{ "assets": [ { "asset_id": "BFT-IP-0001", "baseline_prior_art": [ "leases (Chubby, Gray & Cheriton 1989), capability caching, OAuth token TTL, CT inclusion proofs" ], "cain_mechanism": "authority committed by quorum, enforced locally in ~0.2 ms, revoked locally without quorum, each use anchored later", "commercial_status": "UNVALIDATED", "design_around_status": "EASY", "evidence": [ "GOV-BFT-06..09", "RT-BFT-01/03/05/06/10" ], "evidence_status": "TESTED (self-assessed)", "implementation_files": [ "platform-gateway/governance_snapshot.py" ], "implementation_status": "IMPLEMENTED", "ip_status": "CANDIDATE (not a legal opinion)", "limits": "outage permit window up to the TTL (120 s default, 900 s max); revocation epoch is local to one gateway database, not quorum-ordered", "measurable": "fast-path latency ~0.17-0.22 ms (GOV-BFT-06), revocation-to-miss ~0.2 ms (GOV-BFT-08), outage window = TTL (GOV-BFT-07)", "name": "Quorum-committed authorization snapshots with local revocation epoch", "prior_art_status": "RELATED_PRIOR_ART (author recall; no database search)", "protection_recommendation": "TRADE_SECRET (implementation) + DEFENSIVE_PUBLICATION candidate", "reproduction_status": "REPRODUCED in-process; not independently reproduced", "runtime_path": "GovernanceControlPlane, authorize_fast_path, SnapshotStore", "score_class": "MATERIAL", "score_total": 25, "scores": { "bft_differentiation": 2, "commercial_utility": 3, "design_around_resistance": 1, "evidence": 3, "governance_integration": 4, "protocol_potential": 2, "reproduction_difficulty": 2, "safety_significance": 3, "switching_cost": 2, "technical_effect": 3 }, "technical_effect": "removes the per-call round; revocation independent of cluster liveness; outage permit window = TTL", "technical_problem": "a PBFT round per decision costs ~1-2 s on the live WAN cluster; governance needs sub-ms checks without giving up quorum-agreed authority or fast revocation", "tests": [ "GOV-BFT-06..09", "RT-BFT-01/03/05/06/10" ], "what_breaks_if_removed": "every permit pays a round; under cluster outage every permit fails (no window); revocation would need a round", "why_ordinary_bft_insufficient": "ordinary SMR either orders every request (slow) or serves stale reads; it has no notion of revoking a cached authority locally" }, { "asset_id": "BFT-IP-0002", "baseline_prior_art": [ "transparency logs (CT, RFC 6962), notarisation, permissioned-ledger endorsement" ], "cain_mechanism": "a governance verdict cannot permit unless 2f+1 replicas committed its exact commitment AND the gateway itself verified the QC", "commercial_status": "UNVALIDATED", "design_around_status": "EASY", "evidence": [ "GOV-BFT-01..05", "GOV-BFT-10" ], "evidence_status": "TESTED (self-assessed)", "implementation_files": [ "platform-gateway/fabric_control_plane.py" ], "implementation_status": "IMPLEMENTED", "ip_status": "CANDIDATE (not a legal opinion)", "limits": "replicas do not re-evaluate governance (GOV-BFT-10): it protects the RECORD, not the DECISION; a compromised gateway can commit a wrong ALLOW", "measurable": "GOV-BFT-02/04: no-quorum and false-COMMITTED both deny; GOV-BFT-03: one tampered QC does not block a genuine one", "name": "Fail-closed consensus stage: permit requires a gateway-verified QC over the exact decision commitment", "prior_art_status": "RELATED_PRIOR_ART (author recall; no database search)", "protection_recommendation": "OPEN_PROTOCOL (commitment + QC format) / TRADE_SECRET (pipeline)", "reproduction_status": "REPRODUCED in-process; not independently reproduced", "runtime_path": "TrustFabricControlPlane._consensus_stage; cain_mr_client.order_op/verify_commit", "score_class": "MATERIAL", "score_total": 25, "scores": { "bft_differentiation": 2, "commercial_utility": 2, "design_around_resistance": 1, "evidence": 4, "governance_integration": 4, "protocol_potential": 2, "reproduction_difficulty": 2, "safety_significance": 3, "switching_cost": 2, "technical_effect": 3 }, "technical_effect": "no quorum -> no permit (fail closed); tamper-evident, quorum-signed record of every permit", "technical_problem": "an authorization decision should be non-repudiable and unalterable after the fact, and must not succeed on a replica's word", "tests": [ "GOV-BFT-01..05", "GOV-BFT-10" ], "what_breaks_if_removed": "a lying replica could produce 'COMMITTED'; decisions could be rewritten after the fact", "why_ordinary_bft_insufficient": "SMR clients usually trust f+1 matching replies; CAIN verifies one 2f+1 certificate against pinned membership and the exact digest" }, { "asset_id": "BFT-IP-0005", "baseline_prior_art": [ "signed audit records" ], "cain_mechanism": "states what consensus