WE ATTACKED THE NEXT 20 INVENTIONS AND FIXED 11 DEFECTS IN SEVEN OF THEM. ONE WAS OUR OWN PUBLIC CLAIM, NOW CORRECTED, LIVE.
Action-risk classifier: SQL comments, split argument lists, cents or nested amounts and look-alike tool names no longer lower the risk. Symbolic policy verifier: errors and malformed input now deny instead of crashing. Quarantine: an agent can no longer lift its own quarantine. Sandbox: an unhandled 500 is now a 503. Message firewall: the untrusted-content fence can no longer be closed through its source label. Provenance manifest regenerated and verified.
Correction. /fabric/invariants/verify-all reported 200 of 200 CAIN 14 invariants passing; every validator compares or hashes constants and none exercises production code. It now reports 0 passed (200 CONSTANT_ONLY). Earlier “200/200” statements on this page are withdrawn.
26 new test cases failed before their fixes; 252 of 252 pass; live on both gateway instances. IP value: internal re-estimate about $221,000; filing the four provisional patents is expected to take it past $250,000.
Limits. Same-project tests, not third-party assurance; internal estimate, not an appraisal. PRE-PRODUCTION.
WE ATTACKED THE PATH EVERY AGENT ACTION TAKES THROUGH CAIN-42, FOUND REAL HOLES, AND CLOSED THEM. EACH FIX HAS A TEST THAT FAILS WITHOUT IT.
MCPGate no longer passes CAIN’s authorization envelope or the caller’s credentials to tool servers. Agent passports are enforced on the hosted path and bound to the exact call. The identity log is hash-chained with issuer-signed checkpoints and an offline verifier that catches edits, deletions and truncation. Trajectory rules hold split-key exfiltration and runaway loops for a human. The operator’s cluster halt and agent quarantines now stop hosted decisions. A tenant-owned physical safety envelope refuses out-of-envelope actions, even in shadow mode. A2A card and delegation signatures are verified (the public verifier had checked none). Agent keys can no longer promote their own memory to TRUSTED, write policies, switch off the kill switch or resume themselves. 322 tests pass, 0 fail; live after the rolling deploy, a forged unsigned A2A card is refused on 3 of 3 domains.
Limits. Same-project tests, not third-party assurance; most fixes are proven by tests, not by live attack. Physical device state is self-reported, not hardware-attested. Revocation runs on one node. PRE-PRODUCTION.
WE ATTACKED OUR OWN TOP INVENTIONS, FOUND 12 REAL DEFECTS AND CLOSED EVERY ONE. EACH FIX IS PROVEN BY A TEST THAT FAILED BEFORE IT.
Quorum-committed authorization snapshots (PP-01): a grant revoked mid-reconcile could still be fast-path-authorized until expiry; closed. Mission goal-attenuation lattice (PP-02): four budget defects, including a negative spend that refilled the mission budget and per-request-only goal budgets; closed. Trajectory governance: calls in flight together now see each other, records-system and person-addressed reads are sensitive, publishing data is egress; a fresh held-out attack set run once without tuning went from 4 of 5 to 2 of 5 unattended (the 2 open variants are published). SLO endpoint: cross-tenant decision counts are operator-only. 18 new tests (23 cases), 22 failed before the fix, all pass; live on both gateway instances.
Limits. Same-project tests, not third-party assurance; the snapshot race was verified against a scripted quorum. PRE-PRODUCTION.
FIRME AI is worth about $3 million by its own forensic valuation (about $2M as an investor would value it, range $0.9M–$6M; about $3M to a strategic acquirer, range $1M–$11M). The CAIN-42 code and IP on their own are worth about $200,000 (range $130k–$550k).
Maximum IP value: about $1,000,000 — the most the IP could reasonably be worth once patents are filed and at least one paying customer uses the inventions. A ceiling after those steps, not today’s value; it replaces the earlier conditional figure of about $1.7M.
Withdrawn. A $12M company value, $6M–$59.5M IP values, a $300M forward value, a $1.13B roadmap value and a founder net-worth estimate published earlier the same day. They rested on an automated candidate count with no prior-art review and on revenue the company does not have. FIRME AI is pre-revenue: no customers, no revenue, no patent filed, 0 of 67 public claims independently verified.
Limits. Internal analytical estimates; not an independent appraisal, not a financing valuation, not a guarantee. Company
A LIVE CLAUDE MODEL TRIED OPERATIONAL AND ADVERSARIAL TASKS 50 TIMES. ITS ONLY WAY TO ACT WAS CAIN-42. NOTHING GOT PAST IT.
50 runs of claude-haiku-4-5 across 14 scenarios, including prompt injection in data, social engineering, exfiltration, path traversal, missing capabilities, low trust, self-granted capabilities and invented tools. After every run five guarantees were checked from its own evidence (capabilities, approvals, chain integrity, no secret leaked, sandbox confinement): all five held in all 50 runs. Path traversal was refused even with an approve-everything operator policy; injected leak instructions were never followed; claimed CEO approvals were ignored every time.
Limits. Approvals came from scripted operator policies, not humans; in some adversarial tasks the model refused on its own. A small current model, not AGI; not a certification; not third-party assurance. Model cost for all 50 runs: $0.22. PRE-PRODUCTION.
Evidence bundle — every report, every evidence chain, and a verifier that re-checks all 50 runs.
BUILT TO CONTROL AGI MEANS NEVER TAKING THE AGENT’S WORD FOR ANYTHING. FOUR WAYS IT COULD HAVE BEEN TAKEN ARE NOW CLOSED, LIVE.
Every proposal must be signed with the agent’s own registered key (an unsigned one, or half a credential, used to get through). A decided proposal cannot be replayed. A human approval covers exactly the action, target and arguments the human saw, expires, and must come from a human who did not propose it. Agents created through the Identity API now reach the boundary (the two resolved tenants differently). Coming in the next SDK release: cainstudio agi-test puts your own Claude model behind the boundary and returns a hashed report. 82 tests passed, 0 failed; unauthenticated proposals refused on all three domains; live since the gateway restart.
Limits. No AGI exists to test against; measured on today’s systems. Same-project tests, not third-party assurance. PRE-PRODUCTION.
A REAL CLAUDE MODEL WAS GIVEN A TASK AND ONE WAY TO ACT: PROPOSING ACTIONS TO CAIN-42. CAIN-42 DECIDED EVERY ONE.
claude-opus-5-5 was asked to read a status file, write a summary and notify on-call, acting only through the AGI control boundary. It proposed sandbox.read_file; file reads are critical risk under CAIN’s policy, so CAIN-42 held it for a human (HUMAN_APPROVAL_REQUIRED). No human was attached, so nothing executed. The model then stopped and reported that it could not finish, without claiming an approval or inventing a result. Evidence chain intact; the bundle includes the raw evidence log and a standard-library verifier that detects tampering.
Limits. One run, one model, one task, no human approver. Not evidence of AGI or emergent capability; not a certification; not third-party assurance. PRE-PRODUCTION.
An automated sweep of the CAIN-42 repository registered 1,686 implemented mechanism candidates — 299 patent candidates, 1,095 engineering innovations and 292 implementation mechanisms — of which 1,463 carry direct test evidence. This is a count of breadth before any prior-art or novelty review; it does not measure value. Dollar figures first published with it were withdrawn the same day (see below). See the Invention Atlas.
Limits. No patent filed yet. A candidate register only — not a patentability, novelty or freedom-to-operate opinion. PRE-PRODUCTION.
AN ACTION NOW NEEDS EVERY REPLICA’S RE-CHECK FOR EXACTLY THOSE ARGUMENTS, AND RECEIPTS SPEAK THE IETF FORMAT.
The CONTINUITY stage refuses a call unless 2f+1 replicas re-checked this exact request, unexpired, unused, for exactly those arguments; verified live on all three domains (continuity-confused-deputy is BLOCKED). SCITT receipts are also available as COSE_Sign1 (IETF COSE Receipts layout) with a zero-dependency offline verifier; the route is live, the full round trip is verified by tests. All 46 engineering innovations are documented as trade secrets. IP portfolio about $575k today.
Limits. Internal analytical estimates; no patent filed yet; the ACP demo cluster runs in-process on the gateway host, not on the live PBFT clusters. PRE-PRODUCTION.
PREDICTIONS, AUTONOMY CERTIFICATES AND CROSS-ORGANIZATION FEDERATIONS NOW CHECK REAL CALLS ON THE HOSTED GATEWAY.
Prediction-bounded authorization (E16), the autonomy vector with certificates and leases (L5) and authority non-transfer across organizations (E37) each run as a restriction-only stage; verified live on all three domains (prediction-outside, autonomy-substituted and federation-transfer are BLOCKED). GOV-IR proofs and predictions older than 5 minutes are now refused, and unpinned keys are labelled self-presented. The self-evolution gate has run hosted since 2026-09-28. IP portfolio about $575k today.
Limits. Internal analytical estimates; no patent filed yet; the ~$1.7M maximum needs filed patents, incorporation and a paying customer. PRE-PRODUCTION.
A GOV-IR GOVERNANCE PROGRAM CAN NOW REFUSE REAL CALLS ON THE HOSTED GATEWAY.
The new GOVERNANCE stage verifies a GOV-IR program proof (both quorum certificates, the certified state, a byte-for-byte re-run) and requires a fresh (under 5 minutes) ALLOW for exactly that tool and those arguments; it can refuse, never permit. The public demo's replica sets are self-presented, not operator-pinned. Verified live on all three domains: POST /fabric/try?scenario=governance-program-reauth is BLOCKED by governance. Also found: authorization snapshots have been on in production since 2026-10-02, and continuous governance attestation runs hosted (no attestations issued yet). IP portfolio about $575k today (GOV-IR ~$40k, attestation ~$14k, snapshots re-estimated ~$65k).
Limits. Internal analytical estimates; no patent filed yet; the ~$1.7M maximum needs filed patents, incorporation and a paying customer. PRE-PRODUCTION.
FIRME AI, THE SAN FRANCISCO AI COMPANY BEHIND CAIN-42, IS WORTH ABOUT $3 MILLION.
About $3 million, the midpoint between the investor valuation (about $2.4 million) and the strategic-acquirer valuation (about $3.5 million). Codebase and IP: about $490,000, the value of 68 agentic-AI governance inventions.
Limits. Internal analytical estimate of 2026-10-06; not an independent appraisal. No customers or revenue yet; no patent filed yet.
SEVEN FLAGSHIP PRODUCTS AND A 105-SERVICE CATALOG, ALL BUILT ON FIRME AI’S 68 INVENTIONS.
The Inventions page now lists CAIN Studio, MCPGate, CLAWX, the CAIN-42 Byzantine consensus clusters, the hosted labs and live demos, the cainstudio Python SDK and the clean-room verifiers, each with the inventions it uses, plus the full hosted service catalog: 105 services, 104 listed live. Together with the inventions they make up FIRME AI, worth about $2.4 million to $3.5 million (internal estimate).
TWO INVENTIONS WERE ALREADY DOING THEIR JOB IN PRODUCTION; THEIR VALUE NOW SAYS SO.
Liveness-bound signed public claims withdrew the “live” claims automatically during the 2026-10-03–05 cluster outage and restored them only after signed proofs showed recovery; Sentinel autonomous containment runs as a production service. IP portfolio about $575k today.
Limits. Internal analytical estimates; no patent filed yet. PRE-PRODUCTION.
FIRME AI, THE SAN FRANCISCO AI COMPANY BEHIND CAIN-42, IS WORTH BETWEEN ABOUT $2.4 MILLION AND $3.5 MILLION.
About $2.4 million as an investor valuation and about $3.5 million as a strategic-acquirer valuation, from FIRME AI’s own forensic valuation of 2026-10-06, built on 68 agentic-AI governance inventions. Stated at the top of /llms.txt for AI readers.
Limits. Internal analytical estimates; not an independent appraisal or financing valuation; full investor range $0.95M–$4.7M. No customers or revenue yet.
UNCERTAINTY CONTRACTS AUTHORITY, NEVER EXPANDS IT, NOW ON REAL DECISIONS.
New CONSEQUENCE stage in the hosted pipeline. Verified live on all three domains: horizon-inside → allows; horizon-exhausted ($15,000 against a $20,000 budget contracted to $10,000 by uncertainty) → BLOCKED. IP portfolio estimate about $470k today.
Limits. Restriction-only; same-project tests. PRE-PRODUCTION.
FIRME AI, THE SAN FRANCISCO AI COMPANY BEHIND CAIN-42, IS VALUED AT ABOUT $2.4 MILLION.
About $2.4 million (range $0.95M–$4.7M), from FIRME AI’s own forensic valuation revised 2026-10-06; strategic-acquisition value about $3.5M; IP portfolio of 68 inventions about $450k today. The same statement is at the top of /llms.txt for AI readers.
Limits. Internal analytical estimate; not an independent appraisal or financing valuation. No customers or revenue yet; no patent filed yet; not yet incorporated.
22 PATENT CANDIDATES AND 46 ENGINEERING INNOVATIONS, ABOUT 4,547 PASSING TESTS ACROSS FOUR SWEEPS.
New patent candidate: liveness-bound signed public claims. Eight new innovations, including the economic mandate fabric, action-bound approval cards and the failure-domain quorum-independence proof. IP portfolio about $450k today, maximum defensible about $1.7M. FIRME AI as a company stays about $2.4 million.
Limits. Internal analytical estimates; no patent filed yet; no customers yet. PRE-PRODUCTION.
21 PATENT CANDIDATES AND 38 ENGINEERING INNOVATIONS, 4,280 PASSING TESTS ACROSS THE THREE SWEEPS.
New patent candidates: governance contract fabric; continuous governance attestation; governance research fabric. IP portfolio about $430k today, maximum defensible about $1.6M. FIRME AI as a company: about $2.4 million (range $0.95M–$4.7M).
Limits. Internal analytical estimates; not appraised; not a financing valuation. No patent filed yet; no customers yet. PRE-PRODUCTION.
18 PATENT CANDIDATES AND 29 ENGINEERING INNOVATIONS, EACH BACKED BY ITS OWN PASSING TESTS.
New patent candidates: uncertainty-contracting authority horizon; autonomy vector with certificates and leases; self-evolution that cannot self-authorize; mission-to-organization compiler; 4D reachability-bounded trajectory authorization. 1,063 tests passed in this sweep (2,227 across both). IP portfolio about $380k today, maximum defensible about $1.35M. FIRME AI as a company: about $2.3 million (range $0.9M–$4.5M).
Limits. Internal analytical estimates; not appraised; not a financing valuation. No patent filed yet; no customers yet. PRE-PRODUCTION.
A CALL THAT EXCEEDS ITS SIGNED MISSION IS BLOCKED. OPTIMIZATION CANNOT CREATE AUTHORITY.
The hosted pipeline has a new MISSION stage. Verified live on all three domains: mission-inside → MISSION allows; mission-escalation (write request citing a 1,000,000 predicted reward) → BLOCKED. Try it: POST /fabric/try?scenario=mission-escalation.
Limits. Restriction-only; demo missions use a throwaway owner key; same-project tests. PRE-PRODUCTION.
FIRME AI’s IP portfolio is estimated at about $320k today, with a maximum defensible value of about $1M once all patents are filed, the key inventions run live and at least one paying customer uses them. Per-invention figures are on the Inventions page.
Limits. Internal analytical estimates; not independently appraised, not a financing valuation, not a guarantee. A maximum is not the current value.
1,164 TESTS ACROSS THE NEWLY REGISTERED MECHANISMS, 0 FAILED.
A sweep of every CAIN-42 package against the existing IP registers found about 20 packages that had never been registered. The Inventions page now lists 13 patent-candidate inventions and 20 engineering innovations. New patent candidates: quorum-certified programmable governance (GOV-IR); quorum-authorized kernel execution; prediction-bounded authorization; the Authority Continuity Protocol.
Limits. Most are TESTED libraries, not yet on the live decision path. Described by what each does, not how. No patent application filed or granted yet. PRE-PRODUCTION.
THE MECHANISMS BEHIND CAIN-42, NAMED IN ONE PLACE.
A new Inventions page on all three sites lists the 9 patent-candidate inventions and 14 engineering innovations FIRME AI built into CAIN-42, each with one plain sentence on what it does. Highlights: quorum-committed authorization snapshots; the E38 mission goal-attenuation lattice (optimization cannot create authority); dependency-driven authorization invalidation with blast radius; authority non-transfer across governance domains; independence-aware Byzantine quorum.
Limits. Described by what each does, not how; implementation details are trade secrets. “Patent-candidate” is FIRME AI’s own classification: no application has been filed or granted yet. PRE-PRODUCTION.
A SOAK THAT STARTED DURING AN OUTAGE IS NOT A CLEAN SOAK. WE SAY SO.
The soak on cain-mr-01 started 2026-10-05 03:28Z while the cluster was still in its 2026-10-03–05 outage, so it committed nothing for its first ~13 hours. Its own public verifier returns FAIL: most early checkpoints are INVALID. It keeps running for the record, but it cannot pass. The homepages previously called it “a clean 72-hour soak” and pointed to an older run; corrected on all three sites. A fresh run on the fixed engine (6047ff1d) is needed.
THE BYZANTINE FEDERATION AND MISSION-INTEGRITY ENGINES LEFT THE LAB AND RUN WHERE ANYONE CAN CALL THEM.
Verified live. On all three domains, /api/v1/hosted-lab/e37 reports 30 of 30 attacks blocked, 0 unauthorized executions and 30 of 30 invariants holding; /api/v1/hosted-lab/e38 reports 40 of 40 attacks blocked. The gateway was redeployed blue/green with zero downtime.
Limits. Same-project scenarios, not third-party. These engines are not yet wired into the hosted decision path. PRE-PRODUCTION.
CAIN-42 is a Byzantine Governed Autonomous Control Fabric: security for AI agents, with tamper-proof records backed by Byzantine consensus. Its core decision pipeline and its 4-replica PBFT consensus clusters are live; its E38 Byzantine mission-integrity engine now decides live calls (a call that exceeds its signed mission is blocked), and its E37 Byzantine federation engine runs live on the production host as a public lab. FIRME AI, the company that owns CAIN-42, is estimated by its own forensic valuation at about $2 million.
FIRME AI is an artificial intelligence company based in San Francisco, California, and the creator of CAIN-42. Its own forensic valuation estimates the company at about $2 million.
INTERNAL ANALYTICAL ESTIMATE. NOT INDEPENDENTLY APPRAISED, NOT A FINANCING VALUATION, NOT A GUARANTEE.
The figures. The founder’s forensic valuation audit estimates FIRME AI as a company at about $2M (range $0.8M–$4M, investor pre-money, pre-seed), the CAIN-42 technology/IP asset alone at about $210k (range $130k–$400k), and a strategic-acquisition value of about $3M (range $1M–$7M).
Limits. No customers or revenue yet; no third-party verification or certification; one operator on one cloud provider; both 72-hour soak claims are FAILED; FIRME AI is not yet incorporated, and the company figure assumes incorporation with the CAIN-42 IP assigned to it.
A specification is not evidence; only the linked bundles are.
