{
  "known_unverified": [
    "the older public evidence files under /proof/bundle/ were written before this audit process; only the cluster claim file has been audited so far and it is marked superseded",
    "AGENTS.md figures (398/398 tests, 120/120 vectors, 200 invariants) have not been re-verified"
  ],
  "read_this_first": "Everything here is same-author evidence produced by real runs. Independent checks below re-verify signatures, hashes and recorded agreement without importing CAIN. They do not prove independent failure domains, network-partition behaviour, security, or that any third party has reviewed the work. All three hostnames currently resolve to one machine: identical bytes show consistency, not independence.",
  "infrastructure_status": {
    "claim": "the CAIN-42 gateway process itself (identity, capability-token authorization/delegation, security context, trust graph, and -- new as of 2026-09-22 -- the AGI Control Boundary's last-mile enforcement path) is deployed and reachable on a real host, not a demo/mock server. This is a narrower, load-bearing claim than 'production' in the business sense: there is no paying customer traffic yet, this is same-operator infrastructure, and no third party has audited it.",
    "not_claimed": "customer traffic, revenue, SLA, multi-tenant scale, or that the multi-node BFT cluster (see live-multi-host-cluster-public-probe and cluster-fault-test-run2 recipes below) has passed rejoin certification -- it has not.",
    "verify": [
      "dig +short cainstudio.online mcpgate.online clawx.click A   # all three should resolve to the same host serving this file",
      "curl -sI https://cainstudio.online/ | grep -i strict-transport-security   # HSTS on a real TLS-terminating reverse proxy",
      "curl -s https://cainstudio.online/fabric/agi/sandbox-tools -H 'X-API-Key: anyvalue' | python3 -m json.tool   # live route into cain_agi_control_boundary.ControlBoundary.submit_proposal(), the pipeline that calls MCPGateLastMileEnforcer after a signed Proof-Carrying Decision -- previously reachable only from pytest, wired to a live endpoint 2026-09-22"
    ]
  },
  "recipes": [
    {
      "id": "cain42-agent-proof-package",
      "added": "2026-09-24",
      "what": "Evolution 6: agent identity, signed trajectories, plan/model/tool continuity, delegation non-escalation, enforced at MCPGate on top of PBFT authorization; 40 sample proof chains",
      "instructions": "https://cainstudio.online/proof/bundle/cain42-agent-proof-package-2026-09-24/REPRODUCE.txt",
      "expected": "FINAL RESULT: VERIFIED",
      "does_not_prove": "LLM agents (scripted), hardware attestation (simulated), independent failure domains, the live MCPGate runs this gate"
    },
    {
      "id": "cain42-proof-package",
      "added": "2026-09-24",
      "what": "Evolution 5: consensus-authorized tool calls enforced by the real MCPGate interceptor; 4 executions, 9 blocked attacks, signed proof chain, DAG run; one-command verifier",
      "instructions": "https://cainstudio.online/proof/bundle/cain42-proof-package-2026-09-24/REPRODUCE.txt",
      "expected": "FINAL RESULT: VERIFIED",
      "does_not_prove": "independent failure domains; that the live MCPGate runs this gate; formal verification; a 72-hour soak"
    },
    {
      "id": "pbft-evolution3-fast-path",
      "added": "2026-09-24",
      "what": "152 COMMIT/FAST_COMMIT/PREPARE quorum certificates from a disposable 4-node cluster with the fast path on (41 fast), across a primary failover",
      "browser": "https://cainstudio.online/proof/bundle/pbft-evolution3-2026-09-24/index.html",
