Playbook · delivery

Delivery — the 48-hour checklist

One command, one bundle, one verifier, one guarantee. Deliver the same way every time.

The 48-hour checklist

The commands

# MCP / agent security review
python3 -m cain_audit.cli mcp tools.json --client "Acme"

# Fabrication audit
python3 -m cain_audit.cli audit ./repo --client "Acme" --tier standard

# Verify a produced bundle
python3 -m cain_audit.cli verify artifacts/audits/acme/fa-*/evidence.zip

What is in the bundle

• Signed record(s), in chain order.
• The pinned Ed25519 public key.
• A standalone verifier that imports no CAIN code.
• report.md and findings.json, bound inside the signature.
• A manifest with the SHA-256 of every file.

Quality gate

• A deliverable that fails its own verification is never sent.
• Every finding names the location and the fix.
• Every report states its limits.
• The buyer runs the verifier before paying.

Payment

• Invoice or Stripe payment link; 50% at start, 50% on delivery, or paid in full for $1,500.
• No work starts without a written scope.
• No deliverable is sent before it verifies.