2026-11-02 upgrade (agent-ci-keystone-1.0.0 -> 1.1.0)

• tool names: separators . _ - / : and Unicode dashes removed, Cyrillic/Greek look-alikes folded (engine and clean-room verifier)
• RISK_TIER_DOWNGRADE BLOCK; a tool marked high in the baseline counts as high in the candidate
• require_before: an earlier check must share an argument with the later step when that step has arguments
• vacuous checkers refused (empty contains, empty json_subset, a regex matching everything)
• PATH_MISSING BLOCK, COST_NOT_REPORTED WARN, step-count waste when no costs are reported
• dependencies must point to earlier steps (422)
• definition_sha256 + optional expect_definition_sha256 pin (409 on mismatch); the definition hash is a subject of the signed in-toto statement

FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.