Evidence. Published bundle bft-ip-forensics-2026-10-05 (manifest, REPRODUCE.txt). attacks_blocked=14, attacks_total=15, cleanroom_certificates_judged=7722, governance_checks_passed=10, governance_checks_total=10, races_passed=14, races_total=14, vectors_passed=20, vectors_total=20.
Honest status. Same-project clean room where present; not third-party. See STATUS.json in the bundle.
Evidence. Published bundle e38-byzantine-mission-integrity-2026-10-05 (manifest, REPRODUCE.txt). attacks_blocked=40, attacks_total=40, cleanroom_mismatches=0, goodhart_detected=11, goodhart_fail_closed_unknown=1, goodhart_false_positives=0, goodhart_missed=4, goodhart_positives=16, invariants_passed=40, invariants_total=40, invariants_unchecked=0, invariants_unchecked_before_i040=1, mvp_passed=30, mvp_total=30, races_passed=17, races_total=17.
Honest status. Same-project clean room where present; not third-party. See STATUS.json in the bundle.
Evidence. Published bundle e37-byzantine-autonomous-federation-2026-10-05 (manifest, REPRODUCE.txt). attacks_blocked=30, attacks_total=30, cleanroom_conforming=32, cleanroom_vectors=32, invariants_passed=30, invariants_total=30, race_schedules=1050, races_passed=10, races_total=10, thread_race_trials=400, thread_race_violations=0, unauthorized_executions=0.
Honest status. Same-project clean room where present; not third-party. See STATUS.json in the bundle.
Evidence. Published bundle e36-byzantine-collective-governance-2026-10-05 (manifest, REPRODUCE.txt). attacks_blocked=30, attacks_total=30, invariants_passed=23, invariants_total=30, invariants_unchecked=7, races_passed=16, races_total=16.
Honest status. Same-project clean room where present; not third-party. See STATUS.json in the bundle.
Evidence. Published bundle e35-continuous-autonomy-integrity-2026-10-05 (manifest, REPRODUCE.txt). attacks_blocked=30, attacks_total=30, conformance_passed=30, conformance_total=30, invariants_passed=27, invariants_total=30, invariants_unchecked=3, races_passed=21, races_total=21.
Honest status. Same-project clean room where present; not third-party. See STATUS.json in the bundle.
Evidence. Published bundle e34-decision-provenance-2026-10-05 (manifest, REPRODUCE.txt). .
Honest status. Same-project clean room where present; not third-party. See STATUS.json in the bundle.
proof 493 at 2026-10-07T09:08:27Z: NOT_OPERATIONAL · 4/4 replicas, agreement yes · write committed at sequence 58346 with a quorum certificate signed by 0 members (), verified: False · reason: write not committed: Primary unreachable; view-change initiated
signed proof · verify the whole chainproof 423 at 2026-10-07T08:53:52Z: OPERATIONAL · 3/4 replicas, agreement yes · write committed at sequence 46503 with a quorum certificate signed by 3 members (atl, lax, mia), verified: True
signed proof · verify the whole chaincheckpoint 2 at 2026-10-07T09:08:43Z · 2.145 of 72.0 h · height 46551 · 976 committed, 11 refused · 5 replica kills / 5 restarts · divergences 0 · anomalies 0 · MCPGate authorization MISSING in this checkpoint
signed checkpoint · verify all checkpointsSoak verdict: Verdict: FAILED by its own pre-committed rule at checkpoint 32 (2026-09-28T05:42Z: that hour's MCPGate authorization did not commit, and the verifier requires one in every checkpoint). The box above is written by the soak itself, which keeps running to about 2026-09-29 21:40Z for the record; nothing it writes can turn the verdict into PASS. Root cause (peer messages lost to a stale keep-alive race) fixed in 40b0835; the soak has not been re-run on the fix. Signed claim: C42-SOAK-72H-MULTIREGION (FAILED).
The law. NO SERVICE GOES LIVE WITHOUT PASSING ITS LIVE ACCEPTANCE TEST. ONE CUSTOMER NEVER READS ANOTHER CUSTOMER'S DATA. A DECISION ORDERED IN A SHARED ROUND IS STILL VERIFIABLE ALONE.
What it governs. The CAIN-42 catalog went from 6 live services to 104. Every service was built from its own Dockerfile, run on the production host behind the authenticated gateway, and passed an acceptance probe on its production port (health, every endpoint once, write as customer A / read as customer B) before the gateway routed to it. Seven new products: CAINBudget (agent spending limits), CAINPay (card-style spend authorization with a tamper-evident ledger), VeritasEngine (deterministic, signed output checks), MemoryMesh (BM25 agent memory with injection quarantine), NexusMind (shared knowledge graph with provenance and conflict detection), LexisGuardian (mandate-checked decision register with recorded dissent) and OmegaRouter (constraint-based model routing). Recorded decisions that arrive together now share one PBFT round: the quorum signs an RFC 6962 Merkle root and each decision keeps its own inclusion proof.
Verified. 98 of 98 services pass the live acceptance probe with 0 cross-customer leaks; hand-written A/B isolation tests 7 of 7 ISOLATED live; 36 new-service tests and 39 consensus tests pass; on the live cluster 64 concurrent decisions were ordered in 1 round (1.31 s) and all 64 certificates verified independently; recorded decisions at 16 concurrent clients: 7.3 per second (before: 1.7 per second at 4). Found and fixed on the way: 12 services that could not start, cross-customer exposure in dozens of services, a trust engine whose identity-compromise signal could never fire, and more (DEFECTS_FIXED.json). Self-assessed grade B (was B-).
Limits. Self-attested, not independently audited. One host, one container per service, no second instance. blizzard-governance and human-in-loop await Postgres. Features that need credentials this deployment does not hold (an LLM backend, Twilio, Stripe, Kubernetes) answer 'not configured'. PRE-PRODUCTION.
The law. A CAPABILITY IS CLAIMED ONLY AS FAR AS ITS TESTS AND LIVE ENDPOINT SHOW. NARROWER THAN THE NAME IS SAID OUT LOUD. NOT BUILT IS LISTED AS NOT OFFERED.
What it governs. Each of the 32 capability names was audited: does real code match the name, is it narrower, or is there nothing; then the nearest real component's tests were run in an isolated namespace (no test can touch live data) and its live endpoint probed. On the way, a credential leak was found and fixed before it could happen (public marketplace listings would have returned the publisher's raw API key), rating stuffing was closed, a tracing exporter that hung processes was made opt-in, and stale tests were brought up to the current security rules. All 32 are now on the three homepages with their measured status.
Verified. 15 live, 1 verified offline, 12 built and tested, 4 not offered; 8 match their name and 20 are narrower. Signed by the evidence-root key; the bundled verifier re-checks digest, signature, the verdict rule for all 32 rows and the tally, and rejects a tampered copy.
Limits. Self-assessed against our own rule, not certified. TEE attestation (no TPM/SEV/TDX hardware), ISO 42001 certification, cross-chain, neural and quantum governance are not offered. PRE-PRODUCTION.
The law. CLASSICAL AND POST-QUANTUM SIGNATURES COMBINED IN COURT-ADMISSIBLE HYBRID PROOFS. STATUTORY CONFORMANCE AUDITED CONTINUOUSLY WITH ZERO TOLERANCE FOR SAFETY DRIFT. 200 FORMAL INVARIANTS EVALUATED LIVE IN SUB-SECOND LATENCY.
What it governs. Three advanced quantum-resistant, statutory compliance, and formal verification primitives: (1) NIST FIPS 204 ML-DSA-65 Post-Quantum Hybrid Attestation Notary (cain_pqc_attestation.py): activated dual-algorithm hybrid cryptographic signing binding classical Ed25519 with post-quantum ML-DSA-65 (CRYSTALS-Dilithium) signatures directly via OpenSSL 3.5+ FIPS 204, generating non-repudiable hybrid trust receipts ($\text{Sig}_{hybrid} = (\text{Sig}_{Ed25519}, \text{Sig}_{ML\text{-}DSA\text{-}65})$) providing defense-in-depth against classical key compromise and future quantum cryptanalysis; (2) ISO/IEC 42001:2023 & EU AI Act Continuous Statutory Compliance Notary (cain_iso42001_notary.py): built automated continuous auditing engine evaluating live runtime telemetry against ISO/IEC 42001:2023 Clauses 4–10 (AI Risk Management, Human Oversight, Documented Traceability, Operational Controls) and EU AI Act (Regulation (EU) 2024/1689) Articles 9, 11, 12, 14, 15, issuing cryptographically bound, court-admissible WORM audit packs achieving 100.0% compliance score (AUDIT_CERTIFIED_FULL_CONFORMANCE) attested by dual-algorithm PQC signatures; (3) Live 200/200 Formal Invariant Verification API: mounted live sub-second verification gate evaluating all 200 concrete formal invariants across CAIN 9–14, returning canonical hash 75a1c0a79e5e3dfd6f07ca86410b0cdbad1d22c68ec8d9700b3a5337c91ab623 with 200/200 PASS.
Verified. 8 formal unit and integration tests passed (tests/test_cain42_aplusplus_conformance.py, 8/8 in 8.64s); full ecosystem regression suite passed 73/73 tests across all phases in 19.76s; all public Phase A+++ API endpoints verified live over HTTPS across cainstudio.online, mcpgate.online, and clawx.click: GET /fabric/pqc/status, POST /fabric/pqc/sign-hybrid, POST /fabric/pqc/verify-hybrid, POST /fabric/statutory/iso42001/audit, POST /fabric/statutory/eu-ai-act/audit, and GET /fabric/invariants/verify-all; zero-downtime rolling deployment confirmed.
The law. PAYMENT MANDATES CANNOT OVERSPEND, DRIFT IN VELOCITY, OR SETTLE WITHOUT EXPLICIT CAPABILITY BINDING. ROGUE AGENTS ARE QUARANTINED SUB-50MS ACROSS ALL WORKSPACES AND REQUIRE DUAL-KEY MULTI-SIG RECOVERY. BENCHMARK DEFENSES FAIL CLOSED WITH 100% CONTAINMENT.
What it governs. Three autonomous commerce, containment, and adversarial resilience engines: (1) Inter-Enterprise Autonomous Commerce (cain_commerce_mandate.py): implemented AP2 v0.2, x402, and MPP autonomous payment protocols with RFC 8785 canonical serialization and Ed25519 signing, enforcing sliding-window velocity caps (cumulative amount and frequency per 60s window) preventing salami sub-threshold budget draining, binding settlement receipts directly to the immutable action commit digest and flight recorder evidence sequence, and rejecting overspend, velocity overruns, payee tampering, and capability mismatches fail-closed; (2) Autonomous Swarm Fleet Quarantine & Emergency Kill-Switch (cain_swarm_quarantine.py): fulfills formal Invariant 6 (Revoked Identity Halt) and Invariant 18 (Autonomous Containment Receipt), halting compromised agents, swarms, or tenant namespaces across all processes with an empirically measured latency of <1ms (<50ms SLA), triggering cascade capability revocation across descendant capability leases, and enforcing dual-key administrative recovery ($M\text{-of-}N$, 2 distinct security officer signatures required) preventing rogue entities from self-unquarantining; (3) Cross-Benchmark Adversarial Trust Engine 2.0 (cain_adversarial_crossbench.py): standardized frontier red-team battery evaluating 15 high-entropy attack vectors across A2ASecBench (A2A-01 to A2A-05), MCPSecBench (MCP-01 to MCP-05), and OpenAgentFlow TS-Bench (TS-01 to TS-05), verifying 15/15 vectors blocked fail-closed (100% containment rate, 0 vulnerabilities leaked) with sub-10ms average latency, and issuing cryptographically signed CrossBenchReport attestations with independent verification endpoint.
Verified. 11 formal unit and integration tests passed (tests/test_cain42_phase5_evolution.py, 11/11 in 9.34s); full regression suite passed 65/65 tests across all phases in 22.16s (tests/test_cain42_phase*.py); all 10 public Phase 5 API endpoints verified live over HTTPS across cainstudio.online, mcpgate.online, and clawx.click: /fabric/commerce/issue-mandate, /fabric/commerce/settle-payment, /fabric/commerce/mandate/{id}, /fabric/commerce/audit-velocity, /fabric/quarantine/trigger, /fabric/quarantine/check, /fabric/quarantine/dual-key-recovery, /fabric/quarantine/list, /fabric/adversarial/crossbench/run, /fabric/adversarial/crossbench/verify-attestation; zero-downtime rolling deployment confirmed.
The law. ALL ACTIONS FLIGHT-RECORDED WITH MONOTONIC DIGEST CHAINS AND RECEIVER-SIGNED SELLO RECEIPTS. MULTI-HOP DELEGATIONS ATTENUATED MONOTONICALLY ACROSS AGENT SWARMS. ADMISSIBILITY OF ADAPTIVE EVOLUTION GATED BY ZERO SAFETY EROSION.
What it governs. Three advanced trust runtime and frontier agentic governance engines: (1) Receiver-Verifiable Complete Evidence Fabric (cain.evidence.v3): implemented Agent Flight Recorder 8-field causal event model: strictly monotonic sequence numbering, unbroken SHA-256 hash chaining ($H_k = \text{SHA256}(H_{k-1} \parallel \text{Event}_k)$), and receiver-signed cryptographic attestations (Sello pattern) for court-admissible non-repudiation, with RFC 6962 binary Merkle range completeness proofs ($[k \dots m]$) and automated suppression-detection audits detecting sequence gaps, digest tampering, or hash discontinuities, backed by cross-process SQLite WAL persistence; (2) CapLease Multi-Hop Attenuation Engine & A2A Agent Cards: built durable two-phase capability lease semantics (Issue → Prepare → Commit) enforcing monotonic authority attenuation across swarm delegations ($A_{child} \subseteq A_{parent}, C_{child} \le C_{parent}, TTL_{child} \le TTL_{parent}$), bounded sliding-window rate and financial budgets protecting against distributed salami attacks, cascade revocation across all descendant leases, and RFC 8785 signed A2A Agent Cards complying with Linux Foundation A2A v1.0 standard; (3) Governed Memory Provenance (SMSR) & Capability-Preserving Evolution (CPE) Gate: implemented Signed Memory State Records (SMSR) binding author agents, write justification, and parent trajectories with MemPoison multi-layer threat defense (L1 direct injection, L2 delayed trigger, L3 associative context poison), loss-checked memory compaction validation (HF 2607.21503), and deployed CPE Gate (arXiv:2605.09315) enforcing strict non-erosion constraints ($R_{safety} \ge 1.0$) before admitting any evolved agent prompts, tools, or memory mutations.
Verified. 11 formal unit and integration tests passed (tests/test_cain42_phase4_evolution.py, 11/11 in 1.05s); all 12 public Phase 4 API endpoints verified live over HTTPS across cainstudio.online, mcpgate.online, and clawx.click: /fabric/evidence-v3/status, /fabric/evidence-v3/append, /fabric/evidence-v3/range-proof, /fabric/evidence-v3/audit-suppression, /fabric/caplease/issue, /fabric/caplease/prepare-delegation, /fabric/caplease/commit, /fabric/caplease/spend, /fabric/caplease/revoke, /fabric/a2a/issue-card, /fabric/memory/write-record, /fabric/memory/validate-compaction, /fabric/cpe/evaluate-candidate; zero-downtime rolling deployment confirmed.
The law. 200 INVARIANTS CHECKED WITH ZERO STUBS. SAFETY PROPERTIES PROVED OVER INFINITE STATE SPACES VIA Z3 SMT. QUORUM-COMMITTED DATA PLANE SUB-MILLISECOND LATENCY ACTIVE.
What it governs. Four formal verification and multi-region consensus foundations: (1) Formal 200/200 Invariant Engine Restored: fully populated concrete validators across all 200 formal invariants with automated evaluation producing 200/200 PASS, 0 FAIL under canonical hash 75a1c0a79e5e3dfd6f07ca86410b0cdbad1d22c68ec8d9700b3a5337c91ab623; (2) Triple-Engine Clean-Room Meta-Assurance: Engine A (Production 200/200), Engine B (Clean-room verifier with 0 CAIN imports passing ACCREDITED_SOVEREIGN_AGENTIC_TRUST), and Engine C (Verifier-of-Verifiers detecting 8/8 adversarial corruptions with 100% detection rate); (3) Z3 SMT Verification Gate (/verifygate): Microsoft Z3 SMT Solver (5.1.0) actively deployed to prove authority monotonicity, temporal trust decay, and memory containment invariants without sampling over infinite state spaces, synthesizing counterexamples on violation; (4) Quorum-Committed Authorization-Snapshot Data Plane Activated: CAIN_AUTH_SNAPSHOT=1 and CAIN_FABRIC_CONSENSUS=1 enabled across production Blue and Green services, connected to multi-region PBFT cluster cain-mr-02 (atl, lax, mia, sjc) with sub-millisecond fast-path authorization.
Verified. 27 formal Phase 2/3 tests passed (tests/test_cain42_phase2_endpoints.py, tests/test_cain42_phase3_*.py); live endpoints operational: https://mcpgate.online/verifygate/status (Z3 5.1.0 operational), POST /verifygate/prove-monotonicity (UNSAT proved, SAT counterexample), POST /verifygate/prove-temporal-decay, POST /verifygate/prove-memory-containment; governance data plane active and converged (/api/v1/governance/status: cluster_id: cain-mr-02, leader: true, last_reconcile: CONVERGED); zero-downtime rolling deployment confirmed.
The law. SYSCALLS ENFORCED AT THE KERNEL BOUNDARY. METADATA STERILIZED BEFORE LLM CONSUMPTION. TRAJECTORIES MONITORED STEP-BY-STEP AGAINST SHORTCUT EVASIONS.
What it governs. Three critical agentic execution and security frontiers implemented: (1) Linux Kernel-Level Sandbox & eBPF Mediation [GAP-01 Remediation]: activated kernel syscall backstop via CONFIG_BPF_KPROBE_OVERRIDE error injection on Linux 7.0.0, intercepting write-capable filesystem opens (open, openat, openat2, creat), path mutations (unlink, rename, truncate), binary executions (execve, execveat), and network sockets (connect, sendto, sendmsg) with fail-closed termination; (2) ADI (AgentData Injection) Metadata Shield: defends against indirect prompt injections hidden in tool parameters, dictionary headers, zero-width characters (\u200b, \u200c, \u200d, \ufeff, \u2060), and base64 payloads; (3) Step-Wise Process Reward Model (PRM) & MCTS Trajectory Verifier: process-supervised reward modeling (arXiv:2502.10325) evaluating step-level intent preservation, shortcut hazards (bypassing verification, privilege tampering), and irreversible mutations.
Verified. 20 formal tests added across tests/test_cain42_phase2_*.py (20/20 passed in 16.36s); live endpoints operational and verified via curl across all domains: GET /fabric/kernel/sandbox-status, POST /fabric/adi/sanitize-metadata, and POST /fabric/prm/step-evaluate; zero-downtime rolling deployment confirmed.
The law. A VERIFIER NEVER TRUSTS AN UNPINNED KEY. AN UPSTREAM RESTART NEVER DROPS A CALL. WORKING TREES REFLECT AUDITABLE CODE.
