CAIN-42 CAIN StudioThe 2026-10-27 audit
Before release, the verifiers were attacked live. Four real bugs were found. All were fixed in the release; older copies stay unchanged inside their earlier bundles, because those releases record their hashes.
| Verifier | Bug | Fix |
|---|---|---|
| Execution truth | It took one receipt, so the published "replayed" fixture, which must FAIL, came back VERIFIED | Takes several receipts and tracks receipt and authorization ids across them |
| Execution truth | The enforcer could hide a sensor: dropping the one anchored sensor that saw an undeclared write still gave VERIFIED | Any anchored sensor that did not report makes the result INCOMPLETE (ANCHORED_SENSOR_DID_NOT_REPORT) |
| Launchpad | Fields were shown but never checked: 410 of 1,168 single-field edits still gave VERIFIED, including a step's visible action changed to delete_everything | Every one checked against the signed records; 2026-11-02 sweep confirms only the documented exceptions remain |
| Mission journal | A valid-JSON line that was not an object crashed it with a traceback (nothing was accepted) | Clean FAILED |
The mission-journal verifier passed every other attack in that audit: 132 single-digit edits, truncation against the
witnessed head, reordering, duplication, a swapped trust file, and the same attacks under python -O.
FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.