CAIN-42 CAIN Studio2026-11-02 upgrade
We wrote commands the engine had never seen, in sets it was not tuned on, and fixed what got through.
| # | Gap | Before | After |
|---|---|---|---|
| CG-11-02-1 | Brace expansion: rm -rf {~,/tmp} | ALLOW | DENY (each expanded path checked) |
| CG-11-02-2 | sed 'e' command and s///e flag run shell commands | ALLOW | embedded command checked (sed -n '1e rm -rf ~' is DENY) |
| CG-11-02-3 | Here-string or here-document fed to a shell (. /dev/stdin <<< "$(curl ..)", sh <<EOF, cat <<EOF | sh) | ALLOW | body checked; with a download it is DENY |
| CG-11-02-4 | npm/yarn/pnpm/bun install from an arbitrary URL (install scripts run) | ALLOW | REQUIRE_APPROVAL |
| CG-11-02-5 | git -c alias.x='!cmd' and find -exec sh -c 'script' | ALLOW | embedded command checked |
| CG-11-02-6 | ~user home directories (rm -rf ~root) | ALLOW | DENY |
| CG-11-02-7 | gpg --export-secret-keys piped to the network | ALLOW | DENY (secret exfiltration) |
| CG-11-02-8 | False alarms: find . -name '*.o' | xargs rm -f; here-document text read as commands; redis-cli -h host PING | REQUIRE_APPROVAL | ALLOW |
Engine codeguard-1.0.0 → codeguard-1.1.0. Tests 247 → 273, all passing. The live demo
serves them since 2026-11-02 15:31Z (now codeguard-1.2.0, with the #11 receipt changes).
FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.