We don't read prompts. We gate actions.

CLAWX · the proof behind CAIN-42

See what your AI agents did, and check it yourself

CAIN-42 decides what AI agents may do. CLAWX is where you check it. Decisions are serialized as RFC 8785 canonical JSON, signed with Ed25519 and committed by a 2f+1 quorum of CAIN-42's Byzantine fault-tolerant PBFT cluster, which runs across regions over an encrypted WireGuard mesh. CLAWX publishes that evidence as signed bundles, so you don't have to take our word for anything: your own browser can recompute the proof. Consensus notarizes; it never authorizes. However capable AI agents become, every action they take should leave proof that capability alone cannot forge. Verify it with clean-room verifiers that import none of CAIN's code; the SDK install check passes 19 of 19. Live and self-attested, pre-production; not yet independently audited.

Get started free New to CAIN? Start here Browse the evidence

Verify CAIN-42 yourself in seconds, on your own computer: open the Verifier Room on this page and copy one block into a terminal. It downloads a published evidence bundle and its clean-room verifier and recomputes the result — no account, no contact, nothing taken on trust.

Start here · CAIN in one sentence

CAIN decides whether an AI agent's action is allowed, blocks it if not, and gives you a signed proof you can re-run.

That is the whole product in one sentence. Everything else on this page is detail hanging off it. Pick the path that matches you, or keep scrolling through the beginner sections.

BuildI write the agent, or call the API. ProveI have to show an auditor or a customer. DecideI need to know if this is worth buying.

Beginner · the five objects

Five things. That is the whole model.

If you can explain these five, you understand CAIN. Hover or focus a card to see what it prevents.

1 · PrincipalWho is acting: an agent, a human, or a service.Without it, nobody is accountable.

2 · ActionWhat it wants to do: read, write, pay, send, run.Without it, there is nothing to gate.

3 · PolicyThe rule that says what is allowed, for whom, under what conditions.Without it, every decision is arbitrary.

4 · DecisionAllow, deny, or hold for a human, with the reason.Without it, the policy is just a document.

5 · EvidenceA signed, hash-chained record you can re-check offline.Without it, you are back to taking someone's word.

Beginner · the five-minute first win

Get a key, send one action, read the decision, check the proof.

Four steps. No account, no card. The action is a real engine call and the decision is real; it is not a recorded demo.

Get a free key.
Send one action.
Read the decision. Allow, deny, or hold, with the reason.
Check the proof. Open the Verification Center, a signed bundle, or KEYSTONE and re-run the verifier yourself.

Beginner · what the proof is

A signed record you can re-run.

Every decision is canonical JSON, hashed with SHA-256, signed with Ed25519 and chained to the previous record. The report and findings sit inside the signature, not beside it. A standalone verifier recomputes all of it and imports none of our code.

What it proves

That a specific principal asked for a specific action, a specific policy was applied, a specific decision was made, and the record has not changed since. A third party can check it without trusting us.

Verify a record yourself →

What it does not prove

It is not a certification, not a guarantee that an agent is safe, and not a claim that the scanners see everything. It proves what was checked. We state that limit in the report.

The scanners are heuristic; the tests are same-project; there is no SOC 2 and no third-party audit.

Beginner · should you buy it

What it is, what it is not, what it costs.

It is for you if

A customer, auditor, or insurer is asking you to prove something about an AI agent, and a PDF is not enough. You want a record someone else can re-check.

Start small: one fixed-price audit or one free key. See the six products and prices or plans.

It is not

A firewall you drop in and forget. A certification. A promise that an agent is safe. It is the evidence layer that lets a decision be verified after the fact.

Built by FIRME AI CORPORATION, a three-person team: Vincent Noriega (founder), Lena Noriega, Monica Diaz.

Go deeper · the loop

Once the five objects make sense, the loop is just the order they are checked in.

Every action walks it. A stage can restrict or deny; no stage can turn a denial into an approval.

WHO → AUTHORITY → INTENT → CONTEXT → POLICY → RISK → TRUST → DECISION → ENFORCE → EXECUTE → EFFECT → EVIDENCE → CAUSALITY → COUNTERFACTUAL → OUTCOME → TRUST UPDATE. The architecture page has the full definitions.

Beginner · plain-language glossary

The words, in plain English.

Authority: The permission a principal actually holds right now, not what it claims. Why it matters: most AI incidents are authority that was assumed, not granted.
Trust state: A live, evidence-backed score for a principal. Why: it can go down when behavior changes, so yesterday's trust is not today's permission.
Blast radius: What could be affected if this action is wrong. Why: it decides how much proof and how many approvals an action needs.
Trajectory: The path an agent took, step by step, not just the final answer. Why: a correct answer reached through a dangerous path is still a failure.
Provenance: Where a decision, fact, or artifact came from, and what changed since. Why: it is how you reconstruct an incident after the fact.
Policy: The written rule an action must satisfy. Why: it turns a judgment call into a repeatable test.
Decision: Allow, deny, or hold, with a reason. Why: an unexplained decision cannot be appealed, audited, or fixed.
Evidence: The signed record of what happened. Why: it is the only part a third party can verify without trusting you.
Consensus: An independent quorum ordering the record (PBFT, N=4, Q=3). Why: no single node can rewrite history.
KEYSTONE: The loop that finds a defect, fixes it, proves the fix, and signs the record. Why: it turns "we fixed it" into something you can re-run.
MCP: The protocol agents use to call tools. Why: it is the execution channel where a governed action actually happens.
Provisional key: A free key minted while billing was unreachable. Why: it does not authenticate, so re-issue it before use.

Beginner · copy-paste

Use your key in curl, Python, or TypeScript.

Get a key in the five-minute section above. The examples read it from an environment variable, so nothing secret is pasted into the page.

export CAIN_KEY="cain_free_your_key_here"

# Send one action through the live engine
curl -X POST "https://cainstudio.online/fabric/try?scenario=safe-read" \
  -H "content-type: application/json" -d "{}"

# Read your tenant's decisions
curl "https://cainstudio.online/fabric/decisions" \
  -H "X-API-Key: $CAIN_KEY"

import os, requests

key = os.environ["CAIN_KEY"]
r = requests.get("https://cainstudio.online/fabric/decisions",
                 headers={"X-API-Key": key}, timeout=20)
print(r.status_code, r.json())

const key = process.env.CAIN_KEY!;

const r = await fetch("https://cainstudio.online/fabric/decisions", {
  headers: { "X-API-Key": key },
});
console.log(r.status, await r.json());

Go deeper · four levels

Choose how deep you want to go.

Level 1 — one sentence. CAIN decides whether an AI agent's action is allowed, blocks it if not, and gives you a signed proof you can re-run.
Level 2 — five objects. Principal, action, policy, decision, evidence.
Level 3 — the loop. The sixteen stages that check an action before and after it runs.
Level 4 — the fabric. The 7 moats, Byzantine consensus, ARGUS, KEYSTONE, and the evidence graph. Read architecture when you need it.

Training · CAIN-42 in three short videos

Learn CAIN in two minutes.

What it is, how to get a key and make your first call, and how a fix is proved. Captioned; autoplays muted; switch chapters below.

Use CAIN right nowfree key · no card · verified against the live API

The trust loop

How a fix is proved

All 105 CAIN-42 AI services, one API key

Budgets, payments, memory, knowledge graphs, verification, model routing, compliance, security scanning, cryptography, red-teaming and more: the CAIN-42 catalog lists 105 services; 104 of them were reachable on 2026-10-03, each behind the same authenticated gateway, each keeping every customer's data separate. The 98 services deployed in the 2026-10-03 release each passed a live acceptance test, including a cross-customer data check, before the gateway sent them traffic (see the evidence). CAIN-42 is pre-production: its release gate PRODUCTION_RELEASE_APPROVED is BLOCKED. Starter is $19.75 a month; Full, with every service, is $49.75 a month. New: Quorum-QaaS, Byzantine consensus as a service. Any enterprise can now get BFT without building it. Every 42 seconds, CAIN-42 re-checks its own code: FALSEWORK re-scans anything that changed and publishes the result live at cainstudio.online/#codebase-scan. See how every service grades on live checks →

CAINBudget new

Give every agent a spending limit it cannot talk its way past. Atomic reservations, fail-closed when no budget exists, a signed receipt for every yes and no.

See CAINBudget →

CAINPay new

Card-style authorization for agent purchases: merchant allow and deny lists, per-transaction and daily caps, human approval above your threshold, hold / capture / void / refund, tamper-evident ledger.

See CAINPay →

VeritasEngine new

Check an agent's output before anything trusts it: JSON schema, exact arithmetic, SHA-256, code syntax, quotes against the source. Deterministic, signed, fails closed.

See VeritasEngine →

MemoryMesh new

Long-term memory for your agents with real BM25 search, and prompt-injection text quarantined before it can ever be recalled.

See MemoryMesh →

NexusMind new

One knowledge graph your agents share: every fact keeps its sources, contradictions are flagged instead of overwritten, and you can ask how any two things connect.

See NexusMind →

LexisGuardian new

Who decided, under what mandate, with what dissent. Decisions outside a mandate are refused; dissent is kept verbatim in a hash-chained register.

See LexisGuardian →

OmegaRouter new

Send each request to the right model by your own cost, latency and quality rules, with the reason for every choice and automatic failover when a model starts failing.

See OmegaRouter →

TEE Verifier new

Check your AWS Nitro enclaves and AMD SEV-SNP confidential VMs before you trust them: signatures, certificate chains to pinned AWS and AMD roots, chip and firmware binding, freshness, your PCR policy.

See TEE Verifier →

BLUiZZARD Governance new

Proposals, votes and preserved dissent for your team, with an outcome preview, EU AI Act screening of every proposal and a signed audit trail.

See BLUiZZARD Governance →

All 105 services, by category

CAIN Studio Suite: CAIN-42 products from San Jose, live on the hosted gateway

We moved the CAIN-42 products from our San Jose node to the production host in Atlanta. A product appears in the suite only if it started cleanly in a sandbox and a real call to it worked. Each one runs on demand in its own sandbox with no outbound network. On the Space you can also ask for a product in plain English: an AI model running in your own browser ranks every suite product by meaning and maps the whole suite.

Call every suite product live on cainstudio.online → The suite on the CAIN-42 Hugging Face Space

Measured on our own code: FALSEWORK re-checks the CAIN-42 codebase every 42 seconds and KEYSTONE applies only fixes it has proved. See the results.

IHVRK · Independent Human Verification Resource Kit

The IHVRK is the part of CAIN-42 that keeps a human in charge. It holds a high-impact agent action until an enrolled human verifier approves that exact action, lets the approved action run once, and records every step in a tamper-evident ledger. The download bundle puts the evidence for that in your hands: 32 files (about 103 KB) with the test, formal-model and mutation results, the threat model, the residual risks, and a stand-alone verifier you can run with the network switched off.

The bundle (version 7.0.0) records all 916 tests passing, 22 of 22 formal properties holding in their models, and 85 mutants killed with 4 judged equivalent. Those are the developer's recorded results; the verifier checks that the bundle is intact and self-consistent, it does not re-run them. The bundle is integrity-checked by SHA-256 and is not signed. The IHVRK is a library and reference gate: it is not yet wired into the live CAIN gateway or MCPGate, and it has had no third-party review.

⬇ Download the IHVRK bundle (.tar.gz) SHA-256 · seal record

Read everything about it: IHVRK evidence page · overview · architecture · threat model · one-minute auditor quickstart · limitations · bundle final report · all documents

Three steps, every time

1
The AI asks
An AI agent wants to do something: use a tool, change a database, send money, start another agent. It can only ask.
2
CAIN-42 decides
CAIN-42 checks who is asking, what it is allowed to do right now, what it has already done, and how much could go wrong. No authority means no action.
3
The gate enforces, proof is kept
Only the approved action gets through. The decision and what happened are saved as signed proof anyone can check.

What CAIN-42 does today

Live right now, on these sites

Every AI action sent through CAIN Studio is checked before it runs and blocked if it is not allowed (the live pipeline runs identity, intent, policy, authorization, risk, trust, verification, ActionProof, approval, consensus, egress, MCPGate, execution and evidence; no authorization means no execution). Each recorded decision is signed by a live cluster of 4 servers across 4 US regions (Atlanta, Los Angeles, Miami, Silicon Valley) and 3 of 4 must agree (Ed25519 quorum certificate verified by the gateway). MCPGate lets through only the exact tool call that was approved. Unregistered AI systems and unsigned requests are refused, and an agent may change its own model or tools only with a human sign-off (live) (30 of 30 live cases passed). A Python SDK and MCP proxy that say no to anything you did not allow (default-deny). Today's live deployment: the quorum-committed authorization-snapshot data plane is switched on live (measured 2026-09-29 on cain-mr-01, run record dataplane-evolution-2026-09-29/governance/live_run.json: a per-call PBFT round p50 2,268.6 ms, p99 3,937.8 ms, n=20; the snapshot-covered stage p50 0.8263 ms, p99 3.4686 ms, n=1,000), a revoked agent key is refused on its very next request (measured 2026-10-02), progressive trust scoping preventing exfiltration, payload-bound signed tokens, default-deny egress screening as a live stage (an action naming a destination outside the tenant's allowlist is denied; loopback and cloud-metadata endpoints are denied regardless of rules — manage it at /fabric/egress/rules (with your API key)), and Phase 3 Frontier AI intelligence (live) (AgentPRM process reward scoring, TriCEGAR MDP behavioral verification, Governed Memory Shield, and A2A inter-agent delegation at /fabric/frontier/*).

Proof you can check yourself

the signed claims registry lists every registered claim with its status and evidence; /verify.html counts them from the signed file in your browser. Test reports (the 2026-09-28 6-suite proof-fabric run: 1,963 of 1,978 tests passed, 0 failed, 7 skipped, 8 expected failures), verifiers that use none of our code, and the limitations we have recorded (open release gates are listed in the Verification Center), all on the Proof page and in the changelog. A public, no-key proof that the egress and tool-call stages are inside each decision's signed evidence, with a zero-dependency verifier, is at the restriction-stage proof bundle. A signed status receipt — which stages enforce right now, the running commit and the live health, and is itself re-checkable offline — is at the governance status receipt. Real stored decisions are re-derived and shown tamper-evident at the record-integrity proof. Live and self-attested, pre-production: no outside auditor has reviewed it yet (0 independently verified).

Everything in CAIN-42, on one page

175 products and features, 95 of them live today, plus 105 hosted services, and a library of 9,128 pages organised by niche. Tell us what you want your agents to do safely, or just scroll and click.

For engineers: an interactive API reference with a page for each of the 399 API calls and 410 data schemas, each with code samples and a console that sends the real request with your own key, and step-by-step recipes for your agent framework.

Start here (5)Stop risky actions (10)See what your agents do (9)Inside your free account (12)Secure tools & MCP servers (10)Protect identities, keys & data (6)Test & grade your AI (8)Prove it to anyone (9)For developers (7)For large organisations (15)How it works (12)Coming next (72)

The CAIN-42 Top 100

The 100 CAIN-42 products we’re focusing on

Search, filter and open any of the 100. Each product opens a panel of live tools that run on CAIN-42’s production routes, right here in your browser: the live four-replica PBFT cluster, the 16-stage decision pipeline, signed-ledger verification, autonomy and payment guards, and scanners you can feed your own shell commands and MCP tools. No account needed.

Open the full Top 100 page → · Book a demo · Get started free

New on LinkedIn · 13 products, run live on Oct 30 2026

Thirteen new CAIN-42 products. Attack each one live, then buy the pilot.

The interactive consoles run on cainstudio.online and the CAIN-42 Hugging Face Space; each card opens that product’s live demo at its anchor. Every card was run against production on Oct 30; the script and every reply are in the evidence bundle (14/14 checks). The standing pilot is $500 / 30 days.

MCP Attestor

Scans an MCP tool’s description, then probes what it actually does in a sandbox. A poisoned description is graded STUB; the live probe returns NOT_VERIFIED.

Run the live demo →

Payment Mandate Guard

Binds an agent’s cart to a human-signed mandate. The fake Walmart checkout is refused; the real store is allowed; every step gets a signed receipt.