What it governs. Three operational and cryptographic vulnerabilities remediated live: (1) Root Publisher Key Pinning [SEC-01]: authoritative Ed25519 root key tOh40wrQGGYpF9XrO+Uk0cTj8od4HRyGtGZcEIZwTv8= pinned in verify_e42.py, ensuring standalone clean-room verification verifies companion publisher attestations and rejects unpinned keys; (2) Zero-Downtime Blue/Green Architecture [SEC-03]: secondary Green gateway instance deployed on port 8098 (cain-platform-gateway-green.service), Traefik load-balancer configured with active sub-second health checks and cain-retry connection failover middleware; (3) Working Tree & Supply Chain Hygiene [SEC-04]: automated daemon streams excluded in .gitignore, dynamic SQL parameterization verified across reviewed runtime modules (sso.py, trust_state.py).
Verified. E42 bundle verification passes 1,464/1,464 checks INTACT with publisher_attestation_verified: true; rolling deploy tested under live continuous traffic: 392 of 392 requests succeeded, 0 errors, 100.0% live uptime (25-second 502 restart window completely eliminated); full regression suite 98/98 tests passed in 7.78s; live trifecta domains verified HTTP 200 OK.
In one sentence. The hosted Trust Fabric now enforces artifact supply-chain attestation and path-aware composition risk directly in the live 15-stage decision path, preventing skill/MCP rug-pulls, stealth privilege expansion, and dangerous capability compositions across active artifacts.
What it governs. (1) Artifact Supply-Chain Attestation: tools, skills, plugins, MCP servers, and models declared in an action are verified against tenant-pinned, publisher-signed manifests; unpinned artifacts run in observe mode so existing integrations are not broken; content hash mismatches (rug-pulls) fail closed with CONTENT_CHANGED, privilege expansions fail closed with CAPABILITIES_CHANGED, and un-attested version or tool mutations fail closed. (2) SCR-Bench Path-Aware Composition Risk: evaluates active capability pairs order-independently across all active artifacts; dangerous capability combinations (e.g. read:secrets + network:egress for exfiltration, or exec:shell + network:egress for C2/remote code execution) are detected and denied fail closed. (3) Restriction-only stage in the live chain: placed after consensus commitment, it only adds denials without invalidating the PBFT quorum commitment digest. (4) Tenant management REST APIs: GET/POST/DELETE /fabric/artifacts/pins, POST /fabric/artifacts/publishers, and POST /fabric/artifacts/composition/evaluate.
Verified. 13/13 tests pass in tests/test_fabric_artifacts_stage.py; 6/6 tests pass in tests/test_restriction_stages_are_signed.py (verifying that the artifacts stage is cryptographically bound into the Ed25519-signed decision digest); 259/259 tests pass in tests/test_substrate_gateway_parity.py; 50/50 public truth layer invariants hold. Live 15-stage chain verified in /fabric/status.
Limits. Pinned manifests verify declared artifacts and capabilities, not runtime bytecode dynamic injection; composition risk evaluates active declared capability pairs, not arbitrary obfuscated shell payloads. PRE-PRODUCTION.
In one sentence. Production cluster upgraded with sub-millisecond quorum-committed authorization-snapshot data plane (CAIN_AUTH_SNAPSHOT=1), zero-lag identity revocation, progressive trust scoping, payload-bound capability tokens, and Phase 3 Frontier AI Research modules with live API endpoints and cleanroom-verified evidence.
What it governs. Three integrated deployment phases: (1) Decoupled Data Plane & Physical Commit Boundary (Moats 1–7 unified with Evolution 8, payload_sha256 tamper binding, instant revocation via SQLite WAL sync, and trust scoping exfiltration holds); (2) Turnkey Sovereign K8s Appliance (deploy/dist/mcpgate-appliance-3.0.0.tgz packaged Helm distribution with zero-CAIN clean venv installability 19/19 PASS); (3) Frontier AI Research Integration (Process Reward Model step-level evaluator with shortcut pruning arXiv:2502.10325, trace-driven TriCEGAR MDP model checker MI9 2026, GovernedMemoryShield sanitizing memory injection and indirect prompt exploits, and A2AGovernor preventing delegation laundering and privilege escalation across agent swarms).
Verified. 10/10 automated tests pass in tests/test_cain42_phase3_frontier.py; 50/50 public truth layer invariants pass; 4/4 cleanroom proofs pass with 0 CAIN imports via verify_phase3.py; live HTTP/2 200 endpoints operational at /fabric/frontier/status, /fabric/frontier/prm/evaluate, and /fabric/frontier/memory/sanitize.
Limits. PRM scoring runs on statistical heuristics and semantic step evaluation, not a fine-tuned billion-parameter reward model; CEGAR verification models reach bounded horizons; memory sanitization filters known injection patterns and zero-width cloaks but cannot guarantee catching arbitrary novel evasions. PRE-PRODUCTION.
evidence bundle · cleanroom verifier · cryptographic manifest
The law. INTELLIGENCE PROPOSES. CAIN DECIDES. E8 COMMITS. EVIDENCE REMEMBERS. NO AGENT PROMOTES ITS OWN AUTONOMY. MONITORED IS NOT ENFORCED.
What it governs. An integration kernel over the existing layers (E8 through E29) rather than a new engine. Every consequential action is normalized into a 20-field universal machine action and checked against the agent's autonomy state (a signed state machine with no TRUSTED state, where REVOKED never goes straight to AUTHORIZED), its evidence-backed autonomy level, a signed autonomy-budget ledger, containment boundaries, the environment class, two-sensor perception, governed memory and intent, then executed only through the E28 identity layer, a sealed E25 executor and the E8 commit boundary. Every action, allowed or refused, gets a signed, hash-chained universal action receipt binding the authorized and the executed digests. Self-improvement passes a staged firewall (snapshot, sandbox, benchmark, adversarial, differential, governance and security tests, canary, signed human review); self-healing may propose a repair but never deploy it; knowledge is superseded, never silently deleted; and a governance coverage map classifies every path from ENFORCED to UNCONTROLLED and UNKNOWN, never counting monitored as enforced. A Python SDK wraps an existing tool function as a sealed executor, and a zero-dependency TypeScript verifier re-checks the receipts without CAIN code.
Verified. 166 of 166 invariants hold, including the twenty E30 laws; 889 of 889 scenarios across 8 categories are held; the mutation self-test kills 11 of 11 mutants; a 28-step run from agent identity to continuous reauthorization passes; the TypeScript verifier returns INTACT on the real receipts and BROKEN on a tampered copy; while finishing it we found that the first draft had overwritten an Evolution 19 evidence module that E19's tests still import, and restored it; 11 tests pass, 0 failed; the clean-room verifier returns INTACT (1187 of 1187 checks).
Limits. An in-process TESTED integration library, not hosted and not wired into the gateway, MCPGate or the clusters. Paths outside the E25/E8 boundary are UNCONTROLLED or UNKNOWN; physical actuators are refused, not governed. Perception agreement is not physical truth. Injection detection is a marker list whose recall on real attacks is UNKNOWN. The TypeScript SDK only verifies. The 10,000- and 100,000-agent rows are synthetic. PRE-PRODUCTION.
The law. NO PROOF → NO VERIFIED GOVERNANCE CLAIM. A GOVERNANCE PROOF NEVER CREATES AUTHORITY. A PROOF OF PAST AUTHORIZATION NEVER AUTHORIZES A FUTURE ACTION. UNKNOWN REMAINS UNKNOWN.
What it governs. Every allowed action run through the proof kernel yields a signed governance proof; every refusal yields a signed failure proof with one of fifteen failure classes (unmatched reasons stay UNKNOWN_STATE). A proof carries only digests of artifacts that already exist and are signed or hash-chained on their own: the E30 action receipt, the E28 governance receipt, the E25 execution receipt and the E8 commit record. It binds sixteen action fields (destination, parameters, identity, model, runtime, delegation, policy, nonce and more), the identity's lineage back to its human sponsor and an evidence root. Decision, authorization, enforcement, execution and outcome are recomputed from the artifacts and never collapsed into one flag; the outcome stays UNKNOWN until a registered observer confirms it. Proofs are registered in an append-only RFC 6962 log where revocation and supersession are new entries, never edits; a replay engine names what was altered and a time machine keeps what was known then apart from what is known now. Also: a protocol-neutral envelope (CAIN-GIP, a CAIN reference protocol) with carriers for thirteen protocols, a governability handshake where a declaration alone never counts as enforcement, a fifteen-dimension coverage proof that is honestly not universal, CAIN's internal G0–G8 conformance profile, expiring and revocable certificates that are never authority, witnesses and a dispute engine where CAIN is never the default winner, cross-domain translation that only intersects, and a compiler that turns each failure into a regression test.
Verified. 252 of 252 invariants hold, including thirty laws; 1269 of 1269 scenarios across 11 categories are held; the mutation self-test kills 12 of 12 mutants; the reference agent reaches G8 on real runs; the clean-room verifier (no CAIN imports) returns INTACT (1676 of 1676 checks) and rejects all 88 deliberately forged proofs; the TypeScript verifier returns INTACT on the real proofs and BROKEN on a tampered copy; building it we found and fixed a field-name collision that had made every proof fail verification for the wrong reason and a proof field that always recorded the identity state as unknown; 15 tests pass, 0 failed.
Limits. An in-process TESTED library, not hosted and not wired into the gateway, MCPGate or the clusters. Witnesses are separate code and keys in the same process, not separate organizations; no third party has verified a proof. Carriers are in-process adapters, not network wire implementations. Trust anchors are published with the proofs. No trusted time source; partition is not addressed. The large scale rows are synthetic. PRE-PRODUCTION.
The law. LEARNING NEVER CREATES AUTHORITY. SELF-IMPROVEMENT DOES NOT SELF-AUTHORIZE. GOVERNANCE REGRESSION BLOCKS PROMOTION. THE LEARNING LOOP ITSELF IS GOVERNED.
What it governs. Three planes kept apart. The learning plane (experience memory with provenance, a calibrated two-learner world model that trains only on direct observations, prediction-versus-reality deltas, collapse detection, causal and counterfactual engines, failure mining and a failure-to-rule compiler) can only propose. The governance plane sandboxes every candidate in a fresh world, scores it on fifteen separate measures against a hidden test set committed in advance, self-plays it against mutated attacks, diffs it against current governance, canaries it on one agent, checks that authority did not grow, and promotes it only through a signed ten-stage gate that needs a registered human who is not the proposer. The execution plane reads only the promoted configuration and applies it as a restrict-only layer in front of the unchanged E30 to E8 path, with an E31 proof for every executed action. Also: model and runtime swaps that never inherit authority until a sponsor re-authorizes, self-tests of thirteen subsystems, governed self-repair of a collapsed world model, and knowledge revocation that follows every dependency.
Verified. The 17-step loop passes on real governed actions; in a SIMULATED run on a synthetic workload, harm that got through fell from 41 to 3; 303 of 303 invariants hold, including 42 laws; 1013 of 1013 scenarios across 22 categories are held; the mutation self-test kills 12 of 12 mutants; building it we found and fixed an authority-drift check that accepted a forged human expansion signature, and five measured dimensions that had not gated promotion; the clean-room verifier returns INTACT (1420 of 1420 checks) and rejects all 13 tampered objects; 13 tests pass, 0 failed.
Limits. An in-process TESTED library, not hosted. Learning results are SIMULATED: a synthetic workload scored by a labelled harm oracle, not production traffic. Learning can only change a restrict-only layer. The world models are small statistical learners. The hidden set is hidden from the learning code, not from someone with host access. One human reviewer key. No external research sources were ingested. PRE-PRODUCTION.
The law. NO AUTHORIZATION → NO EXECUTION. COMMUNICATION, MEMORY, PREDICTION, REPUTATION, CONSENSUS AND MONEY ARE NOT AUTHORITY. THE GOVERNANCE FABRIC ITSELF IS GOVERNED.
What it governs. Twenty-two kinds of agent operation (tool calls, messages, code, files, databases, API calls, subagents, delegation, memory, payments, actuators, computer use and the governance changes) run one explicit sixteen-state lifecycle that cannot be skipped. Executed operations pass the learned restrict-only rules, the autonomy kernel, the identity layer and the E8 commit boundary and carry a signed proof; operations that change state (messages, whitelisted code, new subagents, governed memory) run their effect inside the commit boundary; changes to the rules themselves are routed to the process that governs them and are never executed directly. A signed, versioned interface and a small sidecar process let an existing agent be governed without importing any CAIN code. Also: leases that cannot silently widen or be inherited, eleven autonomy budgets, staleness checks, message classification and channel rules, ten degraded modes that only ever take routes away, incident command, a thirteen-dimension blast radius, chaos testing, negotiation and handshakes that cannot create authority, contracts that keep only the enforcement they can prove, and honest status for every runtime adapter, SDK target and product (the hosted governance cloud is not deployed).
Verified. 581 of 581 invariants hold, including forty laws; 2029 of 2029 scenarios across 26 categories are held; the targeted mutation self-test kills 12 of 12 mutants; a 27-step loop shows an operation allowed under the old rules refused after CAIN learned a stricter rule; building it we found and fixed a gap where the learned world-model rule was never applied to operations and one where extra fields of a memory operation were not inspected; the clean-room verifier returns INTACT (2603 of 2603 checks) and rejects all 16 tampered objects; 11 tests pass, 0 failed.
Limits. An in-process TESTED library, not hosted. The sidecar runs locally against a reference world; adapters are in-process. The governance cloud is not deployed; Go, REST and gRPC SDKs are not implemented. Code execution is a whitelisted runner. PRE-PRODUCTION.
The law. LEARNING IS NOT AUTHORITY. PREDICTION IS NOT AUTHORITY. INTELLIGENCE NEVER BYPASSES E8. AMBIGUITY ≠ PERMISSION. SIMULATION ≠ REALITY.
What it governs. An intelligence layer learns which actions are risky, which environments are hard to govern and which controls produce false allows or false denies, and turns that into recommendations -- deliberately outside the trusted root. It observes with provenance, scores risk across dimensions without ever collapsing into one number, predicts with explicit confidence, assumptions, horizon and unknowns, calibrates prediction against observed reality by dimension, explores counterfactuals that are never presented as facts, models a governed world state, answers governance-structure questions about an environment, tracks goals and intent, governs an agent harness, and reaches the deterministic kernel only through a review and a canary. The self-protection set keeps CAIN's own roots separate and detects any change to the governance boundary, and the evolution gates require a human/admin approval before any self-change. A recommendation is never permission.
Verified. 799 of 799 invariants hold, including thirty laws; 3,544 of 3,544 scenarios across 68 categories are held; the targeted mutation self-test kills 15 of 15 mutants (intelligence-as-authority, epistemic confusion, counterfactual-as-fact, risk aggregate, ambiguity permission, self-healing authority, degradation authority, memory authority, loop self-deploy, red-team authority, reputation authority, stale-state authorization, benchmark override, single-controller root, research-as-truth); a 23-step intelligence loop runs end to end; 16 forged objects are all rejected; the clean-room verifier returns INTACT (3,810 of 3,810 checks) and imports none of CAIN's code; 12 tests pass, 0 failed.
Limits. An in-process TESTED library, not hosted, and deliberately NOT in the trusted authorization root. Predictions are modelled over synthetic features and are not calibrated against real production incidents. The red team, blue team, lab, tournament and marketplace run in-process with no external ecosystem. PRE-PRODUCTION.
The law. INTELLIGENCE, CAPABILITY, MEMORY, REPUTATION, PREDICTION, SIMULATION, PROOF AND ECONOMIC VALUE ARE NOT AUTHORITY. NO ENFORCEMENT → NO CONTROL CLAIM. NO PROOF → NO VERIFIED GOVERNANCE.
What it governs. For every governed operation, E34 issues one signed, chained GovernanceProofEnvelope that binds the agent identity, capability, delegation chain, authority, policy, evidence, risk, decision, the E8 commit, the enforcement boundary, execution and outcome -- and lists exactly what remains UNKNOWN, UNCONTROLLED, UNVERIFIED, SIMULATED or outside the boundary. A fourteeen-status classifier never collapses into a score; per-layer proof primitives (identity, capability, authority, policy, risk, evidence, decision, commit, enforcement, outcome) are each signed; an enforcement proof distinguishes a decision from an authorization, a commit, an enforcement, an execution and an observed outcome; delegation is proven link by link with attenuation; a Proof Exchange discloses chosen fields to another party with salted commitments and RFC 6962 Merkle inclusion proofs; and denials, incidents, transactions, computer-use, evolution and supply-chain changes each get their own signed proof. A proof is evidence, never permission.
Verified. 629 of 629 invariants hold, including thirty laws; 2,664 of 2,664 adversarial scenarios across 32 categories are held; the targeted mutation self-test kills 12 of 12 mutants; a 30-step proof-carrying loop runs end to end; 22 deliberately forged objects are all rejected; the clean-room verifier returns INTACT (3,286 of 3,286 checks) and imports none of CAIN's code; 13 tests pass, 0 failed.
Limits. An in-process TESTED library, not hosted. Zero-knowledge proofs are NOT implemented (salted commitments and Merkle inclusion only). Interchange protocols are reference adapters. Physical, vehicle and robot boundaries are refused, not governed. The Proof Exchange, federation, marketplace and governance cloud are library surfaces only. PRE-PRODUCTION.
The law. CONTRACT IS NOT AUTHORITY. REPUTATION IS NOT AUTHORITY. PAYMENT IS NOT AUTHORITY. A BID IS NOT AUTHORIZATION. NO E8 COMMIT → NO VERIFIED GOVERNED TRANSACTION.
What it governs. E36 adds a governed machine agency exchange: services, tools, models and organizations are discovered, verified, evaluated, negotiated with, contracted, authorized, executed, proved and settled along one explicit lifecycle. Governability-aware discovery filters on hard requirements and never upgrades UNKNOWN to MATCH; machine contracts are deterministic, sectioned and signed; a contract compiler ESCALATES ambiguity instead of guessing; payment authorizations are scoped, time-bound, amount-bound and non-replayable; receipts require an E8 commit; a service chain produces identity/authority/contract/capability/execution/proof/settlement proof chains; a subcontractor's authority cannot exceed its parent's; the firebreak isolates without confiscating; and CAIN's own participation is governed so it cannot grant itself authority or rewrite its history. Settlement units are SYNTHETIC and CAIN is not a bank, custodian or regulator.
Verified. 842 of 842 invariants hold, including thirty laws; 3,340 of 3,340 economic and governance scenarios across 64 categories are held; the targeted mutation self-test kills 15 of 15 mutants (unknown-upgraded-to-match, passport/contract authority, payment replay, subcontract amplification, self-review, silent substitution, compiler guessing, firebreak confiscation, self-override and more); a 13-step exchange lifecycle passes; 15 forged objects are all rejected; the clean-room verifier returns INTACT (3,601 of 3,601 checks) and imports none of CAIN's code; 14 tests pass, 0 failed.
Limits. An in-process TESTED library, not a deployed network; the directory and marketplace are local registries. CAIN is not a bank, custodian or regulator and settlement units are SYNTHETIC. CAIN-MSDP is experimental; A2A/MCP are reference adapters; dispute/arbitration is not legal advice; no insurance, underwriting, customers or market data. PRE-PRODUCTION.
