CAIN-42 Premier Products

FALSEWORK — Prove it's real.

Status: LIVE ENGINE · human-led audits

The buyer pain. Your team or vendor ships “AI-powered” features and nobody can tell what is real.

What it does. A mechanical audit engine that grades an AI implementation REAL, PARTIAL, STUB or UNKNOWN. Static checks (source patterns plus an AST cross-check of each route against its engine) look for random numbers dressed as computation, swallowed import errors and placeholder markers. A live differential test sends the same endpoint two different inputs and flags byte-identical answers.

Engine. cainwitness

Mechanics

• Six source patterns: random-number calls returned as results, import errors caught and ignored, bare except: pass, placeholder markers, variables named as mock or simulated data, and hardcoded success responses. Each finding carries the file, the line and the matched text.
• Route cross-check: the engine parses every file, resolves each class and the ancestors it can see, and reports a route that calls a member its engine class does not define. A class whose ancestry leaves the supplied files is not judged.
• Live differential: up to 20 endpoints per audit, each called twice with the two payloads you supply. Byte-identical answers to different inputs are flagged as a possible canned response.
• The offer and a sample: the fixed-price Reality Check and a sample report produced by the same tool on a demonstration project.

What was tested on 2026-10-13

Scope & limitations

• Pattern-based: fabrication written outside the six patterns is not detected by the static pass. The differential test and the auditor decide the grade, not the static pass alone.
• Python source only for the static pass.
• A GET endpoint with no payloads cannot be told apart from a legitimately constant answer, so it is never flagged on that basis alone.
• Reports are produced by a tool from the engine's output and the auditor's notes. They are unsigned: their integrity rests on SHA-256 digests the customer can recompute.
• No customer has bought an audit yet.

Request an audit

SCENIC — CI for agents.

Status: LIVE ENGINE · four engines, self-serve API

The buyer pain. Your agent gets the right answer through a dangerous, wasteful path, and nothing scores that.

What it does. Agent reliability testing with no LLM judge. CAINBench runs fixed regression suites against a real agent endpoint and diffs any two runs. TrajectoryGate grades a successful run for duplicate calls, spend the answer did not need (reverse search over the dependency graph) and risky-then-corrected steps. A root-cause tracer attributes a broken multi-agent run to a step, and a contamination scanner probes for benchmark leakage.

Engine. cainbench · trajectorygate · multi-agent-incident-tracer · contamination-scanner

Mechanics

• CAINBench: a suite is a list of cases, each with a deterministic checker (exact, contains, regex or JSON subset). Runs are stored and any two can be diffed into the cases that changed, with the before and after answers.
• TrajectoryGate: exact repeated (tool, arguments) calls; the cost of every step the final step does not depend on; high-risk steps later followed by a correcting step on the same resource. The same trajectory gets the same verdict whatever order its steps are listed in. Up to 2,000 steps per trace.
• Root-cause tracer: each broken step is “fixed” in a causal model built from the trace, and the steps are ranked by estimated effect on the outcome. Steps whose confidence intervals overlap are a tie that goes to the most upstream step.
• Contamination scanner: sends benchmark prefixes to a model endpoint and measures verbatim overlap with the canonical continuation, against a control set.

What was tested on 2026-10-13

• Not run: contamination-scanner probe run — needs a public model endpoint to probe; only its health was checked, and the repository has no test file for it.

Scope & limitations

• TrajectoryGate cannot infer dependencies: wasted-cost results are only as good as the edges you supply.
• Risky-then-corrected is a tool-name heuristic and is labelled as one in every answer.
• The root-cause tracer returns statistical estimates with confidence intervals, not exact facts.
• The contamination scanner has no test file and its probe was not run in the latest test; only its health and its refusal of internal targets were checked.
• CAINBench and the contamination scanner only reach publicly resolvable endpoints.

Start a trial

NULLIUS — On the word of no one.

Status: PUBLIC PREVIEW · reference tools free

The buyer pain. Everyone claims their AI is safe and verifiable. Nobody can prove it independently.

What it does. A verification toolchain built on one rule: never trust the claimant's own “verified” flag. 18 standalone verifiers re-derive the verdict from the evidence with zero CAIN imports. Evidence is graded on a six-level independence scale, from SELF_REPORTED to INDEPENDENTLY_CORROBORATED.

Engine. the cain-*-verify family + the evidence spine

Mechanics

• Each verifier is a single Python file that reads the evidence and the public keys you supply, recomputes the hashes, signatures and chain itself, and exits 0 only when the claim holds.
• The six levels: CONFLICTING, UNAVAILABLE, SELF_REPORTED, INSTRUMENTED, EXTERNALLY_OBSERVED, INDEPENDENTLY_CORROBORATED. A claim is never ranked above what its weakest required evidence supports.
• No account, no key and no network access are needed to run a verifier.

What was tested on 2026-10-13

Scope & limitations

• Not a standard: a specification with one implementer is a product. That changes only when outside organisations use it.
• 3 of the 18 verifiers are published today, inside evidence bundles; the others exist in the private repository.
• The written specification is not published yet.
• A VERIFIED verdict means the evidence is internally consistent and signed by the keys you pinned. It does not mean the claim was independently observed, and no third party has reproduced these results.