Run the live demo →

Browser Agent Firewall

A runtime session firewall: a hidden Reddit comment sends the agent to Gmail for a one-time code, and the next action is stopped.

Run the live demo →

Agent Autonomy Lease

Autonomy as an expiring, human-signed lease. The agent signs itself level 5 and a $1M budget; the guard refuses it.

Run the live demo →

Self-Modification Firewall

Stops an agent editing its own shutdown script, oversight config or permissions, or copying its weights out.

Run the live demo →

Data-Exfiltration Killswitch

A 50 MB outbound burst severs the agent’s external lines in under a millisecond, with a signed containment receipt.

Run the live demo →

Memory Authority Firewall

A forged-reasoning memory is tainted, dropped from recall, and can never become a permission. Five agent copies count as one source.

Run the live demo →

Swarm Collusion Defense

Consensus is not authorization. A three-agent delegation cycle is blocked; Sybil copies do not manufacture authority.

Run the live demo →

Capability Lease

Multi-hop delegation that only shrinks: a child asking for a capability the parent never had gets HTTP 403.

Run the live demo →

ARGUS Behavioral Envelope

Authority is a lease, not a permission. A wire transfer outside the agent’s LOW envelope is a VIOLATION.

Run the live demo →

ATLAS Transaction Assurance

Trust scoped to one transaction: a cross-org wire without the required identity, evidence or authority is denied.

Run the live demo →

PQC Hybrid Signing

Every receipt signed twice: Ed25519 now and ML-DSA-65 for harvest-now-decrypt-later. A tampered payload is rejected.

Run the live demo →

EU AI Act / ISO 42001 Evidence Notary

A clause-by-clause control-mapping report: EU AI Act 5/5 clauses, ISO 42001 7/7. An evidence pack and gap list, not a certification.

Run the live demo →

All 40 live cards on cainstudio → On the Hugging Face Space →

New in the KEYSTONE family · CAIN-42 Studio

Six new KEYSTONE products: detect, fix, prove, sign

Each one runs a deterministic detector, lets Claude propose the fix, proves the fix with an independent check, and signs the record with Ed25519 so an auditor can verify it offline. Press “Run live” on any card: it calls that product’s engine on this server.

🦞 OpenClaw KEYSTONE (ClawGuard)

OpenClaw skills and plugins

Scans an OpenClaw skill for credential theft, hidden shell commands and instructions aimed at the agent. Claude rewrites the skill; CAIN-42 proves the fixed skill runs inside an isolated sandbox with its own key.

API → · Signed evidence bundle →

SWARM KEYSTONE

Multi-agent delegation

Maps who delegates to whom in a CrewAI, LangGraph or AutoGen swarm and catches authority escalation, delegation loops and collusion. The proof checks the hardened graph is acyclic and every hand-off only narrows authority.

API → · Signed evidence bundle →

VIBEGUARD KEYSTONE

AI-written code

Reads code an AI assistant wrote and flags invented or typosquatted packages, swallowed errors and metrics made from random numbers. Every import goes through CAIN-42's supply-chain guard before the fix is accepted.

API → · Signed evidence bundle →

MEMGUARD KEYSTONE

Agent long-term memory

Inspects a memory before an agent stores it: sleeper instructions, cross-tenant leaks and exfiltration links. Uses CAIN-42's signed prompt-injection classifier, then proves the cleaned memory is free of the residue.

API → · Signed evidence bundle →

SURFGUARD KEYSTONE

Browser agents

Checks a browser agent's plan before it runs: wire transfers, account deletions and other irreversible clicks. Critical steps wait for a human approval that only CAIN-42 can sign, bound to the exact steps and an expiry.

API → · Signed evidence bundle →

ACTUARY KEYSTONE

Agent-fleet risk score

Scores a fleet of agents 0–1000 from its real CAIN-42 decision records, with every adjustment shown. Claude proposes policy rules; a replay of the same history proves each high-risk action is now gated. A risk score from evidence; no insurer is behind it.

API → · Signed evidence bundle →

Newest product · CAIN-42 Studio

KEYSTONE — find the fake, fix it, prove the fix

Watch it happen, line by line, live on this page: FALSEWORK hunts every line for fake results, stubs and unverified claims and names the exact line; Claude Code rewrites that line; CAIN-42 proves the fix and signs the record — and the console below keeps a live, re-checkable tally of every defect ever fixed here. Not a video. Not a claim. The running engine.

Our competitors say “trust us.” We say: don’t trust CAIN — verify CAIN. Use KEYSTONE instead.

1FALSEWORK finds every defect
2Claude fixes it
3CAIN-42 records it as auditor evidence

1FALSEWORK finds the defect
2Claude Code fixes it
3CAIN-42 records the evidence

…sample · standard library only

Loading the samples…

your_code.pyyou paste it

Paste Python code, then attack it.

Want FALSEWORK across your whole codebase? 30-day pilot: $500. We scan your repository and walk your team through every finding. Start a pilot →

record.jsonpaste to re-check

Download all evidence (ZIP)

Recent signed recordsnewest first · each downloadable

Loading…

Signed-evidence ledgerlive

Reading the ledger…

Defects found by FALSEWORKby check

Loading…

Live activitynewest first · auto-refresh 15 s

Loading…

Proof of fixes vs the code-repair field → Download every signed record (ZIP, for auditors) The public key that signs every fix

This is the moat: only KEYSTONE records evidence of every bug it fixes. The other code-repair tools find and fix — then the fix disappears into a chat window. KEYSTONE writes each fix into a signed, hash-chained ledger and lets you watch it happen live: the defect, the exact lines changed, the tests that prove it, the verdict, the SHA-256 chain link and the Ed25519 signature — every record re-checkable by you, and by any auditor, offline. The console below is that ledger, updating in real time as fixes land. No competitor hands you proof of the fix.

Every run writes a signed record: canonical JSON, SHA-256 chained to the previous record, Ed25519-signed. Re-check any record with one click; the key is public at /keystone/public-key. Model-written code runs only inside a sealed bubblewrap sandbox (no network, read-only system). A fix is called a fix only when FALSEWORK re-scans clean and the tests pass on the fix and fail on the original; otherwise the record says NOT_VERIFIED.

New in the KEYSTONE family · CAIN-42 Studio

MCPGate KEYSTONE — harden an MCP tool, prove it was hardened

The MCP security scanner reads a tool definition the way a client receives it — looking for a description that hijacks the assistant, a leaked credential, or a raw command parameter with no constraint. Claude hardens it. Then the SAME scanner re-reads the result, and only a clean second opinion is signed into the ledger. Pick a sample or paste your own MCP tool definition.

MCP tool definition · name · description · input_schema

Scanner findings & signed record

Loading the samples…

record.jsonpaste to re-check

Download all evidence (ZIP)

Recent signed recordsnewest first · each downloadable

Loading…

Signed-evidence ledgerlive

Reading the ledger…

Findings by scanner checkby type

Loading…

Live activitynewest first

Loading…

The moat, again: proof, not opinion. An MCP security scanner finds a poisoned tool; a model can rewrite it. Only MCPGate KEYSTONE re-reads the rewrite with the same deterministic scanner and signs the record — the finding, the hardened definition, the scanner's second opinion and an Ed25519 signature chained into the CAIN-42 ledger. A hardening is called a hardening only when no HIGH or MEDIUM finding remains; otherwise the record says NOT_VERIFIED. Every record is re-checkable and the evidence pack downloads for an auditor.

Pairs with the sibling product MCP-Attestor: scan the descriptor here, harden it, hand the clean descriptor to MCP-Attestor to probe the handler, and you hold one evidence pair. Both reuse the same MCP scanner and the same bubblewrap sandbox.

New in the KEYSTONE family · CAIN-42 Studio

VeriCoding KEYSTONE — a machine proved the fix, for every input

Give a function a contract — a precondition and a postcondition. Z3, a real SMT solver, either proves the contract holds for every possible input, or returns the exact input that breaks it. Claude rewrites the function. Then Z3 proves the rewrite satisfies the contract for all inputs, and CAIN-42 signs it. Not “the tests pass.” A proof, or a counterexample.

Function · verified subset: int/bool, if/else, + - * // %, abs/min/max

precondition postcondition · may use result

Z3 verdict & signed record

Loading the samples…

record.jsonpaste to re-check

Download all evidence (ZIP)

Recent signed recordsnewest first · each downloadable

Loading…

Signed-proof ledgerlive

Reading the ledger…

Functions provedby function

Loading…

Live activitynewest first

Loading…

The strongest moat in the family: a proof, not a test. Every other code tool samples inputs and hopes. VeriCoding KEYSTONE negates the contract and asks Z3 for a satisfying assignment: a real input proves the bug; proving the negation unsatisfiable means the fix holds for every input in the space — and CAIN-42 signs the record. A proof is called a proof only when Z3 proves it and the signature is unchanged; otherwise the record says NOT_VERIFIED. The verified subset is stated up front, never oversold.

Part of the KEYSTONE family alongside KEYSTONE, MCPGate KEYSTONE and MCP-Attestor — same 5-stage loop, same evidence convention, one key that verifies every record. Verify any of them with the shared family verifier in the evidence pack.

KEYSTONE family · AI coding agents · CAIN-42 Studio

CODEGUARD KEYSTONE — a policy gate in front of every command your coding agent runs● checking…

Claude Code, Cursor and Codex run shell commands and write files on your laptop and in CI. CODEGUARD reads each action before it runs and answers DENY, ASK A HUMAN or ALLOW. A deterministic parser makes the call, not a model: it unwraps sudo, sh -c, $(…), backticks, quoting tricks and base64-to-bash, so the hidden command is the one that gets checked. Anything it cannot resolve goes to a person, never through. Type below: every keystroke is checked by the production gate.

Tool

Real incident patterns. Pick one:

No model in the decisionFixed rules, the same answer every time. Auditors can replay it.

Unknown never means allowedUnparseable, computed or unknown commands wait for a person.

Approval only from CAINAn approval is an Ed25519 token tied to that exact action and an expiry. The agent cannot write its own.

Signed receipt per decisionProves what the gate said. It holds a digest of the action, not your command text.

1 · Get the hook (about 30 lines, read it first)

curl -fsSL https://cainstudio.online/api/v1/codeguard-keystone/hook.py -o ~/.claude/codeguard-hook.py

2 · Add it to ~/.claude/settings.json

{"hooks": {"PreToolUse": [{"matcher": "Bash|Write|Edit|MultiEdit|NotebookEdit|Read",
  "hooks": [{"type": "command", "command": "python3 ~/.claude/codeguard-hook.py"}]}]}}

The hook only adds denials and approval prompts. An ALLOW prints nothing, so your own permission settings still apply. If the gate can’t be reached, it asks you rather than allowing. The pending tool call is sent to the gate and not stored. Set CODEGUARD_SEND_CONTENT=0 to keep file contents on your machine. API: samples · install · public key · signed evidence bundle.

The moat: proof, not a prompt filter. Most coding-agent guardrails ask a model whether a command looks dangerous. CODEGUARD parses it, decides by rule, and signs the decision. When Claude proposes a safer command, the same gate re-checks it and the record is chained into the KEYSTONE ledger. Pairs with MCPGate KEYSTONE for MCP tool calls and KEYSTONE for proved code fixes.

KEYSTONE family · pull requests · CAIN-42 Studio

KEYSTONE CI — gate every AI-agent pull request and sign the verdict● checking…

AI agents now open pull requests faster than people can read them, and the same mistakes repeat: tests skipped or deleted to turn CI green, workflows that hand repository secrets to any fork, committed keys, typosquatted packages, hidden Unicode that makes code run differently from how it reads, and poisoned AGENTS.md files. KEYSTONE CI reads the diff with fixed rules, not a model, and answers BLOCK, REVIEW or PASS. Each answer is an in-toto attestation in a signed DSSE envelope that you can keep next to the build and check offline. Paste any public GitHub PR below: the production gate fetches it and checks it now.

Test tamperingSkipped, focused or deleted tests, removed assertions, assert True.

CI takeoverSecrets exposed through pull_request_target, script injection, write-all, unpinned actions, secrets echoed into logs.

Supply chainEvery new pip/npm dependency is checked by the CAIN-42 supply-chain guard, which catches typosquats and rogue package indexes.

Agent tamperingPoisoned AGENTS.md / CLAUDE.md / .cursorrules, agent permission files, CODEOWNERS.

Hidden codeTrojan Source bidirectional-override characters, ASCII-smuggling tag characters and zero-width characters, shown in the diff instead of hidden.

Risky codeCommitted keys (redacted in the output), TLS checks turned off, SQL built from strings, code that fails open.

Add it to any repository: one workflow file

curl -fsSL https://cainstudio.online/api/v1/keystone-ci/action.yml -o .github/workflows/keystone-ci.yml

The workflow runs on every PR with read-only permissions. It adds annotations on the exact lines, fails the check on BLOCK (set FAIL_ON: REVIEW to be stricter), writes a badge into the job summary and uploads the signed attestation as a build artifact. The PR diff is sent to the gate and not stored; the signed verdict and findings are. Read the file before you commit it.

API: samples · action.yml · latest attestation · public key · signed evidence bundle.

The moat: proof, not a reviewer's opinion. AI code reviewers leave comments a model wrote, and the next run may say something different. KEYSTONE CI gives the same verdict for the same diff every time, binds it to the diff's SHA-256 and the head commit, and signs it in the standard supply-chain attestation format (in-toto/DSSE). An auditor can check a year later that this exact PR was gated and what the gate said. Pairs with CODEGUARD, which checks agent actions while the agent is still working, and KEYSTONE, which proves code fixes.

KEYSTONE family · agent credentials · CAIN-42 Studio

BROKER KEYSTONE — a credential for one action, not a key for everything● checking…

Agents usually get standing API keys, so one prompt injection can spend them on anything. With CAIN Action Credentials, the agent asks for one action. CAIN checks that agent's grants and issues a credential tied to that audience, that method, that exact path and the SHA-256 of that exact body. It lives 60 seconds, works once, and any service can check it with a standard EdDSA signature and the published key. The agent can hand a sub-agent a narrower credential, never a wider one. Try it: every step below is a real request to the production issuer and a demo API that accepts nothing else.

Agent Method Path Body

Demo grants (the public page can only issue credentials for these agents and the demo API):

Minting key …. It is separate from the KEYSTONE evidence key and is held in software on the gateway host; there is no hardware security module behind it yet. Each issuance is logged as a hash-chained, signed record that holds the credential’s SHA-256, never the credential itself. The demo API returns labelled demo data and changes nothing. API: JWKS · verifier for your service · latest issuance record · issuance log bundle.

The moat: authority that only shrinks, and proof of every grant. OAuth access tokens and API keys say who you are. A CAIN Action Credential says exactly what one call may do, and it ties a sub-agent’s credential to its parent so delegation can only narrow. The issuance log lets an auditor reconstruct every credential that was ever issued. This extends CAIN’s credential broker, which keeps stored keys away from agents, and pairs with CODEGUARD and KEYSTONE CI.

KEYSTONE family · human approval · CAIN-42 Studio

APPROVAL KEYSTONE — people approve the exact action, in Slack, and the approval is proof● checking…

When an agent wants to do something risky, a person has to say yes, and the yes has to cover exactly what will run. APPROVAL KEYSTONE binds every request to the action’s SHA-256 and requires N of M approvers. The agent can never vote, each person counts once, and one Deny ends it. Each approver gets a one-time signed ballot behind the Approve and Deny buttons in Slack. When the quorum is met, CAIN signs an approval that buys one credential for that action and nothing else. Below, a billing agent wants to delete an invoice. Every step is a real request to production.

Action sha256 …

The cards above are the actual Block Kit message CAIN posts to Slack (from /requests/{id}/slack), drawn in this page. In this demo you hold every approver’s ballot so that one person can try the whole flow. In a real workspace, each ballot goes only to its approver as a Slack DM. The Slack endpoint checks Slack’s request signature and maps each Slack user to an approver. Until a workspace is configured, that endpoint refuses every request. Every request, vote and outcome is a hash-chained, signed ledger record. API: samples · latest ledger record · ledger bundle.