      "verify": [
        "curl -so verify_pbft_qc_bundle.py https://cainstudio.online/proof/bundle/pbft-evolution3-2026-09-24/verify_pbft_qc_bundle.py.txt",
        "python3 verify_pbft_qc_bundle.py https://cainstudio.online/proof/bundle/pbft-evolution3-2026-09-24/PBFT_QC_BUNDLE.json"
      ],
      "expected": "ALL_CHECKS_PASSED: 30/30 checks, 152 certificates verified",
      "bundle_sha256": "43e1c61004d3d53a1f76d96f72a7241ef59793a2f77d9beda5f6b40559e9c9a4",
      "does_not_prove": "independent failure domains; that the live cluster runs the fast path (it does not); a latency improvement (none measured)"
    },
    {
      "id": "dag-evolution4",
      "added": "2026-09-24",
      "what": "DAG dissemination + availability certificates + PBFT anchors on a disposable 4-node cluster incl. a crash-restart; verifier recomputes every anchor's order and the ledger root",
      "verify": [
        "curl -so verify_dag_bundle.py https://cainstudio.online/proof/bundle/dag-evolution4-2026-09-24/verify_dag_bundle.py.txt",
        "curl -so verify_pbft_qc_bundle.py https://cainstudio.online/proof/bundle/dag-evolution4-2026-09-24/verify_pbft_qc_bundle.py.txt",
        "curl -so b.json https://cainstudio.online/proof/bundle/dag-evolution4-2026-09-24/DAG_CLUSTER_EVIDENCE.json && python3 verify_dag_bundle.py b.json"
      ],
      "expected": "ALL_CHECKS_PASSED: 18/18 checks",
      "does_not_prove": "independent failure domains; fairness; that any live cluster runs the DAG layer; MCPGate enforcement; Narwhal/Bullshark compatibility"
    },
    {
      "id": "pbft-evolution2-quorum-certificates",
      "added": "2026-09-24",
      "what": "every COMMIT and PREPARE quorum certificate (160) from a disposable 4-node CAIN-42 PBFT cluster built from git c18844261e74e4d127806f8fe332dc4dd3dd1e8b: 20 decisions, primary killed, view change 0->1, old primary restarted and caught up; plus the VIEW_CHANGE certificate and 4 AuthorizationCertificates",
      "browser": "https://cainstudio.online/proof/bundle/pbft-evolution2-2026-09-24/index.html",
      "urls": [
        "https://cainstudio.online/proof/bundle/pbft-evolution2-2026-09-24/",
        "https://mcpgate.online/proof/bundle/pbft-evolution2-2026-09-24/",
        "https://clawx.click/evidence/pbft-evolution2-2026-09-24/"
      ],
      "verify": [
        "curl -so verify_pbft_qc_bundle.py https://cainstudio.online/proof/bundle/pbft-evolution2-2026-09-24/verify_pbft_qc_bundle.py.txt",
        "python3 verify_pbft_qc_bundle.py https://cainstudio.online/proof/bundle/pbft-evolution2-2026-09-24/PBFT_QC_BUNDLE.json   # needs: pip install cryptography; imports no CAIN code"
      ],
      "expected": "ALL_CHECKS_PASSED: 29/29 checks, 160 certificates verified",
      "bundle_sha256": "f96088a8edf710b38b3cf22a7c25dd04e2758f7ff7ae9583b8eddf4b04cb2dde",
      "proves": "the certificates are authentic Ed25519 quorum signatures (>=3 of the 4 pinned members) bound to exact cluster/epoch/view/sequence/digest, COMMIT and PREPARE votes are not interchangeable, the decision chain is contiguous and identical on all four nodes, and the verifier rejects 7 kinds of tampering",
      "does_not_prove": "independent failure domains (one host), anything about the live cluster (cain-vc runs this build since 2026-09-24 but its API is not publicly reachable and its first two decisions predate certificates; cain-cluster and cain-sbx run older images), freedom from bugs, third-party review; MCPGate does not yet consume the AuthorizationCertificate"
    },
    {
