{ "$schema": "https://cainstudio.online/schemas/threat-model.v1.json", "identity": "CAIN42_THREAT_MODEL", "version": "42.0.0", "generated_at": 1789985400.0, "generated_iso": "2026-09-21T10:10:00Z", "system_description": "CAIN-42 Autonomous Byzantine AI Trust Fabric OS and Tri-Domain Enforcement Architecture", "core_security_posture": "FAIL_CLOSED_ZERO_TRUST", "threat_categories": [ { "category_id": "THREAT-01", "name": "Autonomous Agent Authority Escalation & Confused Deputy", "severity": "CRITICAL", "attack_vectors": [ "Sub-agent requesting permissions broader than parent agent delegation", "Agent inventing synthetic delegation chains or forging issuer signatures", "Agent attempting self-delegation to bypass human supervisor sign-off", "Confused deputy attack invoking an authorized tool with malicious target parameters" ], "cain42_mitigation": { "mechanism": "Monotonic Authority Attenuation & Ephemeral Capability Tokens", "enforcement_point": "clawx/control_plane/principals.py and kernel.py", "invariant": "effective_authority = MIN(sovereign_cap, delegated_auth, policy, budget, blast_radius)", "test_evidence": "tests/clawx_control_plane/test_principals.py, test_causal_resources.py", "fail_closed_verdict": "DENY: SCOPE_AMPLIFICATION_FORBIDDEN" } }, { "category_id": "THREAT-02", "name": "Memory Poisoning & Indirect Prompt Injection", "severity": "CRITICAL", "attack_vectors": [ "Adversarial document injected into vector store claiming agent was granted root authority", "Poisoned retrieved memory instructing agent to disregard constitutional boundaries", "Synthetic historical observation injected to simulate user confirmation" ], "cain42_mitigation": { "mechanism": "Strict 7-Layer Cognitive Segregation & Memory Authority Firewall", "enforcement_point": "clawx/control_plane/memory_history.py", "invariant": "Memory is untrusted input. Memory may influence planning but CAN NEVER create authority.", "test_evidence": "tests/clawx_control_plane/test_memory_history_tql.py, test_memory_kernel.py", "fail_closed_verdict": "DENY: LAW_VIOLATION_I01_MEMORY_CANNOT_CONFER_AUTHORITY" } }, { "category_id": "THREAT-03", "name": "Tool & MCP Server Manifest Mutation", "severity": "HIGH", "attack_vectors": [ "MCP server dynamically mutating tool schema or expanding permission scope post-registration", "Tool substitution attack swapping a read-only query tool with an administrative execution tool", "Argument smuggling through uninspected JSON-RPC parameters" ], "cain42_mitigation": { "mechanism": "Pre-Execution Attested Manifest Verification & MCP Discovery Firewall", "enforcement_point": "clawx/control_plane/tool_registry.py and cain/mcp_proxy.py", "invariant": "Tool presented NOW must match attested manifest digest; any schema change halts execution.", "test_evidence": "tests/clawx_control_plane/test_tool_registry.py", "fail_closed_verdict": "DENY: TOOL_MANIFEST_MUTATION_DETECTED" } }, { "category_id": "THREAT-04", "name": "Correlated LLM Hallucination & Byzantine Collusion", "severity": "CRITICAL", "attack_vectors": [ "Homogeneous validator nodes sharing same model weights agreeing on an unsafe action", "Prompt injection affecting all validators simultaneously, manufacturing a false 4/4 quorum", "Sub-threshold agent collusion attempting to coordinate unauthorized resource transfer" ], "cain42_mitigation": { "mechanism": "Epistemic Byzantine Fault Tolerance & Minimum Collusion Set (MCS) Verification", "enforcement_point": "clawx/control_plane/epistemic.py and cain_epistemic_bft_13.py", "invariant": "Quorum requires epistemic independence across weights, prompts, vector stores, and providers.", "test_evidence": "tests/clawx_control_plane/test_epistemic.py, test_collusion.py", "fail_closed_verdict": "REJECTED_EPISTEMIC_CORRELATED_FAILURE" } }, { "category_id": "THREAT-05", "name": "Distributed Salami Micro-Transaction Attacks", "severity": "HIGH", "attack_vectors": [ "Swarm of 100+ ephemeral sub-agents making $0.99 transactions to evade a $100 threshold", "Cumulative rate limit exhaustion distributed across rotating client IPs", "Slow-drip exfiltration of sensitive records within normal per-query limits" ], "cain42_mitigation": { "mechanism": "Hierarchical Sliding-Window Budget Aggregation & Financial Gate", "enforcement_point": "clawx/control_plane/resources.py", "invariant": "Parent