The moat: an approval you can prove, for the exact thing that ran. Most approval steps are a button in a chat that says “OK”, and nothing ties it to what the agent then does. Here the approval names the action’s digest and the approvers, and the credential the agent receives can only perform that one action, once. It builds on CAIN’s approval queue and Slack alerts, and pairs with BROKER KEYSTONE.

KEYSTONE family · agent spend · CAIN-42 Studio

SPEND GOVERNOR — stop a runaway agent before the bill does● checking…

Runaway agents rarely hit a monthly limit first. They burn money in a retry storm, call the same tool in a loop, or spend in amounts too small to notice one at a time. The governor checks every charge against the agent’s budget and every budget above it (workflow, tenant). It also enforces a spend-rate limit at each level and trips a circuit breaker on identical repeated calls. A tripped agent is stopped until a person resets it with a reset that CAIN signs. The agent can’t reset itself. You get your own budget tree on the production governor; pick an agent and a behaviour.

Each charge is checked atomically across every level, so concurrent agents can’t overspend a shared parent; this is tested with four processes racing. Amounts must be finite and above zero. While building this, we found and fixed a bug in CAIN’s budget engine that accepted negative amounts. In this demo you play the operator. In production, a reset goes through APPROVAL KEYSTONE. Trips and resets are hash-chained, signed ledger records: latest record · ledger bundle.

The moat: limits on spend rate and repetition, not only on totals. Billing alerts arrive after the money is gone, and a monthly cap won’t stop a loop that burns a day’s budget in minutes. The governor decides on every charge, before it happens, at every level of the organisation, and keeps signed proof of every stop. Pairs with BROKER KEYSTONE (what an agent may do) and CODEGUARD.

KEYSTONE family · release gate for AI agents · CAIN-42 Studio

AGENT-CI — don’t ship an agent that got worse● checking…

A new model or prompt can give the same answers and still take a different, riskier path to get there: skip the policy check, loop on a retry, delete something and put it back. AGENT-CI runs the old and new versions of an agent on the same test cases and compares both the answers and every tool call. A deterministic gate gives the verdict, with no LLM judge. A separate clean-room verifier re-derives that verdict in a sandbox before it is signed. Below, a support agent moves from v1.4 to v1.5. Pick a change and run the gate.

Edit the suite JSON (cases, policy, baseline and candidate runs)

In your CI: one standard-library file. Exit code 0 ships, 1 blocks, 2 means the gate could not decide, so the pipeline stops.

curl -sO https://cainstudio.online/api/v1/agent-ci-keystone/client.py
python3 client.py suite.json --strict

Every verdict on this card comes from the production gate, not from this page. The signed record is hash-chained and verifies offline with the clean-room verifier against the pinned KEYSTONE key.

The moat: a release decision someone else can re-check. Eval dashboards score answers; AGENT-CI also grades the path the agent took, and it hands your auditor a signed verdict they can re-derive without trusting us. Pairs with FLIGHT RECORDER, which records what the agent did once it shipped.

KEYSTONE family · attack and patch agent tool policies · CAIN-42 Studio

REDTEAM — break your agent’s tool policy before someone else does● checking…

An allow list that says “only files under docs/” is only as good as the gate that reads it. docs/../.env, an encoded slash or a hidden @ in a URL can pass the gate while the tool reads something else. REDTEAM generates bypass calls from your policy, fires them at the gate and compares what the gate approved with what the tool would actually touch. It then writes the smallest patch that closes every breach without blocking legitimate calls, and proves the patch in a sandbox with an independent verifier. Pick an agent and run the red team.

Edit the policy JSON

Every attack, verdict and patch on this card is computed by the production engine, not by this page. Click a tile to see the exact call and try your own bypass value against the live gate. Records verify offline with the clean-room verifier against the pinned KEYSTONE key.

The moat: a patch that comes with its own proof. Scanners hand you a list of findings; REDTEAM hands you the fix, a second implementation that re-runs every attack against it, and a signed record your auditor can check offline. Pairs with MCPGate KEYSTONE and BROKER, which enforce the patched policy at the boundary.

KEYSTONE family · agent run records · CAIN-42 Studio

FLIGHT RECORDER — a signed black box for every agent run● checking…

When an agent does something it shouldn’t, the first question is what actually happened, and an ordinary trace can be edited after the fact. The flight recorder writes each step of a run as an OpenTelemetry gen_ai span, links every span to the one before it by SHA-256, and seals the run with an RFC 6962 Merkle root signed with Ed25519. Below, a refund agent runs on the production recorder. Then you try to rewrite history.

Every check on this card is computed by the server, not by this page. Erasing a payload keeps its salted commitment, so a GDPR erasure leaves the chain, the Merkle root and the seal verifiable. An inclusion proof shows an auditor one event and the signed root, and nothing else in the run.

The moat: a record the agent’s operator can’t quietly rewrite. Tracing tools show you what happened; the flight recorder lets someone who doesn’t trust you check it, offline, against a pinned key. Pairs with SPEND GOVERNOR, APPROVAL and BROKER, whose decisions it records.

Integrations

CAIN-42 plugs into the stack your teams already run: your LLM gateway, your agent framework, your ITSM, SIEM and on-call tools, and your identity provider.

LLM gateways

LiteLLM (Generic Guardrail API) · Portkey (Bring Your Own Guardrails)

Keep your gateway. CAIN-42 runs inside it as a guardrail: prompt injection and poisoned tools are stopped before the model call, and every tool call the model proposes becomes a governed, recorded decision.

LiteLLM and Portkey setup →

Agent frameworks

LangGraph · CrewAI · AutoGen · OpenAI Agents SDK · Claude Agent SDK · Google ADK · Pydantic AI · LlamaIndex · MCP

A decision before every tool call, in the framework you already use: one HTTP call, or the SDK's adapters.

Framework guides →

ITSM and ticketing

ServiceNow (incidents and Security Incident Response) · Jira Cloud

Blocked actions, held approvals and the kill switch open a ServiceNow incident or a Jira issue, with the signed decision record attached.

ServiceNow and Jira setup →

SIEM and observability

Splunk · Cortex XSIAM · Datadog · Microsoft Sentinel · OpenTelemetry (Grafana, Honeycomb, New Relic, Langfuse, Arize Phoenix)

Every decision streams to the tools your security and platform teams already watch, each event carrying its signed digest.

Forwarding setup →

Alerting and chat

PagerDuty · Slack · Microsoft Teams

Page on-call when an agent is blocked or the kill switch engages; post held actions to the people who approve them.

Alerting setup →

Identity and access

Okta · Microsoft Entra ID · Google Workspace · Auth0 · Keycloak · any OIDC provider · SCIM

Single sign-on to the console with your identity provider, and members provisioned and removed automatically.

SSO and SCIM setup →

Deployment

Hosted (cainstudio.online) · Kubernetes Helm charts · self-hosted MCPGate in your VPC

Use the hosted control plane, or run CAIN-42's enforcement boundary inside your own cluster.

Self-hosted MCPGate →

Hugging Face

CAIN-42 Space: a daily workplace for AI engineers

Sign in with Hugging Face and run any tool-calling model as an agent: CAIN-42 decides each tool call live, you approve what is held, every record is signed. Plus your workspace (approvals, decisions, agent keys, policy), MCP setup for Claude, Cursor, VS Code and tiny-agents, and all 268 CAIN Studio Suite products with copy-paste API code.

Open the CAIN-42 Space →

32 capabilities. Measured, not marketed.

Identity, consensus, runtime control, threat detection, compliance, interoperability and SRE: 28 of the 32 are built and pass their tests today, and 15 of those are running live right now. Every status below is read from a signed audit that runs each capability's tests and probes its live endpoint, and where a capability is narrower than its name, the card says so. The 4 we do not offer are listed too. See the signed audit and verify it yourself.

Identity, security & cryptography

Built and tested

Agent Registry & Identity

measured: IMPLEMENTED

Built and tested

DID Identity (W3C)

Every agent gets a standard W3C did:key, and you can publish a did:web document that follows key rotation and deactivates the moment the identity is revoked.

measured: IMPLEMENTED

Built and tested

Trust Tokenization

Short-lived signed capability tokens bound to the exact action, parameters and model. Not a tradeable token.

measured: NARROWER: IMPLEMENTED

Built and tested

Quantum-Resistant Crypto

An ML-DSA-65 post-quantum signing module, tested. Live decisions are still signed with Ed25519.

measured: NARROWER: IMPLEMENTED

Live

TEE Attestation

Verify YOUR enclaves before trusting them: AWS Nitro Enclaves documents and AMD SEV-SNP reports, checked against pinned AWS and AMD roots (tested on real evidence). CAIN's own servers are not hardware-attested.

measured: NARROWER: IMPLEMENTED, LIVE ENDPOINT

Runtime control & consensus

Live

PBFT Cluster

Two live 4-replica Byzantine-fault-tolerant clusters: 3 of 4 replicas must sign before anything counts. Quorum-QaaS now sells that consensus as a service: any enterprise can get BFT without building it. Send the SHA-256 digest of any record with your API key and get back a receipt signed by the quorum, which anyone can verify offline.

measured: LIVE VERIFIED

Live

Production Cluster

Every hosted decision carries a quorum certificate that the gateway verifies itself.

measured: LIVE VERIFIED / LIVE VERIFIED

Live

Agent Hypervisor (ZoD)

A tool call routed through MCPGate runs only with a quorum-committed authorization; the SDK is default-deny. Calls that bypass the gate are not governed.

measured: NARROWER: LIVE + DISPOSABLE CLUSTER VERIFIED

Verified offline

Formal Verification (TLA+)

TLA+ models of PBFT commit, view change and the MCPGate gate, model-checked by TLC (bounded models, not a proof of the Python code).

measured: OFFLINE VERIFIED

Built and tested

Policy-as-Code Engine

OPA/Rego policies with signed policy bundles. In the hosted pipeline the policy verdict is recorded; your own tool rules are what block.

measured: IMPLEMENTED

Live

Sovereign AI Control

Self-hostable MCPGate and SDK, tested, with a live status endpoint. No public self-hosted installer yet.

measured: NARROWER: IMPLEMENTED, LIVE ENDPOINT

Threat detection & response

Live

Shadow AI Discovery

Find unregistered agents on your hosts, and LLM SDKs, MCP tools and autonomous loops in your code, with a live scanner. Not a network-wide scanner.

measured: NARROWER: IMPLEMENTED, LIVE ENDPOINT

Live

Autonomic Self-Healing

Automated quarantine and recovery, tested; live restore drills verified (run by an operator).

measured: NARROWER: LIVE VERIFIED

Built and tested

Predictive Threat Intelligence

Predicts an action's blast radius and counterfactual risk before it runs. No external threat feed.

measured: NARROWER: IMPLEMENTED

Built and tested

ML Anomaly Detection

Real-time trajectory anomaly rules: drift, salami-style cumulative spend, homoglyphs. Rules and thresholds, not a trained model.

measured: NARROWER: IMPLEMENTED

Compliance & governance

Built and tested

EU AI Act Compliance

Article 5, Annex III and Article 50 screening plus tamper-evident evidence export. No notified body has reviewed CAIN.

measured: NARROWER: IMPLEMENTED

Live

Multi-Jurisdiction Compliance

Live required-clause checks for the EU and California, plus EU AI Act screening. Two jurisdictions, not a global rules engine.

measured: NARROWER: IMPLEMENTED, LIVE ENDPOINT

Built and tested

Autonomous Governance

Plans, conflicts and delegations are checked automatically before execution. Automation never authorizes itself.

measured: NARROWER: IMPLEMENTED

Not offered

ISO 42001 certification: not offered

Not offered: CAIN-42 is not ISO 42001 certified. A readiness self-assessment exists.

measured: NOT ESTABLISHED

Not offered

Cross-Chain Governance

Not offered: there is no blockchain or cross-chain component.

measured: NOT ESTABLISHED

Interoperability

Live

A2A + MCP Protocol

MCP enforcement on the live cluster, and an A2A trust layer that refuses forged agent cards.

measured: LIVE + DISPOSABLE CLUSTER VERIFIED

Live

Third-Party AI Governance

External tools and APIs your agent reaches through CAIN are pinned and allow-listed: changed tools are dropped, unknown destinations denied. Vendors themselves are not audited.

measured: NARROWER: IMPLEMENTED, LIVE ENDPOINT

Live

Delegation Marketplace

Bounded delegation chains (scope, limits, expiry, revocation) and a live agent marketplace. Organisations do not trade tool permissions through it.

measured: NARROWER: IMPLEMENTED, LIVE ENDPOINT

Live

Global Trust Mesh

Two live multi-region clusters across 4 US regions, on one provider. Not global yet.

measured: NARROWER: LIVE VERIFIED

Developer platform & SRE

Live

Agent SRE

A live decision stream and traces in the console, plus live observability and agent-debugger services.

measured: NARROWER: IMPLEMENTED, LIVE ENDPOINT

Live

Vertical Solutions

Finance, health and federal policy packs, served live. Rule sets, not audited regulatory solutions.

measured: NARROWER: IMPLEMENTED, LIVE ENDPOINT

Built and tested

Agent CI/CD Pipeline

A conformance suite and a deploy gate exist and are tested. No hosted CI/CD product for your agents yet.

measured: NARROWER: IMPLEMENTED

Built and tested

Collective Intelligence

Shared trust, risk and incident state across agents, tested in-process.

measured: NARROWER: IMPLEMENTED

Built and tested

Evolutionary Architecture

A self-hardening loop that proposes and tests changes. Nothing deploys itself.

measured: NARROWER: IMPLEMENTED

Live

Policy Cards

Eight ready-made policies (payment approvals and caps, read-only database, internal-only email, shell approval, redaction, agent hold) that compile into rules the live pipeline enforces. Preview free; apply with your key.

measured: IMPLEMENTED, LIVE ENDPOINT

Not offered

Neural Governance

Not offered: the term has no implementation.

measured: NOT ESTABLISHED

Not offered

Quantum Governance

Not offered: the term has no implementation.

measured: NOT ESTABLISHED

Start free Verify the audit

Put your AI system under governance

Free to start. Nothing runs without authority: the default is no.

Get started Watch it block an attack

Under the hood

The technical detail

Everything below is for senior AI and security engineers: how CAIN-42 governs an autonomous AI agent, what is live, what is only tested, and what is not built. Every claim links to signed evidence and a verifier that imports none of CAIN-42's code.

Control for the AGI era

Built to control AGI

As AI agents get more capable, the question stops being “is the model smart?” and becomes “who decides what it is allowed to do?” CAIN-42 answers it the same way for every agent, however capable: being capable, confident or right before earns an agent no authority. No AGI exists yet to test against, so every result published here is measured on today’s models. Prompt filters inspect text. CAIN-42 governs what autonomous AI agents actually do: tool calls, shell, databases, APIs, money, spawning other agents. One authorization is not enough for a system that runs for hours, so authority is continuous: a short-lived, governance-signed lease bound to the agent, its trajectory and its exact plan, re-checked before every action against everything the system has done so far, and lost the moment policy, trust, risk, model or context changes. An agent may learn, remember, plan, delegate and discover tools, but none of that creates authority. Only governance state signed by a quorum of the CAIN-42 cluster does. CAG-L5 is CAIN's own governance designation, not the SAE driving scale.

