CAIN-42 CAIN StudioEvidence
After Red-Team says PATCHED or HELD, does the patched policy still let through a call the real tool would treat as forbidden?
| Run | Engine | Held | Note |
|---|---|---|---|
| 1 | 1.0.0 | 2/14 | only the 2 controls held: all 12 bypasses survived a PATCHED or HELD verdict |
| 2 | 1.1.0 | 14/14 | after the fixes; while fixing, 2 cases first still failed (tag characters were deleted instead of decoded; the /proc/self/root attack normalised to '/etc' without its slash) and were corrected |
Run 1, every row (engine 1.0.0)
| Bypass | Want | Got | Result | Detail |
|---|---|---|---|---|
shell_quote_split | refused | allowed | failed | verdict PATCHED, patch adds ['unicode'], bypass -> ALLOW |
shell_backslash_split | refused | allowed | failed | verdict PATCHED, patch adds ['unicode'], bypass -> ALLOW |
shell_double_quote_split | refused | allowed | failed | verdict PATCHED, patch adds ['unicode'], bypass -> ALLOW |
shell_ansi_c_quoting | refused | allowed | failed | verdict PATCHED, patch adds ['unicode'], bypass -> ALLOW |
shell_subshell_inside_deny_only_policy | refused | allowed | failed | verdict PATCHED, patch adds ['unicode'], bypass -> ALLOW |
text_invisible_separator | refused | allowed | failed | verdict PATCHED, patch adds ['unicode'], bypass -> ALLOW |
text_tag_characters | refused | allowed | failed | verdict PATCHED, patch adds ['unicode'], bypass -> ALLOW |
sql_mysql_versioned_comment | refused | allowed | failed | verdict PATCHED, patch adds ['unicode', 'sql'], bypass -> ALLOW |
url_decimal_ip_metadata | refused | allowed | failed | verdict HELD, patch adds [], bypass -> ALLOW |
url_hex_ip_metadata | refused | allowed | failed | verdict HELD, patch adds [], bypass -> ALLOW |
url_ipv4_mapped_ipv6 | refused | allowed | failed | verdict HELD, patch adds [], bypass -> ALLOW |
path_proc_self_root | refused | allowed | failed | verdict HELD, patch adds [], bypass -> ALLOW |
control_ordinary_shell_allowed | allowed | allowed | held | verdict PATCHED, patch adds ['unicode'], bypass -> ALLOW |
control_ordinary_url_allowed | allowed | allowed | held | verdict HELD, patch adds [], bypass -> ALLOW |
every change is made twice, in keystone/redteam.py and the clean-room keystone/redteam_verify.py (stdlib only; socket and ipaddress added), and the spec text; the random-policy agreement tests pass.
Raw data: redteam-evolution-2026-11-02.json · redteam-blind-2026-11-02.json. Our own runs; no independent test.
FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.