did NOT evaluate", "commercial_status": "UNVALIDATED", "design_around_status": "EASY", "evidence": [ "tests/test_cain42_pbft_authorization.py" ], "evidence_status": "TESTED (self-assessed)", "implementation_files": [ "platform-gateway/cain_pbft_engine_33.py" ], "implementation_status": "IMPLEMENTED", "ip_status": "CANDIDATE (not a legal opinion)", "limits": "verifiers are same-organisation; no third party has run them on record", "measurable": "public verifier tests 11 pass; claims registry downgrades liveness claims on stale proofs (e24781a9)", "name": "Evidence posture: proof objects that state what consensus did NOT evaluate + public zero-CAIN verifier + signed hourly proofs", "prior_art_status": "RELATED_PRIOR_ART (author recall; no database search)", "protection_recommendation": "OPEN_PROTOCOL (verifier + formats)", "reproduction_status": "REPRODUCED in-process; not independently reproduced", "runtime_path": "AuthorizationProofObject", "score_class": "MATERIAL", "score_total": 23, "scores": { "bft_differentiation": 2, "commercial_utility": 2, "design_around_resistance": 1, "evidence": 4, "governance_integration": 3, "protocol_potential": 3, "reproduction_difficulty": 2, "safety_significance": 2, "switching_cost": 2, "technical_effect": 2 }, "technical_effect": "evidence cannot overstate what the quorum checked", "technical_problem": "evidence that overclaims (trust/risk 'HIGH' hardcoded until 2026-09-24) is worse than none", "tests": [ "tests/test_cain42_pbft_authorization.py" ], "what_breaks_if_removed": "third parties must trust CAIN's word", "why_ordinary_bft_insufficient": "BFT says nothing about evidence semantics" }, { "asset_id": "BFT-IP-0004", "baseline_prior_art": [ "Zyzzyva (SOSP 2007), SBFT (DSN 2019), FaB Paxos" ], "cain_mechanism": "a vote-history rule; model-checked", "commercial_status": "UNVALIDATED", "design_around_status": "EASY", "evidence": [ "tests/test_pbft_reference_model.py" ], "evidence_status": "TESTED (self-assessed)", "implementation_files": [ "scripts/cain42_bft/pbft_reference_model.py" ], "implementation_status": "IMPLEMENTED", "ip_status": "CANDIDATE (not a legal opinion)", "limits": "only N=4 f=1, 3 views; not enabled anywhere", "measurable": "exhaustive N=4,f=1 model, 3 views; negative controls fail as expected", "name": "Model-checked vote-history fast path", "prior_art_status": "RELATED_PRIOR_ART (author recall; no database search)", "protection_recommendation": "DEFENSIVE_PUBLICATION / OPEN", "reproduction_status": "REPRODUCED in-process; not independently reproduced", "runtime_path": "check()", "score_class": "DEVELOPING", "score_total": 20, "scores": { "bft_differentiation": 2, "commercial_utility": 1, "design_around_resistance": 2, "evidence": 3, "governance_integration": 1, "protocol_potential": 2, "reproduction_difficulty": 3, "safety_significance": 3, "switching_cost": 1, "technical_effect": 2 }, "technical_effect": "one-round commits when all N vote; OFF by default and in production", "technical_problem": "one-round commit when all replicas vote", "tests": [ "tests/test_pbft_reference_model.py" ], "what_breaks_if_removed": "nothing in production (OFF)", "why_ordinary_bft_insufficient": "naive fast paths are unsafe across view change (model shows naive_fast VIOLATED)" }, { "asset_id": "BFT-IP-0003", "baseline_prior_art": [ "asynchronous audit logging" ], "cain_mechanism": "safety-asymmetric latency rule", "commercial_status": "UNVALIDATED", "design_around_status": "EASY", "evidence": [ "GOV-BFT-05" ], "evidence_status": "TESTED (self-assessed)", "implementation_files": [ "platform-gateway/fabric_control_plane.py" ], "implementation_status": "IMPLEMENTED", "ip_status": "CANDIDATE (not a legal opinion)", "limits": "deferred orders can fail after 5 attempts (recorded as failed)", "measurable": "GOV-BFT-05", "name": "Safety-asymmetric consensus deferral (non-permits ordered after reply)", "prior_art_status": "RELATED_PRIOR_ART (author recall; no database search)", "protection_recommendation": "DEFENSIVE_PUBLICATION", "reproduction_status": "REPRODUCED in-process; not independently reproduced", "runtime_path": "CONSENSUS_DEFER_NONPERMIT, _order_deferred", "score_class": "DEVELOPING", "score_total": 18, "scores": { "bft_differentiation": 2, "commercial_utility": 2, "design_around_resistance": 1, "evidence": 3, "governance_integration": 3, "protocol_potential": 1, "reproduction_difficulty": 1, "safety_significance": 2, "switching_cost": 1, "technical_effect": 2 }, "technical_effect": "a deny costs no consensus round; a permit always does (or a committed snapshot)", "technical_problem": "denies paid the full round latency although they authorize