      "id": "agi-boundary-last-mile-enforcement-live",
      "what": "cain_agi_control_boundary.ControlBoundary.submit_proposal() -- IDENTITY -> CAPABILITY -> POLICY/RISK -> TRUST -> PROOF-CARRYING DECISION -> MCPGATE -> LAST-MILE ENFORCEMENT (MCPGateLastMileEnforcer, in-flight parameter-mutation defense) -> sandboxed EXECUTION -- was fully built and covered by tests/test_agi_*.py but reachable only from pytest before 2026-09-22 (grepped main.py/routers/*.py/cain_private_api.py for any reference; none existed). Now live at /fabric/agi/propose, auth-gated, execution scoped to a small registered sandbox tool set (no general tool-dispatch surface opened).",
      "does_not_prove": "that last-mile enforcement has ever blocked a real attempted mutation in production (no adversarial traffic yet) -- only that the code path is reachable and its own test suite (57 tests, including 5 new endpoint-level tests) passes.",
      "source": "platform-gateway/cain_agi_boundary_api.py, platform-gateway/cain_agi_control_boundary.py, platform-gateway/cain_last_mile_enforcement.py",
      "verify": "curl -s https://cainstudio.online/fabric/agi/sandbox-tools -H 'X-API-Key: anyvalue'   # expect {\"sandbox_tools\": [\"sandbox.read_file\", \"sandbox.send_notification\", \"sandbox.write_file\"]}"
    },
    {
      "bundle": {
        "cainstudio.online": "https://cainstudio.online/proof/bundle/v2/CAIN42_FRONTIER_TRUST_ENGINE_BUNDLE.json",
        "clawx.click": "https://clawx.click/evidence/CAIN42_FRONTIER_TRUST_ENGINE_BUNDLE.json",
        "mcpgate.online": "https://mcpgate.online/proof/bundle/v2/CAIN42_FRONTIER_TRUST_ENGINE_BUNDLE.json"
      },
      "id": "frontier-trust-engine",
      "verify": "curl -s https://cainstudio.online/proof/bundle/v2/verify_frontier_trust_bundle.py -o v.py && python3 v.py --sites",
      "what": "trust-engine fixes, 11 attack handlers with positive controls, signed bundle"
    },
    {
      "bundle": {
        "cainstudio.online": "https://cainstudio.online/proof/bundle/cluster-fault-test-2026-09-21-run2/bundle.json",
        "clawx.click": "https://clawx.click/evidence/cluster-fault-test-2026-09-21-run2/bundle.json",
        "mcpgate.online": "https://mcpgate.online/proof/bundle/cluster-fault-test-2026-09-21-run2/bundle.json"
      },
      "bundle_sha256": "78a2966f4ed70060a3a49470c305326c0dc2dac3d11d337e14ab680ae9f91bca",
      "expected": "VERIFIED: 33/33 checks. Signatures and recorded agreement only; not independence, not fault tolerance, not independent review.",
      "id": "cluster-fault-test-run2",
      "observed": [
        "S1 commit with all 4: COMMITTED, 4 signers verified independently",
        "S2 one node crashed: COMMITTED with 3 signers (quorum 3 of 4)",
        "S3 crashed node restarted: reachable=True; converged within 121.4s = False; sequences {'cain-evid-node-1': 2, 'cain-evid-node-2': 2, 'cain-evid-node-3': 2, 'cain-evid-node-4': 1}",
        "S4 two nodes crashed (beyond f=1): status=CONSENSUS_TIMEOUT, committed=False, primary sequence advanced without a commit=True",
        "S5 both restarted: converged before next commit=False (sequences {'cain-evid-node-1': 3, 'cain-evid-node-2': 2, 'cain-evid-node-3': 2, 'cain-evid-node-4': 1}); next commit COMMITTED with 4 signers; converged after it=True (sequences {'cain-evid-node-1': 4, 'cain-evid-node-2': 4, 'cain-evid-node-3': 4, 'cain-evid-node-4': 4})"
      ],
      "verify": "curl -O https://cainstudio.online/proof/bundle/cluster-fault-test-2026-09-21-run2/bundle.json && curl -o verify_cluster_evidence.py https://cainstudio.online/proof/bundle/cluster-fault-test-2026-09-21-run2/verify_cluster_evidence.py.txt && python3 verify_cluster_evidence.py bundle.json",