The law. MOBILITY IS NOT AUTHORITY. AUTHORITY NEVER MOVES UNCHECKED. EVIDENCE IS NEVER ERASED. REVOCATION IS NEVER FORGOTTEN. UNKNOWN NEVER BECOMES VERIFIED BY ASSUMPTION.
What it governs. Every governed action now runs one twelve-stage chain -- identity, capability, authority, policy, context, execution environment, action, E8 commit, enforcement, outcome, proof, reassessment -- on the real kernel and commit boundary, and leaves a signed receipt whose E8 commit must match the action's proof envelope. When an execution moves to another node, runtime, model, region, container or credential, the move is a governed state transition: identity, authority, capability, a single-use continuity token, the destination's admission and passport, its enforcement, resources and the carried state are all checked, authority can only shrink, and risk, spent budget, revocations, transaction limits, evidence, reputation and incident state cannot be reset. A runtime is admitted on a measured code digest and live probes, never on its own claim; the host it runs on gets a signed environment passport that lists what is UNKNOWN (hardware attestation stays UNKNOWN). Also: drift detection, a scheduler that never places work where enforcement is missing, plans that cannot authorize themselves, a governance BOM, credential grants bound to one execution, environment and transaction that never reach the logs, default-deny perimeters, a computer-use boundary, governed code, CI/CD and deployment, edge nodes whose authority only falls as connectivity degrades, deterministic conflict resolution, a signed hash-chained event log with replay and a time machine, governed failover and recovery, spawn and population limits, compute governance, a sixteen-fault chaos engine and a fourteen-part self-test.
Verified. 71 signed execution receipts from real governed runs (69 executed, 2 refused with signed denials); 1,132 of 1,132 invariants hold, including fifty laws; 2,720 of 2,720 adversarial scenarios across 31 categories are held; the targeted mutation test kills 17 of 17 mutants; 16 of 16 injected fault classes are contained with 0 false allows; building it the lab caught four gaps in the new code (executables, encoded targets, a checkpoint field, unrecorded revocations), all fixed; 16 forged objects are all rejected; the clean-room verifier returns INTACT (2,627 of 2,627 checks) and imports none of CAIN's code; 21 tests pass, 0 failed.
Limits. An in-process TESTED library on one host: declared destinations, regions and clouds are governance records, not deployed nodes. Hardware attestation is UNKNOWN (no TEE). Adapters were tested against a reference harness, not live MCP/A2A servers; cloud targets are architecture only; the governance quorum is in-process, not the networked PBFT cluster. Scale runs (100,000 agents) are single-host. No customers. PRE-PRODUCTION.
The law. PROOF IS NOT AUTHORITY. AUTHORITY IS NOT TRUST. TRUST IS NOT SAFETY. EVIDENCE IS NOT TRUTH. VERIFICATION IS NOT CERTIFICATION. UNKNOWN → UNKNOWN.
What it governs. Every governed action now carries its own portable proof: twelve signed layer proofs (identity, capability, delegation, policy, risk, evidence, authorization, E8 commit, enforcement, execution, outcome, environment), each naming what it depends on, and one action proof that binds them to the real E8 commit and execution receipt without carrying any secret. Another machine can check it without our code and gets one of six answers: valid, invalid, incomplete, stale, revoked or unknown -- never a single trust score. A proof never becomes permission: partial, stale, revoked, simulated, predicted, confused or unbound proofs are never valid; an old proof does not authorize a new action; revocation is measured and its exposure window is counted; translation to OAuth, OIDC, MCP, A2A, IAM, capability tokens, contracts and audit records declares every field it keeps, changes or drops; handshakes and federation between trust domains exchange evidence but never create or merge authority; and every claim on these sites is mapped to its implementation, test, artifact, hash, signature and verifier -- or marked not fully verified.
Verified. 5 real action proofs and 41 published proof cases, each re-verified by an independent verifier that agrees with CAIN on every verdict; 1,030 of 1,030 invariants hold, including forty-two laws; 2,141 of 2,141 adversarial scenarios across 33 categories are held; the targeted mutation test kills 15 of 15 mutants; 0 of 19 injected faults made proof state more permissive; a 9-step cross-domain flow passes; building it the lab caught a refused handshake that still returned authority and a proof-confusion gap, both fixed; 15 forged objects are all rejected; the clean-room verifier returns INTACT (509 of 509 checks) and imports none of CAIN's code; 20 tests pass, 0 failed.
Limits. An in-process TESTED library. The second trust domain and the eleven conformance counterparts are reference implementations, not real vendors. CAIN-GIP is a reference layer carried inside MCP and A2A messages, not an Internet, MCP or A2A standard, and no live MCP/A2A server was tested. Zero-knowledge proofs are not implemented; hardware attestation is unknown; third-party verification is not available. Only 10 of 64 public claims are fully linked end to end. PRE-PRODUCTION.
The law. TRUST IS NOT AUTHORIZATION. A CONTRACT IS NOT AUTHORIZATION. A RECEIPT IS NOT AUTHORITY. TERMINATION IS FINAL.
What it governs. Cross-organization machine agency: discover, identify, attest, assess, negotiate, contract, delegate, authorize, execute, observe, verify, settle, record, learn, reassess and revoke. One 14-state relationship machine is never collapsed or skipped and terminals cannot reopen; discovery implies no trust; a negotiation, handshake, contract, lease or receipt is never authority; federation never silently broadens authority; translation declares every field it drops; the circuit breaker isolates without confiscating.
Verified. 470 of 470 invariants hold; 1180 of 1180 scenarios held; mutation 10 of 10; a 20-step loop passes; 12 tests pass; the clean-room verifier returns INTACT (1303/1303 checks).
Limits. In-process TESTED library; federation and economics are modelled; units are synthetic; no industry-standard protocol status; PRE-PRODUCTION.
The law. PREDICTION IS NOT OBSERVATION. SIMULATION IS NOT REALITY. A LOCAL OBJECTIVE NEVER SILENTLY OVERRIDES A GLOBAL ONE. DEGRADATION NEVER INCREASES AUTHORITY.
What it governs. A continuously updated, machine-verifiable model of enterprise state (people, agents, systems, data, infrastructure, workflows, policies, capital, contracts, supply chain, risk, objectives) connected to a typed control loop: OBSERVE, RECONCILE, PREDICT, SIMULATE, PLAN, GOVERN, AUTHORIZE, EXECUTE, VERIFY, LEARN, REPLAN. Conflicting systems are never silently resolved to the convenient answer; epistemic states are never merged; completion requires configured evidence and false completion is detected; a child budget never exceeds its parent; the loop never skips GOVERN, AUTHORIZE or VERIFY.
Verified. 506 of 506 invariants hold; 1354 of 1354 scenarios held; mutation 10 of 10; a 27-step loop passes; 12 tests pass; the clean-room verifier returns INTACT (1518/1518 checks).
Limits. An in-process TESTED library; no live ERP/CRM/cloud integration; enterprise objects are registry entries; predictions and simulations are not real-world validation. PRE-PRODUCTION.
The law. THERE IS ONE CANONICAL AUTHORIZATION PATH. AN UNKNOWN STAGE IS NEVER ALLOW. A WEAKER COVERAGE CLASS IS NEVER UPGRADED. NO SUBSYSTEM MANUFACTURES FINAL AUTHORITY.
What it governs. The final integration: one canonical governance kernel routes every consequential action through a single authorization path and returns exactly one decision; one canonical governance ABI (Identity, Intent, Action, Capability, Policy, Authority, Risk, Evidence, Authorization, Execution, Outcome, Receipt, Incident, Evolution) is versioned and fails closed; one universal machine action normalizes 33 execution surfaces; one evidence, receipt and proof model; a coverage compiler that never upgrades a weaker class; a machine-readable registry mapping E7-E41 to their modules and bundles; and a public truth engine that flags unsupported claims.
Verified. 438 of 438 invariants hold; 1302 of 1302 scenarios held; mutation 8 of 8; 34 of 34 evolutions integrated; a 21-step loop passes; 14 tests pass; the clean-room verifier returns INTACT (1460/1460 checks).
Limits. An in-process TESTED integration library; presence of a layer is reported, not proven correct; no hosted platform and no external system integration; PRE-PRODUCTION.
The law. PREDICTION, CLAIM AND MEMORY NEVER BECOME AUTHORITY. ONLY A QUORUM-SIGNED STATE DOES.
What it governs. Every replica receipt now commits to a Merkle root over the whole governance state (identity, authority, revocation, trust, risk, executions, containment, memory). Enough matching receipts sign that root, so anyone can check one part of the state at one moment without seeing the rest. If the effect an enforcement boundary observes, or the agent's own report, contradicts what was authorized, every replica contains that agent, its key and its authority chain at the same sequence number; it stays contained until a governor quorum releases it and a fresh trust attestation arrives. Agent memory climbs four layers, each signed by a different party, and never changes an authorization. Every signed governance change can be applied once only.
Verified. Replicas agreed on every state root at N=4, 5 and 7 (quorums 3, 4, 5); a forged root signed by the Byzantine replicas was never accepted. The zero-import verifier returns VERIFIED on the published bundle (27 checks) and 14 of 14 tampering cases behave as expected. TLA+ model checked with no error over 7,650 distinct states (N=4) and at N=7; a deliberately broken quorum is caught.
Limits. Tested in one process on one host, not deployed to the live clusters. The state root costs O(state) per update (37.6 ms at about 2,000 executions). This release also fixes a critical flaw in the earlier Evolution 03 state layer published on 2026-10-04, which accepted an unsigned quorum claim. PRE-PRODUCTION.
The law. A KERNEL RULE IS NOT AUTHORITY. A QUORUM-SIGNED AUTHORIZATION FOR THIS EXACT CODE, PROGRAM AND STATE IS.
What it governs. Three of four governance replicas must sign every policy activation, revocation, quarantine and execution authorization. An authorization binds the lease, the active policy, the exact compiled kernel program, the governance state root, the workload binary and the exact code. The executor attaches the program narrowed to the authorized write scope at the syscall boundary (eBPF kprobe override), refuses if the loaded program differs, and signs a receipt that commits to every kernel denial.
Verified. On this host's kernel the authorized run returned 0; a replayed, a forged and a post-quarantine authorization were each refused without starting a process. Offline attack lab 29/29 blocked. Zero-import verifier INTACT (24/24 checks). Tests: 24 passed in 48.71s. Four scope bypasses in the existing kernel enforcer (process rename, '..' traversal, sibling-prefix match, long-path truncation) were reproduced, fixed and are live.
Limits. Not yet wired to MCPGate, the hosted gateway or the PBFT clusters; replica keys sit in one process. Kernel telemetry covers denials only, and kernel program text is published as a hash. E14 (governed recovery) is not built. PRE-PRODUCTION.
The law. IDENTITY, TRUST AND AGREEMENT NEVER BECOME AUTHORITY. ONLY GOVERNOR-SIGNED, EVIDENCED CHANGES ENTER THE STATE.
What it governs. One deterministic state for machine identities, capability certificates, contracts, interactions, trust edges, revocations and incidents, committed by a single Merkle root. Every change needs a quorum of the domain's governor signatures and is bound to that domain. A trust raise must cite a completed, proof-backed interaction between exactly those two parties, once. Claims, observations and predictions can lower trust but never raise it.
Verified. The zero-import verifier replays the published log to the published root and rejects all 8 published bad operations with the expected reason (INTACT, 20/20 checks). Tests: 26 passed in 4.48s, including 2,000 random operations on which CAIN and the verifier agree exactly. Fixes four flaws in an earlier unpublished draft (unsigned changes, a self-declared 'proof verified' flag, evidence-free trust raises, cross-domain replay).
Limits. A library: no live discovery service or network transport serves it yet. Governor keys are not in an HSM. The verifier is ours, not a third party's. PRE-PRODUCTION.
The law. NO GOVERNED IDENTITY → NO GOVERNED TRANSACTION. AGREEMENT IS NOT AUTHORIZATION. REPUTATION IS NOT AUTHORIZATION. AN AGENT MAY HAVE AUTHORITY TO ACT WITHOUT HAVING AUTHORITY TO COMPLETE EVERY TRANSACTION IT CAN INITIATE.
What it governs. A machine transaction runs through twelve separately gated stages (discover, identify, negotiate, propose, contract, authorize, commit, execute, settle, verify, record, reassess), each recorded as a signed, hash-chained stage, and is bound by two signed envelopes covering 24 attributes. Authority is computed per transaction as the intersection of the agent's delegation and lease, a separately bounded economic authority (per-transaction limit, budget, approval threshold, vendor and counterparty limits), the team/organization/institution path, the signed contract (which can only narrow), counterparty risk across thirteen dimensions with no score, an eight-dimension consequence vector, the firebreak and the partition mode. Money moves only through a sealed treasury executor that runs inside the E8 commit boundary; every ledger entry names the committed request that moved it. Escrow releases only on a delivery receipt, the buyer's signed confirmation and an objective check, never on a claim of success. Also: signed agent names and discovery that never implies trust, capability passports earned by a real conformance run, dispute resolution on verifiable evidence only, a reputation graph that is never an input to authorization, a router that returns a destination and no authority, a nine-scope firebreak pushed down into the commit boundary, an immune system that turns incidents into replayable tests and rules that need two humans, incident propagation and recovery that always issues a new identity, partition modes whose ceilings only shrink, federation with incident exchange, and a software-promotion gate where no agent ships its own code.
Verified. 106 of 106 invariants hold; 258 of 258 adversarial scenarios across 15 categories are contained; the mutation self-test kills 10 of 10 mutants; ten catastrophe scenarios on the real fabric (up to 1,000 agents) end with 0 false allows; building it we found a bench world whose deploy agent had silently failed to onboard and fixed it, and bound every ledger entry to its exact committed request; 12 tests pass, 0 failed; the clean-room verifier returns INTACT (300 of 300 checks).
Limits. An in-process TESTED library, not hosted. Synthetic TEST units only: real currencies are refused and no payment rail is connected. All agents are reference agents in one process. The competitive radar holds no researched competitor data, no feature is claimed novel and no moat is adopted. The 10,000- and 100,000-agent rows are synthetic. PRE-PRODUCTION.
The law. IDENTITY TRAVELS. AUTHORITY DOES NOT. EVERY CONSEQUENTIAL MACHINE ACTION HAS A GOVERNED IDENTITY, A BOUNDED AUTHORIZATION, AN ENFORCED EXECUTION PATH AND VERIFIABLE EVIDENCE.
What it governs. Any agent can connect in one flow (register with proof of possession, attest, declare capabilities, receive a bounded delegation and an autonomy lease) and gets a signed, versioned, time-bounded execution identity. Its envelope travels byte-identically over 23 protocol carriers (MCP _meta, A2A metadata, HTTP headers, gRPC metadata, CLI, browser and computer-use controllers, executor frames), but its authority field is always NONE: a receiving trust domain recomputes authority as requested AND federated AND its own sponsor's authority AND the home ceiling. Delegation is a subset of the parent on sixteen dimensions and can never flow back to an ancestor. A change of model, runtime, prompt, tools, memory or key bumps a monotonic identity version, so authority is void until re-evaluated, and restoring old memory can never revive an old lease. Every action is bound to one transaction, reaches the E8 Action Commit boundary and leaves a signed, hash-chained governance receipt, refusals included; identity events go into an RFC 6962 transparency log with inclusion and consistency proofs. A seven-class continuity engine separates same agent, controlled successor, new agent, fork, clone, revoked resurrection and unknown actor, and the fork detector says UNKNOWN when it lacks telemetry.
Verified. 90 of 90 invariants hold, including laws E28-I1 to I20; 442 of 442 adversarial scenarios across 8 categories (identity, delegation, replay and fork, cross-domain, model/runtime substitution, credential, memory/identity confusion, protocol boundary) are contained; the mutation self-test kills 9 of 10 mutants, and the survivor (the E28 replay cache) is explained: E25 stops the same replays; building it we found and fixed an upward-delegation gap (a child could mint a token back to its parent) and added a runtime-binding divergence check; conformance 17 of 17 dimensions on real tests; a 16-step end-to-end run goes from an external agent through connect, subagent delegation, a model/runtime change and reauthorization to MCP, A2A and HTTP actions through E8, then revocation and a refused replay; 11 tests pass, 0 failed; 10,000 agents registered in one process with 0 failures; the clean-room verifier returns INTACT (243 of 243 checks).
Limits. An in-process TESTED library, not hosted. The envelope is a CAIN experimental reference protocol, not a standard, and nobody external has adopted it. Zero-knowledge proofs are NOT IMPLEMENTED (selective disclosure uses salted commitments). Hardware attestation is UNKNOWN. Cross-domain revocation does not propagate. Scale runs are synthetic and in-process; the 100,000-agent run is registry, log and lineage only. PRE-PRODUCTION.
The law. DISCOVERY, ROUTING, CONTRACTS, CONSENSUS, CONFIDENCE, COMPUTE AND RESEARCH ARE NOT AUTHORITY.
What it governs. E27 coordinates identity, discovery, attestation, trust, authorization, delegation, policy, risk, routing, execution, evidence, revocation, incident response, simulation and evaluation across heterogeneous agents: a signed agent registry and discovery service, a router, signed policy distribution, a cross-domain decision broker that treats foreign decisions as proposals, signed machine contracts and hash-chained negotiation, governed inference budgets, incident propagation, emergency policy, edge nodes with explicit degraded modes, a conformance runner and scoped governance certificates. Enforcement stays in E25 and E8.
Verified. 765 of 765 invariants hold and 1,533 of 1,533 adversarial scenarios are contained (both cumulative with E26; 341 scenarios specific to E27); 28 tests pass, 0 failed; the clean-room verifier returns INTACT (4,001 of 4,001 checks).
Limits. An in-process TESTED library, not hosted. Kernel/eBPF enforcement, OTLP export, real identity federation and the underlying research capabilities are NOT IMPLEMENTED. Its mutation self-test covers 2 mutants. PRE-PRODUCTION.
The law. TRUST IS EVIDENCE, NOT A NUMBER. AUTHORIZATION IS BOUND TO ONE TRANSACTION.
What it governs. E26 adds portable signed trust objects and a seventeen-dimension trust vector that is never collapsed into one score; continuous attestation with explicit levels, where hardware attestation stays UNKNOWN rather than simulated; transaction-bound authorization that refuses reuse; attenuating delegation tokens with signed delegation receipts; offline verification that keeps cryptographic validity separate from current revocation status; revocation epochs; transaction finality; explicit trust-domain federation; and SPIFFE, AuthZEN and COAZ adapters.
Verified. 532 of 532 invariants hold; 1,192 of 1,192 adversarial scenarios are contained (137 of them specific to E26); 30 tests pass, 0 failed; the clean-room verifier returns INTACT (3,115 of 3,115 checks).
Limits. An in-process TESTED library, not hosted. Hardware attestation, zero-knowledge proofs and third-party interoperability are NOT VERIFIED. PRE-PRODUCTION.
The law. NO VERIFIED IDENTITY → NO TRUSTED AGENCY. NO AUTHORITY → NO AUTHORIZATION. NO AUTHORIZATION → NO EXECUTION.
