CAIN-42 CAIN Studio
Sign inGet started
Menu
25CAIN-42 Top 25 › Black Box flight recorder › How it works

How it works

  1. Record. Each agent step is a span: trace id, span id, parent span, name, kind, start and end time (as decimal strings, so JavaScript cannot round them), gen_ai attributes and status.
  2. Commit, don't store in the hash. The step's payload (prompt, tool arguments, result) is hashed with a random 16-byte salt: sha256(salt || payload). The hash covers the commitment, never the payload itself.
  3. Chain. Each step's hash covers the previous step's hash. Insert, delete, reorder or edit anything and every later link breaks; the verifier names the first broken step.
  4. Seal. An RFC 6962 Merkle root over all step hashes is signed with Ed25519 and written to a chained ledger. After sealing nothing can be appended.
  5. Erase. Deleting a payload and its salt leaves the commitment, so the seal still verifies, and the deleted text cannot be guessed back from the hash (the salt is gone).
  6. Prove one step. An RFC 6962 audit path proves a single step is in the sealed run without revealing the others.

FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.