{
 "claims": [
  {
   "claim": "PROOFLOOP records are sealed into an RFC 6962 Merkle tree and the root is notarized by the 3-of-4 quorum",
   "evidence": "https://cainstudio.online/evidence/proofloop-seal/verifier-output.txt",
   "status": "LIVE",
   "today": "Both PROOFLOOP ledgers sealed; signed tree heads anchored on cain-mr-02 (sequence 1762996 for KEYSTONE). A standalone verifier proves one real VERIFIED_FIX record is inside the signed, anchored tree: 4 of 4 checks PASS."
  },
  {
   "claim": "Byzantine quorum: 4 nodes in 4 regions, any 3 must agree; it notarizes and never authorizes",
   "evidence": "https://cainstudio.online/api/v1/quorum/status",
   "status": "LIVE",
   "today": "cain-mr-02: n=4, f=1, quorum 3 (Atlanta, Los Angeles, Miami and a fourth region). Tolerates ONE faulty node, not several."
  },
  {
   "claim": "A fix is accepted only if an independent test fails on the old code and passes on the fix, FALSEWORK re-scans clean and a safety guard passes; rejected fixes get a signed denial record",
   "evidence": "https://cainstudio.online/evidence/factory-of-proof/record.json",
   "status": "LIVE",
   "today": "KEYSTONE proof standard v2; test author must differ from the fix author."
  },
  {
   "claim": "PROOFLOOP attacks code live in a sandbox in eight languages, including C/C++ memory-safety witnesses (AddressSanitizer) and fuzzing (libFuzzer)",
   "evidence": "https://cainstudio.online/proofloop/live",
   "status": "LIVE",
   "today": "Python, JavaScript, TypeScript, Go, Java, Rust, C, C++. Detectors are heuristic: on untouched real C code the static rules were right 1 time in 17; the witness, not the rule, decides CONFIRMED."
  },
  {
   "claim": "Offline verifiers import no CAIN code",
   "evidence": "https://cainstudio.online/evidence/proofloop-seal/verify_proofloop_seal.py",
   "status": "LIVE",
   "today": "Every bundle ships its verifier; you pin the key yourself."
  },
  {
   "claim": "Live trust state restricts an agent whose trust has degraded",
   "evidence": "",
   "status": "LIVE (REST + hosted /mcp) / BUILT (appliance)",
   "today": "REST decision path: every call re-reads trust (REVOKED denies everything). Hosted /mcp (live since deploy 20261110T022511Z): the identity comes from the X-API-Key the call authenticates with; a production call declaring a different identity was refused with IDENTITY_MISMATCH, and the same trust matrix applies, so a revoked principal cannot hide by leaving its name out. Keyless calls carry no identity. The MCPGate appliance applies the same check at customers."
  },
  {
   "claim": "Every MCPGate tool call requires a single-use capability token",
   "evidence": "",
   "status": "BUILT",
   "today": "Single-use tokens are enforced when presented. Rollout: warn first, then required (owner decision). The hosted /mcp endpoint has no capability tokens yet."
  },
  {
   "claim": "A trust drop revokes the agent's tokens",
   "evidence": "",
   "status": "BUILT (MCPGate appliance)",
   "today": "When an agent's trust is revoked or suspended, every capability token issued to it before the revocation is dead for good: lifting the revocation does not revive them; only new tokens work. Shared across processes, never moves back. Tested end to end with real signed tokens (281 MCPGate/hosted tests pass). The appliance runs at customers, not on our sites."
  },
  {
   "claim": "Fleet kill switch across machines",
   "evidence": "https://cainstudio.online/evidence/fleet-kill/record.json",
   "status": "LIVE (measured)",
   "today": "Signed halt sent from Atlanta to all 4 cain-mr-02 hosts (Atlanta, Miami, Los Angeles, San Jose); each commits it and replies only after an agent process there has stopped. Measured over 30 fleet-wide trials: all 4 regions stopped and confirmed in 132 ms (p50), 139 ms max; about 2 ms of that is the kill switch on each host, the rest is network distance. Under 50 ms holds on the same host, not across US regions. Forged, stale and replayed orders refused."
  },
  {
   "claim": "Collusion and steganography shields",
   "evidence": "https://cainstudio.online/evidence/shields/record.json",
   "status": "LIVE (measured)",
   "today": "Steganography shield on its live route: 8 of 14 covert payloads caught before the fix, 13 of 14 after (deploy 20261110T022511Z), 0 of 11 false alarms. Fresh held-out sets: 7 of 10 (0 of 8 false alarms); after adding Greek look-alikes, base32 and ROT13 a third fresh set scored 9 of 10, 0 of 8 false alarms (the miss was a padding bug, since fixed; that last batch goes live with the next deploy). Still missed: meaning hidden in ordinary wording. Collusion: POST /api/v1/swarm-collusion/analyze runs the detector on your own agent graph and signs with the published key (live, verified). No entropy-anomaly detection exists."
