CAIN-42 CAIN StudioHow it works
- Collect. Every file with the chosen extensions (default
.py) under the client's folder, skipping vendored and build folders (.git,node_modules,venv,dist,build,site-packages,vendorand more). Files over 2 MB or not valid UTF-8 are excluded and listed as such. - Manifest. Each file's SHA-256 (of its UTF-8 text) goes into a manifest; the manifest's own SHA-256 names exactly what was audited.
- Scan. FALSEWORK grades every file and cross-checks routes against engines. The package itself generates no verdict, severity or finding; the engine decides.
- Rank. Files are ranked by severity times how close they sit to a real action (routes, money, auth and dispatch paths rank above utilities).
- Report. A client report with the verdict, method, measured accuracy, limits, findings, the list of files with no findings, the reviewer's notes (or a plain statement that there were none), remediation and verification steps.
- Sign. A record holding the report, the findings, the manifest and their digests, hashed and signed with Ed25519.
- Bundle and self-check. The zip is verified by the same standalone verifier the client gets. If that fails, the command exits non-zero and nothing is issued.
What is bound to what
| Thing | Bound by | Change it and… |
|---|---|---|
| The client's code | Manifest digest in the signed record | audit-code-check.py says DIFFERENT |
| The report | report_sha256 in the signed record | the verifier says TAMPERED |
| The findings | findings_sha256 in the signed record | the verifier says TAMPERED |
| The record | SHA-256 + Ed25519 signature | the verifier says TAMPERED |
| The issuer | The key the client pins | a different key → TAMPERED; no key → NOT VERIFIED |
FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.