CAIN-42 CAIN Studio2026-11-02 upgrade
| # | Gap | Before | After |
|---|---|---|---|
| A33-11-02-1 | A caller could pull quarantined (injected) text into recall with include_quarantined: true | text returned | listed with text null and 'withheld'; only the reviewer secret shows it |
| A33-11-02-2 | The agent that wrote an injected memory could release it by typing any name | released | release needs the tenant's reviewer secret (salted hash stored; set once, changed only with the old one) |
| A33-11-02-3 | Injection placed in tags or in the source field was not screened, but both are returned to the model | active | text, every tag and the source are screened |
| A33-11-02-4 | Injection hidden in Unicode tag characters (ASCII smuggling) | active | screened after decoding tag characters and removing format characters |
| A33-11-02-5 | Forget kept text_sha256, so a short text (an e-mail address) could be guessed back | hash kept | hash cleared |
| A33-11-02-6 | Forget kept tags and source (which can hold personal data) | kept | cleared |
| A33-11-02-7 | Forgotten text stayed in the SQLite files on disk | recoverable from the -wal file | secure_delete + WAL checkpoint/truncate; response reports erased_from_disk |
| A33-11-02-8 | Found while fixing (not in the blind set): each audit entry's payload_sha256 hashed the whole row, so a short forgotten text could be confirmed from the audit log by guessing | guessable | a random value that is never stored is hashed in |
Added the same day
| Capability | What | How tested |
|---|---|---|
| MCP server | one standard-library file: aether33_remember, aether33_recall, aether33_get, aether33_forget over stdio; no release tool; recall never requests quarantined rows | real JSON-RPC session (initialize, tools/list, tools/call x3, unknown method) against the live service 2026-11-02; not yet run inside a Claude Code session |
| Signed tenant export | GET /aether33/api/export: every memory (quarantined text withheld, tombstones empty) + the whole chain from genesis, Ed25519-signed; standalone verifier /aether33/export-verify.py | blind set B 14/14; route test downloads the export and the verifier and checks it, then a tampered copy |
Our own documentation, corrected
- the agents docs page said 'HTTP and MCP' before any AETHER-33 MCP server existed; it now points at the real one
- its code sample imported cain_audit.http, which does not exist; replaced with requests
Engine tests 13 → 22, gateway route tests 19 → 20, all passing; 33/33 invariants (two now require the reviewer secret). Fixes live since 2026-11-02 16:30Z; MCP server and signed export since 16:43Z (deploy/20261102T164311Z), both checked on both gateway instances: export verifies with the downloaded verifier, a tampered copy fails, no quarantined text in it; the MCP server downloaded from the site quarantined an injection and returned no hit for it.
FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.