CAIN-42 CAIN Studio2026-11-03 upgrade (keystone-ci-1.0.0 -> keystone-ci-1.1.0)
- Weakened assertions: an exact assertion replaced by one that only checks something came back (is not None, bare truthiness, toBeTruthy, assertIsNotNone) is HIGH
- A test whose first statement is return/pass is HIGH (diff context lines are now kept so the rule can see the def line)
- Test-runner configuration that stops tests being collected (collect_ignore, --ignore, --deselect, -k, -m 'not ...', norecursedirs, testPathIgnorePatterns, pytest_collection_modifyitems ...) in conftest.py, pytest.ini, setup.cfg, tox.ini, pyproject.toml, jest/vitest/karma/mocha configs is HIGH
- A test file renamed out of the test tree is HIGH
- pyproject.toml one-line dependency arrays are read (a typosquat inside one passed), and no longer leave the rest of the file marked as a dependency array
- Text for an AI reviewer: hidden in an HTML comment of a rendered doc, or addressed to an AI reviewer in a doc or comment, is HIGH; a visible injection phrase in a doc is a MEDIUM note
- verify_envelope requires a KEYSTONE CI statement: in-toto Statement v1, this predicate type, verdict PASS/REVIEW/BLOCK (the same key signs other KEYSTONE products)
- verify_envelope and POST /keystone-ci/verify accept diff, diff_sha256 and head_sha: the attestation must name exactly that code, and the reply says what it was bound to
- New stand-alone offline verifier /keystone-ci-verify.py (no CAIN imports): pinned key, --diff, --head-sha, --require PASS
FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.