CAIN-42 Evolution #7: a kernel syscall filter inside a ZoD authorized by the LIVE cluster, 2026-09-28T03:38:21Z.

What happened (all of it is in this bundle):
  - A real production CAIN decision came back REQUIRE_APPROVAL, quorum-certified by cain-mr-01.
  - A ZoD (the agent's execution zone) was approved by an operator key and its authorization was committed by
    the live 4-server cluster cain-mr-01 (3 of 4 Ed25519 signatures).
  - Code ran inside it under bubblewrap namespaces, cgroup v2 and a seccomp-BPF filter (99 classic-BPF
    instructions, seccomp_filter.hex.txt). It tried what an escaping agent would do. The kernel refused
    all 15: unshare (user and net namespaces), setns, mount, ptrace, bpf, keyctl, io_uring, perf_event_open, chroot,
    kexec_load, init_module, clone with CLONE_NEWUSER, raw packet sockets, netlink sockets (EPERM); clone3 gets
    ENOSYS; egress is unreachable. Ordinary work (fork) still ran. The process was uid 65534, seccomp mode 2,
    no_new_privs 1.
  - The hypervisor signed the hash of the exact command and of its output into the evidence chain, so the
    output published here can be checked against that signed record.

Verify in seconds (Python 3.8+, pip install cryptography, no CAIN code):
  B=https://clawx.click/evidence/e7-seccomp-2026-09-28
  for f in SECCOMP_RUN.json EVIDENCE_CHAIN.json decision.json qcs.json membership.json approval.json seccomp_filter.hex.txt; do curl -so $f "$B/$f"; done
  for v in verify_e7_seccomp verify_pbft_qc_bundle; do curl -so $v.py "$B/$v.py.txt"; done
  python3 verify_e7_seccomp.py .
  Expect "8/8 checks" and VERIFIED. Edit the output, claim a syscall succeeded, swap the filter or the quorum
  certificate, and it prints NOT VERIFIED.

Status: LIVE-CLUSTER-VERIFIED for the authority; the syscall refusals are observed by the kernel on the gateway host
and bound to that authority by the hypervisor's signature.

Not established (stated, not hidden): this is classic-BPF seccomp, not eBPF (no eBPF program is loaded). Which
filter the kernel loaded is operator-asserted: its hash is in the registered measurement, but nothing outside this
host attests it (no TPM/TEE). Egress is deny-all, not an allowlist. The hypervisor is a library the operator runs,
not a hosted service. x86_64 only. Production status: PRE-PRODUCTION.