Evidence

We attacked BROKER in-process on 2026-11-02, with every credential minted by the real engine. Our own testing, not independent.

#	Finding	Before	After
F1	single use defeated by attenuation: attenuate(parent) with no change mints a fresh credential for the identical action; parent + 3 clones = 4 uses	4 of 4 accepted	parent accepted, 3 clones refused (replayed): parent and children share one use (root_jti)
F2	approval bypass: a person-approved DELETE /invoices/INV-9 could be narrowed to DELETE /invoices/INV-9/lines with any body, and the parent stayed usable	accepted	refused (attenuation_widens); an approved credential can only be repeated exactly, once
F3	any credential could be narrowed to any deeper path, e.g. /orders/A-1 -> /orders/A-1/x, with any body	accepted	only a collection credential (path ends in '/', no body, no approval) narrows to one bodiless member
F4	paths servers interpret differently were minted: '/orders/..;/admin' (Tomcat reads '..;' as '..'), '%252e' double encoding, full-width dots, ';' path parameters, CR/LF and tab	ALLOW	DENY at mint, refused at verify, and refused by the downloadable verifier

Still holding (re-checked)

shared replay store across both gateway instances (SQLite, WAL)
exact method/path/body binding
EdDSA only with the published kid
approval single use

The downloadable verifier

The same rules were added to verifier.py (what a downstream service runs): family single use and the extended path rules. Tested: the parent verifies, its clone is refused as replayed, and a ..; path is refused.

Tests

tests/test_broker_keystone.py 28 (12 new) + test_approval_keystone 9 + test_governor_keystone 16 passed.

Data: broker-evolution-2026-11-02.json, SHA-256 ab0d4adf974188e667653bfe1a6ba7ce6888b5ffacc262171840a1c18f5abf83.

FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.