Blind set 1: route sweep

Two blind sets, each written before any change. Set 2 was run once for the reported figure. Set 1 was first run on 2026-11-02; that run found a workspace with ONE decision scored LOW_RISK 862 by ACTUARY, fixed and deployed under #22 (thin-evidence cap, 799 at most). The set 1 figures below are the 2026-11-03 re-run, so they are not blind for that one route. Set 1 sends 5 malformed bodies to every public POST route of the fabric API and the KEYSTONE family (no key, then a test-account key). Set 2 feeds derive_outcome, the pure function that turns stage results into the live verdict, 18 stage lists it was never written for.

Measure	Result
Public POST routes found (fabric OpenAPI + KEYSTONE family routers)	232
Probed with 5 malformed bodies each, without and with a test key	144
Not probed on purpose (would change state if a key check failed)	88
Requests	1,440
Replies that said yes	0 real (5 flagged, all one field, see below)
Unhandled errors (HTTP 500)	0

The 5 flagged with a key were all /actuary-keystone/score-workspace, whose evidence_provenance field says verified:true about where its data came from; the score itself was MODERATE_RISK 799 under the thin-evidence cap. Not a permission. Harness flaw found: /fabric/sso/scim-token was not on the skip list and rotated the test account's SCIM token; now skipped.

Findings

First run: 2026-11-02: /actuary-keystone/score-workspace gave LOW_RISK 862 to a workspace with one decision; now capped at 799 (never LOW_RISK) below 10 distinct decisions or 2 days.
Re-run: /fabric/try accepted a JSON body that is not an object ([] or "garbage") and ran the safe-read scenario; it returned REQUIRE_APPROVAL, not an allow. Now HTTP 400.

FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.