69 signedpublic claims, each with its evidence, status and limits; 18 verified on the live system. Check the signature in your browser 3 of 4replica signatures from a live Byzantine cluster across 4 US regions on every hosted decision, checked by the gateway itself 30 of 30live L5 governance cases on the live gateway behaved as specified (13 system-governor, 17 evolution-gate)14 of 14ways an agent loses its permission, each tripped on the live cluster; the tool never ran after any of them

CAG-L5 system governor (live)

Governs the whole autonomous system, not a single call. One decision composes: emergency freeze, a 2f+1 cluster certificate over the current governance state, a governance-signed system manifest (agents, models, tools, resources), model identity, tool registry, exact capabilities (READ, WRITE, DELETE and ADMIN are never implied by each other), deterministic policy precedence (a lower ALLOW never beats a higher DENY), the intersection of agent, delegator, system and trajectory-lease authority, and graph-derived blast radius where irreversible or wide actions need two operators. The gate re-verifies the signed decision and its execution commitment before anything runs. On in the hosted gateway since 2026-09-28: unregistered systems and unsigned requests are refused. Also live since 2026-09-28: the evolution gate. An agent's model and MCP tool set change only through a signed proposal, an evaluator-signed test report and a human operator (never the agent itself), and every change gets a new capability commitment that the cluster must sign before the agent may act again. Since 2026-10-06 a signed agent passport binds identity, model, tools and authority scope to the exact call; sequences of individually allowed calls (a sensitive read then an outbound send, even split across two keys, a privilege raised step by step, split payments, a runaway loop) go to a human; and a tenant-owned physical safety envelope refuses out-of-envelope device actions, even in shadow mode.

verify the live run (41/41) →

Byzantine consensus authorization (live)

Two live PBFT clusters, n=4 and f=1: cain-mr-02 (Atlanta, Los Angeles, Miami, Silicon Valley) orders and signs hosted decisions with one replica per host surviving any single host loss, and cain-mr-01 (Atlanta, Los Angeles, Miami) has committed 37,409 sequences. Nothing counts without a quorum certificate of 3 Ed25519 signatures, and the gateway verifies that certificate itself instead of trusting a replica's word. Each cluster signs its own proof every 30 minutes: 506 of 743 OPERATIONAL on cain-mr-01 since 2026-09-26, 614 of 815 on cain-mr-02 since 2026-09-27. 442 Byzantine tests pass, and a fault-injection run held 49 of 49 checks.

watch it live →

Enforcement boundary (MCPGate)

Sits in front of MCP servers, APIs and tools. A call runs only if that exact call was authorized; anything else gets a signed denial. The tool server never receives CAIN's authorization envelope or the caller's credentials, and an operator's global halt or agent quarantine stops hosted decisions for every tenant. Being caught earns an agent nothing: two blocked prompt injections no longer unlock a $250,000 transfer or rm -rf /, every action is scored by what it does (tool, destructiveness, amount), dangerous ones wait for a human, your deny rules match every spelling of a path, and an approval covers one exact call, arguments included. Live on 3 of 3 domains since 2026-09-28; 48 of 48 decisions match the cluster's own public record.

5 ran, 12 attacks blocked →

Signed evidence

An Ed25519-signed, hash-chained record per decision in canonical JSON (RFC 8785) with RFC 6962 Merkle proof trees, keys kept outside the database, and standalone clean-room verifiers that re-check everything offline without CAIN code. The identity and passport log is hash-chained per tenant with issuer-signed checkpoints, so an edited, deleted, reordered or truncated record fails offline verification.

Verification Center →

Default-deny SDK & data plane (live)

The Python guard and MCP proxy hold any action you did not declare. Allow tools explicitly with guard(allow=[...]); opting out is recorded on every decision. The live decoupled data plane (CAIN_AUTH_SNAPSHOT=1) executes sub-millisecond local authorization verified against quorum-committed PBFT snapshots with dynamic progressive trust scoping.

quickstart →

Frontier agent intelligence & ZoD (live)

Agent code runs confined with Linux namespaces and seccomp-BPF filters. Real-time Process Reward Model (AgentPRM arXiv:2502.10325) prunes hallucinated shortcut steps, TriCEGAR model checks MDP state transitions, Governed Memory Shield sanitizes injection vectors at write time, and A2A delegation verifies Ed25519 card and delegation signatures, attenuates monotonically and labels capabilities self-asserted. Agent keys cannot raise their own memory to trusted, write policies or operate the controls that govern them. Live endpoints at /fabric/frontier/*.

verify Phase 3 evidence →

CLAWX

Agent identity, channels and approvals

CAIN-42 decides, MCPGate enforces, and CLAWX governs the agents and the channels they act through. Every row shows its real status.

Capability	Status	Source
Signed agent identities and trajectories; agents propose, only consensus authorizes	SIMULATED	agent proof package · claim C42-AGENTS-CANNOT-SELF-AUTHORIZE (scripted agents, in-process, attestation simulated)
Tool authorization bound to a PBFT-committed decision	VERIFIED	proof package · claim C42-MCPGATE-ENFORCES (disposable cluster; not the live MCPGate)
Public evidence log, signed claims registry, in-browser verification	LIVE	/evidence/claims/
Decoupled authorization data plane (CAIN_AUTH_SNAPSHOT=1, sub-millisecond fast-path)	LIVE	phase1-5-hardening bundle · 2746× speedup
Progressive trust matrix & parameter integrity (_scope_seen, payload_sha256)	LIVE	audit & trust scope tests (14/14 PASS)
Frontier 2026 agent intelligence: AgentPRM, TriCEGAR MDP verifier, Governed Memory Shield, A2A delegation	LIVE	phase3-frontier bundle (4/4 clean-room checks PASS)
Artifact supply-chain attestation & publisher pinning (tools, skills, MCP servers)	LIVE	stage-proof bundle · tests (13/13 PASS)
SCR-Bench path-aware composition risk (exfiltration & C2 capability pair denial)	LIVE	stage-proof bundle · order-independent fail-closed
Turnkey self-hosted Helm appliance (mcpgate-appliance v3.0.0)	TESTED	installability tests (19/19 PASS)
Portable execution identity across 23 protocol carriers (E28)	VERIFIED	E28 evidence bundle (442/442 attacks contained)
Universal proof-of-governance with independent offline verifiers (E31)	VERIFIED	E31 evidence bundle (1269/1269 attacks contained)
Governed machine agency exchange (discovery and RFQ without authority leakage) (E36)	VERIFIED	E36 evidence bundle (3340/3340 attacks contained)
Governed execution mobility: migration, runtime admission and signed execution receipts (E37)	PASS	E37 evidence bundle (2,720/2,720 attacks contained)
Portable proof-carrying agency: signed action proofs re-verified without CAIN code (E38)	PASS	E38 evidence bundle (2,141/2,141 attacks contained)
Governed agent factory: mission to minimal, independently evaluated organization of governed agents (E39)	PASS	E39 evidence bundle (3,441/3,441 attacks contained)
Autonomous enterprise intelligence: enterprise state modelled, reconciled and predicted, never authorized (E40)	PASS	E40 evidence bundle (1,354/1,354 scenarios held)
Cross-organization machine agency exchange: machines negotiate and contract, never mint authority (E41)	PASS	E41 evidence bundle (1,180/1,180 scenarios held)
Integration library: one kernel, ABI and action model compose E7–E41 in-process (E42; not the hosted enforcement path)	TESTED	E42 evidence bundle (34/34 evolutions integrated)
Universal agent adapter, OpenClaw adapter	NOT IMPLEMENTED	planned (CLAWX 21)
Telegram and WhatsApp channels, approval cards	NOT IMPLEMENTED	planned (CLAWX 21); needs real accounts to test
Prompt-injection firewall, credential broker	NOT IMPLEMENTED	planned (CLAWX 21)

Architecture

Where CAIN-42 sits

The same diagram is on all three sites. Solid boxes are on the live path today; the dashed layer runs live on the multi-region cluster.

Solid: in the live path today.Dashed: the consensus layer (live cluster cain-mr-02); it orders and signs every hosted decision.Verdicts: ALLOW · REQUIRE_APPROVAL · BLOCKED.

Proof, not promises

Check what is live right now

Your browser loads each row below from its source as the page opens. A source that does not answer shows as NOT LIVE. The passing set is shown here; every claim, its limits and every run outcome stay published in full on the Proof page.

Production gates: 14 of 15 core, 5 of 9 additional passed (proof page & known limitations)Verify every claim Live cluster

Verifier Room — verify CAIN-42 yourself, in seconds

You do not have to trust us or contact us. Every evidence bundle below ships a clean-room verifier that imports none of CAIN-42's code. Copy one block into a terminal on your own computer: it downloads that bundle and its verifiers, and runs two chained checks. verify_publisher.py must print PUBLISHED_BY_PINNED_KEY: the bytes are exactly what the CAIN publisher key signed, so an edited or re-signed bundle fails. Only then does the bundle's own verifier run, and it must print "result": "INTACT": its internal hashes and signatures agree. The block ends with one line, VERIFIED or NOT VERIFIED. Do not run the bundle verifier on its own. Nothing on these sites is needed after the download.

Requires Python 3 and internet. The verifiers read published data only; they never touch the live service and never call our servers for a verdict. A changed byte in any bundle file makes the verifier report BROKEN. INTACT alone means only that the bundle agrees with the key shipped inside it, which anyone who re-signs a bundle can arrange. That is why every block also runs verify_publisher.py (verifier, pinned key at /.well-known/cain-publisher-key.json): it refuses an edited, added, removed or re-signed file. The publisher key is ours, so neither check is independent verification.

BFTIP · bft-ip-forensics-2026-10-05

— published result: INTACT (58/59 checks)

mkdir -p bft-ip-forensics-2026-10-05 && cd bft-ip-forensics-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://clawx.click/evidence/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/bft-ip-forensics-2026-10-05.json", "../bft-ip-forensics-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../bft-ip-forensics-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "bft-ip-forensics-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "bft-ip-forensics-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../bft-ip-forensics-2026-10-05 ../bft-ip-forensics-2026-10-05.attestation.json \
  && python3 verify_bftip.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCE.txt · verify_bftip.py

E38 · e38-byzantine-mission-integrity-2026-10-05

— published result: INTACT (127/127 checks)

mkdir -p e38-byzantine-mission-integrity-2026-10-05 && cd e38-byzantine-mission-integrity-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://clawx.click/evidence/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e38-byzantine-mission-integrity-2026-10-05.json", "../e38-byzantine-mission-integrity-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e38-byzantine-mission-integrity-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e38-byzantine-mission-integrity-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e38-byzantine-mission-integrity-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e38-byzantine-mission-integrity-2026-10-05 ../e38-byzantine-mission-integrity-2026-10-05.attestation.json \
  && python3 verify_e38.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCE.txt · verify_e38.py

E37 · e37-byzantine-autonomous-federation-2026-10-05

30/30 invariants · 30/30 scenarios held — published result: INTACT (70/70 checks)

mkdir -p e37-byzantine-autonomous-federation-2026-10-05 && cd e37-byzantine-autonomous-federation-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://clawx.click/evidence/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e37-byzantine-autonomous-federation-2026-10-05.json", "../e37-byzantine-autonomous-federation-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e37-byzantine-autonomous-federation-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e37-byzantine-autonomous-federation-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e37-byzantine-autonomous-federation-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e37-byzantine-autonomous-federation-2026-10-05 ../e37-byzantine-autonomous-federation-2026-10-05.attestation.json \
  && python3 verify_e37.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCE.txt · verify_e37.py

E36 · e36-byzantine-collective-governance-2026-10-05

23/30 invariants · 30/30 scenarios held — published result: INTACT (69/76 checks)

mkdir -p e36-byzantine-collective-governance-2026-10-05 && cd e36-byzantine-collective-governance-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://clawx.click/evidence/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e36-byzantine-collective-governance-2026-10-05.json", "../e36-byzantine-collective-governance-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e36-byzantine-collective-governance-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e36-byzantine-collective-governance-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e36-byzantine-collective-governance-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e36-byzantine-collective-governance-2026-10-05 ../e36-byzantine-collective-governance-2026-10-05.attestation.json \
  && python3 verify_e36.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCE.txt · verify_e36.py

E35 · e35-continuous-autonomy-integrity-2026-10-05

27/30 invariants · 30/30 scenarios held — published result: INTACT (108/111 checks)

mkdir -p e35-continuous-autonomy-integrity-2026-10-05 && cd e35-continuous-autonomy-integrity-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://clawx.click/evidence/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e35-continuous-autonomy-integrity-2026-10-05.json", "../e35-continuous-autonomy-integrity-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e35-continuous-autonomy-integrity-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e35-continuous-autonomy-integrity-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e35-continuous-autonomy-integrity-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e35-continuous-autonomy-integrity-2026-10-05 ../e35-continuous-autonomy-integrity-2026-10-05.attestation.json \
  && python3 verify_e35.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCE.txt · verify_e35.py

E34 · e34-decision-provenance-2026-10-05

0/0 invariants · 0/0 scenarios held — published result: PARTIAL (0/0 checks)

mkdir -p e34-decision-provenance-2026-10-05 && cd e34-decision-provenance-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://clawx.click/evidence/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e34-decision-provenance-2026-10-05.json", "../e34-decision-provenance-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e34-decision-provenance-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e34-decision-provenance-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e34-decision-provenance-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e34-decision-provenance-2026-10-05 ../e34-decision-provenance-2026-10-05.attestation.json \
  && python3 verify_e34.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCE.txt · verify_e34.py

E32 · e32-global-trust-settlement-2026-10-05

mkdir -p e32-global-trust-settlement-2026-10-05 && cd e32-global-trust-settlement-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://clawx.click/evidence/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e32-global-trust-settlement-2026-10-05.json", "../e32-global-trust-settlement-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e32-global-trust-settlement-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e32-global-trust-settlement-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e32-global-trust-settlement-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e32-global-trust-settlement-2026-10-05 ../e32-global-trust-settlement-2026-10-05.attestation.json \
  && python3 verify_e32.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCE.txt · verify_e32.py

E31 · e31-governance-proof-fabric-2026-10-05

mkdir -p e31-governance-proof-fabric-2026-10-05 && cd e31-governance-proof-fabric-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://clawx.click/evidence/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e31-governance-proof-fabric-2026-10-05.json", "../e31-governance-proof-fabric-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e31-governance-proof-fabric-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e31-governance-proof-fabric-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e31-governance-proof-fabric-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e31-governance-proof-fabric-2026-10-05 ../e31-governance-proof-fabric-2026-10-05.attestation.json \
  && python3 verify_e31.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCE.txt · verify_e31.py

E30 · e30-governance-network-2026-10-05

mkdir -p e30-governance-network-2026-10-05 && cd e30-governance-network-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://clawx.click/evidence/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e30-governance-network-2026-10-05.json", "../e30-governance-network-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e30-governance-network-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e30-governance-network-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e30-governance-network-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e30-governance-network-2026-10-05 ../e30-governance-network-2026-10-05.attestation.json \
  && python3 verify_e30.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCE.txt · verify_e30.py

E28 · e28-catcp-ip-commercial-2026-10-05

mkdir -p e28-catcp-ip-commercial-2026-10-05 && cd e28-catcp-ip-commercial-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://clawx.click/evidence/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e28-catcp-ip-commercial-2026-10-05.json", "../e28-catcp-ip-commercial-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e28-catcp-ip-commercial-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e28-catcp-ip-commercial-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e28-catcp-ip-commercial-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e28-catcp-ip-commercial-2026-10-05 ../e28-catcp-ip-commercial-2026-10-05.attestation.json \
  && python3 verify_e28.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCE.txt · verify_e28.py

E27 · e27-catcp-control-2026-10-05

mkdir -p e27-catcp-control-2026-10-05 && cd e27-catcp-control-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://clawx.click/evidence/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e27-catcp-control-2026-10-05.json", "../e27-catcp-control-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e27-catcp-control-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e27-catcp-control-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e27-catcp-control-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e27-catcp-control-2026-10-05 ../e27-catcp-control-2026-10-05.attestation.json \
  && python3 verify_e27.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCE.txt · verify_e27.py

E26 · e26-byzantine-trust-2026-10-05

mkdir -p e26-byzantine-trust-2026-10-05 && cd e26-byzantine-trust-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://clawx.click/evidence/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e26-byzantine-trust-2026-10-05.json", "../e26-byzantine-trust-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e26-byzantine-trust-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e26-byzantine-trust-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e26-byzantine-trust-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e26-byzantine-trust-2026-10-05 ../e26-byzantine-trust-2026-10-05.attestation.json \
  && python3 verify_e26.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCE.txt · verify_e26.py

