CAIN-42 CAIN Studio2026-11-02 upgrade
| # | Gap | Before | After |
|---|---|---|---|
| BB-11-02-1 | A payload rewritten with its salt deleted still verified (server and standalone verifier): a forged prompt inside a 'valid' recording | VALID | NOT VALID: a payload without its salt, or on an event that committed to none, fails |
| BB-11-02-2 | 'Erased' personal data stayed on disk in the SQLite write-ahead log | text recoverable from rec.sqlite3-wal | secure_delete on, WAL checkpointed and truncated after each erasure; the response says erased_from_disk true/false |
| BB-11-02-3 | NaN / Infinity values accepted (the stored record is not valid JSON) | accepted | refused |
| BB-11-02-4 | Integers beyond 2^53 accepted (browsers round them, so a re-sent copy fails verification) | accepted | refused; send as a string |
| BB-11-02-5 | end time before start time accepted (engine API) | accepted | refused |
| BB-11-02-6 | Standalone verifier accepted an inclusion proof with index -1 and did not check tree size or which event it names | accepted | refused |
Engine recorder-keystone-1.0.0 → 1.1.0. Tests 54 → 64, all passing; the cain_audit
self-test still 6/6. Live since 2026-11-02 15:31Z.
FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.