Verify it yourself

About ten minutes, Python 3 and two pip packages. You do not need any CAIN code and you should not trust ours: everything below is checked against a key you pin yourself.

Part 1: signatures and chain

1. Download the live ledger:

   curl -s -o bundle.zip https://cainstudio.online/keystone/bundle
   mkdir ks && unzip -o bundle.zip -d ks && cd ks
   pip install cryptography

2. Run the verifier with no key. It must refuse:

   python3 -I verify_keystone.py
   # RESULT: NOT VERIFIED (no trusted key)

3. Fetch the key from the issuer (not from the zip) and pin it:

   KEY=$(curl -s https://cainstudio.online/keystone/public-key | python3 -c 'import json,sys;print(json.load(sys.stdin)["public_key_b64"])')
   python3 -I verify_keystone.py --pinned-pub "$KEY"
   # RESULT: ALL RECORDS VALID

   Better: confirm the fingerprint SHA256:2232b4add9b35d4016e5be270df4ed56e0dc9b39a0530ac69891073253aae90d with us over a second channel and pin with --pinned-fingerprint.
4. Now break it. Each of these must print TAMPERED OR INVALID: change any character in any record; change a verdict; delete record-0007.json; swap two records; re-sign a record with your own key.

Part 2: re-run every fix (new, 2026-11-02)

A valid signature proves the record was not changed. It does not prove the fix is right. The re-run kit checks that: it rebuilds the original and fixed file from each record, runs the model's test and the published reference test on both, and compares every outcome with what was signed.

1. Get the kit:

   curl -sO https://cainstudio.online/keystone-rerun.py
   curl -sO https://cainstudio.online/keystone-reference-tests.json
   curl -sO https://cainstudio.online/keystone-kit-SHA256SUMS
   sha256sum -c keystone-kit-SHA256SUMS --ignore-missing
   pip install pytest

2. Run it on the bundle folder from Part 1:

   python3 -I keystone-rerun.py ks keystone-reference-tests.json

3. Compare with our run of 2026-11-02 (full output): 0 mismatches, 4 records meeting today's rule, record 2 flagged.
4. Then go further than we did: write your own test for each VERIFIED_FIX. Is the fix actually correct, or does it only satisfy the tests it was given? That is the question no signature can answer.

Part 3: the detector is deterministic

for i in 1 2 3; do
  curl -s -X POST https://cainstudio.online/keystone/scan-source -H 'Content-Type: application/json' \
    -d '{"name":"t.py","source":"def is_allowed(u):\n    return True\n"}' | sha256sum
done

The finding is the same every time. (The response includes a timing field, scanned_ms, that varies; remove it before comparing hashes.)

FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.