CAIN-42 boundary hardening (2026-10-06)

WE ATTACKED THE PATH EVERY AGENT ACTION TAKES THROUGH CAIN-42, FOUND REAL HOLES, AND CLOSED THEM. EACH FIX HAS A TEST THAT FAILS WITHOUT IT.

What was fixed

• MCPGate (896848d6). The proxy forwarded CAIN's own authorization envelope (_cain_* arguments) and the caller's Authorization, X-API-Key and cookies to the downstream tool server. The tool server now receives only the call and an allow-list of protocol headers; a requested kernel sandbox that cannot be built stops the tool server from starting instead of running it unconfined. Test: tests/test_mcpgate_forwarding_hygiene.py
• Shipped package (5ce2d7f9). The installable package carried stale copies of eight security modules, including identity defects already fixed in the gateway (sub-agents inheriting every parent capability, revocation not cascading, a nonce race). The package now carries the fixed modules. Test: tests/test_substrate_gateway_parity.py
• Agent passports on the hosted path (01731e4a). Signed agent passports were checked only by an opt-in MCPGate gate. The hosted decision path now runs the passport check, and the agent-signed request must describe the exact call being decided (tenant, tool, arguments, calling agent); a tenant can require a passport on every call. Test: tests/test_fabric_passport_stage.py
• Tamper-evident identity log (50adc064, 9f2ffcaa). The identity and passport audit log was append-only by convention. It is now hash-chained per tenant, the issuer signs checkpoints, and a standalone verifier with no CAIN imports detects edited, deleted, reordered and truncated history. Test: tests/test_identity_audit_chain.py
• Trajectory governance (1d632b0f, 2ea07272, 509c5f25). Trust earned on cheap reads no longer unlocks high-risk actions, and sequences of individually allowed calls go to a human: a sensitive read followed by an outbound call (also when two keys of one tenant split it), a privilege raised step by step, split payments, a look-alike tool, and the same consequential call repeated in a tight loop. Test: tests/test_mission3_trajectory_governance.py
• Emergency controls (c9e3557d, 81bf32ab). The operator's cluster emergency halt and agent quarantines did not stop hosted decisions. They now halt every tenant (or the quarantined agent) in enforce and shadow mode alike, and an unreadable halt store fails closed. Test: tests/test_fabric_global_freeze.py
• Physical safety envelope (993a8cb0). A tenant-owned envelope per device (geofence, speed, payload, battery, sensor freshness and agreement) refuses out-of-envelope physical actions deterministically, even in shadow mode. Device state is self-reported and not hardware-attested. Test: tests/test_fabric_physical_stage.py
• Agent-to-agent (A2A) (34d69e8b, bf2c39d0). The public delegation verifier answered 'cryptographically verified' without checking any signature, and the guard accepted a forged card for a registered agent signed with the caller's own key. Card and delegation signatures are now verified, a registered agent's card is checked only against the issuer key, and capabilities are labelled self-asserted. Test: tests/test_cain42_phase3_frontier.py, tests/test_guard_a2a_cards.py
• Agents cannot raise their own authority (13d2d291, 2adb8c56). An agent key could promote its own memory (stored as if from a human) to TRUSTED, create or loosen policies, switch off the kill switch and resume itself after being paused. Agent keys can now only lower trust and cannot operate the controls that govern them. Test: tests/test_memory_authority_laundering.py, platform-gateway/tests/test_agent_cannot_operate_controls.py

Results

• Test run: 322 passed, 0 failed, 0 errors (junit.xml).
• Live after the rolling deploy (scripts/ops/rolling_deploy.py, tag deploy/20261006T230837Z, both gateway instances): a forged, unsigned A2A delegation card was refused on 3 of 3 public domains; the public demo decision answered REQUIRE_APPROVAL (the documented result, so no emergency halt is tripping).

Limits, stated

• Self-verified by the same project; not a third-party review.
• Most fixes are proven by tests, not by live attack: the live probes above cover only what can be checked from outside without a customer key.
• Physical device state is self-reported; there is no hardware attestation and no real-hardware validation.
• Agent passports are enforced on the hosted path when a call declares one or the tenant requires one; tenants that do neither are unchanged.
• Revocation runs on a single node.

Source code is not published. RESULTS.json · manifest.json (SHA-256 of every file here).