CAIN-42 CAIN Studio2026-11-02 upgrade
| # | Gap | Before | After |
|---|---|---|---|
| RC-11-02-1 | A Black Box seal (signed by the same key) verified as a 'valid' CODEGUARD decision receipt, on the server route and in our published verify_receipt.py | valid: true | refused: schema, required fields and decision value are checked; seals likewise refuse receipts |
| RC-11-02-2 | Receipts did not name their signing key | no key id | kid = SHA256 fingerprint of the key, checked by verify_receipt.py |
| RC-11-02-3 | A CODEGUARD approval token could be used again and again for 10 minutes (one person's yes to 'git reset --hard' allowed repeats) | ALLOW, ALLOW | single use: the second try needs a person again (approval_token_reused); a token is spent only when it is what allows the action |
| RC-11-02-4 | Approval tokens had no type; a receipt's signature was refused as a token only because it lacked 'exp' | accidental | typed tokens (cain42.codeguard.approval.v2) with a unique id |
approval tokens issued before 1.2.0 (no typ) are refused; they expired within 10 minutes anyway. Receipts issued before 1.2.0 carry no kid and still verify.
CODEGUARD tests 273 → 279, recorder 64, SurfGuard all pass. Engine codeguard-1.2.0.
FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.