E23 · e23-continuous-assurance-2026-10-05

mkdir -p e23-continuous-assurance-2026-10-05 && cd e23-continuous-assurance-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://clawx.click/evidence/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e23-continuous-assurance-2026-10-05.json", "../e23-continuous-assurance-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e23-continuous-assurance-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e23-continuous-assurance-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e23-continuous-assurance-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e23-continuous-assurance-2026-10-05 ../e23-continuous-assurance-2026-10-05.attestation.json \
  && python3 verify_e23.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCE.txt · verify_e23.py

E22 · e22-byzantine-global-verification-2026-10-05

mkdir -p e22-byzantine-global-verification-2026-10-05 && cd e22-byzantine-global-verification-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://clawx.click/evidence/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e22-byzantine-global-verification-2026-10-05.json", "../e22-byzantine-global-verification-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e22-byzantine-global-verification-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e22-byzantine-global-verification-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e22-byzantine-global-verification-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e22-byzantine-global-verification-2026-10-05 ../e22-byzantine-global-verification-2026-10-05.attestation.json \
  && python3 verify_e22.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCE.txt · verify_e22.py

E21 · e21-byzantine-economic-coordination-2026-10-05

mkdir -p e21-byzantine-economic-coordination-2026-10-05 && cd e21-byzantine-economic-coordination-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://clawx.click/evidence/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e21-byzantine-economic-coordination-2026-10-05.json", "../e21-byzantine-economic-coordination-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e21-byzantine-economic-coordination-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e21-byzantine-economic-coordination-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e21-byzantine-economic-coordination-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e21-byzantine-economic-coordination-2026-10-05 ../e21-byzantine-economic-coordination-2026-10-05.attestation.json \
  && python3 verify_e21.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCE.txt · verify_e21.py

E18 · e18-byzantine-counterfactual-governance-2026-10-05

— published result: VALID (31/31 checks)

mkdir -p e18-byzantine-counterfactual-governance-2026-10-05 && cd e18-byzantine-counterfactual-governance-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://clawx.click/evidence/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e18-byzantine-counterfactual-governance-2026-10-05.json", "../e18-byzantine-counterfactual-governance-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e18-byzantine-counterfactual-governance-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e18-byzantine-counterfactual-governance-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e18-byzantine-counterfactual-governance-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e18-byzantine-counterfactual-governance-2026-10-05 ../e18-byzantine-counterfactual-governance-2026-10-05.attestation.json \
  && python3 verify_e18.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCE.txt · verify_e18.py

E13 · e13-bpf-governance-execution-2026-10-05

— published result: INTACT (24/24 checks)

mkdir -p e13-bpf-governance-execution-2026-10-05 && cd e13-bpf-governance-execution-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://clawx.click/evidence/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e13-bpf-governance-execution-2026-10-05.json", "../e13-bpf-governance-execution-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e13-bpf-governance-execution-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e13-bpf-governance-execution-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e13-bpf-governance-execution-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e13-bpf-governance-execution-2026-10-05 ../e13-bpf-governance-execution-2026-10-05.attestation.json \
  && python3 verify_e13.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e13.py

E12 · e12-trust-network-state-2026-10-05

— published result: INTACT (20/20 checks)

mkdir -p e12-trust-network-state-2026-10-05 && cd e12-trust-network-state-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://clawx.click/evidence/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e12-trust-network-state-2026-10-05.json", "../e12-trust-network-state-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e12-trust-network-state-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e12-trust-network-state-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e12-trust-network-state-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e12-trust-network-state-2026-10-05 ../e12-trust-network-state-2026-10-05.attestation.json \
  && python3 verify_e12.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e12.py

E11 · e11-governance-proof-2026-10-05

— published result: INTACT (32/32 checks)

mkdir -p e11-governance-proof-2026-10-05 && cd e11-governance-proof-2026-10-05
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://clawx.click/evidence/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e11-governance-proof-2026-10-05.json", "../e11-governance-proof-2026-10-05.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e11-governance-proof-2026-10-05.attestation.json"))["files"])
for f in names:
    get(E + "e11-governance-proof-2026-10-05/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e11-governance-proof-2026-10-05/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e11-governance-proof-2026-10-05 ../e11-governance-proof-2026-10-05.attestation.json \
  && python3 verify_e11.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e11.py

E42 · e42-supreme-governed-agentic-infrastructure-2026-10-01

— published result: INTACT (1460/1460 checks)

mkdir -p e42-supreme-governed-agentic-infrastructure-2026-10-01 && cd e42-supreme-governed-agentic-infrastructure-2026-10-01
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://clawx.click/evidence/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e42-supreme-governed-agentic-infrastructure-2026-10-01.json", "../e42-supreme-governed-agentic-infrastructure-2026-10-01.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e42-supreme-governed-agentic-infrastructure-2026-10-01.attestation.json"))["files"])
for f in names:
    get(E + "e42-supreme-governed-agentic-infrastructure-2026-10-01/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e42-supreme-governed-agentic-infrastructure-2026-10-01/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e42-supreme-governed-agentic-infrastructure-2026-10-01 ../e42-supreme-governed-agentic-infrastructure-2026-10-01.attestation.json \
  && python3 verify_e42.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e42.py

E41 · e41-machine-agency-exchange-2026-09-30

— published result: INTACT (1303/1303 checks)

mkdir -p e41-machine-agency-exchange-2026-09-30 && cd e41-machine-agency-exchange-2026-09-30
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://clawx.click/evidence/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e41-machine-agency-exchange-2026-09-30.json", "../e41-machine-agency-exchange-2026-09-30.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e41-machine-agency-exchange-2026-09-30.attestation.json"))["files"])
for f in names:
    get(E + "e41-machine-agency-exchange-2026-09-30/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e41-machine-agency-exchange-2026-09-30/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e41-machine-agency-exchange-2026-09-30 ../e41-machine-agency-exchange-2026-09-30.attestation.json \
  && python3 verify_e41.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e41.py

E40 · e40-autonomous-enterprise-intelligence-2026-09-30

— published result: INTACT (1518/1518 checks)

mkdir -p e40-autonomous-enterprise-intelligence-2026-09-30 && cd e40-autonomous-enterprise-intelligence-2026-09-30
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://clawx.click/evidence/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e40-autonomous-enterprise-intelligence-2026-09-30.json", "../e40-autonomous-enterprise-intelligence-2026-09-30.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e40-autonomous-enterprise-intelligence-2026-09-30.attestation.json"))["files"])
for f in names:
    get(E + "e40-autonomous-enterprise-intelligence-2026-09-30/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e40-autonomous-enterprise-intelligence-2026-09-30/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e40-autonomous-enterprise-intelligence-2026-09-30 ../e40-autonomous-enterprise-intelligence-2026-09-30.attestation.json \
  && python3 verify_e40.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e40.py

E37 · e37-autonomous-execution-mesh-2026-09-30

1132/1132 invariants · 2720/2720 scenarios held — published result: INTACT (2627/2627 checks)

mkdir -p e37-autonomous-execution-mesh-2026-09-30 && cd e37-autonomous-execution-mesh-2026-09-30
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://clawx.click/evidence/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e37-autonomous-execution-mesh-2026-09-30.json", "../e37-autonomous-execution-mesh-2026-09-30.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e37-autonomous-execution-mesh-2026-09-30.attestation.json"))["files"])
for f in names:
    get(E + "e37-autonomous-execution-mesh-2026-09-30/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e37-autonomous-execution-mesh-2026-09-30/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e37-autonomous-execution-mesh-2026-09-30 ../e37-autonomous-execution-mesh-2026-09-30.attestation.json \
  && python3 verify_e37.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e37.py

E36 · e36-machine-agency-exchange-2026-09-30

842/842 invariants · 3340/3340 scenarios held — published result: INTACT (3601/3601 checks)

mkdir -p e36-machine-agency-exchange-2026-09-30 && cd e36-machine-agency-exchange-2026-09-30
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://clawx.click/evidence/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e36-machine-agency-exchange-2026-09-30.json", "../e36-machine-agency-exchange-2026-09-30.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e36-machine-agency-exchange-2026-09-30.attestation.json"))["files"])
for f in names:
    get(E + "e36-machine-agency-exchange-2026-09-30/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e36-machine-agency-exchange-2026-09-30/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e36-machine-agency-exchange-2026-09-30 ../e36-machine-agency-exchange-2026-09-30.attestation.json \
  && python3 verify_e36.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e36.py

E35 · e35-governance-intelligence-2026-09-30

799/799 invariants · 3544/3544 scenarios held — published result: INTACT (3810/3810 checks)

mkdir -p e35-governance-intelligence-2026-09-30 && cd e35-governance-intelligence-2026-09-30
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://clawx.click/evidence/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e35-governance-intelligence-2026-09-30.json", "../e35-governance-intelligence-2026-09-30.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e35-governance-intelligence-2026-09-30.attestation.json"))["files"])
for f in names:
    get(E + "e35-governance-intelligence-2026-09-30/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e35-governance-intelligence-2026-09-30/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e35-governance-intelligence-2026-09-30 ../e35-governance-intelligence-2026-09-30.attestation.json \
  && python3 verify_e35.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e35.py

E34 · e34-proof-carrying-machine-agency-2026-09-30

629/629 invariants · 2664/2664 scenarios held — published result: INTACT (3286/3286 checks)

mkdir -p e34-proof-carrying-machine-agency-2026-09-30 && cd e34-proof-carrying-machine-agency-2026-09-30
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://clawx.click/evidence/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e34-proof-carrying-machine-agency-2026-09-30.json", "../e34-proof-carrying-machine-agency-2026-09-30.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e34-proof-carrying-machine-agency-2026-09-30.attestation.json"))["files"])
for f in names:
    get(E + "e34-proof-carrying-machine-agency-2026-09-30/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e34-proof-carrying-machine-agency-2026-09-30/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e34-proof-carrying-machine-agency-2026-09-30 ../e34-proof-carrying-machine-agency-2026-09-30.attestation.json \
  && python3 verify_e34.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e34.py

E33 · e33-governed-agentic-operating-fabric-2026-09-30

581/581 invariants · 2029/2029 scenarios held — published result: INTACT (2603/2603 checks)

mkdir -p e33-governed-agentic-operating-fabric-2026-09-30 && cd e33-governed-agentic-operating-fabric-2026-09-30
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://clawx.click/evidence/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e33-governed-agentic-operating-fabric-2026-09-30.json", "../e33-governed-agentic-operating-fabric-2026-09-30.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e33-governed-agentic-operating-fabric-2026-09-30.attestation.json"))["files"])
for f in names:
    get(E + "e33-governed-agentic-operating-fabric-2026-09-30/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e33-governed-agentic-operating-fabric-2026-09-30/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e33-governed-agentic-operating-fabric-2026-09-30 ../e33-governed-agentic-operating-fabric-2026-09-30.attestation.json \
  && python3 verify_e33.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e33.py

E32 · e32-governed-autonomy-learning-2026-09-30

— published result: INTACT (1420/1420 checks)

mkdir -p e32-governed-autonomy-learning-2026-09-30 && cd e32-governed-autonomy-learning-2026-09-30
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://clawx.click/evidence/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e32-governed-autonomy-learning-2026-09-30.json", "../e32-governed-autonomy-learning-2026-09-30.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e32-governed-autonomy-learning-2026-09-30.attestation.json"))["files"])
for f in names:
    get(E + "e32-governed-autonomy-learning-2026-09-30/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e32-governed-autonomy-learning-2026-09-30/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e32-governed-autonomy-learning-2026-09-30 ../e32-governed-autonomy-learning-2026-09-30.attestation.json \
  && python3 verify_e32.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e32.py

E31 · e31-universal-proof-of-governance-2026-09-30

— published result: INTACT (1676/1676 checks)

mkdir -p e31-universal-proof-of-governance-2026-09-30 && cd e31-universal-proof-of-governance-2026-09-30
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://clawx.click/evidence/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e31-universal-proof-of-governance-2026-09-30.json", "../e31-universal-proof-of-governance-2026-09-30.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e31-universal-proof-of-governance-2026-09-30.attestation.json"))["files"])
for f in names:
    get(E + "e31-universal-proof-of-governance-2026-09-30/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e31-universal-proof-of-governance-2026-09-30/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e31-universal-proof-of-governance-2026-09-30 ../e31-universal-proof-of-governance-2026-09-30.attestation.json \
  && python3 verify_e31.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e31.py

E30 · e30-governed-machine-autonomy-2026-09-30

— published result: INTACT (1187/1187 checks)

mkdir -p e30-governed-machine-autonomy-2026-09-30 && cd e30-governed-machine-autonomy-2026-09-30
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://clawx.click/evidence/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e30-governed-machine-autonomy-2026-09-30.json", "../e30-governed-machine-autonomy-2026-09-30.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e30-governed-machine-autonomy-2026-09-30.attestation.json"))["files"])
for f in names:
    get(E + "e30-governed-machine-autonomy-2026-09-30/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e30-governed-machine-autonomy-2026-09-30/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e30-governed-machine-autonomy-2026-09-30 ../e30-governed-machine-autonomy-2026-09-30.attestation.json \
  && python3 verify_e30.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e30.py

E29 · e29-machine-transaction-fabric-2026-09-30

— published result: INTACT (300/300 checks)

mkdir -p e29-machine-transaction-fabric-2026-09-30 && cd e29-machine-transaction-fabric-2026-09-30
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://clawx.click/evidence/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e29-machine-transaction-fabric-2026-09-30.json", "../e29-machine-transaction-fabric-2026-09-30.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e29-machine-transaction-fabric-2026-09-30.attestation.json"))["files"])
for f in names:
    get(E + "e29-machine-transaction-fabric-2026-09-30/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e29-machine-transaction-fabric-2026-09-30/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e29-machine-transaction-fabric-2026-09-30 ../e29-machine-transaction-fabric-2026-09-30.attestation.json \
  && python3 verify_e29.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e29.py

E28 · e28-portable-execution-identity-2026-09-30

— published result: INTACT (243/243 checks)

mkdir -p e28-portable-execution-identity-2026-09-30 && cd e28-portable-execution-identity-2026-09-30
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://clawx.click/evidence/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e28-portable-execution-identity-2026-09-30.json", "../e28-portable-execution-identity-2026-09-30.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e28-portable-execution-identity-2026-09-30.attestation.json"))["files"])
for f in names:
    get(E + "e28-portable-execution-identity-2026-09-30/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e28-portable-execution-identity-2026-09-30/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e28-portable-execution-identity-2026-09-30 ../e28-portable-execution-identity-2026-09-30.attestation.json \
  && python3 verify_e28.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e28.py

E27 · e27-agentic-internet-control-plane-2026-09-30

— published result: INTACT (4001/4001 checks)

mkdir -p e27-agentic-internet-control-plane-2026-09-30 && cd e27-agentic-internet-control-plane-2026-09-30
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://clawx.click/evidence/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e27-agentic-internet-control-plane-2026-09-30.json", "../e27-agentic-internet-control-plane-2026-09-30.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e27-agentic-internet-control-plane-2026-09-30.attestation.json"))["files"])
for f in names:
    get(E + "e27-agentic-internet-control-plane-2026-09-30/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e27-agentic-internet-control-plane-2026-09-30/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e27-agentic-internet-control-plane-2026-09-30 ../e27-agentic-internet-control-plane-2026-09-30.attestation.json \
  && python3 verify_e27.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e27.py

E26 · e26-universal-machine-agency-trust-2026-09-30

— published result: INTACT (3115/3115 checks)

mkdir -p e26-universal-machine-agency-trust-2026-09-30 && cd e26-universal-machine-agency-trust-2026-09-30
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://clawx.click/evidence/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e26-universal-machine-agency-trust-2026-09-30.json", "../e26-universal-machine-agency-trust-2026-09-30.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e26-universal-machine-agency-trust-2026-09-30.attestation.json"))["files"])
for f in names:
    get(E + "e26-universal-machine-agency-trust-2026-09-30/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e26-universal-machine-agency-trust-2026-09-30/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e26-universal-machine-agency-trust-2026-09-30 ../e26-universal-machine-agency-trust-2026-09-30.attestation.json \
  && python3 verify_e26.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e26.py

