CAIN-42 is in Public Beta. Expect changes, and do not rely on it as your only control for anything critical. What beta means
CAIN-42 CAIN Studio
Sign inGet started
Menu

CAIN-42 External Grading Package

Package cain42-grading · version 2026.10.09 · published 2026-10-09T17:20:26Z · release 4.0.0 · source commit 0c22524b30d63f4f6306e538619ff115fde32198.

Purpose. Let an outside reviewer assign separate, defensible grades for architecture, implementation correctness, enforcement-boundary security, evidence/verifier rigor, reliability/performance, developer usability, and website claim accuracy. Evidence categories are not equivalent and are not summed into one "verified" number. Honest INCOMPLETE / NOT_ESTABLISHED is used where evidence is unavailable.
Independence: 0 independent reviews. Every artifact is operator-generated. "Remotely verified" means CAIN's own replicas, not an external auditor. Soak: NOT_ESTABLISHED (running). Appraisal: none (internal scenario only).

Manifest

manifest.json · manifest.txt (same JSON as text/plain) · delivery-check.json · corrections.md · cain42-review-2026.10.09.zip (sanitized attachment)

Sections

Artifacts (current)

ArtifactCategoryTypeBytesSHA-256Limitations
README.mdbundle_indextext/markdown231520dec01ac306f8df…verification artefacts only
MANIFEST.jsonartifact_integrityapplication/json475791200c3e2a643ba1…operator-generated
PUBLISHER_KEY.jsonpublisher_authenticationapplication/json5500dca93bf2417753a…self-published key; identity not authenticated
review-core-2026-10-09.jsonpublisher_authenticationapplication/json22848911a52cfac9cd6a…signature valid against pinned key; key is self-published
QUORUM_CERTIFICATE.jsonrecomputed_semanticsapplication/json738695f99766bee1d8bd…disposable cluster, not live
PBFT_QC_BUNDLE.jsonrecomputed_semanticsapplication/json946231f96088a8edf710b3…disposable cluster; single host
verify_pbft_qc_bundle.pyrecomputed_semanticstext/x-python20717ba452ce42528f11f…offline verifier
MEMBERSHIP.jsondeploymentapplication/json726604b4723f3a54e8d…disposable cluster membership
REPLICA_KEYS.jsondeploymentapplication/json760c4bd4e1d7cc9cbd0…public keys only
CANONICALIZATION.mdschematext/markdown1120995946b3dc21e80c…spec only
CERTIFICATE_SCHEMA.jsonschemaapplication/json1339ecfc6e816ed2bdf4…spec only
NEGATIVE_FIXTURES.mdverifier_rigortext/markdown615442381dec10907dc…built-in controls
TEST_RECONCILIATION.mdreport_consistencytext/markdown880b528a01823434109…operator-run; source not public
FORMAL_SUMMARY.mdrecomputed_semanticstext/markdown10183cec001669fa5457…bounded models; no refinement
ENFORCEMENT_BOUNDARY.mdenforcementtext/markdown1285fe4c4dc9138f669f…bypass demos NOT_ESTABLISHED
SOAK_VERDICT.jsonreliabilityapplication/json6449a78e580a2d1ada4…NOT_ESTABLISHED while running
E42_VERIFIER_V2.pyverifier_rigortext/x-python227834ca9fc761c22ca7d…corrected verifier
E42_VERIFIER_REPORT.jsonverifier_rigorapplication/json3704e7efea80096668c5…categorised; behavioural pass false
E42_VERIFIER_ASSURANCE.jsonverifier_rigorapplication/json3749245a16754c6e1456…15/15 mutations caught
EVIDENCE_CATEGORIES.jsonverifier_rigorapplication/json310768352313af24b20a…categories not summed
KNOWN_LIMITATIONS.mdlimitationstext/markdown5496ba6f8623873429fa…operator-generated
REPRODUCE.txtrecomputed_semanticstext/plain26489d1d31bb2e8cc633…bounded models
CAINPBFTCommitSafety.tlc.jsonrecomputed_semanticsapplication/json2464078d1bc438d8ac7b…bounded model
TEST_MANIFEST.jsonreport_consistencyapplication/json2600494c6f3ca8aa8498db6…operator-run; source not public
heartbeat.jsonreliabilityapplication/json4800921686a00efbc63…RUNNING; volatile
latest.jsonlive_observationapplication/json18550112085ed5c5b3f5…volatile; operator-run
system-map.jsonarchitectureapplication/json234183844659ddc76d68…operator-attested
banner-reconciliation.jsonwebsite_accuracyapplication/json17666d62e27e149c9e39…correction record
commercial-vs-technical.jsoncommercialapplication/json12790f2b8d746632ca4e…internal scenario, not appraisal
technical-bundle.jsonbundle_indexapplication/json20247f3785f77dc3db95…A-F statuses
verifier-findings.jsonverifier_rigorapplication/json3808ad4fa18bad544b87…7 findings
e2e-workflow.jsonenforcementapplication/json1034963eda8a2a6e2eee…NOT_ESTABLISHED
developer-website-grading.jsonusabilityapplication/json1858d04e0baa84225ab6…operator-run
rubric.jsonrubricapplication/json2932f3208f8829b34ffe…no self-grade
retrieval-check.jsonartifact_integrityapplication/json15364e58d7a8c592600f4…operator-run check
delivery-check.jsonartifact_integrityapplication/json117537c7c5b03ca2032b7…operator-run delivery check
corrections.mdwebsite_accuracytext/markdown1428e4390e1e6185ebcf…dated corrections

Historical versions are preserved at their immutable URLs (e.g. the original scripts/cain45/verify_e42.py v1 is retained; v2 supersedes it).

Why /evidence/ was unreachable to the external reviewer

Cause (known): the gateway catch-all /{slug}/{path:path} matched /evidence/… and returned no such service 'evidence' (404). Fixed 2026-10-09 by registering /evidence and /review before the catch-all. No security control was disabled; sanitized static evidence is served through a safe read-only route.

Known limitations

This page is server-rendered HTML with no client-side JavaScript. Same data as JSON at /review/manifest.json.