2026-11-02 upgrade

What changed today, and what we found while doing it.

New: the re-run kit

Until today, the public evidence let you check that the records were not altered, but not that their test results were real. We published:

reference_tests.json: the independent reference tests for the four demo samples, previously only inside our code.
rerun_keystone.py: a standalone script (no CAIN imports) that rebuilds each record's original and fixed file, runs both tests on both, and compares every outcome with the signed record. It also applies today's verdict rule to every old record.
rerun-2026-11-02.json: the full output of our own run, with hashes.

What the re-run showed

0 mismatches: every test outcome in all 6 re-runnable records reproduced exactly.

Record 2 does not meet today's rule. It was signed VERIFIED_FIX on 2026-10-14 for pasted code with no independent reference test. The rule that requires one was added on 2026-10-23 (commit 56701ab0). Under today's rule that record would be NOT_VERIFIED. Evidence is never rewritten, so the record stays in the ledger, and the kit flags it.

That leaves 4 fixes that meet today's rule. All 4 are on the same sample (forged-token) and the same detector check. Earlier copy that said "5 verified fixes" without that context overstated the evidence.

Also verified today

The offline verifier refuses without a pinned key, accepts with the published key, and rejects an edited verdict.
The re-run kit fails (exit 1) when a record's fixed code is replaced with the original.

What would make KEYSTONE stronger next

These are plans, not done:

Turn live fixing back on, so new runs can be watched end to end (needs model API credit).
Record schema v2 with the reference test's SHA-256 inside the signed record.
Runs across more samples and more detector checks, so the evidence is not one sample deep.
A second signer or a public transparency log for the head hash.
An independent paid review: re-run the kit, write their own tests, publish the result.

FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.