      "what": "PBFT n=4,f=1 twin cluster: commit with 4, with 3 after a crash, no commit with 2 crashed, restart behaviour"
    },
    {
      "bundle_root": "3bffe4a481e22d502600beec8b8b7a36ae96986383003389a2d1bd831e1232a2",
      "id": "live-multi-host-cluster-public-probe",
      "note": "a verdict of NOT_ESTABLISHED for the deployed cluster is a real, current finding; it is independent of the twin-cluster fault test above, which exercises the same image on one host",
      "site_verdicts": {
        "cainstudio.online": "NOT_ESTABLISHED",
        "clawx.click": "NOT_ESTABLISHED",
        "mcpgate.online": "NOT_ESTABLISHED"
      },
      "verify": "curl -sO https://cainstudio.online/proof/bundle/byzantine-cluster-2026-09-21/verify_cluster_bundle.py.txt && mv verify_cluster_bundle.py.txt verify_cluster_bundle.py && python3 verify_cluster_bundle.py https://cainstudio.online/proof/bundle/byzantine-cluster-2026-09-21/ --live",
      "what": "read-only probe of the deployed multi-host cluster through the public sites, with computed verdicts (published by a separate run of this work; bundle_root and verdicts are read from its own manifest)"
    },
    {
      "id": "live-cluster-read-only",
      "runs_on": "the host only",
      "verify": "python3 verify_cluster_evidence.py --node http://127.0.0.1:18421 --node http://127.0.0.1:18422 --node http://127.0.0.1:18423 --node http://127.0.0.1:18424",
      "what": "signed state proofs of the four live test-cluster nodes (ports 18421-18424 on the host; not publicly exposed)"
    },
    {
      "audit": {
        "cainstudio.online": "https://cainstudio.online/proof/bundle/cluster-fault-test-2026-09-21-run2/legacy-cluster-claim-audit.json",
        "clawx.click": "https://clawx.click/evidence/cluster-fault-test-2026-09-21-run2/legacy-cluster-claim-audit.json",
        "mcpgate.online": "https://mcpgate.online/proof/bundle/cluster-fault-test-2026-09-21-run2/legacy-cluster-claim-audit.json"
      },
      "id": "legacy-cluster-claim-audit",
      "problems": [
        "reachable nodes report a quorum below the 3 the file claims (2 of 4 is not Byzantine tolerant)",
        "not every listed node exposes a PBFT engine endpoint",
        "none of the claimed invariants carries any attached evidence"
      ],
      "verdict": "CLAIMS_NOT_SUPPORTED_BY_LIVE_OBSERVATION",
      "what": "audit of the older public file cain_cluster_4node_bft_evidence.json against what its endpoints report"
    },
    {
      "bundle": {
        "cainstudio.online": "https://cainstudio.online/proof/bundle/bft-multiprocess-2026-09-21/REPRODUCE.txt",
        "clawx.click": "https://clawx.click/evidence/bft-multiprocess-2026-09-21/REPRODUCE.txt",
        "mcpgate.online": "https://mcpgate.online/proof/bundle/bft-multiprocess-2026-09-21/REPRODUCE.txt"
      },
      "does_not_prove": "independent failure domains, partitions, view change; ran the CAIN 23.0 test node service, not the production PBFT engine",
      "expected": "\"overall\": \"ALL_VERIFIED_WITH_LIMITATIONS\"",
      "id": "bft-multiprocess-runs",
      "verify": "see REPRODUCE.txt: python3 verify_bft_evidence.py runs",
      "what": "7 multi-process 4-node runs (honest, wrong commitment, equivocation, forged votes, crash 1, crash 2, pre-fix crash) with raw signed messages; equivocation and deviation are derived as cryptographic proofs"
    }
  ],
  "schema": "cain42.ai_verify_entrypoint.v1",
  "status": "PRE-PRODUCTION"
}