E25 · e25-universal-machine-agency-2026-09-30

— published result: INTACT (2977/2977 checks)

mkdir -p e25-universal-machine-agency-2026-09-30 && cd e25-universal-machine-agency-2026-09-30
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://clawx.click/evidence/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e25-universal-machine-agency-2026-09-30.json", "../e25-universal-machine-agency-2026-09-30.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e25-universal-machine-agency-2026-09-30.attestation.json"))["files"])
for f in names:
    get(E + "e25-universal-machine-agency-2026-09-30/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e25-universal-machine-agency-2026-09-30/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e25-universal-machine-agency-2026-09-30 ../e25-universal-machine-agency-2026-09-30.attestation.json \
  && python3 verify_e25.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCTION.md · verify_e25.py

E24 · e24-governed-agentic-internet-2026-09-29

— published result: INTACT (1952/1952 checks)

mkdir -p e24-governed-agentic-internet-2026-09-29 && cd e24-governed-agentic-internet-2026-09-29
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://clawx.click/evidence/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e24-governed-agentic-internet-2026-09-29.json", "../e24-governed-agentic-internet-2026-09-29.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e24-governed-agentic-internet-2026-09-29.attestation.json"))["files"])
for f in names:
    get(E + "e24-governed-agentic-internet-2026-09-29/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e24-governed-agentic-internet-2026-09-29/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e24-governed-agentic-internet-2026-09-29 ../e24-governed-agentic-internet-2026-09-29.attestation.json \
  && python3 verify_e24.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

VERIFICATION.md · verify_e24.py

E23 · e23-governed-meta-intelligence-2026-09-29

— published result: INTACT (733/733 checks)

mkdir -p e23-governed-meta-intelligence-2026-09-29 && cd e23-governed-meta-intelligence-2026-09-29
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://clawx.click/evidence/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e23-governed-meta-intelligence-2026-09-29.json", "../e23-governed-meta-intelligence-2026-09-29.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e23-governed-meta-intelligence-2026-09-29.attestation.json"))["files"])
for f in names:
    get(E + "e23-governed-meta-intelligence-2026-09-29/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e23-governed-meta-intelligence-2026-09-29/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e23-governed-meta-intelligence-2026-09-29 ../e23-governed-meta-intelligence-2026-09-29.attestation.json \
  && python3 verify_e23.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

VERIFICATION.md · verify_e23.py

E21 · e21-open-ended-intelligence-2026-09-29

— published result: INTACT (218/218 checks)

mkdir -p e21-open-ended-intelligence-2026-09-29 && cd e21-open-ended-intelligence-2026-09-29
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://clawx.click/evidence/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e21-open-ended-intelligence-2026-09-29.json", "../e21-open-ended-intelligence-2026-09-29.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e21-open-ended-intelligence-2026-09-29.attestation.json"))["files"])
for f in names:
    get(E + "e21-open-ended-intelligence-2026-09-29/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e21-open-ended-intelligence-2026-09-29/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e21-open-ended-intelligence-2026-09-29 ../e21-open-ended-intelligence-2026-09-29.attestation.json \
  && python3 verify_e21.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCE.txt · verify_e21.py

E20 · e20-agentic-institutions-2026-09-29

— published result: INTACT (179/179 checks)

mkdir -p e20-agentic-institutions-2026-09-29 && cd e20-agentic-institutions-2026-09-29
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://clawx.click/evidence/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e20-agentic-institutions-2026-09-29.json", "../e20-agentic-institutions-2026-09-29.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e20-agentic-institutions-2026-09-29.attestation.json"))["files"])
for f in names:
    get(E + "e20-agentic-institutions-2026-09-29/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e20-agentic-institutions-2026-09-29/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e20-agentic-institutions-2026-09-29 ../e20-agentic-institutions-2026-09-29.attestation.json \
  && python3 verify_e20.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCE.txt · verify_e20.py

E19 · e19-governed-autonomy-2026-09-28

— published result: INTACT (117/117 checks)

mkdir -p e19-governed-autonomy-2026-09-28 && cd e19-governed-autonomy-2026-09-28
python3 - <<'PY'
import json, time, urllib.request
def get(url, dest):  # retries: a busy host can drop a request
    for i in range(4):
        try:
            return urllib.request.urlretrieve(url, dest)
        except Exception:
            if i == 3:
                raise
            time.sleep(2 * (i + 1))
E = "https://clawx.click/evidence/"
# The publisher attestation lists every published file and is signed by the pinned CAIN key.
get(E + "_publisher/e19-governed-autonomy-2026-09-28.json", "../e19-governed-autonomy-2026-09-28.attestation.json")
get(E + "_publisher/verify_publisher.py.txt", "../verify_publisher.py")
names = sorted(json.load(open("../e19-governed-autonomy-2026-09-28.attestation.json"))["files"])
for f in names:
    get(E + "e19-governed-autonomy-2026-09-28/" + f, f)
try:  # served pages are not attested (site chrome is injected), but some verifiers check index.html
    urllib.request.urlretrieve(E + "e19-governed-autonomy-2026-09-28/index.html", "index.html")
except Exception:
    pass
print("downloaded the bundle:", len(names), "files")
PY
python3 -m pip install --quiet cryptography 2>/dev/null || true
python3 ../verify_publisher.py ../e19-governed-autonomy-2026-09-28 ../e19-governed-autonomy-2026-09-28.attestation.json \
  && python3 verify_e19.py.txt . \
  && echo "VERIFIED: published by the pinned CAIN key, and internally INTACT" \
  || { echo "NOT VERIFIED: do not trust this bundle"; false; }

REPRODUCE.txt · verify_e19.py

Newest published bundle: bft-ip-forensics-2026-10-05. Every bundle is also mirrored on the other two sites so the same verifier runs against an independent copy.

What CAIN-42 is not, yet

What CAIN-42 is, and is not

What it is

The governor for autonomous AI agents: a trust and execution-control runtime that sits between an autonomous AI system and the actions it takes. Every proposed action is checked (identity, authority, trajectory, policy, risk, trust, system scope), a boundary applies the verdict before the tool runs, and the decision is recorded as signed evidence. The CAG-L5 system governor runs in the hosted gateway: a system must be registered with a governance-signed manifest, every request must be signed by the agent's own key, and governance state counts only when the live 4-replica PBFT cluster has signed it with a quorum certificate (3 of 4 signatures). Every hosted decision is ordered and signed by that cluster, and agent authority in the CAIN-45 hypervisor is committed by it too. Since 2026-09-28 an agent's capability (its model and the MCP tools it may call) can change only through the governed evolution gate, and the cluster signs a capability commitment, so authority granted for the old capability never carries over to the new one.

Is it an "agent hypervisor"?

Partly. The hosted gateway mediates the tool calls routed through it and cannot see a call that bypasses it. Separately, the CAIN-45 agent hypervisor (ZoD) confines agent code with Linux namespaces and cgroups, takes its authority from the live cluster, and re-checks that authority before every action. It is a library the operator runs today. It has a kernel syscall filter (seccomp-BPF, classic BPF, not eBPF), but no egress allowlist (egress is deny-all) and no hardware attestation yet. It is not a VM hypervisor.

What it is not, today

Not certified by anyone. Not independently reviewed. Consensus for hosted decisions runs live on 4 replicas on 4 hosts in 4 regions (cluster cain-mr-02, one replica per host, so a quorum of 3 remains after any one host is lost), but one team and one provider run all of them, and one replica shares a host with the public gateway. Not every hosted stage enforces: since 2026-09-27 every tenant is in enforce mode by default, and identity, authorization, trust (which now weighs how dangerous the action itself is), your own tool rules, approval holds, PBFT consensus, MCPGate and execution block; the OPA policy, injection-screen, intent, verification and ActionProof verdicts are recorded but do not block on their own. An agent's authority lapses on a policy change and on risk or blast-radius budgets (tripped on the live cluster); a cluster epoch or membership change is enforced too, but was tested only with an injected change, not by re-keying the live cluster. "L5" here means CAG-L5, CAIN's own governance designation, not the SAE driving scale, and nothing claims an agent is "SAE Level 5". The live L5 run used an operator self-test tenant and a scripted agent: no customer and no LLM agent is governed end to end yet. Of 12 L5 governance capabilities, 6 are verified on the live path and 6 are tested but only partly exercised live (continuous authorization, trajectory, MCP execution, risk, trust, independent verification). The hosted endpoint returns a signed verdict; your own gate executes. Current known limitations, including every claim that is not a pass, are listed in full on the Proof page. The roadmap's next evolution (a unified trust kernel, eBPF kernel enforcement, swarm governance, cluster federation) is a plan, not built. No customer traffic is claimed.

8 ways to verify CAIN-42 yourself

Verify CAIN-42 yourself

Every step uses a real endpoint or a published, signed file. The verifiers import none of CAIN-42's code; the implementation itself is not published.

1 · Live multi-region PBFT cluster

4 replicas in Atlanta, Los Angeles and Miami, running now. Your browser fetches each decision from all four replicas and verifies every Ed25519 vote. It can audit the whole history continuously, and a tamper lab lets you try to get a modified certificate accepted. Fault-injection run: 336 certificates, 49/49 checks.

live cluster · fault-injection proof · REPRODUCE.txt

2 · Current state

The generated snapshot: commit, process start, enforcement flags, live mode, known limitations.

/now.html · /now.json

3 · The signed claims registry

Every public CAIN-42 claim with its status, evidence level, artifact digests and limits. Your browser checks the Ed25519 signature. Auditors: the signed CAIN-42 Auditor Kit 8.3.1 runs a 42-second integrity check offline, standard library only, at cainstudio.online/evidence/auditor-kit/8.3.1/ (measured 2026-10-12: the full online challenge passed every stage in 16.5 s, inside its 42-second budget; initial verdict median 2.50 s over 30 cold runs, slowest 2.61 s). New in 8.3: Evolution 14, Evolution 15, Sovereign Evolutions 1 and 2, and IP register v46 / valuation v41. 8.3.0 was withdrawn.

Verification Center · verify_claims.py · Auditor Kit 8.3.1

4 · Agent hypervisor on the live cluster

Agent authority committed by cain-mr-01, then broken 17 ways: 14 tripped for real (expiry, trust, identity, tool schema, context, trajectory, revocation, deleted evidence, revoked parent, policy change, unreadable policy, risk budget, blast-radius budget, a delegate spending its parent's budget) and 3 injected (epoch, membership). Every next action was refused and the tool never ran. One command each, no CAIN code: 48/48 and 60/60 checks. The syscall-filter run is a third bundle (8/8).

first 9 (48/48) · next 8 (60/60)

5 · MCPGate enforcing governance, live

On the live gateway across all three domains: a tool an evolution disabled, a model swapped outside the gate and a lease issued before a capability change are all refused; cain-mr-01's own records carry every capability commitment its quorum signed. Earlier, on a disposable cluster: tool calls ran only with a PBFT-committed authorization and nine attack classes were refused.

live evolution gate (REPRODUCE.txt)

6 · Live sandbox cluster

Crash up to two of four sandbox nodes and watch commits stop at the quorum boundary; signed node state checked in your browser.

Lab

7 · Soak on the live multi-region cluster

Continuous writes; every 20 minutes a random replica is killed on its own host and restarted; hourly hash-chained checkpoints signed with the evidence-root key, each with a fresh MCPGate-enforced authorization and its refused replay. The full run record is published checkpoint by checkpoint on the Proof page.

Soak: checking…

REPRODUCE.txt · latest checkpoint

8 · Soak history, kept for the record

The full history of every soak run — what each run exercised and how it ended — stays published, checkpoint by checkpoint, on the Proof page.

REPRODUCE.txt · last checkpoint

Three sites, one system

cainstudio.online · CAIN Studio

The hosted CAIN-42 control plane: the decision pipeline, API keys, the evidence store, the public Lab and the Verification Center.

mcpgate.online · MCPGate

The enforcement boundary: the component in the agent's call path that lets a tool call run or stops it. Self-hosted by design.

clawx.click · CLAWX

The agent-facing layer: agent identity, channels and approvals, and the public evidence log. Most CLAWX integrations are not built yet; each is labelled.

All three names resolve to one host today. They are three views of one system, not three independently operated deployments.

Full evidence log and three-site status

Live status of all three sites

checking the shared runtime…

Site	Resolves to	HTTPS	Checked
checking…

Checked from this server just now, not cached from a report. A site that does not answer is shown as not answering.

Verify it yourself. No account, no trust required.

Every number we publish here is a real run, hashed and Ed25519-signed, and checked by a tool that imports none of our code. We publish what did not pass as well. Self-attested by three operators. We publish outcomes, not implementation: our source code stays private.

Start here: VERIFY CAIN-42 (Verification Center). Every public CAIN-42 claim we have registered is in one signed registry, each with a status, an evidence level, SHA-256 digests of its artifacts, and its limits. Three claims are NOT_IMPLEMENTED, and two benchmark results are negative. With one button, your browser checks the Ed25519 signature and re-hashes every artifact. You can also drop any downloaded evidence file to check it. Python: verify_claims.py. The registry includes 28 executable invariants (all pass; 6 only partially covered, each gap named) and 1,000 agent trajectories. Self-attested.
New 2026-09-24: Evolution 6, agents propose but consensus decides. CAIN42-AGENT-PROOF-PACKAGE: agents with signed identities and signed trajectories act only through MCPGate with a PBFT-committed authorization. A plan change, model update or tool swap after consensus is refused and must be reauthorized. Undeclared actions, impersonation, replay, forged histories and delegation escalation are blocked. 1,000 trajectories all ended as expected, and all 620 allowed actions have a complete verified proof chain. Scripted agents, in-process, attestation simulated; cain_proof_verify: VERIFIED.
New 2026-09-24: Evolution 5, MCPGate now enforces consensus (one-command proof). CAIN42-PROOF-PACKAGE: 4 consensus-authorized tool calls ran, and 9 attacks were blocked at MCPGate with signed denial proofs (replay, action substitution, capability escalation, identity substitution, security-context drift, forged quorum certificate, forged certificate, no authorization, expired). python3 verifiers/cain_proof_verify.py . checks manifest, membership, consensus, authorization, enforcement, execution, evidence chain and DAG, and prints FINAL RESULT: VERIFIED only if every section passes. Disposable cluster on one host; the live MCPGate does not run this gate yet.
New 2026-09-24: PBFT Evolution 3 and 4, verifiable in your browser or with one command. Fast-path quorum certificates: 152 certificates from a disposable 4-node cluster, 41 of them decided by the new fast path, which is accepted only with all four members' signatures (30/30 checks). DAG evidence: 40 requests disseminated through a signed DAG with availability certificates, anchored by PBFT and ordered identically on all four nodes, including one crash-restarted node; the verifier recomputes the order itself (18/18). One host, disposable cluster; the live cluster does not run the fast path or the DAG layer.
New 2026-09-24: PBFT quorum certificates you verify in your browser. Open it and press verify · REPRODUCE.txt. A disposable 4-node cluster built from commit c188442 committed 20 decisions. Its primary was killed and the survivors changed view (0 to 1) and kept committing. That produced 160 quorum certificates carrying the original Ed25519-signed votes. In a few seconds your browser re-checks every signature, the 3-of-4 quorum, the decision chain and agreement across all four nodes, and it confirms that seven kinds of tampering are rejected (29/29 checks). The cluster ran on one host. The live cain-vc cluster is reported to run this build; the signed registry lists that as UNVERIFIED (claim C42-LIVE-CLUSTER-EVO2). Its API is not public, and its first two decisions predate certificates.
Byzantine cluster, probed live. Findings · signed manifest (root 93c8a5f8fe0b3d5a…). A checker probes every node, verifies signatures, derives the Byzantine quorum and prints BFT_F1_ESTABLISHED or NOT_ESTABLISHED with reasons. Recorded verdict on 2026-09-21: NOT_ESTABLISHED (three remote nodes report a quorum of 2 where 3 is required; only one node serves a signed state proof). node2's signed state proof does verify independently. Run --live for the current verdict.
Hardening round. 16 defects found by attacking our own controls (root 26449783615937cc…): 114 attack types exercised, 97 blocked by a real control, 17 inconclusive (no real control to attack yet), 0 succeeded; 222/222 executable invariants (tests, not formal verification); 585 tests passed in a serial run.
Fault test on a disposable 4-node twin. Crash one node: still commits with 3 signers; crash two: correctly refuses. It also records that a restarted node did not catch up on its own. It is not the live cluster.
Frontier bundle and daily evidence. frontier claims · daily evidence · llms.txt · changelog.
Try it live. The no-account sandbox on cainstudio.online sends an action through the live pipeline and returns a real decision with an evidence record; the demo forces enforcement on, and the hosted deployment is in enforce mode by default since 2026-09-27 (a tenant may opt down to shadow mode, and that choice is logged).

curl -sO https://clawx.click/evidence/byzantine-cluster-2026-09-21/verify_cluster_bundle.py.txt && mv verify_cluster_bundle.py.txt verify_cluster_bundle.py
python3 verify_cluster_bundle.py https://clawx.click/evidence/byzantine-cluster-2026-09-21/ --live

What is built, and what is not

Capability	Status	Evidence
Self-audit fabric: assumptions, controls, claims, release gate	BUILT · TESTED	75 invariants, each checked by an attack test (TESTED, not proven)
Guards tested by breaking them (mutation testing)	BUILT · TESTED	see evidence
Execution gate: claim, graph and context binding	BUILT · TESTED	see evidence
Independent verification by a separate party	NOT DONE	the second verifier shares code and process with the first
Universal agent adapter, OpenClaw adapter	NOT IMPLEMENTED	planned (CLAWX 21)
Telegram and WhatsApp channels, approval cards	NOT IMPLEMENTED	planned (CLAWX 21); needs real accounts to test
Prompt-injection firewall, credential broker, trust center	NOT IMPLEMENTED	planned (CLAWX 21)
Production deployment at scale	NOT DONE	one server, no load testing

Nothing here should be read as a guarantee of security.