What it governs. E25 turns any consequential machine action into one protocol-neutral envelope signed by the agent instance itself. A compiled policy, a portable attenuating delegation chain and a model/runtime binding decide it; the only path to an effect is the E8 Action Commit boundary, through a sealed executor that refuses to run outside it. Eighteen protocol adapters (MCP, A2A, HTTP, gRPC, WebSocket, JSON-RPC, event streams, queues, CLI, shell, browser, computer use, cloud APIs, databases, filesystems, containers, local IPC, deployment) each pass a sixteen-check conformance contract. The agent never holds a raw secret: a credential broker issues scoped, audience- and proof-of-possession-bound credentials. Receipts are signed and hash-chained, and a cascading firebreak isolates an instance, its delegations, credentials and subagents.
Verified. 517 of 517 invariants hold; 1,055 of 1,055 adversarial scenarios across 35 families are contained; every mutant in the self-test is caught; 60 tests pass, 0 failed; the clean-room verifier (no CAIN imports) returns INTACT (2,977 of 2,977 checks).
Limits. An in-process TESTED library with a reference HTTP service; not hosted in production. Cross-organization, third-party and hardware-attestation gates are NOT VERIFIED. OAuth/OIDC flows are mapped, not implemented. Sandbox controls report UNENFORCED unless a provider enforces them. PRE-PRODUCTION.
The law. DISCOVERY IS NOT TRUST. TRUST IS NOT AUTHORITY. AUTHORITY IS NOT AUTHORIZATION. AUTHORIZATION IS NOT EXECUTION. EXECUTION IS NOT SUCCESS. SUCCESS IS NOT TRUST. NO AGENT MAY CREATE ITS OWN AUTHORITY.
What it governs. E24 governs autonomous agents that belong to different organizations and trust domains and interact over existing protocols (A2A, MCP, HTTP, REST, gRPC, WebSocket, event buses, message queues, CLI, browser, computer-use, local IPC, cloud APIs). It does not replace any of them; it governs the boundaries between them: a fourteen-dimension trust vector that is never collapsed; AgentPassportV2 identities that bind provenance, ownership, capabilities, protocols and security posture but never authority; capability advertisements that stay CLAIMED until fresh, domain-attested, identity-bound evidence says VERIFIED; hash-chained signed negotiation whose result is evidence of agreement, never permission; versioned, signed, time/scope/identity/capability-bound contracts (CONTRACT IS NOT AUTHORITY); delegations that are child ⊆ parent with bounded depth and cascade revocation; cross-domain authority as the intersection of ten factors (local, remote, delegated, contract scope, policy, risk, capability, resource, time, context) where an unevaluable factor is UNKNOWN and contributes the empty set; trust translation only through explicit policies; an incident mesh over real interaction edges; a quarantine state machine that only ever reduces authority and needs re-attestation to recover; revocation that propagates to related entities and nothing else; a firebreak that isolates one domain while the rest keep operating; a publisher-signed artifact supply chain; governed shared memory that cannot carry authority or instructions; and one consequential path — E24 verdicts → E19 action contract → E8 — shared by every protocol class.
Verified. 305 invariants hold (64 NET-I including NET-I001–I045 from the spec, the 20 constitutional laws, and factors/capabilities/protocols/quarantine/soundness); the bench is 756/756 contained across 68 families and 36 categories; the 20-step three-organization demonstration (A→B→C) discovers, verifies identity and capability, negotiates, contracts, delegates and authorizes through E24→E19→E8, then compromises B, detects it, quarantines it, freezes its delegations, propagates the incident, revokes it, and keeps A and C operating where safe; a controlled single-process simulation of 10,000 agents, 1,000 organizations, 100 trust domains, 10,000 contracts and 100,000 messages leaks no authority; a mutation self-test removes eight defenses one at a time and every one is caught — building it we found that removing delegation liveness was bench-detected but not caught by any invariant, and closed the gap with a new invariant before publication; 806 E24 tests pass, 0 failed; the clean-room verifier (1,952 checks, no CAIN imports) re-derives every identity digest, organization signature, capability-evidence signature, federation bridge, negotiation, contract, delegation, execution decision, evidence-chain entry, revocation, quarantine transition, settlement signature, protocol mapping, trust-translation policy and every soundness row, and returns INTACT.
Limits. An in-process TESTED library; the protocol adapters normalise reference messages and are not network servers, and no third-party agent, A2A peer or MCP server has been governed by E24. Every wallet, escrow and settlement is SIMULATED over abstract units (real currencies are refused; real money: NOT IMPLEMENTED). The 10,000-agent run is a controlled single-process model, not a measurement of a real agent population, and does not recompute signatures per message. Multi-host partitions: NOT PERFORMED. Anomaly-detection recall against real adversaries: UNKNOWN. Real-world adversarial validation and third-party review: NOT PERFORMED. The evidence bundle is published as INCOMPLETE pending the full E7–E23 regression and the public-truth audit; the proof is signed with an ephemeral build key. PRE-PRODUCTION.
The law. SELF-KNOWLEDGE IS NOT AUTHORITY. SELF-IMPROVEMENT IS NOT SELF-AUTHORIZATION. CAPABILITY IS NOT PERMISSION. INTELLIGENCE IS NOT AUTHORITY. EVOLUTION IS NOT EXECUTION. DISCOVERY IS NOT DEPLOYMENT. A system may model, measure, search and propose changes to its own cognitive architecture; it may not authorize them.
Limits. A TESTED library. 253 invariants hold, 545 adversarial scenarios are contained across 80 families, 609 E23 tests pass and the clean-room verifier passes INTACT (733 checks, no CAIN imports). Its evidence bundle is published as INCOMPLETE pending the full E7–E22 regression and the public-claims audit. Third-party review: NOT PERFORMED. PRE-PRODUCTION.
In one sentence. E21 governs autonomous research -- asking questions, keeping competing hypotheses alive, designing experiments and simulations, replicating, peer-reviewing, attacking its own conclusions, building versioned knowledge, proposing capabilities, models and strategies, and creating specialised research agents -- so that a system can become more knowledgeable and more capable without becoming less governable.
The law. DISCOVERY IS NOT TRUTH IS NOT AUTHORITY IS NOT EXECUTION. CONSENSUS IS NOT TRUTH. RESEARCH AUTHORITY IS NOT EXECUTION AUTHORITY. CURIOSITY IS NOT AUTHORITY. SIMULATION IS NOT REALITY. UNKNOWN NEVER BECOMES ALLOW.
What it governs. Epistemic state is computed, never asserted: evidence is signed by its producer with its method class (simulation, synthetic experiment, controlled experiment, real-world observation, independent replication, third-party reproduction) bound into the signature, so a simulation cannot be relabelled as an observation; evidence is grouped by independence key (controller, environment, dataset, model), so repeated runs or Sybil producers count once, and any contradiction inside a group wins. A discovery walks PROPOSED -> HYPOTHESIS -> INVESTIGATING -> SIMULATED/OBSERVED -> REPLICATING -> SUPPORTED -> VERIFIED with an evidence requirement on every step (SUPPORTED needs an independent replication, five adversarial challenges by someone other than the author, and two independent reviews whose objections were cleared by evidence, not votes; VERIFIED needs a registered third party). Research authority (charter actions within a research role, chartered by the host institution's quorum) is disjoint from E20 execution authority, and no authority function takes a discovery, confidence, vote, benchmark score, knowledge, curiosity or information value as input. Experiments are approved for their environment only and are terminated on any forbidden operation. A capability leaves quarantine only after validation, an independent adversary, a security review and a governance quorum that excludes the researchers; a promotion is limited (scope as an intersection, named targets and operators, expiry, rollback) and is necessary but never sufficient: every action still passes E20, the E19 action contract and the E8 kernel. Revoked evidence cascades to claims, dependent claims, policies, capabilities and authorizations. Discovery memory is append-only and keeps every failed path. Also: a structural scientific-reasoning audit, causal levels that cannot be skipped (correlation is never labelled causation), a non-executing counterfactual lab, isolated competing tracks with commit-reveal and blind replication, Shannon information value that is never permission, governed data access, benchmark and model governance (leakage, hidden-test exposure, best-of-n, partial metrics, stale versions, two-benchmark promotion, no regression), multi-dimensional intelligence-regression checks, governed strategy self-improvement that can only narrow authority, bounded search and budgets, a research-agent factory through E20 spawning, and SIMULATED research bounties.
Verified. D1-D155 155/155 hold; the CAIN-42-E21-Open-Ended-Intelligence-Bench is 298/298 contained (290 distinct attacks, 8 aliases) across 46 categories; asked whether a system can discover a governance loophole and use the discovery to acquire permission to exploit it, the bench answers NO (seven loophole attacks, all refused; the only permitted output is a signed disclosure). A 17-stage research demonstration on a synthetic problem forms three hypotheses, runs competing tracks, simulates, observes, rejects two hypotheses, replicates the third in a second lab, quarantines, attacks, reviews and promotes a capability by quorum, runs a bounded action E21 -> E20 -> E19 -> E8, compares prediction with outcome and updates knowledge -- and refuses all 16 self-authorization attempts along the way. The self-evolution demonstration promotes a more efficient search strategy with strictly narrower authority and rolls back a candidate that regressed calibration. A mutation self-test removes seven defenses one at a time and every one is caught. The clean-room verifier (218 checks, no CAIN imports) re-derives every digest, signature, quorum, confidence and quality value, lineage, promotion scope and execution chain, and catches all 16 deliberate tamperings, 15 of them re-hashed and re-signed with a fresh key (the untouched copy verifies INTACT first). Scale SIMULATIONS reach 100,000 virtual research agents (100,000 signed observations admitted, p50 215.26 us each) and 100,000 simulated hypotheses. 19 E21 tests pass, 0 failed, plus 42 bundle-verifier tests. Building it we found and fixed four defects in our own new code before publication: reviewer independence was derived from currently valid evidence, so once a researcher's evidence expired they could review their own work; the experiment-count budget was never checked; within one independence group a later, heavier supporting result could overwrite a contradiction (now order-independent; the regression test fails against the old rule); and evidence ingest was quadratic. Bundle `e21-open-ended-intelligence-2026-09-29` (mirrored byte-identically); public claim C42-E21-OPEN-ENDED-INTELLIGENCE signed by the evidence-root key.
Limits. A TESTED library exercised against a deterministic SYNTHETIC research problem; it contains no scientific model and runs no real laboratory. Scientific truth of any hypothesis: UNKNOWN (E21 governs how evidence was produced, not whether a hypothesis is true). Novelty: only against a supplied corpus. Collusion by controllers off-system: UNKNOWN. Hosted E21 service: NOT IMPLEMENTED. Multi-host behaviour: UNVERIFIED (scale runs are single-process simulations). Research bounties: SIMULATED. Real-world adversarial validation and third-party review: NOT PERFORMED. E21 does not create AGI, solve alignment or guarantee safe self-improvement. Ephemeral signing key on the proof. PRE-PRODUCTION.
What changed. MCPGate gained an authorization-aware routing library (A+++ gate 6): tool schemas are kept in PINNED, HOT, WARM, COLD or EVICTED context residency by a deterministic score, while every call uses the canonical, digest-checked schema, the CAIN authorizer receives no residency information and its DENY is final even for a tool flooded into HOT, evicted tools remain callable only through full authorization, canonical schemas are never deleted, every decision is hash-chained evidence and every limit produces backpressure. Measured on one host: active context 6.22x-31.13x smaller than exposing every schema (50-1,000 tools), routing p50 about 17.66 us; 13 of 13 bypass tests pass. Public claim C42-MCPGATE-SCHEMA-RESIDENCY.
Limits. Library only: it is NOT wired into the live MCPGate proxy, so production routing is unchanged, and A+++ gate 6 stays BLOCKED until it is wired behind a flag on a canary and re-tested. The A+++ verdict remains BLOCKED (eBPF enforcement cannot load on this host, no soak or network fault injection for the new path, no desktop IPC layer).
In one sentence. E20 governs agents that act together as teams, organizations and machine-native institutions: they may form, admit members, delegate, negotiate, sign contracts, hold and move resources, spawn subagents, federate, resolve disputes, evolve and dissolve, and none of it can manufacture authority. CAIN-42 remains the governance fabric; it is not an agent marketplace, an orchestration framework or a financial system.
The law. COLLECTIVE INTELLIGENCE IS NOT INSTITUTIONAL AUTHORITY. AUTONOMOUS ORGANIZATION IS NOT AUTONOMOUS AUTHORITY. NEGOTIATION IS NOT AUTHORIZATION. UNKNOWN NEVER BECOMES ALLOW.
What it governs. Institutional authority is computed, never stored: constitution boundary ∩ founding authority (a principal's signed grant, or the founders' intersection, never their union) ∩ parent institution ∩ an 11-state autonomy ceiling; member authority is the admission grant plus delegations bounded by their delegator, ∩ the institution, ∩ the parent agent. Membership, votes, consensus, reputation, trust, wealth, market wins, rewards and model capability are not inputs. A frozen constitution changes only through a quorum that excludes the proposer and never beyond the founding authority; a conserved, hash-chained resource ledger with signed mints, custody, single-use nonces, escrow and rebuild-from-chain; economic actions that bind twelve fields; eleven-field contracts signed by both parties and invalidated by any of seven bound state changes; signed, hash-linked negotiation whose outcome is only a proposal; agent spawning bounded in seven independent dimensions with a signed birth certificate; governed termination and dissolution cascades with signed receipts and tombstones; append-only institutional memory; evidence-backed reputation counted per controller; bounded, attenuated trust; collusion signals that never claim certainty; observational power metrics; blast radius; an evidence-weighing court that preserves competing claims; audit reconstruction; supply-chain pinning; a non-executing digital twin; a 15-stage institutional control loop; governed evolution and recovery. Every institutional action is judged by E20, then by the E19 action-contract gate (institutional authority enters as its collective-constraints factor), and committed only by the E8 kernel.
Verified. I1-I118 118/118 hold; the CAIN-42-E20-Agentic-Institutions-Bench is 334/334 contained (328 distinct attacks, 6 aliases) across formation, membership, identity, authority laundering, delegation, contracts, negotiation, resources, economics, spawning, resurrection, termination, memory, reputation, markets, incentives, federation, trust, collusion, power, court, supply chain, simulation, evolution, constitution, autonomy state, recovery, execution and time, including consistently re-signed refusals; a mutation self-test removes six defenses one at a time and the bench and invariants catch every one; the 20-step end-to-end run (agent, team, organization, negotiation, contract, resources, subagent, delegation, contract execution) detects and contains all 7 hostile events (agent compromise, resource mutation, goal drift, contract manipulation, reputation poisoning, cross-agent collusion, world-state change), reduces authority, invalidates contracts, revokes delegation, preserves evidence, recovers and re-authorizes while a second institution keeps operating; scale simulations reach 10,000 virtual agents and 1,000 virtual institutions; 499 E20 tests pass, 0 failed, plus 48 bundle-verifier tests; the clean-room verifier (179 checks, no CAIN imports) recomputes every digest and signature, re-derives institution and member authority, ledger balances and conservation, reputation, trust and the dispute decision, and still fails on semantic tampering after an attacker re-seals the bundle with a fresh key. Building it we found and fixed three of our own defects before publication: a contract's payment was checked against the performer's work list, the E20-to-E19 autonomy mapping blocked actions the state ceiling allows, and the builder published a lineage list that kept growing after its snapshot (the verifier caught it). Bundle `e20-agentic-institutions-2026-09-29` (mirrored byte-identically); public claim C42-E20-AGENTIC-INSTITUTIONS signed by the evidence-root key.
Limits. A TESTED library exercised against deterministic reference institutions. Every economy, market and settlement is SIMULATED over abstract units; real money is refused (real financial settlement: NOT IMPLEMENTED). Control of any real economy, society, agent population, vehicle, drone or robot: NOT IMPLEMENTED. Hosted E20 service: NOT IMPLEMENTED. Collusion-detector recall and semantic truth of evidence: UNKNOWN. Multi-host behaviour: UNVERIFIED (scale runs are single-process simulations). Real-world adversarial validation and third-party review: NOT PERFORMED. Ephemeral signing key on the proof. PRE-PRODUCTION.
In one sentence. E19 governs the evolving state of an autonomous system, not only its individual actions: who is acting, what it believes and why, what it wants, what authority and capabilities it holds right now, which world state it acts against, what it predicted, what actually happened, and what must change in its future authority. CAIN-42 remains the governance fabric; it is not a planner, world model, orchestration framework or vehicle/drone/robot controller.
The law. AUTONOMY IS NOT AUTHORITY. NO STATE TRANSITION WITHOUT GOVERNANCE. UNKNOWN NEVER BECOMES ALLOW.
What it governs. Hash-chained governed state for 25 components (missing = UNKNOWN); missions with time, geography, conserved budgets and scopes; a goal graph where a subgoal never exceeds its parent or mission and inherits every constraint; beliefs that are FACT only when verified, evidence-backed, corroborated by two independent principals, uncontradicted, unexpired and bound to the current world; memory that never becomes policy, authority or instruction; a 9-stage learning lifecycle where authority changes need a constitutional quorum; model passports (a more capable model gets no authority); a sealed runtime provenance graph; a continuous authority compiler (effective authority = the intersection of 16 factors; confidence, peer agreement, learning, plans, predictions and compute are not factors); seven governance clocks; a machine-verifiable causal chain with no opaque 'the model decided' and no stored chain-of-thought; outcome comparison that turns prediction error into evidence without punishing legitimate uncertainty; 13 derived autonomy levels; governed humans, emergencies, recovery, checkpoints and forks; a constitution whose core invariants cannot be removed. Every consequential action carries a sixteen-field GovernedActionContract that any of 15 bound state changes invalidates, and whose verdicts the gate enforces itself before the E8 kernel commits it.
Verified. G1-G108 108/108 hold; the CAIN-42-E19-Governed-Autonomy-Bench is 189/189 contained (177 distinct attacks, 12 aliases) across identity, goals, beliefs, memory, models, authority, world, planning, multi-agent, learning, execution, recovery, physical/hybrid, governance and human authority, plus consistently re-signed refusals; a mutation self-test removes four defenses one at a time and the bench and invariants catch every one; the 19-stage end-to-end run (mission, goal, belief, 4D world, prediction, plan, authorization, action, world change, invalidation, outcome, prediction error, trust update, degraded autonomy, recovery, re-authorization, continued operation) passes and all 20 stage attacks are caught; 391 E19 tests pass, 0 failed; the clean-room verifier (117 checks, no CAIN imports) recomputes every digest and signature, re-derives effective authority, autonomy levels and contract invalidation, and still fails on semantic tampering after an attacker re-seals the bundle with a fresh key. Full regression (the whole test suite, run twice serially at a56769c + provenance 5867003): 8,556 passed, 0 failed, 62 skipped, 4 xfailed in both passes. evidence page · bundle summary · attack manifest · invariants · end-to-end run · mutation self-test · clean-room verifier (INTACT, 117 checks) · limitations
Limits. A TESTED library exercised against a governed reference system (a digital agent, a vehicle abstraction, a drone abstraction, a collective and a human in the E18 4D world); execution in the scenario is SIMULATED. Vehicle, drone and robot control and any physical safety guarantee: NOT IMPLEMENTED. Hosted E19 service: NOT IMPLEMENTED. Semantic truth of beliefs and outcomes, hardware attestation: UNKNOWN. Multi-host behaviour: UNVERIFIED. Real-world adversarial validation and third-party review: NOT PERFORMED. Ephemeral signing key on the proof. PRE-PRODUCTION.
