# Threat Investigation Evidence Review

**SKU:** CAIN-A75-036  
**Development:** #36 Evidence-grounded threat investigation  
**Product status:** DELIVERABLE  
**Engine:** `threat_evidence` (`cain_a75_engines/threatevidence/engine.py`)  
**Profile:** `high_severity_case`  
**Generated:** 2026-11-12T07:59:12Z UTC

## Result

VERIFIED: evidence integrity/custody, finding grounding, hypotheses and timeline recomputed; 15/15 case-failure cases as expected

- **high_severity_threat_case**: VERIFIED
- **honest_threat_case**: SOUND
- **finding_without_evidence**: UNSOUND
- **finding_cites_unknown_evidence**: UNSOUND
- **custody_missing**: UNSOUND
- **integrity_not_verified**: UNSOUND
- **stale_evidence**: UNSOUND
- **confirmed_without_evidence**: UNSOUND
- **high_case_open_hypothesis**: UNSOUND
- **timeline_dangling**: UNSOUND
- **confidence_out_of_range**: UNSOUND
- **duplicate_finding**: UNSOUND
- **claim_overstates**: UNSOUND
- **unknown_claim**: UNSOUND
- **wrong_schema**: UNSOUND
- **garbage**: UNSOUND

## Limits of this run

Reviews the case record. It does not re-collect evidence, prove authenticity, or confirm attribution. The run is Ed25519-signed; pin the issuer key out of band.

This is a bounded run on a sample. It is not an assessment of any production system, not a
certification, and not a signed attestation. The accompanying `manifest.json` records SHA-256
hashes so a recipient can detect a changed file. The manifest is not a signature and not an
attestation; it does not prove who produced the artifact.

## What this is not

- Not a vendor integration, partnership or endorsement.
- Not legal, tax, clinical, insurance or safety advice.
- Not a third-party audit, SOC 2 report, ISO certification or patent filing.
- Not a production write action: no downstream tool was called.

Prices and packaging are proposals. Built by a three-person team.