escrows and limits all descendant spend; cumulative sliding window prevents sub-threshold bleed.", "test_evidence": "tests/clawx_control_plane/test_causal_resources.py", "fail_closed_verdict": "DENY: BUDGET_EXCEEDS_PARENT_REMAINING or RATE_EXCEEDS_PARENT" } }, { "category_id": "THREAT-06", "name": "Causal History Inversion & Clock Manipulation", "severity": "HIGH", "attack_vectors": [ "Replaying an expired authorization token with forged or future-dated timestamps", "Inserting retroactive events into the causal audit log to mask unauthorized effects", "Exploiting NTP clock drift between distributed validator nodes" ], "cain42_mitigation": { "mechanism": "Cryptographic Causal Chaining & Bounded Lamport Logical Clocks", "enforcement_point": "clawx/control_plane/causal.py", "invariant": "Causal ordering enforces monotonic Lamport sequence; future-dated or inverted events trigger immediate paradox halt.", "test_evidence": "tests/clawx_control_plane/test_causal_resources.py", "fail_closed_verdict": "DENY: CAUSAL_TEMPORAL_PARADOX_DETECTED" } }, { "category_id": "THREAT-07", "name": "Crash Inconsistency & Double-Spend / Non-Atomic Failures", "severity": "CRITICAL", "attack_vectors": [ "Process kill or power outage occurring between authorization and tool execution", "Replaying a partially executed transaction on restart to execute tool twice", "Database lock starvation causing silent authorization drops" ], "cain42_mitigation": { "mechanism": "Two-Phase Commit (2PC) State Coordination & SQLite WAL Logging", "enforcement_point": "clawx/control_plane/kernel.py and clawx/control_plane/chaos.py", "invariant": "Crash at any stage leaves immutable trace and releases claims safely without allowing replay.", "test_evidence": "tests/clawx_control_plane/test_chaos.py", "fail_closed_verdict": "FAIL_CLOSED_WITH_EVIDENCE_RECORDS" } }, { "category_id": "THREAT-08", "name": "Cross-Tenant Cryptographic Context Leakage", "severity": "CRITICAL", "attack_vectors": [ "Tenant A agent inspecting memory vectors or capability tokens of Tenant B", "Token forwarding across tenant namespaces in multi-tenant gateway instances", "Shared cache or prompt embedding contamination" ], "cain42_mitigation": { "mechanism": "Cryptographic Tenant Namespace Binding & Isolated SQLite Databases", "enforcement_point": "clawx/control_plane/service.py and platform-gateway/main.py", "invariant": "All capability tokens and memory records are bound to cryptographic tenant IDs; cross-tenant references fail immediately.", "test_evidence": "tests/test_cross_tenant_isolation_aggressive.py", "fail_closed_verdict": "DENY: CROSS_TENANT_ACCESS_FORBIDDEN" } }, { "category_id": "THREAT-09", "name": "Supply Chain Compromise & Malicious Node Replacement", "severity": "HIGH", "attack_vectors": [ "Compromised container image deployed to validator cluster", "Tampered Python dependencies altering signature verification routines", "Malicious third-party MCP package distributed via public repositories" ], "cain42_mitigation": { "mechanism": "SLSA Level 3 Build Provenance Attestation & In-Toto Manifest Verification", "enforcement_point": "clawx/control_plane/supplychain.py and .github/workflows/", "invariant": "Unsigned or hash-mismatched images and libraries cannot initialize the trust microkernel.", "test_evidence": "tests/clawx_control_plane/test_supplychain.py", "fail_closed_verdict": "STARTUP_HALT: SUPPLY_CHAIN_VERIFICATION_FAILED" } }, { "category_id": "THREAT-10", "name": "Public Evidence Equivocation & Web Surface Divergence", "severity": "HIGH", "attack_vectors": [ "Website reporting VERIFIED status while cluster execution failed", "Adversary altering HTML or public JSON on web server to mask policy breaches", "Desynchronization between cainstudio.online, mcpgate.online, and clawx.click" ], "cain42_mitigation": { "mechanism": "Daily Cryptographic Fabric Synchronizer & Clean-Room Offline Verification", "enforcement_point": "scripts/cain_daily_synchronizer.py and scripts/cleanroom_verify_epoch14.py", "invariant": "All web claims map to signed Merkle tree roots independently verifiable with zero CAIN imports.", "test_evidence": "tests/test_cain42_epoch14_os.py, tests/test_clawx_site.py", "fail_closed_verdict": "ALERT: PUBLICATION_INTEGRITY_FAILURE" } } ] }