{
  "schema": "cain42.top25.qaas.evidence.v1",
  "ran_at": "2026-11-02T05:00:06Z",
  "who": "FIRME AI CORPORATION (self-run, NOT independent)",
  "live_suite": {
    "script": "24-hours/qaas/verify_qaas.py (also in the Hugging Face Space qaas/)",
    "result": "19/19 checks passed",
    "notarize_seconds": 2.6
  },
  "forgery_kit": {
    "file": "qaas-forgeries.py",
    "sha256": "dd5be0a634135177965c63854036b5d1c94fdb80c2e3e33563cced782595fe14",
    "result": "17 forgeries, 17 rejected; real receipt NOTARIZED",
    "output": "OK  NOTARIZED     control: real receipt, pinned\nOK  NOT_VERIFIED  duplicate signer: node-1's vote filed under node-3\nOK  NOT_VERIFIED  vote relabelled as another member (sender_id swapped)\nOK  NOT_VERIFIED  3rd vote signed by an outsider key embedded in the vote\nOK  NOT_VERIFIED  PREPARE vote passed off as a COMMIT vote\nOK  NOT_VERIFIED  extra vote from a non-member id\nOK  NOT_VERIFIED  certificate view changed\nOK  NOT_VERIFIED  quorum lowered to 2 with 2 votes\nOK  NOT_VERIFIED  operation digest differs from receipt digest\nOK  NOT_VERIFIED  leader proposal attributed to a non-primary\nOK  NOT_VERIFIED  PREPARE_QC removed\nOK  NOT_VERIFIED  COMMIT_QC null\nOK  NOT_VERIFIED  sequence as a string\nOK  NOT_VERIFIED  signature with extra padding (malleated encoding)\nOK  NOT_VERIFIED  request_id changed\nOK  NOT_VERIFIED  client_id changed\nOK  NOT_VERIFIED  receipt type changed\nOK  NOT_VERIFIED  whole cluster re-signed with the forger's own 4 keys, for a digest never notarized\n\n17 new forgeries, 17 rejected; control OK\n"
  },
  "finding_2026_11_02": {
    "what": "POST /api/v1/quorum/verify with no pin answered NOTARIZED (cluster cain-mr-02) for a receipt re-signed with four keys the forger generated, for a digest the cluster never notarized.",
    "fix": [
      "route defaults the pin to this site's live cluster (code change, needs a gateway deploy)",
      "command-line verifier never prints NOTARIZED without --pin (exit 3), live 2026-11-02"
    ],
    "tests": "tests/test_quorum_qaas.py 21 passed (5 new)"
  },
  "verifier_sha256": {
    "verify_qaas_receipt.py": "a0e80428fedb2b5cf2e2bc9598c4d6f69998d1e439790cb939f10dfbe95e2ad2",
    "verify_pbft_qc_bundle.py": "1d90370f3ab7270d95b4c104f2dda318ea9b21fe062c99da9b58d78da9234132"
  },
  "cluster_health_2026_11_02": [
    "04:23Z DEGRADED: 1 replica unreachable (cain-mr2-node-3, Miami)",
    "04:53Z HEALTHY"
  ]
}