marketplace for governed agent services. TESTED library
• CAIN Policy Compiler — Write a rule in plain terms and get an enforceable policy. TESTED library
• CAIN Proof Exchange — Swap proofs between companies in a standard format. TESTED library
• CAIN Red Team — Continuous red-teaming of your whole agent setup. TESTED library
• CAIN Simulator — Simulate agents and rules together to see what would happen. TESTED library

Claims (7)

Invariants: 799 of 799 held

Rules the code must never break, each checked across many scenarios. See all 799 on one page.

Attacks tried

Measured performance

in-process; no learned component is in the trusted authorization root

Verify it in your browser

Your browser downloads the bundle's SHA256SUMS manifest and the file(s) behind this page, hashes them with SHA-256 locally (WebCrypto), and compares. A match shows the record you are reading is the published one; it does not by itself prove who published it (see the signed claims registry and the bundle verifier for that).

Known limitations

• An in-process TESTED library; not hosted. The intelligence layer is deliberately NOT in the trusted authorization root; it can only produce recommendations.
• Predictions, counterfactuals and simulations are modelled in-process over synthetic features; they are not calibrated against real production incidents because none are ingested here.
• The red team, blue team, research lab, tournament and marketplace run in-process; there is no external ecosystem, no third-party publisher and no customer.
• The technology radar and research graph are seeded from a small set of items; provenance is recorded but coverage of the literature is incomplete.
• Conformance, deployment-readiness and governability scores are internal multi-dimensional views; they are not certifications and never collapse into a single number.
• No learned component may be placed in the trusted root; the deterministic kernel and E8 remain authoritative.
• Mutation self-testing runs each mutant against the bench subset that exercises the mutated component.
• Scale rows reuse the E33 synthetic in-process benchmark; the intelligence layer adds a 50-sample analysis row.
• No third party has independently verified anything in this bundle.

The bundle's own README

CAIN-42 Evolution 35 -- Continuous Governance Intelligence Fabric#

The intelligence layer learns which actions are risky, which environments are hard to govern and which controls fail, and turns that into recommendations. It is deliberately NOT in the authorization path: INTELLIGENCE -> RECOMMENDATION -> DETERMINISTIC KERNEL -> AUTHORITY -> E8 -> ENFORCEMENT. Learning never creates authority. Verify with verify_e35.py.txt (see REPRODUCTION.md). Status: TESTED library, pre-production.