CAIN-42 Frontier Lab

Play with the trust gate live, and verify the Byzantine-consensus evidence in your own browser. Nothing here has to be taken on trust.

Scope, stated plainly: a same-operator sandbox on one host. The gate is the real gate running with throwaway keys, so allowed here means nothing outside the sandbox. You only ever receive decisions: no code, keys, paths or configuration. The Byzantine evidence comes from a test harness (4 processes, one host), not from the live cluster, whose own recorded probe verdict is on the llms.txt page.

1. Sandbox

Fresh throwaway keys: human (root authority), agent, sub.

Mode

No sandbox yet.

2. Mint a capability

Audience (tool) Resource

Actions (comma) TTL s

single-use require proof-of-possession

Capability chain (JSON list — edit it to tamper)

3. Invoke

Agent Tool

Action Resource

Session Tenant

Arguments (JSON) Proof-of-possession (JSON, optional) Memory ids (comma, optional)

One-click attacks

Each runs against your sandbox. Switch to enforce to see them actually blocked.

Staged enforcement policy

Enforce only where you say, with a canary percentage and per-category blocking. Strictly validated.

Memory never authorises

Authority 0-3 Scopes

Hash-chained decision log

Verify real Byzantine-consensus runs in your browser

Each run is 4 real OS processes with their own Ed25519 keys. Every node exported the raw signed messages it sent and received. This page re-checks every signature, quorum, the safety property and the Byzantine proofs locally using WebCrypto. Then try to break it.

Run

Tamper, then re-verify:

Verify your own evidence file (paste JSON)

Hash-check every published file, locally

Downloads the bundle manifest from this site and checks each file's SHA-256 in your browser. Cross-check other sites with the command below.

curl -s https://clawx.click/evidence/frontier/verify_frontier_bundle.py.txt > verify.py && python3 verify.py     # fetches all three sites and cross-checks them

manifest.json · claims.json (incl. what is NOT claimed) · guide · verifier · BFT verifier

For AI agents and scripts

Everything above is a plain JSON API. Machine-readable description: /api/v1/frontier-lab/index.json.

T=$(curl -s -X POST https://cainstudio.online/api/v1/frontier-lab/session | python3 -c "import sys,json;print(json.load(sys.stdin)['token'])")
curl -s -X POST https://cainstudio.online/api/v1/frontier-lab/scenario/exfiltration -H 'content-type: application/json' -d "{\"token\":\"$T\"}"

Limits: 30-minute sandboxes, 300 decisions each, rate-limited per client. Decisions only; no code is ever returned. See llms.txt for the evidence index.