CAIN-42 CAIN StudioLive engine
48-hour delivery
PROOFLOOP. Any AI can write the fix. We prove it.
Anyone can call a frontier model. Almost nobody can prove what it did.
FALSEWORK finds the code that looks finished but fakes its result. KEYSTONE fixes it and proves the fix with a test the model did not write. CAIN-42 notarizes the record on a four-replica Byzantine cluster. You get one signed artifact you can re-check offline, without us.
$500 · 48 hours · one Python module. After payment, reply to the Stripe receipt with the file or a repo link; we start on receipt. If we cannot produce a signed record, the pilot is refunded. The $1,500 audit covers a whole repository.
Six stages. Each one removes a way to cheat.
This is the whole differentiator. Not the model, not the dashboard, not the scanner. The closing loop: a deterministic verdict, an independent proof, a signature, a quorum, and an export the buyer can run without us.
14 scenes · about 15 minutes
Watch PROOFLOOP explained, end to end
A long, captioned walkthrough of the whole loop: the fabricated result, the diff that proves nothing, the independent test, the signature, the quorum, the export, and the honest limits. The presenter is an animated character, not a real person. The visuals and captions start on their own; browsers block sound until you interact, so one tap turns the voice on.
Prefer to read? The six stages are below, each linked to the live artifact that proves it. Or skip to the three commands.
DETECT — FALSEWORK
A deterministic detector, not a model, decides there is a defect. AST and rule checks find fabricated metrics, success verdicts that are given rather than established, checks that can never fail, route-to-engine mismatches, and shipped mocks. No model client, no network in the detector.
Engine and method → Sample report →ACT — the fixer
A frontier model or a human/CI actor writes the fix. The file is passed as data, not instructions. The record names which actor did it, so you can swap the model without changing the guarantee.
How the actor is bound →PROVE — the independent test
A reference test the fixer did not write must fail on the original file and pass on the fixed file, inside bubblewrap: no network, read-only system, 256 MB, 20 seconds. A same-lab, unknown-lab, self-authored or undeclared test is refused as independent.
What the run proves → Exactly what each proof covers →SIGN — canonical JSON, SHA-256, Ed25519
The finding, the diff, the test, the hashes and the verdict become one canonical record, hashed, chained to the previous record, and signed. All checks hold → VERIFIED_FIX. Anything short of one → NOT_VERIFIED, with the reasons.
ANCHOR — the quorum
The record hash is ordered and committed by a live four-replica Byzantine cluster: four US regions, one faulty replica tolerated, quorum three of four. The replicas sign their own votes and the receipt ships inside the bundle. Consensus notarizes; it never authorizes.
Live cluster status → How the receipt verifies →EXPORT — the verifier
A ZIP with the signed record, the reviewer evidence, the issuer key and a standalone verifier that imports no CAIN code. The published sample is a live model-backed VERIFIED_FIX (Claude Opus 5.5, independent acceptance test), notarized on cain-mr-02 at sequence 1526491. Pin the key yourself. Change one byte and it prints TAMPERED OR INVALID.
Why PROOFLOOP, and not a diff
The typical approach
- The model writes the fix and a test that agrees with it.
- A failed fix can still look like a fix.
- You verify by trusting the vendor.
- A passing test is the end of the story.
- The evidence is a PDF or a dashboard.
This loop
- The reference test is independent and must fail on the old code first.
- Short of every check →
NOT_VERIFIED, with reasons. - You pin a key and re-check offline.
- Detector re-scan + fix-safety guard + hash chain + quorum receipt.
- The evidence is a signed record with a standalone verifier.
We are not claiming that no one else anywhere does something like this. We are claiming that ours does it today, and that you can falsify our output without our permission. That is a narrower claim, and it is the only one worth making.
Don't believe this page. Run it.
Three commands. A machine you control. No account, no key from us.
curl -s -o bundle.zip https://cainstudio.online/evidence/keystone-live-2026-11-05/keystone-evidence-ks-20261105T225548Z-4f35c76d.zip
unzip -o bundle.zip -d ks
KEY=$(curl -s https://cainstudio.online/keystone/public-key | python3 -c 'import json,sys; print(json.load(sys.stdin)["public_key_b64"])')
cd ks && python3 verify_keystone.py --pinned-pub "$KEY"Expected: RESULT: ALL RECORDS VALID and the fingerprint SHA256:2232b4add9b35d4016e5be270df4ed56e0dc9b39a0530ac69891073253aae90d. Change one byte and the same command prints TAMPERED OR INVALID. The verifier refuses to run without a pinned key, because a key that ships inside the ZIP proves nothing.
Issuer public key · All CAIN-42 public keys
One module for $500. One repo for $1,500. PROOFLOOP either way.
FALSEWORK scan, one finding fixed and proved with an independent reference test, signed record, quorum receipt when the operator key is configured, and the standalone verifier. If we cannot produce a signed record, the pilot is refunded.
Graded report, findings JSON, signed evidence ZIP, standalone verifier, 30-minute walkthrough. 48 hours from access.
Larger scope, tests included, or a pre-raise/multi-repo review. 5–10 business days.
Pay the $500 pilot now: Stripe checkout. The receipt says CAIN-42 PROOFLOOP pilot. Reply to it with the file and the finding (or the test you want us to prove). We start when we have both; see what happens next.
Want the $1,500 audit instead? Reserve it with a $750 deposit; the $750 balance is invoiced on delivery. Prefer to send scope first? Send the repo size and deadline. If the bundle does not verify on your machine with the pinned key, the balance is not billed.
Fix + Prove attaches to any audit: $500 small, $1,500 standard, $2,500 complex. You supply one acceptance test that should fail today and pass when the finding is closed. We supply the patch and the signed record naming you as the test author. If the proof does not hold, the verdict is NOT_VERIFIED and the balance is not billed.
Included in every verified record: the record hash is notarized on the live four-replica CAIN-42 cluster when the operator key is configured. The anchored sample above includes its quorum receipt.
50% deposit, 50% on delivery. If the bundle does not verify on your machine with the pinned key, the balance is not billed. If we miss the turnaround, the deposit is refunded and you keep what was produced.
Exactly what you get
Precise, signed, and checkable without us
- Each proof covers one finding, one independent test and the exact code we ran, so you know precisely what was proved.
- FALSEWORK is deterministic: the same code gives the same answer every time. A person reviews every finding before it reaches you.
- Every delivery is run by our team, end to end. The signed ledger and the offline verifier are live today.
- You get evidence you can check yourself, not a certificate you have to take on trust.
- A 3-of-4 server quorum notarizes every record, so no single server can rewrite it. Notarizing records the result exactly as proved.
Built by
FIRME AI CORPORATION, a California corporation, built by a three-person team. We build the detector, the prover and the evidence chain ourselves.
No customer is named on this page. The sample is ours. Numbers marked "live" come from the routes linked above.