CAIN-42 CAIN StudioSigned decision receipts
A log line that says "DENIED" proves nothing: whoever runs the log can change it. A CAIN decision receipt is the decision itself, signed with Ed25519 over a canonical JSON body: the hash of the exact action, the verdict, the hash of every finding, the names of the checks that fired, the engine version and the key id. Anyone can check it offline with the public key; change one byte and it fails.
#11 of the CAIN-42 Top 25 4 gaps found and fixed today server fix live since 2026-11-02 15:31Z (verified on both gateway instances)
held on today's blind set, before any change
after the fixes
CAIN code needed to verify
use per approval token, since today
Check one yourself, in this browser
2. Tamper with a copy; your browser AND the live server check each one:
Since 2026-11-02 15:31Z the live server refuses the "seal as receipt" trick, and so does your browser's check.
On this site
Anatomy of a receipt
Every field and why.
Receipt lab
The interactive checker.
Approval tokens
Typed, bound, single use.
One key, many objects
Why domain separation matters.
Evidence
18 cases, every row.
Verify offline
Python, Node, the browser.
API
Routes.
Limits
Honestly.
Use cases
Where it fits.
2026-11-02 upgrade
What we broke and fixed.
FAQ
Questions.
FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.