nothing", "tests": [ "GOV-BFT-05" ], "what_breaks_if_removed": "deny latency = permit latency", "why_ordinary_bft_insufficient": "ordering is symmetric in SMR" }, { "asset_id": "BFT-IP-0007", "baseline_prior_art": [ "batching + Merkle (CT, Bitcoin)" ], "cain_mechanism": "applied to governance decisions", "commercial_status": "UNVALIDATED", "design_around_status": "EASY", "evidence": [ "tests/test_consensus_group_commit.py" ], "evidence_status": "TESTED (self-assessed)", "implementation_files": [ "platform-gateway/cain_mr_client.py" ], "implementation_status": "IMPLEMENTED", "ip_status": "CANDIDATE (not a legal opinion)", "limits": "batch reveals a root and count only", "measurable": "tests/test_consensus_group_commit.py (31 pass)", "name": "Group commit with per-decision RFC 6962 inclusion proofs", "prior_art_status": "RELATED_PRIOR_ART (author recall; no database search)", "protection_recommendation": "OPEN", "reproduction_status": "REPRODUCED in-process; not independently reproduced", "runtime_path": "order_grouped, root_from_path", "score_class": "DEVELOPING", "score_total": 18, "scores": { "bft_differentiation": 1, "commercial_utility": 2, "design_around_resistance": 1, "evidence": 3, "governance_integration": 3, "protocol_potential": 2, "reproduction_difficulty": 1, "safety_significance": 1, "switching_cost": 1, "technical_effect": 3 }, "technical_effect": "many decisions per round, each verifiable", "technical_problem": "rounds queue at the primary under load", "tests": [ "tests/test_consensus_group_commit.py" ], "what_breaks_if_removed": "1.7 decisions/s at c4 (measured 2026-10-03)", "why_ordinary_bft_insufficient": "batching hides individual requests from verifiers" }, { "asset_id": "BFT-IP-0006", "baseline_prior_art": [ "accountability (PeerReview, SOSP 2007), BFT reconfiguration" ], "cain_mechanism": "quarantine as an ordered op", "commercial_status": "UNVALIDATED", "design_around_status": "EASY", "evidence": [ "BFT-TV-08", "RT-BFT-02" ], "evidence_status": "TESTED (self-assessed)", "implementation_files": [ "platform-gateway/cain_pbft_engine_33.py" ], "implementation_status": "IMPLEMENTED", "ip_status": "CANDIDATE (not a legal opinion)", "limits": "no dynamic membership (BFT-TV-18: NOT_IMPLEMENTED)", "measurable": "BFT-TV-08, RT-BFT-02/14", "name": "Consensus-ordered quarantine + hash-chained Byzantine evidence", "prior_art_status": "RELATED_PRIOR_ART (author recall; no database search)", "protection_recommendation": "OPEN", "reproduction_status": "REPRODUCED in-process; not independently reproduced", "runtime_path": "ByzantineEvidenceLog, apply_operation('quarantine')", "score_class": "DEVELOPING", "score_total": 17, "scores": { "bft_differentiation": 1, "commercial_utility": 1, "design_around_resistance": 1, "evidence": 3, "governance_integration": 2, "protocol_potential": 1, "reproduction_difficulty": 2, "safety_significance": 3, "switching_cost": 1, "technical_effect": 2 }, "technical_effect": "equivocation becomes durable evidence; exclusion is itself agreed", "technical_problem": "excluding a Byzantine replica must itself be agreed and evidenced", "tests": [ "BFT-TV-08", "RT-BFT-02" ], "what_breaks_if_removed": "framing/eviction disputes", "why_ordinary_bft_insufficient": "PBFT tolerates but does not evict" }, { "asset_id": "BFT-IP-0008", "baseline_prior_art": [ "composite/hybrid signatures (IETF LAMPS drafts)" ], "cain_mechanism": "applied to QCs; library opt-in", "commercial_status": "UNVALIDATED", "design_around_status": "EASY", "evidence": [ "tests/test_cain42_pbft_hybrid_qc.py" ], "evidence_status": "TESTED (self-assessed)", "implementation_files": [ "platform-gateway/cain_pbft_qc.py" ], "implementation_status": "IMPLEMENTED", "ip_status": "CANDIDATE (not a legal opinion)", "limits": "library only, opt-in", "measurable": "18 tests pass", "name": "Hybrid Ed25519 + ML-DSA-65 quorum certificates", "prior_art_status": "RELATED_PRIOR_ART (author recall; no database search)", "protection_recommendation": "OPEN", "reproduction_status": "REPRODUCED in-process; not independently reproduced", "runtime_path": "hybrid QC", "score_class": "DEVELOPING", "score_total": 14, "scores": { "bft_differentiation": 1, "commercial_utility": 1, "design_around_resistance": 1, "evidence": 2, "governance_integration": 1, "protocol_potential": 2, "reproduction_difficulty": 2, "safety_significance": 2, "switching_cost": 1, "technical_effect": 1 }, "technical_effect": "PQ migration path for certificates", "technical_problem": "PQ migration of certificates", "tests": [ "tests/test_cain42_pbft_hybrid_qc.py" ], "what_breaks_if_removed": "nothing deployed", "why_ordinary_bft_insufficient": "n/a" } ] }