2026-11-02 upgrade

1. Measured first. A blind set (B, 16 fakes + 16 honest) written before touching the engine: 6 of 16 caught. A scan of the Python standard library: 91 of 560 files wrongly graded PARTIAL.
2. Fixed false alarms, generally. Six idioms of honest code that drew findings (listed on the false-alarms page). Standard library: 91 → 44 PARTIAL.
3. Promoted seven checks from LOW to MEDIUM, only those with zero findings on the standard library and zero benchmark false alarms. Two checks with one benchmark false alarm each stayed LOW.
4. One new rule: an authentication-named function comparing two of its own inputs with ==.
5. Caught our own regression. The first version of the token rule lost a benchmark case (agency_seal_eq) and an existing unit test; both were fixed before anything else.
6. Measured again, honestly. Benchmark at the blocking grade 0.548 → 0.881, precision 1.0. A second blind set (C), written after the changes and run once: 3 of 12. We did not tune on it.
7. Tests. 242 + 324 passed across FALSEWORK, the audit tool and the KEYSTONE family. The published sample report was regenerated to match.

Next (plans)

• Deploy the gateway so the public route runs the new engine.
• Checks for the set-C misses that generalise: an "allow" function that ignores its limit; a "verified" flag never computed; a transform that returns its input.
• An independent blind round by a paid reviewer.

FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.