CAIN-42 Evolution 7 + 8 proof bundle  (e7-e8-predictive-kernel-2026-09-28)
================================================================
Built 2026-09-28T19:53:07+00:00 at commit ed202ddd3138129d3cb3d70502482d3e2e04edfb.

WHAT THIS PROVES
  - E7 invariants (I1-I12) all hold: 12/12
  - E8 invariants (K1-K22) all hold: 22/22
  - 65 tests passed, 0 failed: ============================== 65 passed in 1.71s ==============================

REPRODUCE
  python3 -m pytest tests/test_cain42_e7_world_state.py tests/test_cain42_e8_kernel.py \
      tests/test_cain42_e7_e8_wiring.py -q
  python3 scripts/cain45/build_evolution7_8_bundle.py

VERIFY (imports NO CAIN-42 code; Python + `cryptography` only)
  python3 verify_e7_e8.py .

LIMITS
  TESTED, not hosted: the fabric and kernel are libraries on the operator host; they are not services. | The consequence gate and the kernel boundary are wired RESTRICTION-ONLY into the CAIN-45 hypervisor; they can add a refusal, never grant or loosen authority. | The world state is the state an observer reports, not ground truth: every element carries its source, freshness, confidence, provenance and verification status. | The digital twin is not a high-fidelity infrastructure twin and has no validated error bound. | Long-horizon simulation depth is not reliability; uncertainty is tracked and contracts authority. | Enforcement depth is APPLICATION/RUNTIME/CONTAINER, never OS or HARDWARE on this host. | Prediction errors raise uncertainty; an agent-reported 'match' can never lower it. | No hosted API surface is exposed for these fabrics; they are libraries plus a restriction-only hook. The CLI is `cain l5 e7-audit` / `e8-audit` / `e7e8-bundle` / `e7e8-verify`. | No third party has reviewed these artefacts; the clean-room verifier shares no CAIN imports but was written by the same operator.

SIMULATION IS NOT PROOF OF SAFETY, AND A PREDICTION IS NOT AUTHORITY.