# Signed Deliverable Pack

**SKU:** CAIN-A75-026  
**Development:** #26 Finished knowledge-work deliverables  
**Product status:** DELIVERABLE  
**Engine:** `worm_evidence` (`cain/worm_export.py`)  
**Profile:** `evidence_pack`  
**Generated:** 2026-11-12T07:59:12Z UTC

## Result

Clean package verified=True; tampered package verified=False.

- **export_and_verify**: WORM_PACKAGE_VERIFIED_AUTHENTIC
- **tampered_decision**: VERIFICATION_FAILED: Merkle root mismatch: computed f9030ac3408748542ed1df0a2cb0fa5eecda15382bb466af4c5217ed9b0585ed != stored 3384db1ef35ad7bca66f37a6c4384a9ad208d80d4822133022273410adda7517; Inclusion proof failed for record e1 at index 1

## Limits of this run

Exports and verifies the supplied records. It does not prove the records are true; it proves the package changed or did not change.

This is a bounded run on a sample. It is not an assessment of any production system, not a
certification, and not a signed attestation. The accompanying `manifest.json` records SHA-256
hashes so a recipient can detect a changed file. The manifest is not a signature and not an
attestation; it does not prove who produced the artifact.

## What this is not

- Not a vendor integration, partnership or endorsement.
- Not legal, tax, clinical, insurance or safety advice.
- Not a third-party audit, SOC 2 report, ISO certification or patent filing.
- Not a production write action: no downstream tool was called.

Prices and packaging are proposals. Built by a three-person team.