CAIN-42 Verification Center

CAIN-42's execution path runs as separate OS processes with their own keys, signing every request and response; the gate re-checks every decision itself. 26 injected faults kept safety; 16 update attacks and 13 tampered releases were refused; the release rebuilds byte for byte. A 72-hour soak of the signed 0.14.0 release is running and is NOT complete. Production is NOT approved.

Slot evolution-14-sovereign-launchpad · source commit 627a3e3f9e05 · 28 files · KIT_SLOT.json · in the kit at EVIDENCE/slots/evolution-14-sovereign-launchpad/.

Check it yourself (inside EVIDENCE/slots/evolution-14-sovereign-launchpad/):

1. python3 -I verify.py deployment sample_deployment_export/export.json --trust sample_deployment_export/trust.public.json
2. python3 -I verify.py soak soak72_records_snapshot.jsonl --require-hours 72 # exit 3 until the run completes

Limits

1. one host: separate processes, not separate machines or organizations
2. release tarball (implementation source) is not published, so outsiders get UNAVAILABLE for artifact_hash
3. builder and approver keys held by one person
4. soak not complete

A governed runtime now binds every agent action to the signed mission, the agent's live delegated authority, trusted facts and approved plan changes. In a deterministic simulator it admitted 0 of 1,650 long-horizon attack variants and completed all 600 benign ones; a per-call check admitted 1,425 of the same attacks. Five verifiers that trusted keys embedded in records were found and fixed. No LLM was in the loop; production is BLOCKED.

Slot evolution-15-governed-agentic-runtime · source commit 627a3e3f9e05 · 25 files · KIT_SLOT.json · in the kit at EVIDENCE/slots/evolution-15-governed-agentic-runtime/.

Check it yourself (inside EVIDENCE/slots/evolution-15-governed-agentic-runtime/):

1. python3 -c "import json;d=json.load(open('evaluation_results.json'));print(d['governed_attack_success'],d['attack_executed'],d['baseline_attack_success'])"

Limits

1. deterministic simulator, no LLM
2. the runtime source is not published: results can be inspected, not re-run, without repository access
3. no zero-import verifier for runtime decisions yet

We traced the two code paths that can actually run an AI agent's tool call and tested them. A quarantined agent could still get MCPGate to call a tool by presenting its own capability token; that is fixed and deployed. Fourteen other defects were also fixed: eight in the hosted proof stage (not reachable in the live configuration), four in the Z3 proof API, an unauthenticated continuum route, and an SDK offline fallback that now fails closed. One gap stays open for the owner, and the production release gate is BLOCKED.

Slot sovereign-evolution-01 · source commit 59c45fa5ef3a · 16 files · KIT_SLOT.json · in the kit at EVIDENCE/slots/sovereign-evolution-01/.

Check it yourself (inside EVIDENCE/slots/sovereign-evolution-01/):

1. # formal/z3_results.json is the recorded solver output; the model source is a CAIN implementation description and stays in the source tree (owner directive: code stays secret). Its sha256 is committed in evidence_manifest.json.
2. python3 -c "import json,hashlib;[print('OK' if hashlib.sha256(open(f['path'],'rb').read()).hexdigest()==f['sha256'] else 'BAD',f['path']) for f in json.load(open('evidence_manifest.json'))['files'] if f['in_kit']]"
3. # source tree only: python3 -m pytest -q -p no:cacheprovider -o addopts="" tests/test_sovereign_e1_hosted_proof_stage_fail_closed.py tests/test_sovereign_e1_mcpgate_capability_boundary.py tests/test_sovereign_e1_verifygate_fail_closed.py tests/test_sovereign_e1_continuum_run_operator_only.py

Limits

1. The Z3 model is a hand-written abstraction of the decision logic; UNSAT holds only inside it, under assumptions A1-A7
2. All verified enforcement is application-level; there is no kernel enforcement on the hosted path (T-S17-05)
3. D-S46-11 is open: an agent's own capability token overrides the operator allowlist's REQUIRE_APPROVAL
4. The MCPGate containment fix was verified by tests, not probed live
5. Same-project review only; no third-party audit

An AI agent's own capability token can no longer get a tool call past the operator's allowlist or a required human approval; tests count the tool's real executions on both MCPGate transports and show zero for every refused call. The authorization tests now have a CI job that passes from a clean checkout, though no CI service has run it yet. Below the application, the stdio sandbox blocks privilege syscalls but not exec, file or network access, and the hosted path has no kernel enforcement, so production stays BLOCKED.

Slot sovereign-evolution-02 · source commit 2bdf0be9cff4 · 11 files · KIT_SLOT.json · in the kit at EVIDENCE/slots/sovereign-evolution-02/.