Known gaps

The CAIN baseline that CLAWX reuses allows some risky-sounding actions (for example a wire transfer) from an agent that is registered nowhere. It is recorded, not fixed.
Some gates combine facts supplied by the caller; a compromised caller could supply false facts.
The evidence log detects edits but only detects truncation when its head is pinned somewhere else.

The full list is in the evidence page and in the forensic report.

History

Latest changes, 2026-10-07: governed self-evolution. An agent can now propose a better skill, and CAIN-42 decides whether it may become authorized behaviour: the candidate runs in a fresh confined process with no network, must reproduce its gain on hidden and unrelated regression tasks, passes the evolution gate, an operator approval and a canary, and every outcome gets a governance-signed receipt (16 of 16 verify under a clean-room verifier). On the benchmark the CAIN-governed agent reached 1.0 task success with 0 security violations, against 0.625 and 36 violations for an ungoverned self-evolving agent and 0.3333 for a static baseline; a continuous red team blocked 411 of 411 attacks after its first run found and closed 4 real defects in existing gates. Learning does not grant authority. The same day, batch 3 of IP hardening closed 11 decision-path and public-verifier defects, live on all three domains (12 of 12 forged proofs refused): a prepare certificate is no longer accepted as a commit, a signed DENIED record can no longer be re-split into ALLOWED, and the public offline, universal-proof, WORM and attestation verifiers no longer accept forgeries signed with the forger’s own key. 2026-10-04 to 2026-10-06: nine IP evolutions of the governance contract fabric were published (consequence forecasts, replay under a proposed change, governed learning that can only tighten, formal assurance, a governance compiler that can only narrow authority, mandatory governance packages, attestation); a live frontier model ran under the AGI control boundary in 50 runs across 14 scenarios with every specified property holding; boundary hardening closed 9 areas of the decision path (no credential leak through MCPGate, agent passports enforced on the hosted path, a tamper-evident identity log, trajectory governance, emergency halt and quarantine honoured for every tenant); IP hardening batches 1 and 2 closed 23 more defects; and two public statements were corrected: the 200/200 invariant figure was withdrawn, and FIRME AI CORPORATION is valued at about $3 million (a 2026-10-06 figure, since superseded: the current internal IP register, v56, puts the IP base at $17,123,490; an internal analytical scenario, not an appraisal). Earlier, 2026-10-03: 104 of 105 catalog services are live (up from 6 the day before; the 98 deployed in this release each passed a live acceptance test), including seven new products (CAINBudget, CAINPay, VeritasEngine, MemoryMesh, NexusMind, LexisGuardian, OmegaRouter); recorded decisions that arrive together now share one PBFT round, each keeping its own Merkle inclusion proof (evidence). The 32 CAIN-42 capabilities were measured the same day and are on this page with their real status (signed audit). Before that, 2026-10-01: Phase 1-3 implementation and live deployment: the quorum-committed authorization-snapshot data plane (CAIN_AUTH_SNAPSHOT=1) is active on the live gateway, replacing the per-call PBFT round (p50 2,268.6 ms, n=20) with a snapshot-covered stage (p50 0.8263 ms, n=1,000) for snapshot-covered tenants (measured 2026-09-29 on cain-mr-01; run record dataplane-evolution-2026-09-29/governance/live_run.json). The Progressive Trust Matrix (_scope_seen) prevents horizontal credential reuse and unauthorized exfiltration holds; revoking an agent key halts it on its very next request (measured 2026-10-02; the revoke call itself took 3-6 s under heavy host load); action tokens bind payload SHA-256 digests; Evolution 8 physical ActionCommitBoundary enforces single-use capability leases (24/24 tests pass); mcpgate-appliance Helm chart v3.0.0 packaged for turnkey deployment; clean-room SDK installability verified (19/19 checks pass). Phase 3 Frontier AI Research Integration mounts AgentPRM Process Reward Model trajectory evaluation and shortcut pruning (arXiv:2502.10325), TriCEGAR discrete Markov Decision Process model checking, Governed Memory Shield write-time injection sanitization (Zep/Mem0 backdoor defense), and A2A inter-agent delegation attenuation directly onto live gateway endpoints (/fabric/frontier/*) with standalone clean-room verification (4/4 proofs pass). Earlier, 2026-09-30: Evolution 39 turns a mission into a governed machine organization: CAIN compiles the mission into bounded rules, designs the smallest team of agents that can do the work, gives each agent only the authority its role needs inside what the sponsoring person really holds, has every agent attacked and tested by an independent evaluator, promotes nothing on its own say-so, and runs the real work through the decision kernel and the E8 commit boundary with a proof for every action. No generated agent can grant itself authority, grade itself, promote itself or come back after it is retired. In a 16-step loop 4 real agents were provisioned and 3 consequential tasks ran with valid proofs; 1,041 of 1,041 invariants hold, 3,441 of 3,441 attack scenarios are contained, the targeted mutation test kills 16 of 16 mutants, and the clean-room verifier passes 3,307 of 3,307 checks. Evolution 38 lets another machine check CAIN's work without trusting CAIN: every governed action now carries twelve signed layer proofs and one action proof bound to its real E8 commit, and an independent verifier with none of our code recomputes whether each proof is valid, invalid, incomplete, stale, revoked or unknown. A proof is never permission -- partial, stale, revoked, simulated or confused proofs are never valid, revocation is measured rather than assumed, translations into OAuth, MCP, A2A and audit formats declare every field they drop, and trust domains exchange evidence without ever merging authority. 5 real action proofs and 41 published proof cases, 1,030 of 1,030 invariants hold, 2,141 of 2,141 attack scenarios are contained, the targeted mutation test kills 15 of 15 mutants, 0 of 19 injected faults made proof state more permissive, and the clean-room verifier passes 509 of 509 checks. Evolution 37 makes governance travel with the work: every governed action runs one twelve-stage chain on the real decision kernel and E8 commit boundary and leaves a signed receipt, and when an execution moves to another node, runtime, model, region or credential the move is itself governed -- authority can only shrink, a material change opens a new epoch, and risk, spent budget, revocations, evidence and incident history travel with it and can never be reset. A runtime is admitted on a measured code digest and live probes, never on its own claim, and nothing is scheduled where enforcement is missing. 71 signed execution receipts come from real governed runs, 1,132 of 1,132 invariants hold, 2,720 of 2,720 attack scenarios are contained, the targeted mutation test kills 17 of 17 mutants, 16 of 16 injected fault classes are contained with no false allows, a 100,000-agent scale run completes on one host, and the clean-room verifier passes 2,627 of 2,627 checks. Evolution 36 turns CAIN into a governed machine agency exchange: agents, tools, models and organizations are discovered, verified, negotiated with, contracted, hired and transacted with along one lifecycle, and the exchange never hands out authority. Governability-aware discovery never upgrades an unknown requirement into a match; a service chain proves identity, authority, contract, capability, execution, proof and settlement; a subcontractor can never be given more than its parent; payment authorizations are scoped, time-bound and non-replayable; a receipt requires a final E8 commit; and CAIN's own participation is governed so it can never grant itself authority or rewrite its history. Money in this layer stays synthetic: CAIN is not a bank, a custodian or a regulator. 842 of 842 invariants hold, 3340 of 3340 economic and governance attack scenarios across 64 categories are contained, 15 of 15 disabled defences are caught, a 13-step exchange lifecycle passes, and the clean-room verifier passes 3601 of 3601 checks. Evolution 35 adds a governance intelligence layer and keeps it out of the authorization path: it observes with provenance, scores risk across dimensions without ever collapsing into one number, predicts with explicit confidence, assumptions, horizon and unknowns, calibrates itself by dimension, explores counterfactuals that are never presented as facts, and recommends -- and a learned control is deployed only after a deterministic review and a canary, with the reviewed action still passing the kernel and E8, so learning can never create authority. 799 of 799 invariants hold, 3544 of 3544 attack scenarios across 68 categories are contained, the targeted mutation test kills 15 of 15 mutants, a 23-step loop passes, and the clean-room verifier passes 3810 of 3810 checks. Evolution 34 makes every governed action carry its own verifiable proof: one signed, chained governance proof binds who acted, the capability, the delegation and its attenuation, the authority, the policy, the evidence, the risk, the decision, the E8 commit, the enforcement boundary, the execution and the outcome, and states plainly what remains UNKNOWN or outside the boundary -- with fourteen statuses that never collapse into a score, per-layer proof primitives, an enforcement proof that separates a decision from an authorization, a commit, an enforcement, an execution and an observed outcome, and RFC 6962 selective disclosure; a proof is evidence, never permission. 629 of 629 invariants hold, 2664 of 2664 attack scenarios across 32 categories are contained, 12 of 12 disabled defences are caught, and the clean-room verifier passes 3286 of 3286 checks. Evolution 33 turns everything an agent does into one governed operation: calling a tool, sending a message, running code, creating a helper agent, changing its memory or paying all follow the same checked lifecycle, are committed at E8 and carry a signed proof, while changes to the rules themselves are handed to the process that governs them and never simply executed. An existing agent can be governed through a small sidecar without importing any CAIN code, and every request it sends must be signed. In a full-loop run, an action that got through under the old rules was refused the next time, after CAIN had learned and adopted a stricter rule with a human sign-off. 581 of 581 invariants hold, 2029 of 2029 attack scenarios across 26 categories are contained, and the clean-room verifier passes 2603 of 2603 checks. Evolution 32 lets CAIN learn from the actions it governs without ever giving itself more power: it watches where harm got through, proposes a stricter rule, tries it in an isolated sandbox and on a hidden test set it never saw, compares it on fifteen separate measures, and adopts it only with a signed human approval; a proposal that stops harm by refusing everything is rejected, and learning can only make the rules stricter. In a simulated run on a synthetic workload, harm that got through fell from 41 to 3 with no new wrongly refused actions. 303 of 303 invariants hold, 1013 of 1013 attack scenarios across 22 categories are contained, the mutation test catches 12 of 12 disabled defenses, and the clean-room verifier passes 1420 of 1420 checks. Evolution 31 makes governance provable: every allowed action can now produce a signed governance proof that ties that one action to who did it, the delegation and policy it ran under, the final E8 check that let it through and the record of it actually running, and every refused action produces a signed record of why it was refused. Anyone can re-check a proof against our published keys with verifiers that share none of our code, in Python and in TypeScript; each proof sits in an append-only log, and a proof is evidence only, never permission to act again. 252 of 252 invariants hold, 1269 of 1269 attack and conformance scenarios are contained, the mutation test catches 12 of 12 disabled defenses, every one of 88 deliberately forged proofs is rejected, and the clean-room verifier passes 1676 of 1676 checks. Evolution 30 joins the layers into one autonomy kernel: every consequential action an agent takes, from what it perceives and remembers through a transaction to a proposal to improve itself, goes through one path that checks its autonomy state, level, budget, containment and evidence before the E8 commit boundary, and leaves a signed receipt whether it was allowed or refused. An agent cannot raise its own autonomy level; a self-improvement needs a sandbox, an adversarial test, a canary and a human review; and a coverage map says plainly which paths CAIN does not control. 166 of 166 invariants hold, 889 of 889 scenarios across eight attack categories are contained, the mutation test catches 11 of 11 disabled defenses, and the receipts check out in a clean-room verifier (1187 of 1187 checks) and in a separate zero-dependency TypeScript verifier. Evolution 29 governs machine-to-machine transactions end to end: an autonomous procurement agent discovers vendors, checks their identity, tested capability and counterparty risk (thirteen dimensions, no single score), negotiates, signs a contract, is authorized for that one transaction by the intersection of its delegation, lease, a separately bounded spending authority, its organization's budget, the contract and the consequence forecast, locks funds in escrow, receives a governed delivery and releases payment only on a delivery receipt, the buyer's signed confirmation and an objective check. Money in it is synthetic test units, and it moves only through a sealed settlement step inside the E8 commit boundary. 106 of 106 invariants hold, 258 of 258 adversarial scenarios are contained, ten catastrophe scenarios on the real fabric end with 0 false allows, and the clean-room verifier passes 300 of 300 checks. Evolution 28 gives any agent that connects a signed, portable execution identity: it travels unchanged over 23 protocol carriers (MCP, A2A, HTTP, gRPC, CLI, browser and computer use among them), but its authority does not: every receiving domain recomputes it from its own policy, delegation shrinks on sixteen dimensions and can never flow back up, a change of model, runtime, prompt, tools, memory or key voids authority until it is re-evaluated, and every action is bound to one transaction, passes the E8 commit boundary and leaves a signed receipt in a hash chain, with identity events in an RFC 6962 transparency log. 90 of 90 invariants hold, 442 of 442 adversarial scenarios are contained, conformance passes 17 of 17 dimensions on real tests, and the clean-room verifier passes 243 of 243 checks; building it we found and closed a gap that let a child agent mint a delegation back to its parent. Evolution 27 is an agentic-internet control plane (registry, discovery, routing, policy distribution, contracts, incident propagation, edge nodes) that coordinates without becoming authority (1,533 of 1,533 adversarial scenarios contained, 341 specific to E27). Evolution 26 adds portable signed trust objects, a seventeen-dimension trust vector that never collapses into one score and authorizations that work for exactly one transaction (1,192 of 1,192 contained). Evolution 25 turns any consequential machine action into one signed transaction across eighteen protocol adapters, committed only through E8, with the agent never holding a raw secret (1,055 of 1,055 contained). All four are TESTED libraries, not hosted services, and none of them can give an agent more power. Earlier, 2026-09-28: the evolution gate is live: on the live gateway an agent can change its model or its MCP tools only through a signed proposal, an evaluator-signed test report and a human operator, and the old authority is void until the live cluster signs the new capability. 17 of 17 live cases behaved as specified across all three domains. Building it, we found that the governance state the cluster signs had not covered the MCP tool map, and fixed that. The public proof fabric is live: a signed claims registry, the 2026-09-28 6-suite test run (1,978 tests, 1,963 passed, 0 failed), a build manifest, an SBOM, test vectors, a signed evidence pack and a clean-room verifier. A sweep of all three sites withdrew 16 older files whose numbers no run had produced; each now says why, and the originals are kept. The system governor is on: unregistered systems and unsigned requests are refused; 13 of 13 live cases behaved as specified. Every registered claim, every limitation we have recorded and every run outcome stays published on the Proof page; release gates that are still open are listed in the Verification Center. No third party has verified any claim yet (0 independently verified), and the Proof page says so. Earlier generations (CAIN 1–41) stay published as history, not as the current system; the previous homepage is kept as it was on 2026-09-25, marked superseded, and the now page takes precedence over it. Evolution 7 (predictive consequence governance) and Evolution 8 (the mandatory governance kernel) are added as TESTED libraries, wired restriction-only into the CAIN-45 agent hypervisor: a governed world-state and digital-twin fabric whose predictions and uncertainty can only contract authority, and a signed, short-lived, action-bound governance token checked at an action-commit boundary before execution. Neither can grant authority, and neither is hosted yet; 12 and 22 machine-checkable invariants hold and 65 new tests pass. Evolution 9 adds a signed agent passport, an AgentBOM and a provenance graph for every governed agent: 15 more machine-checkable invariants hold and 46 more tests pass, memory can never mint authority, delegation can never increase authority, revocation propagates, and a material mutation invalidates the attestation and the bound governance token. Both new layers are TESTED libraries, not hosted services, and neither can grant authority. Evolution 10 governs agent collectives rather than individuals: 20 more invariants hold and 20 of 20 collective attacks are blocked, collective authority is an intersection of envelopes and never a sum, combination risk is evaluated before commitment, and a unanimous decision still carries no authority. It is a TESTED library, not an orchestration service. Evolution 11 governs the information channel: 20 more invariants hold and 20 of 20 message/intent attacks are blocked, a valid message signature proves who sent it but never what they may do, tool and MCP output stay data rather than policy, information never inherits the destination's trust, and taint survives derivation. It is a TESTED library, not a hosted service. Evolution 12 governs what an agent is allowed to believe: 20 more invariants hold and 32 of 32 evidence attacks are contained, a source whose identity cannot be established stays UNKNOWN, stale or expired evidence cannot authorize, corroboration counts independent principals rather than repeated agents, retrieved content stays data rather than policy, a valid hash proves bytes did not change but not that they are true, and reality drift forces re-evaluation. It is a TESTED library that governs what enters the trusted decision path; it does not claim to know everything; a system outside its boundary remains UNCONTROLLED, UNVERIFIED or UNKNOWN. Evolution 13 governs how a decision is formed: 24 more invariants hold and 36 of 36 decision attacks are contained, reasoning can propose but never authorize, authority can be narrowed but never expanded by argument, a policy conflict is never silently resolved, a material change marks the decision stale, a deny cannot be turned into an allow, and the governance token binds the decision, policy, authority and risk digests. It is a TESTED library that governs decision construction from recorded inputs and stores no private chain-of-thought; it does not claim that a model's reasoning is correct. Evolution 14 treats every capability as a power surface: tools, skills, plugins, connectors, models and subagents are identified by their artifact, admitted only with a publisher-signed provenance chain, granted only within the issuer's own authority, and used only under a short-lived signed lease that the commit boundary checks again, bound to the decision, policy, risk, sandbox and credential. 30 more invariants hold and 44 of 44 capability attacks are contained, among them artifact and dependency substitution, a malicious upgrade, a dangerous capability pair split across two agents, and a revocation racing a commit. Building it we found two Evolution 13 attack scenarios that had been counted as contained without being tested, and fixed both. It is a TESTED library wired into the agent hypervisor in front of MCPGate, not a hosted service; hardware attestation and vulnerability intelligence remain UNKNOWN. Evolution 15 establishes the interfaces and governance primitives for bringing spatial intelligence, world models, simulation, trajectories and physical actions into the same governed trust path: signed sensor observations enter through the evidence layer, the world state is versioned and replayable, a world model's output is a prediction rather than authority, a trajectory is a proposal until a signed approval binds it, and every physical action binds nine digests, crosses the governance kernel and reaches an actuator adapter only with a single-use permit. 36 more invariants hold and 55 of 55 spatial and physical attacks are contained, among them sensor spoofing, map substitution, trajectory replay, a world-state rollback and a swapped actuator command; digital, physical and hybrid agents run the same path. It is a TESTED library exercised against a reference robot adapter, not a vehicle or a robot: it drives nothing and does not guarantee physical safety, and real sensor and actuator integration is not yet implemented. Evolution 16 adds a temporal and causal dimension to that world state: events and intervals, typed causal and correlation relations that are never conflated, counterfactual branches that never become reality, a predictive state engine whose output is never authority, prediction-vs-reality calibration, and a causal blast radius. Evolution 17 governs action by autonomous agent teams as a first-class system object: collective authority is a constrained intersection and never a sum, consensus is not authorization, a world-state fork blocks authorization, dissent is preserved, and one action that fans out to many agents is pre-authorized; 61 of 61 invariants hold and 91 of 91 bench entries (88 distinct attacks) are contained; it is a TESTED library, not an orchestration service. Evolution 18 adds the actionable 4D world: entity state at (X,Y,Z,T) with uncollapsed uncertainty, reachable / permitted / authorized sets kept distinct, intent and trajectory hypotheses, an interaction graph and a conflict field, counterfactual futures, actionability, a conserved uncertainty budget, micro-authorization and a continuous re-authorization loop, for a car, a drone and a digital agent in one shared world; ACTIONABILITY IS NOT AUTHORIZATION, REACHABILITY IS NOT PERMISSION, PREDICTION IS NOT REALITY, and AUTHORIZATION IS A FUNCTION OF WORLD STATE. 89 of 89 invariants hold and 123 of 123 bench entries (109 distinct attacks, among them GNSS spoofing, map substitution, geofence mutation and a re-signed refusal) are contained. Our review before publication found that the E17 and E18 commit boundaries bound the policy, risk and authority verdicts without reading them, so a consistently re-signed refusal was authorized; both now enforce every verdict they bind, and each fix is pinned by a regression test written against the unfixed code (full record on the Proof page and in the changelog). Evolution 19 governs the evolving state of an autonomous system itself: identity, mission, goals, beliefs, memory, models, learning, authority, world, outcomes and recovery become hash-chained governed state, effective authority is compiled as the intersection of sixteen factors so it shrinks when conditions deteriorate and never grows because an agent is confident, agrees with its peers, learns or predicts success, autonomy is derived from evidence rather than requested, and every consequential action carries a sixteen-field action contract that is invalidated by any material state change and whose verdicts the gate enforces itself before the E8 kernel commits it. 108 of 108 invariants hold, 189 of 189 bench entries (177 distinct attacks) are contained, deliberately removing a defense is caught by the bench, and an independent verifier re-derives the evidence (117 of 117 checks). AUTONOMY IS NOT AUTHORITY. Evolution 20 governs agents that act together as teams, organizations and machine-native institutions: they may form, admit members, delegate, negotiate, sign contracts, hold and move resources, spawn subagents, federate, resolve disputes, evolve and dissolve, and none of it can manufacture authority. Institutional authority is always an intersection and never a sum; membership, votes, consensus, reputation, trust, wealth, market wins, rewards and model capability are not inputs to it; a contract or a negotiated agreement authorizes nothing by itself; a spawned subagent inherits only what is explicitly permitted in each of seven dimensions; a terminated agent or dissolved institution cannot come back through stale state; and every institutional action still passes the E19 action contract and the E8 kernel. 118 of 118 invariants hold, 334 of 334 bench entries (328 distinct attacks, among them Sybil institutions, constitutional takeover, contract laundering, double spending, spawning explosions and agent resurrection) are contained, an end-to-end run from one agent to a two-institution economy detects and contains 7 hostile events and then recovers and keeps working, deliberately removing a defense is caught by the bench, and an independent verifier re-derives the evidence (179 of 179 checks). Every economy in it is a simulation over abstract units: it moves no money. COLLECTIVE INTELLIGENCE IS NOT INSTITUTIONAL AUTHORITY. Evolution 21 governs autonomous research itself: asking questions, keeping competing hypotheses alive, designing and running experiments and simulations, replicating, peer-reviewing, attacking its own conclusions, building versioned knowledge, proposing new capabilities, models and strategies, and creating specialised research agents. What the research is allowed to believe is computed from signed evidence whose type (simulation, experiment, real-world observation, independent replication, third-party reproduction) cannot be relabelled, and a hundred runs of the same setup or a hundred agents under one controller count as one source. Research authority and execution authority are separate: a discovery, a confidence score, a reviewer vote, a benchmark win or a research reward never widens what an agent may do. A new capability leaves quarantine only after validation, an independent adversary, a security review and a governance quorum that excludes the researchers, and even then every action still passes E20, the E19 action contract and the E8 kernel. When evidence collapses, the dependent knowledge, policies and capabilities are invalidated with it and execution stops. Unsuccessful experiments are kept as evidence. 155 of 155 invariants hold; 298 of 298 bench entries (290 distinct attacks) are contained; a governed research lab solves a synthetic problem end to end in 17 stages and refuses all 16 attempts to authorize itself along the way; and an independent verifier re-derives the evidence (218 of 218 checks) and catches all 16 deliberate tamperings. Can a system that discovers a governance loophole use that discovery to get permission to exploit it? The bench's answer is NO: it can only disclose it. Building it we found and fixed four defects in our own new code before publication, among them a contradiction that a later supporting result could mask and a researcher who could review their own work once their evidence had expired. E21 checks how evidence was produced, not whether a hypothesis is true, and the research problem is synthetic. DISCOVERY IS NOT TRUTH, AND INTELLIGENCE IS NOT AUTHORITY. Evolution 22 (a governed cognitive runtime) was started and is not built or published yet. Evolution 23 governs AI systems that reason about and redesign their own architecture: a redesign is only a proposal; it is checked against the governance rules, measured on twelve separate governability scores before any capability gain counts, attacked by a separate red team, verified by a separate evaluator, tried in shadow, and promoted only with a governance quorum that excludes the system itself, a human sign-off and an E8 commit, so a smarter but less governable design is rejected. 253 of 253 invariants hold, 545 of 545 adversarial scenarios across 80 attack families are contained, among them a system that finds a governance loophole and asks to use it, and the clean-room verifier reports INTACT (733 of 733 checks). SELF-IMPROVEMENT IS NOT SELF-AUTHORIZATION. Evolution 24 governs agents that belong to different organizations and trust domains as they discover each other, negotiate, sign contracts, delegate work, pay in simulated units and act over thirteen protocol classes, among them A2A, MCP, HTTP and computer use: authority across organizations is the intersection of ten factors, discovery, contracts, reputation and payment are never among them, unknown trust stays unknown, and a compromised agent is detected, quarantined and revoked while the other organizations keep working. 305 of 305 invariants hold, 756 of 756 adversarial scenarios across 68 attack families are contained, a controlled simulation of 10,000 agents and 100,000 messages shows 0 cases of authority leakage, and the clean-room verifier reports INTACT (1,952 of 1,952 checks). E16–E21, E23 and E24 are TESTED libraries; they are not hosted, they contain no autonomous-driving model, flight controller, vehicle controller, robot policy or navigation stack, and they drive nothing. The governance data plane, 2026-09-29: the quorum now commits authority once per window instead of once per call. A 4-replica PBFT quorum commits a short-lived authorization snapshot, the gateway verifies the commit certificate itself, and a covered call is checked locally, so against the live cluster cain-mr-01 on 2026-09-29 the consensus step went from a per-call PBFT round (p50 2,268.6 ms, p99 3,937.8 ms, n=20) to the snapshot-covered stage (p50 0.8263 ms, p99 3.4686 ms, n=1,000), on a 2-CPU host against a throwaway gateway database (run record dataplane-evolution-2026-09-29/governance/live_run.json). Every covered decision is still anchored into a quorum-committed Merkle root, and revocation takes effect on the next call without a quorum round. Any miss falls back to the per-call round, which fails closed. It is built and live-tested and not yet switched on in the hosted gateway. The PII redactor gained a span pipeline 1.1–1.43 times faster from 1 KB to 10 MB with no loss of recall; building it we found and fixed a leak where a card number next to a phone number went unredacted while the report said fully redacted. 9 of 15 production gates pass, and the A+++ verdict is BLOCKED: eBPF enforcement cannot run on this host yet, there is no soak or network fault injection for the new path, and the desktop IPC layer does not exist. Each blocker is published with its evidence in the A+++ evidence bundle.

