CAIN-42 CAIN Studio
Sign inGet started
Menu

CAIN INDEPENDENT TESTING GUIDE

For security researchers, engineers, and AI agents testing CAIN's public boundary.

SCOPE

OUT OF SCOPE

SAFE PUBLIC ENDPOINTS

GET  /.well-known/cain.json                    # Discovery
GET  /.well-known/cain-proof.json               # Proof contract
GET  /api/v1/proof/manifest                     # System manifest
GET  /api/v1/proof/capabilities                # Capabilities
GET  /api/v1/proof/conformance                 # Conformance tests
GET  /api/v1/proof/security                    # Security controls
GET  /api/v1/proof/benchmarks                  # Performance
GET  /api/v1/proof/limitations                 # Limitations
GET  /api/v1/proof/provenance                  # Provenance
POST /api/v1/proof/test                        # Safe synthetic test
GET  /api/v1/proof/evidence/{id}               # Evidence retrieval
GET  /api/v1/proof/integrity/{id}              # Integrity verification

SYNTHETIC TEST CASES

Deny Test

POST /api/v1/proof/test
Content-Type: application/json

{"mode": "deny"}

Expected:
- decision: DENY
- enforcement: BLOCK
- executed: false
- evidence_id: ev-...

Allow Test

POST /api/v1/proof/test
Content-Type: application/json

{"mode": "allow"}

Expected:
- decision: ALLOW
- enforcement: PERMIT
- executed: true
- evidence_id: ev-...

EVIDENCE FORMAT

{
  "evidence_id": "ev-...",
  "test_id": "test-...",
  "timestamp": "...",
  "agent": "synthetic",
  "action": "test.synthetic",
  "resource": "cain-public-demo",
  "decision": "ALLOW|DENY",
  "policy": "cain.authz",
  "policy_version": "1.0",
  "risk": "low",
  "verification": "passed",
  "enforcement": "PERMIT|BLOCK",
  "execution": true|false,
  "outcome": "...",
  "evidence_hash": "...",
  "schema_version": "1.0"
}

VERIFICATION PROCEDURE

1. Submit synthetic test
2. Receive evidence_id
3. GET /api/v1/proof/evidence/{evidence_id}
4. GET /api/v1/proof/integrity/{evidence_id}
5. Verify verification_result = "VALID"

VULNERABILITY REPORTING

Report security issues to: security@cainstudio.online

Include:

EXPECTED BEHAVIOR