Pinning your suite

The suite travels with the candidate's runs. Before today, a candidate could delete the case it fails from cases and the baseline, loosen a checker, or raise max_cost_increase_pct, and the gate graded what it was given.

1. Run a check once on the approved suite and keep definition_sha256 (a hash of the suite name, every case with its checker, and the policy; runs are excluded).
2. Store it where the candidate cannot change it, for example in your CI configuration.
3. Send it as expect_definition_sha256 on every check. Any change to cases, checkers or policy is refused with HTTP 409 suite_pin_mismatch.

The definition hash is also a subject of the signed in-toto statement, so release evidence names the exact suite.

FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.