Previous homepage (archived)Changelog

⚡ FIRST-MOVER AUTONOMOUS SYSTEMS GOVERNOR

LIVE MULTI-AGENT SWARM GOVERNOR & SUB-50MS EMERGENCY KILL-SWITCH

Controlling autonomous AI agent swarms WITHOUT PROMPTS. In autonomous execution channels (MCP, shell commands, databases, financial settlements), conversational prompts fail. CAIN-42 enforces single-use ActionCapabilityTokens, checks OWASP ASI01–10 invariants, and backs every verdict with a 4-node Byzantine PBFT cluster.

🤖 Researcher-Alpha IDLE

Scrapes market & target repos

Trust: 0.95 No Token

🤖 Coder-Beta IDLE

Synthesizes patch artifacts

Trust: 0.92 No Token

🤖 Executor-Gamma IDLE

Executes infrastructure tools

Trust: 0.88 No Token

🤖 FinOps-Delta IDLE

Settles micro-payments & escrows

Trust: 0.96 No Token

See what your AI agents did, and check it yourself

CAIN decides whether an AI agent's action is allowed, blocks it if not, and gives you a signed proof you can re-run.

Five things. That is the whole model.

Get a key, send one action, read the decision, check the proof.

A signed record you can re-run.

What it proves

What it does not prove

What it is, what it is not, what it costs.

It is for you if

It is not

Once the five objects make sense, the loop is just the order they are checked in.

The words, in plain English.

Use your key in curl, Python, or TypeScript.

Choose how deep you want to go.

Learn CAIN in two minutes.

All 105 CAIN-42 AI services, one API key

CAINBudget new

CAINPay new

VeritasEngine new

MemoryMesh new

NexusMind new

LexisGuardian new

OmegaRouter new

TEE Verifier new

BLUiZZARD Governance new

ActionProof (2)

Authorization (3)

Build & ship code (7)

Commerce & distribution (2)

Evidence (7)

Execution Enforcement (2)

Governance (4)

Identity (5)

Industry applications (6)

Memory, retrieval & knowledge (5)

Model & ML infrastructure (8)

Observability (3)

Platform operations (2)

Policy (6)

Reasoning, planning & orchestration (8)

Risk (10)

Security (13)

Unmapped (1)

Verification (11)

CAIN Studio Suite: CAIN-42 products from San Jose, live on the hosted gateway

Three steps, every time

The AI asks

CAIN-42 decides

The gate enforces, proof is kept

What CAIN-42 does today

Live right now, on these sites

Proof you can check yourself

Everything in CAIN-42, on one page

The 100 CAIN-42 products we’re focusing on

Thirteen new CAIN-42 products. Attack each one live, then buy the pilot.

MCP Attestor

Payment Mandate Guard

Browser Agent Firewall

Agent Autonomy Lease

Self-Modification Firewall

Data-Exfiltration Killswitch

Memory Authority Firewall

Swarm Collusion Defense

Capability Lease

ARGUS Behavioral Envelope

ATLAS Transaction Assurance

PQC Hybrid Signing

EU AI Act / ISO 42001 Evidence Notary

Six new KEYSTONE products: detect, fix, prove, sign

🦞 OpenClaw KEYSTONE (ClawGuard)

SWARM KEYSTONE

VIBEGUARD KEYSTONE

MEMGUARD KEYSTONE

SURFGUARD KEYSTONE

ACTUARY KEYSTONE

KEYSTONE — find the fake, fix it, prove the fix

MCPGate KEYSTONE — harden an MCP tool, prove it was hardened

VeriCoding KEYSTONE — a machine proved the fix, for every input

CODEGUARD KEYSTONE — a policy gate in front of every command your coding agent runs● checking…

1 · Get the hook (about 30 lines, read it first) Copy

1 · Get the hook (about 30 lines, read it first)

2 · Add it to ~/.claude/settings.json

Add it to any repository: one workflow file