Certificates

POST /vericoding-keystone/certificate with the same JSON returns a zip: certificate.json (signed with Ed25519), recheck.py (no CAIN code) and a README.

curl -s -X POST https://cainstudio.online/vericoding-keystone/certificate -H 'Content-Type: application/json' \
  -d @contract.json -o cert.zip && unzip -o cert.zip
KEY=$(curl -s https://cainstudio.online/vericoding-keystone/public-key | python3 -c 'import json,sys;print(json.load(sys.stdin)["public_key_b64"])')
python3 -I recheck.py certificate.json --pinned-pub "$KEY"

What recheck.py does

1. Verifies the signature against the key you pinned; any edit → INVALID.
2. Refuses any code outside the subset (it will not run arbitrary code).
3. Replays the evidence in plain Python: runs the function on the counterexample and confirms the postcondition breaks, or, since 2026-11-02, confirms that Python really raises ZeroDivisionError where the certificate says so; for a proof, runs 20,000 random inputs that meet the precondition as an independent spot check.

A certificate whose verdict was flipped is rejected (the 14-check live suite tests this on every run).

FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.