CAIN-42 IP hardening, batch 2 (2026-10-06)

WE ATTACKED THE NEXT 20 INVENTIONS AND FIXED 11 DEFECTS IN SEVEN OF THEM. ONE WAS OUR OWN PUBLIC CLAIM: IT IS NOW CORRECTED, LIVE.

What was fixed

• Action-risk classifier (scores every hosted decision). SQL hidden by comments (drop/**/table), commands split into argument lists (["rm","-rf","/"]), amounts in cents or nested objects, and look-alike letters in tool names all lowered the risk. All four now score correctly. The SQL is read twice, raw and with comments removed, so stripping cannot itself hide a statement.
• Symbolic policy verifier. Unexpected evaluation errors and malformed advisory input crashed the check. Both now deny.
• CAIN 14 invariant checker. The public route /fabric/invariants/verify-all reported 200 of 200 invariants passing. Every one of those validators compares or hashes constants; none exercises production code. A correction made on 2026-09-23 had been reverted on 2026-10-04. The route now reports 0 passed, with all 200 listed as CONSTANT_ONLY, and earlier “200/200” statements are withdrawn.
• Quarantine and kill switch. A quarantined agent could lift its own quarantine, with a blank reason. Both are now refused.
• Sandbox boundary. /sandbox/isolation returned an unhandled 500 error; it now answers 503 “sandbox unavailable”.
• Message-injection firewall. The untrusted-content fence could be closed through an unescaped source label; fixed.
• Code provenance manifest. Regenerated from a clean checkout and verified (1,126 files).

How it was proven

26 new test cases were written first and failed against the old code; 3 tests that were already failing now pass. Proof run: 252 of 252 pass. Rolling deploy deploy/20261006T234207Z to both gateway instances, then checked live four times per route.

Files: RESULTS.json (every defect, fix and live check) · junit.xml · manifest.json (SHA-256 of every file). Source code is not published.

Limits. Same-project tests, not third-party assurance. The invariant catalog is complete, but none of its 200 invariants has a real check yet. PRE-PRODUCTION.