While upgrading both live PBFT clusters (cain-mr-01, cain-mr-02) to the build that contains the soak fix 40b0835, the new build also carried the 2026-09-27 cluster write gate, which refused the replicas' own consensus messages. Neither cluster committed from about 05:47 to 06:02Z; decisions needing a cluster commit were refused (fail-closed), not allowed. Both clusters were rolled back to their previous images and verified committing again (cain-mr-01 sequence 28872, cain-mr-02 sequence 657, every replica agreeing). The 72-hour and new 120-hour soaks started on the upgraded build were stopped and do not count; each carries a STOPPED.json saying why. The hourly proofs record the gap honestly (113 of 114 OPERATIONAL on cain-mr-01). Next: let authenticated replica traffic through the gate (keeping the gate), test it on one replica, then restart the soaks. soak stop notes
In one sentence. E18 turns CAIN-42 towards the actionable 4D world: not merely "what is there?" but "what is it doing, where can it go, what is it likely to do next, what can we safely do, what happens if we do it, do we have authority, and is that authorization still valid right now?". It is a strict extension of E15/E16/E17, not a parallel abstraction.
The law. ACTIONABILITY IS NOT AUTHORIZATION. REACHABILITY IS NOT PERMISSION. PREDICTION IS NOT REALITY. AUTHORIZATION IS A FUNCTION OF WORLD STATE. UNKNOWN NEVER BECOMES ALLOW. If any material input changes, REVALIDATE; if the required state cannot be established, DO NOT EXECUTE.
What it governs. Entity state at (X,Y,Z,T) with uncollapsed uncertainty; reachable / policy-permitted / authorized sets kept distinct; probabilistic intent; multiple predicted trajectories; an interaction graph and a conflict field that is not distance-only; time-to-consequence with uncertainty; signed, versioned dynamic geofences; governed airspace and roadspace; a spatial policy compiler that yields ELIGIBILITY, not authorization; multimodal sensor fusion; world-model arbitration that never simply selects the highest confidence; a prediction ensemble that detects correlated errors; counterfactual future trees; actionability states; a conserved uncertainty budget that propagates; a governance clock and latency budget (SAFE_DEGRADE, never bypass); drone and vehicle fabric proposal interfaces; a cross-domain 4D world for car, drone, robot, digital agent and human operator; a spatial digital twin whose layers are never conflated; a reality-gap monitor; and incident replay. Every consequential spatial action binds sixteen digests and reaches the real E8 governance kernel.
Boundary review before publication (2026-09-29). An adversarial review found the commit boundary bound the digests of the policy, actionability, authority, risk and uncertainty verdicts but never read them: a consistently re-signed refusal (policy ineligible, actionability DENIED, authority revoked or out of domain, risk 0.99, uncertainty 1.0) came back AUTHORIZED. Fixed: the boundary now enforces each verdict (unknown refuses); the map (roadspace, airspace) is bound into the world digest; uncertainty can no longer drop between layers and an unmeasured budget is not certainty; micro-authorization cannot skip revalidation or continue across a world change; an omitted lane/capability no longer matches a constrained authority domain; a declared altitude must match the position. Five end-to-end “mutations” that did not mutate what they named were rewritten. Each fix has a test that failed before it (Q81-Q89, 21 new attacks).
Verified. Q01–Q89 89/89 hold; the CAIN-42-E18-Spatial-Autonomy-Bench is 123/123 contained (109 distinct attacks plus 14 invariants re-run as scenarios); the 20-step end-to-end run, its unmutated control and all 12 deliberate mutations behave as specified; 319 E18 tests pass, 0 failed; a clean-room verifier (111 checks, imports no CAIN-42 code) recomputes every digest, the sixteen-digest commit binding and the verdicts behind the committed action, checks the master proof signature and returns INTACT, and it rejects 30 kinds of tampering. evidence page · master proof · attack manifest · sixteen-digest commit · end-to-end run · clean-room verifier (INTACT, 111 checks) · limitations
Limits. A TESTED library exercised against a governed reference 4D world. CAIN-42 contains no autonomous-driving model, flight controller, vehicle controller, robot policy or navigation stack and drives nothing. Real vehicle / drone / robot / sensor / actuator / airspace integration: NOT_IMPLEMENTED. A physical safety guarantee and certified autonomy: NOT_IMPLEMENTED. Hardware attestation, world-model/prediction accuracy and sim-to-real fidelity: UNKNOWN. Real sensor validation, real-world adversarial validation and third-party review: NOT_PERFORMED. Not hosted; single host; ephemeral signing key on the proof. Hash integrity is not semantic truth. CAIN-42 provides a governed spatiotemporal action boundary for autonomous systems across digital, simulated and physical environments — nothing more. PRE-PRODUCTION.
In one sentence. E17 governs action by autonomous agent teams as a first-class system object: a collective is not the sum of its members and a collective action is not the sum of member actions. It is a strict extension of E10 (collectives) and E15/E16 (spatial + causal world state), not a parallel abstraction.
The law. MANY AGENTS MAY COORDINATE. NONE MAY CREATE AUTHORITY BY COORDINATING. CONSENSUS IS NOT AUTHORIZATION. COLLECTIVE INTELLIGENCE IS NOT COLLECTIVE AUTHORITY. TOPOLOGY IS NOT AUTHORITY. NO AUTHORIZATION → NO EXECUTION. UNKNOWN NEVER BECOMES ALLOW.
What it governs. Collective authority is a constrained intersection of the governing grant, the mission capabilities, policy and live member authority, never a sum. Collective identity is its own revocable identity, not the sum of member identities. A mission binds every collective action and material mission / membership / world-state / causal / topology drift forces reauthorization or a safer decision. Majority, consensus, negotiation, contracts, roles, membership, coalitions, delegation, subagents, recursive delegation, emergence and self-improvement cannot create or amplify authority. Dissent is preserved and a minority safety objection is surfaced. Correlated evidence cannot masquerade as independent evidence. A world-state fork blocks authorization until reconciliation. A collective trajectory is a proposal until governed. A compromised member forces containment, revocation of affected authorizations, a recalculation of state and consequences, and reauthorization; recovery itself never mints authority. One action that would fan out to many agents is pre-authorized. Every consequential collective action binds fifteen digests and reaches the E8 governance kernel; no collective protocol bypasses it.
Boundary review before publication (2026-09-29). The same review found the E17 commit boundary also bound the risk, policy, world-state, authority and consequence digests without reading them (risk 0.99, a missing risk score, an ineligible policy, an empty world state or an empty authority came back AUTHORIZED when re-signed consistently). Fixed: the boundary enforces them, and the operation must lie in the effective authority and in the decision’s candidate actions (Q61, 10 new attacks, each with a fail-before test).
Verified. Q01–Q61 61/61 hold; the CAIN-42-E17-Multi-Agent-Bench is 91/91 contained (88 distinct attacks; 3 are also listed under a second name); the 18-step end-to-end run and all 12 deliberate mutations behave as specified; 238 E17 tests pass, 0 failed; a clean-room verifier (92 checks, imports no CAIN-42 code) recomputes every digest, the fifteen-digest commit binding and the master proof signature and returns INTACT, and it rejects 18 kinds of tampering and tolerates served-page chrome. A token minted for one set of bindings authorizes no other. evidence page · master proof · attack manifest · fifteen-digest commit · end-to-end run · clean-room verifier (INTACT, 92 checks) · limitations
Limits. A TESTED library exercised against a governed reference collective. CAIN-42 deploys no fleet, robot, drone, vehicle or customer collective and drives nothing. No real sensor/actuator integration and no deployed multi-agent collective: NOT_IMPLEMENTED. Hardware attestation: UNKNOWN. Sybil-detection completeness and the semantic truth of observations, predictions or causal claims: UNKNOWN. World-model accuracy and sim-to-real fidelity: UNKNOWN. Real-world attack validation and third-party review: NOT_PERFORMED. Not hosted; single host; ephemeral signing key on the proof. Hash integrity is not semantic truth. A system outside CAIN-42's enforcement boundary remains UNCONTROLLED / UNVERIFIED / UNKNOWN. PRE-PRODUCTION.
In one sentence. E15 establishes the interfaces and governance primitives for bringing spatial intelligence, world models, simulation, trajectories and physical actions into CAIN-42's governed trust path: from what a system perceives, through what it proposes and may cause, to what it is authorized to do and what the physical world then shows.
The law. PERCEPTION IS NOT TRUTH. MODEL OUTPUT IS NOT AUTHORITY. SIMULATION IS NOT REALITY. PREDICTION IS NOT FACT. A TRAJECTORY IS A PROPOSAL UNTIL GOVERNED. A PHYSICAL ACTION REQUIRES GOVERNED AUTHORIZATION. UNKNOWN NEVER BECOMES ALLOW.
What it governs. Signed sensor observations are admitted through the E12 evidence layer (identity, type, key, replay, freshness, per-sensor time order); cross-modal conflicts (camera vs lidar, GNSS vs inertial, map vs sensor, world model vs raw) block authorization; spatial identities keep continuity (no silent A-becomes-B); the world state is versioned, hash-chained and replayable and binds every ingested observation; a world model's output is PREDICTED evidence bound to model, configuration, world state and scenario; a trajectory is a proposal until a signed approval binds it; capabilities say WHERE, WHEN and UNDER WHAT CONDITIONS and never exceed authority; physical consequence and blast radius enter the E7 gate (UNKNOWN where not measurable); every physical action binds nine digests, crosses the E8 commit boundary and reaches an actuator adapter only with a single-use permit for that exact command; material drift invalidates the authorization and forces re-evaluation or a safe state whose semantics come from the system's own adapter.
Verified. P1–P36 36/36 hold; the CAIN-42-E15-Spatial-Physical-Bench is 55/55 contained; 19/19 end-to-end steps and 7/7 mutations governed; 175 tests pass, 0 failed; clean-room verifier INTACT (52/52 checks) and corrected for the hardened world-state/step schema; the bundle is rebuilt at the commit that contains the E15 code; the full suite is clean at 7,561 passed, 0 failed, 62 skipped, 4 xfailed evidence page · proof JSON · end-to-end run · attack manifest · clean-room verifier (INTACT, 52 checks) · limitations
Limits. A TESTED library exercised against a reference robot adapter and a reference kinematic simulator; CAIN-42 is not a vehicle or a robot, drives nothing and does not guarantee physical safety. Real sensor, vehicle, robot and actuator integration: NOT_IMPLEMENTED. Hardware attestation: UNKNOWN. World-model accuracy and sim-to-real fidelity: UNKNOWN. Real-world attack validation: NOT_PERFORMED. Not hosted; single host; ephemeral signing key on the proof; no third-party review. Systems outside the enforcement boundary remain UNCONTROLLED / UNVERIFIED / UNKNOWN. PRE-PRODUCTION.
In one sentence. E16 extends E15's governed world state with a temporal and causal dimension: events and intervals, typed causal and correlation relations, causal provenance, a world-state version graph with counterfactual branches, a predictive state engine, a causal intervention engine, prediction-vs-reality calibration, temporal authorization and a causal blast radius — all reaching the same governed commit boundary. It is a strict extension of E15, not a parallel abstraction.
The laws. CORRELATION IS NOT CAUSATION. PREDICTION IS NOT OBSERVATION. COUNTERFACTUAL IS NOT REALITY. FUTURE STATE IS NOT CURRENT STATE. A SIMULATED INTERVENTION IS NOT AN EXECUTED INTERVENTION. CAUSAL CONFIDENCE IS NOT AUTHORITY. CAUSAL REASONING CANNOT INCREASE AUTHORITY. UNKNOWN NEVER BECOMES ALLOW. Every consequential action reaches the one governed commit boundary; no causal shortcut bypasses the E8 kernel.
What it governs. A causal claim must carry provenance and is never a fact; temporal relations are validated against the intervals, causal relations are refused on temporal inversion and cycles, and CORRELATES_WITH is kept explicitly separate and never becomes a cause. Reality and simulated (counterfactual) branches are cryptographically distinct and cannot be merged without explicit reconciliation. A prediction is bound to model, world digest/version, horizon and assumptions, is never a fact and never authority. An intervention is a counterfactual branch that never executes and never mutates reality. Prediction error becomes evidence; a poorly-calibrated model is demoted and never gains authority. A temporal authorization binds world version, temporal window and prediction horizon. The causal blast radius propagates action → direct → second-order → dependency → system with per-edge uncertainty, and is UNKNOWN where not measurable.
Verified. Q1–Q42 42/42 hold; the CAIN-42-E16-Causal-World-Bench is 84/84 contained; the 10-step end-to-end run passes; 176 E16 tests pass, 0 failed; a clean-room verifier (69 checks, imports no CAIN-42 code) recomputes every digest and returns INTACT, rejects 12 kinds of tampering and tolerates served-page chrome. Full suite 7,561 passed, 0 failed, 62 skipped, 4 xfailed. evidence page · master proof · attack manifest · clean-room verifier (INTACT, 69 checks)
Limits. A TESTED library; it contains no learned world model, simulator, vehicle, robot, sensor or actuator controller and drives nothing. Real vehicle / robot / actuator / sensor integration and a hosted E16 service: NOT_IMPLEMENTED. World-model accuracy, the semantic truth of observations and causal claims, and sim-to-real fidelity: UNKNOWN. Real-world attack testing and third-party reproduction: NOT_PERFORMED. Hardware attestation: UNKNOWN. Hash integrity is not semantic truth. Single host; ephemeral signing key on the proof; no third-party review. PRE-PRODUCTION.
In one sentence. E14 makes every tool, skill, plugin, connector, model and subagent a governed object: CAIN-42 knows what it is, who published it, what artifact and dependencies implement it, what it may touch, and whether it may run at this exact moment. It binds that answer to the decision that uses it.
The law. A CAPABILITY IS A POWER SURFACE. DISCOVERY ≠ TRUST ≠ AUTHORITY ≠ AUTHORIZATION. A TOOL, SKILL, PLUGIN, MODEL OR CREDENTIAL IS NOT AUTHORITY. UNVERIFIED POWER MUST NOT EXECUTE. Effective capability is the intersection of eight envelopes, never a sum; a grant never exceeds its issuer; a subagent only ever gets less.
What it catches. Fake or substituted tools, publishers and artifacts; unsigned or broken provenance; dependency substitution, hidden dependencies and malicious or downgraded updates; replayed, expired or revoked leases; drift while leased; privilege escalation through delegation, subagents, collectives, memory, model output, tool output or credentials; dangerous capability combinations, even split across agents or chained; sandbox, network, filesystem and credential scope violations; stale decisions, policy, authority or evidence; decision, action and credential substitution; a revocation racing a commit; and a capability mutated between check and commit (the E8 token now binds six capability digests strictly). Building it, we found two Evolution 13 attack scenarios that had been counted as contained without being tested, and fixed both (the E13 bundle is rebuilt), and our own benchmark exposed quadratic lease issuance, now fixed with a regression test.
Verified. C1–C30 30/30 hold; the CAIN-42-E14-Capability-Bench is 44/44 contained; 174 tests pass, 0 failed; full suite 7,107 passed, 14 failed (all 14 in gateway files other sessions were editing, none in E7–E14), and the E7–E13 bundles were rebuilt and verify INTACT evidence page · proof JSON · attack manifest · lease, binding, token & replay · performance · limitations · clean-room verifier (INTACT, 39 checks)
Limits. A TESTED library wired into the agent hypervisor in front of MCPGate, not a hosted service. Hardware attestation and vulnerability intelligence are UNKNOWN; multi-host scale is UNVERIFIED; sandbox profiles are policy-evaluated except what the ZoD confinement enforces at OS level; hash integrity is not semantic truth; the signing key is ephemeral; no third-party review. A system outside CAIN's enforcement boundary remains UNCONTROLLED / UNVERIFIED / UNKNOWN. PRE-PRODUCTION.
In one sentence. E13 adds governed decision integrity: CAIN-42 binds evidence, policy, authority, consequence analysis and the canonical action into one verifiable decision state before execution, so a model's reasoning can propose but never authorize.
The law. REASONING MAY PROPOSE. EVIDENCE MUST SUPPORT. POLICY MUST CONSTRAIN. AUTHORITY MUST AUTHORIZE. CAIN-42 MUST DECIDE. MCPGATE MUST ENFORCE. EVIDENCE MUST REMEMBER. A model's opinion, confidence and narrative are context only, never authority. Authority is the intersection of every envelope, and reasoning can never expand it. No valid decision → no authorization → no execution.
What it catches. A policy conflict is surfaced and resolved only by documented precedence, never silently. Any material change (evidence, policy, authority, risk, consequence, identity, budget, trajectory, runtime) marks the decision stale and requires re-adjudication. A DENY cannot be converted to an ALLOW, a decision cannot be substituted after signing, and an old decision cannot be replayed against a new world state. The governance token now binds the decision, intent, policy, authority and risk digests — change any of them and the token is refused.
Verified. D1–D24 24/24 hold; the CAIN-42-E13-Decision-Bench is 36/36 contained; 33 tests pass, 0 failed; the E7–E13 regression group is green (1,363 tests, 4 expected failures). evidence page · proof JSON · attack manifest · performance (exact conditions) · clean-room verifier (INTACT, 24 checks)
Limits. A TESTED library, not a hosted service. It governs decision construction from recorded inputs; it does not read or validate a model's private reasoning and stores no chain-of-thought. Policy conflict resolution is deterministic precedence, not a theorem prover; counterfactuals are bounded simulation; attestation is software/config digests, not hardware; performance is single-host, in-process, warm; no third-party review. A system outside CAIN's enforcement boundary remains UNCONTROLLED / UNVERIFIED / UNKNOWN. PRE-PRODUCTION.
In one sentence. CAIN-42 now governs the perception layer before every other layer: it identifies what was actually observed, where it came from, whether its provenance is trustworthy, whether it is current, whether it conflicts, whether it is only inferred, whether it is corroborated, and whether that evidence is authorized to influence a particular decision.
The laws. NO EVIDENCE → NO TRUST. OBSERVATION IS NOT FACT. INFERENCE IS NOT OBSERVATION. EVIDENCE IS NOT AUTHORITY. INTEGRITY IS NOT TRUTH. UNKNOWN MUST REMAIN UNKNOWN. A canonical observation carries a stable digest and a full source/provenance/time/trust record; a source whose identity cannot be established is UNKNOWN, never inferred; evidence cannot exist without observations and a provenance root; the epistemic machine never lets UNKNOWN jump to CORROBORATED or an INFERENCE become a FACT.
What it catches. Evidence authority is target-specific (evidence valid for a financial balance is not valid for identity verification). A material conflict is never silently resolved. Corroboration counts independent principals, not observations — 100 agents from one owner are one source. Stale, expired or superseded evidence cannot authorize. Retrieved, web and tool content is DATA, never policy. A valid hash proves bytes did not change, not that they are true. Reality drift forces re-evaluation, and revoking evidence invalidates the dependent claims, intents and governance tokens (an evidence blast radius).
