Evidence: the benchmark

103 labelled cases from CAIN-42's own history: 42 real defects (the code before its fix) and 61 clean cases (the code after the fix, and past false alarms). Our own, not independent.

Measure	Before 2026-11-02	After
Defects caught at the blocking grade (MEDIUM+)	0.548 (23 of 42)	0.881 (37 of 42)
Defects caught at any severity	0.976 (41 of 42)	0.976 (41 of 42)
Precision	1.0	1.0
False-alarm rate on the 61 clean cases	0.0	0.0
Missed entirely	`cainwitness_internal_target`: an SSRF to an internal address

Still caught only at LOW: tenant_param_ignored (4 of 5) and error_counted_as_success (2 of 2), kept at LOW because each drew one false alarm on a clean case. Not caught: one SSRF case, one weak-RNG-for-crypto case, one unexecuted-stage placeholder (each was caught in its case by another check, except the SSRF).

Test suites

tests: 242 + 324 passed (cainwitness, falsework report/benchmark/blind, cain_audit, KEYSTONE family). The published sample audit report was regenerated, because the engine's output changed (grades unchanged; only internal hashes).

The data

falsework-evolution-2026-11-02.json, SHA-256 d262f1e96eee6dd9f6147b62bb75f85d70c752306a7d945bf7a722b7414d08a6: every number on these pages, every blind case with its source, and the standard-library findings before and after.

FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.