  },
  {
   "claim": "Memory screens out prompt injection",
   "evidence": "https://cainstudio.online/evidence/memory-injection/record.json",
   "status": "LIVE (known phrasings only, measured)",
   "today": "Measured on the shipped screen: 9 of 14 known-phrasing injections caught, 0 of 20 reworded ones, 0 of 15 on a fresh reworded set; 1 false alarm in 25 normal notes. A rule pass that looked better (18 of 20) caught 0 of 15 on held-out text, so it was reverted. What actually protects: recalled memory never grants authority, and any tool call it asks for still goes through the CAIN gates. Do not read this as 'stops prompt injection'."
  },
  {
   "claim": "Closed-loop policy evolution: denied decisions become narrow, human-approved Rego refinements",
   "evidence": "https://cainstudio.online/evidence/policy-evolution/record.json",
   "status": "LIVE (proposals)",
   "today": "cain.policy_evolution analyzed all 10,471 recorded decisions and proposed 69 narrow refinements (exact tenant + path + method), each with its evidence, a Rego rendering and a replay over the history showing exactly which past decisions would change and that none outside its scope would (0 in every case). Nothing is applied: a named person approves each one, approved rules go to a staging Rego file, loading it is a separate deploy. Never loosens trust, risk, quarantine or execution denials. 0 approved so far."
  },
  {
   "claim": "Federation: organizations cross-sign each other's receipts and hand agent work across company lines",
   "evidence": "https://cainstudio.online/evidence/federation/verifier-output.txt",
   "status": "LIVE (protocol + demo; second company: none yet)",
   "today": "cain.federation.receipts: each organization pins the others' keys; a countersignature records that an independent party checked a signature (no endorsement, no authority); cross-organization delegation can only narrow scope, and the verifier rejects results outside it or after expiry. Live demo: FIRME AI CORPORATION delegated a fix-record check to a DEMO PARTNER agent, the result was countersigned and notarized on cain-mr-02 (sequence 1767193); standalone verifier: all checks PASS. Both demo keys are held by the same operator, so the verifier itself reports multi-enterprise NOT PROVEN; that needs a second company."
  },
  {
   "claim": "Verify-before-handoff: what one agent passes to another is screened and signed first",
   "evidence": "",
   "status": "BUILT (deploying)",
   "today": "cain.continuum.handoff_guard screens agent-to-agent payloads with the measured steganography shield and the injection detector: a relayed injection or a smuggled credential is BLOCKED, covert channels are stripped (SANITIZED), and a signed envelope binds what was sent to what is delivered; the receiver accepts only a payload matching a valid envelope addressed to it. Hidden text is screened as its own message (it can fuse with visible text and slip past word rules). HTTP route /api/v1/handoff/verify for any agent framework, and a hosted /mcp stage. Limit: injection detection is lexical (reworded instructions pass, measured 0 of 35)."
  },
  {
   "claim": "Human overrides: restricting is instant; releasing needs two different people, each with their own key",
   "evidence": "",
   "status": "BUILT (deploying; approver keys to be registered)",
   "today": "Quarantine and the cluster halt stay one-operator and immediate (they only restrict). Lifting a quarantine already needed two different named approvers; it now needs, once approver keys are registered, a fresh Ed25519 signature from EACH approver's own key over that exact quarantine record and justification, so one holder of the admin key can no longer type two names. Each approval is recorded as signature-verified or named-only; a completed lift is notarized on the validator quorum. 9 tests; 73 quarantine tests pass."
  },
  {
   "claim": "Hardware (silicon-rooted) attestation required before an agent may start",
   "evidence": "",
   "status": "NOT BY CODE (needs hardware)",
   "today": "None of the CAIN hosts has a TEE (no AMD SEV-SNP, Intel TDX, TPM or AWS Nitro device; checked 2026-11-10). The attestation appraiser exists; making it mandatory today would lock out every agent. Needs a rented confidential-computing machine; until then nothing is claimed as hardware-attested."
  },
  {
   "claim": "Independent third-party audit, EU AI Act sign-off, paying subscriptions, an insurer",
   "evidence": "",
   "status": "NOT BY CODE",
   "today": "None yet. Verifiers make an outside audit possible; none has been done."
  },
  {
   "claim": "'Uncompromisable', 'absolute', 'mathematically impossible to misuse', 'the industry standard'",
   "evidence": "",
   "status": "NOT BY CODE",
   "today": "Opinions or absolutes. What is true: built so that unauthorized actions routed through CAIN are refused and every result is signed and independently checkable."
  }
 ],
 "date_utc": "2026-11-10",
 "public_key_b64": "b6hfA2rpAdV29FOdhNXGkk4t91mCV0AnfFYwq0HO0R8=",
 "record_hash": "d0af60b322e73d50ece73040c5a82325f326dd2de5caf8b5708f7caf415b822a",
 "rule": "statuses follow evidence; a claim is LIVE only with a public link anyone can check",
 "schema": "cain42.claim-evidence.v1",
 "signature_b64": "4C7tR1sr/cSbDkTmRpb9JpLk8mXCpgjJX+n8UPbAwFMjeFsPjPZJgf7hrJGPkxubgA6YbCD25GPVlhdtFgECBA=="
}