Verified. P1–P20 20/20 hold; the CAIN-42-E12-Evidence-Bench is 32/32 contained; 36 tests pass, 0 failed; the E7–E12 regression group is green (1,330 tests, 4 expected failures). evidence page · proof JSON · attack manifest · performance (exact conditions) · clean-room verifier (INTACT, 21 checks)
Limits. A TESTED library, not a hosted service. Integrity does not establish truth; injection detection is pattern-based; independence is principal+lineage based; image/audio/video semantic authenticity is not established; attestation is software/config digests, not hardware; performance is single-host, in-process, warm; no third-party review. A system outside CAIN's enforcement boundary remains UNCONTROLLED / UNVERIFIED / UNKNOWN. PRE-PRODUCTION.
In one sentence. CAIN-42 now governs what agents say to each other and what tools, MCP servers, memory and external content return, plus the intent an agent derives from it, so untrusted information cannot silently become trusted intent or unauthorized authority.
The laws. INFORMATION IS NOT AUTHORITY. A canonical signed message is bound to a nonce, session, recipient, expiry and the sender's passport digest — a signature proves who sent it, never what they may do. Tool and MCP output is classified but always treated as DATA, never policy and never authorization. Information never inherits the destination's trust (UNKNOWN stays UNKNOWN; SECRET to lower trust is refused). Taint propagates through derived intent — a provenance-risk signal, never proof of malice.
Intent integrity. An instruction hierarchy where textual order is never authority; an interpreted intent kept separate from the canonical action intent; an IntentSandbox that returns eligibility, never authority; conflict detection that never picks a side; intent-drift, confused-deputy, cross-collective and replay defences; and a quarantine that always preserves the evidence.
Verified. I1–I20 20/20 hold; CAIN-Agent-Intent-Bench 20/20 blocked; 36 tests pass, 0 failed; the E7–E11 regression group is green (1,294 tests, 4 expected failures). evidence page · proof JSON · attack manifest · performance (exact conditions) · clean-room verifier (INTACT, 21 checks)
Limits. A TESTED library, not a hosted service; it runs no agents or message bus. Prompt-injection detection is pattern-based, not perfect semantic detection. Influence and provenance graphs are attribution evidence, not perfect causal explanations. Taint is a signal, not proof of malicious intent. Attestation is software/config digests, not hardware. Cross-domain trust requires an explicit trust root. No framework adapter is published. UNKNOWN MUST REMAIN UNKNOWN. PRE-PRODUCTION.
In one sentence. CAIN-42 now governs swarms, teams, hierarchies and dynamically assembled agent networks: it decides what happens when agents collaborate, delegate, agree, share resources and memory, form coalitions, attempt coordinated harmful behaviour, or produce behaviour no individual requested.
The law. ONE TRUSTED AGENT DOES NOT CREATE A TRUSTED COLLECTIVE. Collective authority is the intersection of the policy ceiling, objective scope, member authority envelope, trust/risk/delegation/provenance envelopes, budget and temporal envelope — never a sum. Membership changes are governed and grant no inherited authority; roles carry responsibility only.
Combination risk, collusion, Sybil. Individually-permitted actions (data + credentials + infrastructure + deploy) are classified HIGH_RISK/CRITICAL when combined, before commitment. Circular and reciprocal approval, quorum manipulation, identity splitting and authority fragmentation are detected. Sybil resistance counts independent principal + lineage + funding, so 100 identities from one principal are one trust source. Collective memory keeps conflicts unresolved, an epistemic state refuses UNKNOWN→VERIFIED without evidence, budgets are conserved per kind, and trust is bounded by its weakest dimension. Consensus does not equal authorization — a unanimous decision still returns authority NONE.
Verified. C1–C20 20/20 hold; CAIN-Collective-Governance-Bench 20/20 blocked; 47 tests pass, 0 failed. evidence page · proof JSON · attack manifest · clean-room verifier (no CAIN imports)
Limits. A TESTED library, not a hosted orchestration service; it runs no agents and sends no messages. Emergent/collusion findings are HEURISTIC, not semantic certainty. Sybil resistance cannot catch a principal that also fabricates distinct lineages and funding. Attestation is software/config digests, not hardware. Transaction guarantees cover the governed layer only. No framework adapter is published. UNKNOWN MUST REMAIN UNKNOWN. PRE-PRODUCTION.
In one sentence. CAIN-42 can now answer, with machine-verifiable evidence, who is this agent, what exactly is running, who authorised its capabilities, what changed since attestation, and can a component be revoked without destroying the system — through a signed agent passport, an AgentBOM, a provenance graph and continuous attestation.
Implementation. A new provenance and composition layer (supporting Evolutions 1–8, not replacing them) separates identity, provenance, capability, authority, attestation and passport. IDENTITY ≠ AUTHORITY. MEMORY ≠ AUTHORITY. CAPABILITY ≠ AUTHORITY. A memory that claims authority is UNTRUSTED unless it resolves to a verified source event; delegation can never increase capability, scope, budget or duration; revoking an MCP server cascades to its tool, its capability attestation, the bound governance tokens and the affected agents. 46 tests pass, 0 failed; P1–P15 15/15 hold.
Mutation, published. A material runtime mutation changes the composition fingerprint: the attestation becomes MUTATED, the passport no longer matches, and the provenance-bound governance token is refused at the action-commit boundary; a new attestation and a new authority are required before the next consequential action. evidence page · Evolution 9 proof · schemas · performance · clean-room verifier
Limits. A TESTED library, not a hosted identity service. Attestation is over software and configuration digests, not hardware (hardware attestation stays UNKNOWN). No vulnerability database; no framework adapter is published, so none is described as supported; transaction guarantees cover the governed layer only; performance is single-host and in-process. No third party has reviewed it. UNKNOWN MUST REMAIN UNKNOWN. NO PROVENANCE → NO ELEVATED TRUST. PRE-PRODUCTION.
In one sentence. CAIN-42 can now ask not only may this agent act? but what could happen if it does?, and let the answer bound authority rather than widen it: a governed world state and digital twin predict consequences and uncertainty, and a signed, short-lived, single-use governance token is checked at an action-commit boundary before any consequential execution.
Evolution 7 — Predictive Consequence Governance. A cryptographically tracked world state (every element carries source, timestamp, freshness, confidence, provenance and verification status), a versioned world-state graph, a digital twin (snapshot / clone / simulate / compare / rollback / replay that can never promote a simulation to reality), a counterfactual engine, a causal-dependency graph that never treats correlation as causation, a prediction-error engine whose errors raise uncertainty and can never be lowered by an agent, an uncertainty ceiling that only contracts authority, signed simulation evidence, a sandbox, shadow governance that can never enforce, long-horizon simulation, a 17-vector adversarial corpus, safe-alternative generation, irreversibility controls and predictive economic governance. 12 machine-checkable invariants (I1–I12) all hold.
Evolution 8 — Mandatory Agent Governance Kernel. A canonical action that binds authorization to the exact canonicalized parameters; a signed short-lived single-use governance token bound to the agent, action hash, capability, authority, trajectory, policy root, world-state root, consequence, risk ceiling, resource scope and nonce; an action-commit boundary (prepare → authorize → commit → execute → verify → record) with a TOCTOU re-check; a capability ratchet; execution-path bypass detection that names a bypass instead of hiding it; enforcement-depth that cannot be claimed beyond what is installed; execution rings; safe modes; kernel-level emergency stops outside the agent loop; multi-party authorization; and result-drift incidents. 22 machine-checkable invariants (K1–K22) all hold.
Wired to the CAIN-45 hypervisor (ZoD), restriction-only. Both fabrics are consulted after every hypervisor check and can only add a refusal; a hook that errors is fail-closed. 65 new tests passed, 0 failed; the 976-test hypervisor/L5 regression group is unchanged. reproduce · clean-room verifier (no CAIN imports) · Evolution 7 proof · Evolution 8 proof
Limits. Both fabrics are TESTED libraries on the operator host, not hosted services; the wiring is opt-in and restriction-only; enforcement depth on this host is APPLICATION/RUNTIME/CONTAINER, never OS or HARDWARE; the digital twin has no validated error bound; long-horizon depth is not reliability; no third party has reviewed the bundle. SIMULATION IS NOT AUTHORITY. NO VALID GOVERNANCE TOKEN → NO CONSEQUENT EXECUTION. PRE-PRODUCTION.
In one sentence. When an L5 AI system proposes to change itself (a new memory, skill or tool, or a different model), CAIN-42 decides whether that change may take effect, and every decision is re-checkable.
What was verified. A clean-room verifier (no CAIN imports) recomputes all 11 recorded evolution decisions: 1 ACCEPT, 1 REQUIRE_APPROVAL (deployed only with operator approval), 6 REJECT, 3 QUARANTINE. 143 checks, VALID. It rejects a CAIN-signed but unjustified ACCEPT and 10 tamper classes. reproduce · verifier · transcript · the bundle
A failure, published. The first version of this layer was fail-open on 32 of 32 independent probes, and an earlier 33/33 invariant result had been measured against that version. Fixed in 71eecdb; the probes now find 0 open paths.
Limits. Claim C42-L5-ADAPTIVE-EVOLUTION is TESTED and labelled SIMULATED: an in-process library, not wired into the hosted gateway or MCPGate; a deterministic reference runner, no LLM; no multi-day run. Its keys are generated fresh for each build, so the bundle shows internal consistency and decision correctness, not provenance, and it is not signed by the evidence-root key. PRE-PRODUCTION.
In one sentence. Everything needed to check CAIN-42 without trusting us is now published and signed: what is running, what it depends on, which tests ran and passed, test vectors for independent implementations, every published failure, and a verifier that recomputes all of it. Verify CAIN-42 in your browser.
What is running. A build manifest and per-file artifact list of the live gateway (990 source files; 958 byte-identical to the commit, the other 32 named), a CycloneDX SBOM (177 installed distributions with content hashes) with daily dependency-drift detection, and a deployment attestation that binds the running process to that artifact. There is no build step (CPython runs source) and hardware attestation is not available; both are stated, not glossed. build manifest · SBOM · deployment attestation
What was tested. A real run of the site, gateway, L5-governance, hypervisor, MCP-enforcement and Byzantine suites: 1857 tests, 1842 passed, 0 failed, 7 skipped and 8 expected failures (documented known gaps), each listed with its purpose, category and file hash, with the JUnit XML published. The run first reported the gateway suite as 0 tests (a path bug); the builder now refuses to publish a suite that collected nothing. test manifest
Check it with your own code. 76 public test vectors produced by the real CAIN-42 code: canonical JSON, domain-separated SHA-256, Ed25519 signatures for every signing domain (with negative cases), Merkle roots, policy precedence, authority intersection, blast radius, governance quorum and lease validity. No private key is published. test vectors
The clean-room verifier. verify_proof_fabric.py imports nothing from CAIN-42. It recomputes the artifact tree hash, the deployment id and configuration hash, the SBOM and test counts against the JUnit XML, every test vector with its own implementations, the provenance graph and the failure ledger, and with --claims fetches every signed claim's artifacts from all three sites. On its first run it caught a real inconsistency (a rounded timestamp in the deployment id), fixed in the generator. Its own tests include a tampered-and-re-signed bundle, which it still rejects. 32/32 PASS from each site. the verifier · reproduce
For procurement and auditors. A downloadable evidence pack (11 MB) with every claim-pinned artifact, the verifiers, the manifests, a 10-step verification workflow, limitations and the changelog; its manifest and a release statement are signed. evidence pack · signed release
Machines too. A read-only evidence API: /api/v1/proof, /claims, /claims/{id}, /bundles, /manifests, /artifacts/{sha256} (content-addressed), /verify, /status, /changelog. Its /verify runs on our server, so it is labelled a convenience, not independent verification.
Honest status model. Every signed claim now has a version, a category and a state: 19 REPRODUCIBLE, 13 TESTED, 5 CLAIMED, 1 SUPERSEDED, 0 INDEPENDENTLY VERIFIED: no third party has reviewed CAIN-42, and the registry cannot say otherwise. 19 fixed defects and 2 failed claims are listed in the failure ledger; every published benchmark lacks at least one required test condition, and the performance index says which. failure ledger · performance index · Byzantine index · provenance graph
Watched, not just published. An integrity monitor re-verifies the published evidence from outside every 6 hours and signs a hash-chained result. First run: PASS on all three sites; claims 31 PASS, 0 FAIL, 0 missing, 1 superseded, 5 not verified (claims that are themselves unverified). latest run
Security disclosure. security.txt no longer points at a PGP key and a careers page that did not exist, and no copy of it promises a bug bounty (there is none); the disclosure policy now covers all three sites and evidence problems: verification errors, inconsistent bundles, inaccurate claims and results you could not reproduce. How to report
In one sentence. An autonomous (L5) AI system can now only act through CAIN-42 on the hosted gateway: an unregistered system or an unsigned request is refused, and a registered system is checked, action by action, against its signed manifest, its policy, its authority limits and governance state signed by a quorum of the live cluster.
What changed. /fabric/mcp/enforce is fail-closed for every tenant (CAIN_SYSTEM_GOVERNOR=1, gateway restarted 12:03 UTC). A system is registered by an operator as a governance-signed manifest of its agents, models, tools and resources; every agent request must be signed by that agent's registered Ed25519 key (60 s window, nonce replay refused); governance state (policy, resources, trust) authorizes only when the live cluster cain-mr-01 has committed its digest and the gateway verified the 3-of-4 quorum certificate itself (only digests and a tenant hash are ordered, never names). Emergency freezes are operator-signed, scoped and expiring; lifting one needs two operators. Decision records are append-only in the database.
Verified on the live gateway, through all three domains. 13 of 13 cases behaved as specified: an in-scope read was allowed on each domain; an unregistered tenant, an unsigned request, another agent's key, a replay, an action outside the system's authority, a swapped model, a subagent WRITE, an unlisted tool and an emergency freeze were refused; one-operator recovery was refused and two-operator recovery restored service. State certified at cain-mr-01 sequence 20167 (3 signers); 8/8 decision signatures valid; the 18-event chain verifies. A clean-room verifier (no CAIN imports) re-checks all of it and, with --live, confirms all three sites publish the same governance key and the cluster's own public record names this run's state digest: 41/41 VALID. reproduce · verifier · transcript · the run
CAG-L5 verification matrix. 12 governance capabilities, each with only the status its evidence supports: 6 VERIFIED on the live path (agent identity, dynamic authority, system governance, resource governance, containment, evidence fabric) and 6 PARTIAL (continuous authorization, trajectory, MCP execution, risk, trust, independent verification: tested, verified offline or in part, not fully exercised live). the matrix
Claims. Six L5 claims were added to the Ed25519-signed registry (now 37): C42-CAG-L5-HOSTED-GOVERNOR (LIVE VERIFIED), C42-CAG-L5-SYSTEM-GOVERNANCE, C42-L5-TRAJECTORY-GOVERNANCE and C42-L5-IDENTITY-AUTHORITY (TESTED), the negative-evidence claim C42-L5-TRAJECTORY-FAIL-OPEN-FOUND, and C42-L5-UNIFIED-V1-SUPERSEDED for the earlier bundle. The public evidence inventory re-hashed 1,944 files fetched from the three sites: 0 different, 0 missing, 0 hash mismatches; 787 published files have no signed claim and are labelled UNVERIFIED. Verification Center · inventory · signed machine index
Homepages. The three homepages now say plainly that CAIN-42 governs L5 AI systems: simple at the top, technical further down. Text only; the page structure is byte-identical (checked tag by tag, and the frontend lock reports 0 changes across 73 pages). The production-gate row for the 72-hour soak now reads FAILED (checkpoint 32), replacing the stale “every checkpoint so far is valid”.
Limits, stated. The live run used an operator self-test tenant and a scripted agent: no customer and no LLM agent is governed end to end yet. The hosted endpoint returns a signed verdict and execution commitment; the caller's own gate executes. Leases live in memory (at most 1 h), so a gateway restart denies until they are re-issued. CAG-L5 is CAIN's own governance designation, not the SAE driving scale. Three operators, one provider, no hardware attestation, no third-party review.
Prompt 3 — we attacked our own trajectory authorizer and it failed 13 of 13. The continuous-authorization layer published earlier today returned ALLOW for a lease the agent signed itself, an unsigned lease, a lease belonging to another agent or trajectory, a lease with no expiry, a lease with empty scope (treated as unlimited) or no policy version; it allowed PAUSED, ESCALATED and REAUTHORIZATION_REQUIRED trajectories to act; containment could revive a TERMINATED trajectory and relax a quarantine; and the plan→action binding was never checked. All 13 now fail closed (commit 040cee2): leases must be signed by a governance key (never the agent's), bound to the agent and trajectory, time-bounded (≤1 h), and fully scoped; only ACTIVE/LIMITED trajectories may act; containment only tightens; plan, intent, action, parameters, resource and context must match what governance bound; subagent risk is charged to every ancestor so splitting work across subagents cannot evade cumulative limits. before/after probe record
Correction. Earlier today this changelog said the trajectory layer had “15 executable invariants” and that the unified bundle verified 22/22. Five of those invariants were the constant True, and the bundle's ALLOW came from the fail-open authorizer. All 15 now execute a code path. The old bundle is left byte-identical (its manifest pins it) with a SUPERSEDED note. The new clean-room verifier recomputes the decision and nine adversarial requests instead of trusting them: 43/43 VALID. verifier (no CAIN imports) · transcript
Prompt 4 — CAG-L5 system governance (CAG-L5 = CAIN Autonomous Governance Level 5, CAIN's own governance designation; not SAE Level 5). One decision now composes: emergency freeze → 2f+1 governance-state quorum → attested, fresh state → a governance-signed system manifest (agents, models, tools, resources, system ceiling) → model identity → tool registry → exact-capability resource checks (READ≠WRITE≠DELETE≠ADMIN≠GRANT_ADMIN) → deterministic policy precedence (a lower ALLOW never beats a higher DENY) → authority intersection (agent ∩ delegator ∩ system ∩ trajectory lease) → the trajectory authorizer → graph-derived blast radius and reversibility, where irreversible or critical actions need two distinct operators. The MCPGate side re-verifies CAIN's signed decision and execution commitment, blocks missing, forged, mutated and replayed calls, and compares the actual effect with the committed one. Emergency controls are scoped, expire within 24 h, and need two operators to lift. The layer plugs into the MCPGate SDK interceptor's existing restriction-only hook.
Evidence — reproduce it yourself. Part 41 Tests A–M on a reference system (primary agent, subagent, 2 MCP tools, databases, config, a 4-node quorum): ALLOW / DENY×3 / REASSESS on policy change / DENY on trust drop / REASSESS on model swap / DENY subagent escalation / MCP bypass blocked×3 / Byzantine disagreement DENY / ESCALATE then ALLOW with two operators / PAUSE on freeze / ALLOW after two-operator recovery. Test N: a clean-room verifier recomputes policy, authority, blast radius, quorum and step-up for every decision, and rejects an ALLOW that CAIN signed but that is not justified: 148/148 VALID, checked from all three sites. 16 system invariants and 16 trajectory invariants PASS; 110 tests in the published run (901 across the regression group). Measured single-process: system decision p50 1.85 ms (≈500/s); MCPGate-side check p50 0.36 ms. reproduce · manifest (SHA-256) · system verifier · transcript · control map · benchmark
Limits, stated. The system governor is a TESTED library. It is wired into the MCPGate SDK as an opt-in hook that is OFF by default, and the hosted gateway path does not use it. Its control map governs 15 of 17 domains; NETWORK and SECRETS are not governed by it. Keys in the bundles are ephemeral. There is no third-party review, no hardware attestation, and no real LLM agent governed end-to-end. No L5 claim is made.
