# CAIN-42 premier products: test evidence, 2026-10-13

Products: FALSEWORK, SCENIC, NULLIUS, SALLYPORT.

| File | What it is |
|---|---|
| `SMOKE_TEST.json` | each product called once the way a customer would: 35 passed, 0 did not match, 2 not run |
| `STRESS_TEST.json` | repeated load, malformed and hostile input, tampered evidence: 34 passed, 0 did not match, 1 not run |
| `verify_premier_products.py` | run it yourself: standard library only, no CAIN code, your own key, answers you can check by hand |
| `AUDITOR_SCRIPT_RUN_BY_DEVELOPER.json` | our own run of that script against the public site: 43 passed, 0 did not match |
| `IP_REGISTER_V54_SUMMARY.json` | the four engine families added to the IP register (internal analytical scenario, not an appraisal) |
| `MANIFEST.json` | SHA-256 of every file here |

## Check it yourself

    curl -s -X POST https://cainstudio.online/subscribe/free/signup -H 'content-type: application/json' -d '{}'
    python3 verify_premier_products.py --key YOUR_API_KEY

The script checks SALLYPORT against the gate running on the developer's host (no customer cluster runs it yet) and
checks cainbench and the contamination scanner for reachability only.

## What testing found

Defects in three engines: the audit engine (two source checks that could never match, working code graded STUB when it
used an inherited method or a callable field, and no refusal of internal targets in its live audit), the root-cause
tracer (a different root cause named for the same trace on different calls) and the trajectory grader (a different
duplicate named when the same steps were listed in another order; duplicate step indexes accepted). All were fixed
and covered by tests. The fixes are deployed: the three engines were rebuilt and every check was run again against them.

## What this does not show

- These are same-project tests on the developer's own host, not an independent review. Passing every check that was
  run does not mean the products are free of defects: this round of testing found several.
- The stress test was sized to leave the soak undisturbed. It is not a capacity test.
- The contamination scanner's probe, SALLYPORT in a customer's cluster, the worker-isolation suite and PBFT under
  load were not run.
- This bundle is not part of the signed Auditor Kit. Its manifest lets you check the files against each other, not
  against a signature.

Check the manifest: `python3 -c "import hashlib,json;m=json.load(open('MANIFEST.json'));print(all(hashlib.sha256(open(f,'rb').read()).hexdigest()==h for f,h in m['files'].items()))"`