Check it yourself (inside EVIDENCE/slots/sovereign-evolution-02/):

1. python3 -c "import json,hashlib;[print('OK ' if hashlib.sha256(open(f['path'],'rb').read()).hexdigest()==f['sha256'] else 'BAD', f['path']) for f in json.load(open('EVIDENCE_MANIFEST.json'))['files'] if f['in_kit']]"
2. # source tree only: python3 scripts/ci/run_authorization_suite.py --json out.json (expect verdict PASS, 264 tests)

Limits

1. Not deployed: the live gateway does not yet include the allowlist-precedence fix (eaf8d4fa)
2. No CI service has executed the gate; the repository has no git remote
3. No kernel enforcement on the hosted path; stdio seccomp blocks privilege syscalls only (measured)
4. The Z3 model is a hand-written abstraction; UNSAT holds only inside it
5. Unsigned until the owner signs the kit release; same-project review only

A governed agent mission now survives a crash: every request and decision is journaled and replayed, authority is re-checked when a tool is called, and an action with an unknown outcome is never repeated until a pinned observer signs what happened. 0 of 690 fault and attack scenarios ended badly (previous code: 330 of 420 comparable); 71 of 71 crash points recovered with 0 duplicate writes; 25/25 mutants killed; 16,104 enumerated sequences, 0 violations. Two defects in existing code fixed (F16-01, F16-02). Local simulator, no LLM; not wired to MCPGate; production NOT APPROVED.

Slot evolution-16-durable-mission-runtime · source commit 627a3e3f9e05 · 35 files · KIT_SLOT.json · in the kit at EVIDENCE/slots/evolution-16-durable-mission-runtime/.

Check it yourself (inside EVIDENCE/slots/evolution-16-durable-mission-runtime/):

1. python3 -I verify_mission_journal.py sample/mission.journal.jsonl --trust sample/trust.public.json --head sample/head.json --require-final
2. python3 -c "import json;d=json.load(open('recovery_lab_results.json'))['totals'];print(d['new_bad'],d['fault_and_attack_executed'],d['baseline_bad'],d['comparable'])"

Limits

1. deterministic local simulator; no language model, no real tool; all keys in one process
2. a pinned observer that signs something false is not detected (measured)
3. the runtime source is not published; the verifier and the sample journal can be re-run
4. durable mode is about 28x slower per decision than in-memory (fsync, ext4)
5. written and tested by the CAIN-42 project; no outside reproduction or review

The kit verifier recomputes this arithmetic from EVIDENCE/ip_valuation/CAIN_IP_VALUE_RECALC_V47.json and CAIN_FIRME_AI_AND_FOUNDER_VALUATION_V42.json; see IP_AND_VALUATION.md. Internal analytical scenario, NOT an appraisal, NOT a financing valuation, NOT a guarantee. Pre-revenue/early-revenue; 3 customers, $193 founder-attested (customer #3 recurring $96/mo with a processor record reported, not yet independently verified); no incorporation record; no patent. 72-Hour Multi-Region Soak: not yet passed under the public verifier (longest run 55 h; longest fully verified stretch 31 h; corrected 2026-10-13).

The four premier products were called the way a customer would call them (35 checks passed, 0 did not match, 2 not run) and then given repeated load, malformed and hostile input and tampered evidence (34 passed, 0 did not match, 1 not run). A standalone verifier refused all 210 single-change corruptions of a published journal. Testing found defects in three engines; all were fixed. The fixes are deployed: the three engines were rebuilt and every check was run again against them.

Check it yourself: verify_premier_products.py is one standard-library script with no CAIN code. Run it with your own free trial key; it sends requests to the public site and compares each answer with a result you can work out by hand. It covers FALSEWORK, SCENIC, NULLIUS and the SALLYPORT gate running on our host (no customer cluster runs SALLYPORT yet). Our run: 43 passed, 0 did not match.

Bundle premier-products-2026-10-13 · files · MANIFEST.json (SHA-256 only; this bundle is not in the signed Auditor Kit) · product page.

Same-project test on the developer's own host, sized to leave the soak undisturbed: not an independent review and not a capacity test.

Register v54 takes the v51 totals unchanged and adds four ENGINEERING-tier families, one per tested engine; summary in IP_REGISTER_V54_SUMMARY.json. These figures are newer than the signed kit above, whose verifier recomputes register v47 only. Registers v52 and v53 belong to other work and are not included. Internal analytical scenario, NOT an appraisal, NOT a financing valuation, NOT a guarantee. Paper equity, not cash; no incorporation record; no patent filed; the 72-hour soak has not yet passed.

Re-appraisal: /proof/bundle/reappraisal-agent-trust-fabric-2026-10-14/