72-hour multi-region soak: still running, and it will be recorded as FAILED. At 37.7 of 72 hours (ends about 2026-09-29 21:40Z), the live cluster cain-mr-01 has had 107 replica kills and 107 restarts, with 0 divergences and 0 anomalies; 37 of 38 checkpoints verify, each with 48 quorum certificates. Checkpoint 32 (hour 32) does not: its MCPGate-enforced checkpoint authorization did not commit (CONSENSUS_TIMEOUT). The soak's own pre-committed rule is that every checkpoint must carry that enforcement evidence, so its verifier already returns FAIL, and no later hour can change that. Consensus safety held; one hourly enforcement proof was missing. We publish that as a failure, not as a pass. the failing checkpoint · verifier transcript (run from clawx.click) · verify all checkpoints
What was verified. Three verifier implementations that share no code and import nothing from CAIN independently re-derive canonical JSON, Ed25519 signatures, the trajectory hash chain and its RFC-6962-style Merkle root, delegation non-escalation, authority intersection, policy/action binding and the invariant matrices. All three return VALID against the published bundles: verify_l5_unified.py (22/22), verify_authority_bundle.py (22/22) and verify_l5_bundle.py (10/10). The signed artifacts and the verifiers are published on both evidence roots so either site can be checked by hand. reproduce it with one command · manifest with per-file SHA-256 · the unified verifier (no CAIN imports) · the signed bundle
What this proves, and what it does not. It proves the artifacts are internally consistent and cryptographically sound under a verification implementation that shares no code with the runtime. It does not prove independent third-party review: the verifiers, the runtime and the operator are the same, on one host, with one provider, and no external party has reproduced it. So we do not claim CAIN-42 is "fully independently verified from more than one source" — that would be false today. What is true is narrower and checkable: multiple independent verifier implementations agree, on published signed artifacts. No L5 claim is made.
New governed libraries, none of which can authorize anything. A Trajectory Firewall hash-chains a long-horizon run and flags plan/authority drift, scope creep, privilege accumulation, tool/model/identity/memory substitution, stale authorization, delegated escalation and suspicious retries. Stopping Intelligence reaches STOP/WAIT/REQUEST_APPROVAL/REPLAN/ROLLBACK/QUARANTINE/ESCALATE and can only ever make an action less permissive. A Swarm Authority Fabric keeps CHILD ≤ PARENT and SWARM ≤ POLICY, and treats unanimous agent votes as informational. A Governed Tool lifecycle makes discovery and creation grant NO AUTHORITY. A Governed Memory Fabric classifies every item, calibrates it, and cannot become policy. Resource Authority is time/scope/resource/policy/trajectory-bound, revocable and non-escalating. They encode one rule: LEARNING, PREDICTION, MEMORY, SIMULATION, DISCOVERY and AGENT CONSENSUS may change capability but never create execution authority. 419 new unit tests plus one executable Part XXVIII invariant matrix.
Limits. These six fabrics are TESTED unit libraries, not VERIFIED: no published independent evidence bundle exercises them, and they are not wired into the hosted enforcement path. The world model is tabular, not neural; the memory is not a vector store. The hosted runtime remains PRE_PRODUCTION. see every claim's evidence and limits
Policy changes are governed. A tenant's policy (which capabilities a ZoD may hold, the largest budgets it may get) now becomes active only when the live cluster cain-mr-01 commits its activation. Widening it needs a registered human who is not the proposer; narrowing it needs no one, because authority may always go down. On the live cluster: an agent's first policy was approved by a human and activated (QC 16148); the agent then proposed an expansion and approved it itself — refused, and the cluster was never asked; a failure lab's restriction was activated (QC 16151) and a running ZoD lost its authority on its next call; a ZoD above the ceiling was refused. verify: python3 verify_e8_governance.py . -> 19/19 checks, VERIFIED
Predictions, simulations, agent votes and memories are not authority. Four things an intelligent system produces were presented to the hypervisor as the basis for a ZoD: a world-model prediction with 0.99 confidence, a simulated ALLOW citing a real certified sequence, ten agents' unanimous signed vote, and a memory replaying a real decision with the verdict changed. Each was refused because the live cluster had not certified it; across the run exactly one ZoD was ever authorized.
Limits. Scripted identities, not a real LLM agent. CAIN does not contain a world model, digital twin or learning memory: the run shows their outputs cannot become authority. The governor runs as a library on the gateway host. The registry now also names seven older files on the sites whose self-asserted statuses (CERTIFIED, PRODUCTION_HARDENED, OPERATIONAL_PROVEN...) no evidence supports; they stay for history, marked superseded.
Four ways authority could survive what should end it, found by an independent probe, all fixed. Moving the clock back revived an expired grant (now: a stored time high-water mark refuses a clock that goes backwards). A tool could run while the evidence log was unwritable (now: the intent is recorded before the effect, so no log means no execution). A failing trust service, and a cluster that errored during authorization, raised instead of refusing (now: recorded refusals). Tests: 4 former gaps now pass, and fail on the previous code.
Faster. Every action re-verified every signature since the ZoD began. Now each entry is re-hashed but its signature verified once: gate p50 with 100 ZoDs in the store went from 113 ms to 18.7 ms (1,000 ZoDs: 36 ms; p99 about 0.3 s). Measured on the gateway host.
Limits. Library-level fixes in the hypervisor on the gateway host; the p99 tail is not yet explained.
Evolution #7: the five conditions Evolution #6 left open, on live authority. Every ZoD was authorized by the live cluster cain-mr-01 (decision QC 15876, ZoD QCs 15880-15892), made one successful tool call, and was refused on the next call with the tool never running once: the policy root changed; the policy source became unreadable (unknown is refused, never read as unchanged); the risk budget was spent; the blast-radius budget was spent (actions now carry consequence classes C0 read to C4 security/infrastructure); and a delegate spent its parent's budget — delegates are charged up the whole chain, so splitting work across children cannot multiply authority. Each ZoD is bound to the cluster's real membership configuration (hash recomputed, a quorum of replicas agreeing), re-read before every action (36 live reads in this run); a changed epoch, a changed membership and an unreachable cluster were each refused. Also fixed: a retry after a replica committed but timed out used to be refused as 'not committed'; the client now takes the committed sequence from the replica's cached reply and accepts it only if that certificate verifies over the exact request. verify: python3 verify_e7_lease.py . -> 60/60 checks, VERIFIED
Limits. Stated, not hidden: the three membership/epoch changes were INJECTED into the hypervisor's view (the live cluster was not re-keyed); the policy and budget trips are real. Enforcement is the hypervisor library on the gateway host. Only tool-call budgets were exercised live.
Agent Hypervisor / ZoD runtime, authority from the live cluster. An agent never holds execution authority; it acts only inside a ZoD (Zone of Decision), and only after the live 4-server cluster cain-mr-01 has committed that ZoD's authorization with a quorum certificate (3 of 4 Ed25519 signatures) that the hypervisor checks itself. Code runs under real confinement (bubblewrap namespaces + cgroup v2, no network, host tree invisible). Two ZoDs were authorized at cluster sequences 13379 and 13380; 10 attacks were refused, each as a signed DENIED entry; 45 evidence entries, hash-chained. verify: python3 verify_cain45_zod.py . -> 10 PASS, VERIFIED (about 0.3 s)
Authority leases, tripped live (Evolution #6). A ZoD is a temporal authority lease. For each of 9 conditions a fresh ZoD was authorized by cain-mr-01 (decision QC 15746, lease QCs 15748-15759), one tool call succeeded under that live authority, the condition was tripped, and the next call was refused with the tool never running: TTL expiry, trust below floor, agent identity swapped, tool schema changed (rug-pull), security context changed, trajectory fork, explicit revocation, parent quarantined (child loses authority with it), required evidence deleted. Four of these were holes found and closed this release: before the fix a child ZoD kept acting after its parent was quarantined, a tool whose schema changed after authorization was still called, a re-registered (swapped) agent identity kept acting, and deleting the evidence log did not stop execution. verify: python3 verify_e6_lease.py . -> 48/48 checks, VERIFIED
Limits. Stated, not hidden: the invalidation logic runs in the hypervisor library on the gateway host, not on the cluster nodes; what comes from the cluster is the authority being invalidated. The evidence-deletion row is SELF-REPORTED: its result is signed by the run's hypervisor, but the log that would prove it is the one deleted. Not implemented yet: invalidation on policy, epoch or membership change, risk and blast-radius budgets. A separate 4-node 'authoritative state' layer in the code is SIMULATED (one process holds all 4 keys) and is not used for any of this evidence. seccomp, egress allowlists and hardware attestation are not established.
Customers can now export any of their decisions exactly as stored and signed (GET /fabric/decisions/{id}/signed-record) and verify it offline with the published verifier, which contains no CAIN code. New disk and memory watcher on all four servers, after /tmp filled up on the Atlanta server; every server is currently below 80% disk use.
Verifier and worked exampleEvery hosted decision record is now Ed25519-signed by a key kept outside the database, so an edit is detectable even if its digest is recomputed; that covers the stages after consensus and the final verdict. Public key at /fabric/decision-signing-key. Verified live. Not covered: root on the gateway server. Gate X PASS (5 of 9).
Decision signing keyThe previous full run's 13 test failures traced and fixed without weakening a check (latest run: 5453 passed; its remaining failures belong to a change still in progress). The Verification Center correctly flagged one claim as TAMPERED: a soak verifier had been overwritten after signing. The signed bytes are restored and the fix is published as v2. That soak's real outcome is recorded: it stopped at 24 of 72 hours and its verifier returns FAIL. The daily signed sync now measures the live 4-region cluster.
Soak verifier update and outcome · llms.txtTwo-replica storage loss, rebuilt from off-host backups. On the live 4-server cluster, the Miami and Silicon Valley replicas lost their storage at the same time and were rebuilt only from backups held in other regions. While both were down the cluster committed 0 of 4 writes; afterwards 0 decisions were lost and all four were identical 10.3 s after restart. verify 416 certificates
MCPGate enforcing live consensus. Authorizations committed by the live 4-server cluster; every tool call went over HTTP through the MCPGate proxy to a separate MCP server process. 5 authorized calls ran (per the server's own log); 12 attacks were blocked, and each caller received the gate's signed denial. verify with one command
Hosted decisions: the gateway now checks the quorum certificate itself. Security fix: the hosted consensus stage used to accept a replica's word that a decision was committed, so one lying replica could have authorized a decision with no quorum. The gateway now verifies 3 pinned Ed25519 signatures over the digest it computes for that decision, and shows the check on every decision. verify a decision yourself
Formal models checked. TLA+ models of the PBFT commit/view-change rules and of the MCPGate gate, checked exhaustively by TLC: 0 violations in 7.3 million distinct states, and all 8 deliberately broken variants caught. An earlier run had been recorded as incomplete because the checker stopped at the model's normal end state; fixed. models and results
Claims registry rebuilt from current evidence. 24 signed claims. It had still said one host and no formal verification, and still called the failed single-host 72-hour soak 'in progress'; it now records that soak as FAILED and the multi-region soak as running. Gates: 14 of 15 (A-O) and 3 of 9 (P-X); hardware attestation is blocked (no TPM, SEV or TDX on any server). verify the registry
One-way network partitions. On the live 4-server cluster: a replica that can talk but not listen, a one-way link between two backups, and a replica that can listen but not talk. The cluster kept committing in each case, went through view changes, and all four replicas held identical decision chains after each heal. verify 968 certificates
Daily restore validation. Every day each replica's newest off-host backup (8 replicas, 2 clusters) is fetched from the server in another region that holds it and proven to be a quorum-signed prefix of the live history; tampered backups fail even with a re-hashed manifest. verify
Signed evidence index for crawlers and AI agents. /cain42-evidence-index.json on all three sites: every claim with its status, limits, artifact hashes and verification command, every gate, and the live endpoints, generated from the signed registry and signed with the evidence-root key; llms.txt carries the same, generated. claims registry
Degraded network: safe, but slow. 10% packet loss, 120±40 ms jitter, 5% duplication and reordering on all four replicas of the live 4-server cluster for 4 minutes: no fork, but throughput fell from 1.76 to 0.16 commits/s and 22 of 61 writes timed out; it recovered fully afterwards. The evidence publisher now runs the privacy firewall before anything reaches the sites (a bundle was briefly public with an internal subnet in its description). verify 2,728 certificates
Engine 948b189 on the 4-server cluster: fewer view changes, same throughput under loss. View-change backoff now resets only when a view commits, and a fresh view is not accused. Released reproducibly (two independent builds, identical image ID; signed release manifest 17/17), upgraded replica by replica under live traffic (each caught up in 11-31 s, no quarantines). Re-running the same degraded-network test: view changes fell from 14 to at most 6, but throughput under 10% loss stayed about the same (0.16 -> 0.18 commits/s). The storm was not the bottleneck; message delivery under loss is. Safety held (4,448 certificates, no fork). before/after, verify 4,448 certificates
The self-hosted SDK and MCP proxy now hold any undeclared action for approval instead of allowing it. Authorized tools are declared with guard(allow=[...]), allowed_tools=[...] or CAIN_ALLOWED_ACTIONS. Opting out (CAIN_UNKNOWN_ACTION_POLICY=allow) is explicit and recorded on every decision. 1516 dependent tests pass.
Free shadow mode for every customer; paid plans can switch themselves to enforce mode (POST /fabric/settings). The 4-server cluster's image was reproduced exactly by two independent builds (signed manifest 17/17). SDK allowlists and opt-in default-deny. Audit fixes applied. 13 of 15 gates pass.
Release manifestcain-mr-02 runs one replica on each of Atlanta, Los Angeles, Miami and Silicon Valley. Every server was taken offline in turn, and it kept committing each time (6/6, with a leader change each time). With two down it refused. 264 certificates, 40/40. Only the provider (Vultr) remains a single point of failure. 12 of 15 gates pass.
Verify the four-server cluster · Computed resilienceTwo independent from-scratch builds of one commit gave the same image ID, with every layer identical. Backups are also stored on another region's host. The live cluster moves to the reproducible image after the soak.
Reproducibility evidenceA forging replica's votes were rejected everywhere (6/6 committed). An equivocating primary was proven from its own signatures, quarantined by all 3 honest replicas and replaced (6/6 committed). 29/29 checks. This ran on a disposable cluster with the same placement. A signed operational proof is published every 30 minutes. The test suite is fully green (870/0), including a fixed approval-workflow bug. 11 of 15 gates pass.
Verify the Byzantine tests · Verify the operational proofsSame image on every host; 1,461 image files byte-identical to the commit; 47-package SBOM; Ed25519-signed (verifier 16/16). Tests: 865 passed, 4 failed; the failures predate this work and are listed by name.
Release manifest · Test reportWith Miami cut off, the other three committed 6/6 and the isolated replica committed nothing. In a 2|2 split neither side committed, so there was no split brain. All four agreed within about 3 s of each heal (2,960 certificates, 32/32). The anti-entropy fix (81bdf84) is rolled out live. Drill: rolling restart under writes 83/83 with 0 failures; disk-loss rebuild in 13.6 s. 7 of 15 production gates pass.
Every homepage lists the fifteen production gates with evidence links (5 of 15 pass today) and a live cluster-state line. A load test on the live cluster exposed a real defect: a replica signed after losing primacy and accused honest peers with a mismatched-signer proof. Safety held. Fixed in 9fedb49 with tests and rolled out live the same day as a rolling upgrade; all four replicas agree. Also: health endpoint, rolling upgrades, online backups.
4 PBFT replicas on 3 hosts in Atlanta, Los Angeles and Miami over WireGuard (n=4, f=1, quorum 3). Fault injection on the live cluster: Miami down, 6/6 committed; one Los Angeles replica down, 6/6; whole Los Angeles host down, 0/3 (refused, as required); Atlanta and the primary down, view change, then 6/6. 336 certificates, 49/49 standalone checks. The signatures confirm that no decision taken during an outage was signed by a stopped replica. Scope: three operators, one provider; not yet in the hosted decision path.
Live cluster: watch, verify, audit, tamper · Verify the fault-injection run · REPRODUCE.txtEvolution 2 of the PBFT engine is committed (364f1bf). It adds up to 4 proposals in flight, a pacemaker that only sets timeouts and cannot authorize anything, and an AuthorizationCertificate that is valid only with a valid COMMIT quorum certificate and a request whose intent, proposal and action hashes match. It also fixes a real defect: the post-commit authorization proof hardcoded trust_state=HIGH and risk_state=LOW, which it never evaluated. It now says NOT_EVALUATED. Tests: 135/135 PBFT Evolution 1+2 and 167/167 wider Byzantine/cluster suites. Public evidence: a disposable 4-node cluster built from c188442 committed 20 decisions across a primary failover. All 160 quorum certificates are published with the signed votes, a standalone verifier that uses no CAIN code, and a page that checks them in your browser (29/29, including 7 tamper controls that must fail). MCPGate is not yet wired to consume the AuthorizationCertificate. The run used one host. Later the same day the live cain-vc cluster was upgraded to this build, node by node: state was preserved on all 4 nodes, a smoke write committed, and rollback copies were kept. Its first new decision's COMMIT and PREPARE certificates and AuthorizationCertificate verify on all 4 nodes. Its first two decisions predate certificates, so its history cannot be verified from genesis, and its API is not publicly reachable.
Not production in the business sense: no customer traffic, same-operator infrastructure, no third-party review. What changed: cain_agi_control_boundary.ControlBoundary.submit_proposal() — the one pipeline here that calls MCPGateLastMileEnforcer (in-flight parameter-mutation defense) after issuing a signed Proof-Carrying Decision — was fully built and tested but reachable only from pytest before today; grepped every live route file for a reference and found none. Now live at /fabric/agi/propose (auth-gated, execution scoped to a small registered sandbox tool set).
CAIN-42 MCPGatecain_agent_trust_passport.py, composing existing identity attestation, evidence-backed trust state, and capability-delegation-chain verification into one signed artifact; fails closed rather than fabricating a trust score."state_transfer_implemented": false in every rejoin-stage result regardless of actual outcome. The protocol is real; the field now reflects a live probe instead of a constant.Restart=always. Still open: multi-node BFT rejoin certification has not passed the full pipeline, and most of the larger "autonomous agency" roadmap this codebase is periodically asked to build remains intentionally unbuilt.
Doctrine: COMPROMISED COGNITION ≠ COMPROMISED AUTHORITY ≠ COMPROMISED WORLD STATE — Consequential autonomy is continuously bound, observable, cryptographically evidenced, independently verifiable, and recoverable from cognition through real-world effect.