Download a verifier (free, no key, no signup)

3 of the 18 verifiers are published today, each next to the evidence it checks:

• cain-execution-truth-verify
• cain-launchpad-verify
• cain-mission-journal-verify

Try one in a minute. It needs Python 3 and the cryptography package, nothing from CAIN:

B=https://cainstudio.online/evidence/evolution-16-durable-mission-runtime
curl -sO $B/verify_mission_journal.py
for f in mission.journal.jsonl trust.public.json head.json; do curl -sO $B/sample/$f; done
python3 verify_mission_journal.py mission.journal.jsonl --trust trust.public.json --head head.json
# change any digit in mission.journal.jsonl and run it again: the verifier refuses it

More published evidence and verifiers: Verification Center · proof bundles.

Download the verifier

SALLYPORT — The only door.

Status: PILOT PROGRAM · live gate on our host today; pilots in your cluster

The buyer pain. Autonomous agents hold credentials and execute consequential actions. Who authorizes them, really?

What it does. An enforcement appliance built to run inside your cluster. It independently verifies signed authorization envelopes against your trust roots, binds each one by SHA-256 to the exact execution request, and runs the action in an unprivileged, network-less, scoped sandbox, or refuses. Authority is a lease that is re-checked continuously (CAIN ARGUS).

Engine. TALOS kernel · CAIN trust kernel · PBFT · ARGUS

Mechanics

• The TALOS gate checks every authorization itself before anything runs; any step that does not pass, or any error, means the action does not run.
• The authorization signs a digest of the exact request (command, code, path, environment), so an approval for one request cannot be replayed for another. Capability tokens are short-lived and single-use.
• The worker that runs the action has no network, an unprivileged user and a scoped filesystem.
• ARGUS re-checks authority while a task runs: a lease the agent cannot renew for itself.
• Try it: a free trial key can create a session and send commands through the live gate. Allowed commands run in the sandbox and are recorded with a decision id and a digest of the exact request; everything else is refused before it runs. The check script does this for you.

What was tested on 2026-10-13

• Not run: worker isolation, ledger, enforcement and PBFT suites; 72-hour soak — larger suites and cluster work were left out to protect the running 72-hour soak (ends about 2026-10-16 14:00Z); the soak itself has not yet passed.
• Not run: load test of a deployed appliance; worker-isolation suite; PBFT under load — no appliance is deployed outside the test harness, and cluster or sandbox load is held during the 72-hour soak window (ends about 2026-10-16 14:00Z).

Scope & limitations

• Deployed on our own host only: the gate that decides and confines the commands sent to the talos-coder service. No customer cluster runs it yet, and no load test of it has been run.
• The running gate is the Evolution 7 release; later work (MCP tool dispatch, signed receipts, policy governance) is built and tested but not switched on in it.
• The live gate's command policy is a short allow-list (list and read files in the session, the test runner, a linter, read-only git). Your own policy and trust roots come with a pilot.
• The 72-hour multi-region soak has not yet passed; a run is in progress.
• The gate's issuer and verifier run in one process today. Splitting them is a precondition for a pilot.
• The hosted CAIN path does not enforce by default; the appliance is the enforcing deployment.
• No third-party security audit. Same-project tests only.

Request a pilot

How to buy: three doors and one free layer

• AUDITFALSEWORK Reality Check · fixed price, led by a person
• →
• RELIABILITYSCENIC · self-serve API: free trial, then the Full plan
• →
• GOVERNANCESALLYPORT · pilot, then an appliance in your cluster

The free public layer: NULLIUS verifiers — free, no key. The written spec is not published yet. Each path is bought separately.

Check it yourself

You do not have to take these results on trust. One script, Python standard library only and no CAIN code, sends requests to the public site with your own key and compares each answer with a result you can work out by hand from the input shown in the script. A free signup gives you a key with a 30-day Full-plan trial and no card.

curl -s -X POST https://cainstudio.online/subscribe/free/signup -H 'content-type: application/json' -d '{}'
curl -sO https://cainstudio.online/evidence/premier-products-2026-10-13/verify_premier_products.py
python3 verify_premier_products.py --key YOUR_API_KEY

It checks FALSEWORK (11 checks), SCENIC (13) and NULLIUS (3, including 25 random changes that you choose, not us). It checks SALLYPORT (16 checks) against the gate running on our host: which commands it allows and refuses, and what a probe you send can reach from inside the sandbox. It cannot check SALLYPORT installed in a customer's cluster, because none exists yet. Our own run of the same script: 43 passed, 0 did not match (output).

Test evidence

Smoke test: 35 checks passed, 0 did not match, 2 not run, including 12 made through the public gateway with a trial account's key. Stress and robustness test: 34 passed, 0 did not match, 1 not run. The stress test was kept small on purpose because the engines share a host with a running 72-hour consensus soak: it is not a capacity test. Testing found defects in three engines; all were fixed. The fixes are deployed: the three engines were rebuilt and every check was run again against them. Full results: evidence bundle.

Same-project tests on the developer's own host. No third-party audit, no independent reproduction yet, no patent filed. Pre-production.

Try the four products live

The four interactive tools below call the real engines (FALSEWORK, SCENIC, NULLIUS, SALLYPORT) over the public API. Nothing is simulated.