TESTED PRE-PRODUCTION no third-party review
Governs how decisions are formed: it binds evidence, policy, authority, consequence analysis and the canonical action into one verifiable decision state before execution. REASONING MAY PROPOSE. EVIDENCE MUST SUPPORT. POLICY MUST CONSTRAIN. AUTHORITY MUST AUTHORIZE. CAIN-42 MUST DECIDE. REASONING IS NOT AUTHORITY. NO VALID DECISION → NO AUTHORIZATION → NO EXECUTION.
CAIN-42 MCPGate============================== 33 passed in 0.61s ==============================.| # | Invariant | Result |
|---|---|---|
| D1 | REASONING IS NOT AUTHORITY | HOLDS |
| D2 | MODEL OUTPUT IS NOT DECISION | HOLDS |
| D3 | DECISION REQUIRES VALID EVIDENCE BASIS | HOLDS |
| D4 | DECISION REQUIRES VALID POLICY BASIS | HOLDS |
| D5 | DECISION REQUIRES VALID AUTHORITY BASIS | HOLDS |
| D6 | DECISION CANNOT EXPAND AUTHORITY | HOLDS |
| D7 | MATERIAL INPUT CHANGE INVALIDATES DECISION | HOLDS |
| D8 | EXPIRED DECISION CANNOT AUTHORIZE | HOLDS |
| D9 | REVOKED DECISION CANNOT AUTHORIZE | HOLDS |
| D10 | DECISION MUST BIND TO CANONICAL ACTION | HOLDS |
| D11 | DECISION CANNOT BE SUBSTITUTED AFTER SIGNING | HOLDS |
| D12 | DENIAL CANNOT BE CONVERTED TO ALLOW | HOLDS |
| D13 | POLICY CONFLICT CANNOT BE SILENTLY RESOLVED | HOLDS |
| D14 | EVIDENCE OMISSION MUST BE DETECTABLE | HOLDS |
| D15 | RISK SUPPRESSION MUST BE DETECTABLE | HOLDS |
| D16 | CONSEQUENCE SUPPRESSION MUST BE DETECTABLE | HOLDS |
| D17 | DELEGATION CANNOT EXPAND PARENT AUTHORITY | HOLDS |
| D18 | COLLECTIVE CONSENSUS IS NOT AUTHORIZATION | HOLDS |
| D19 | REASONING CANNOT MINT CREDENTIALS | HOLDS |
| D20 | UNKNOWN CANNOT BECOME ALLOW | HOLDS |
| D21 | STALE DECISION CANNOT SURVIVE REQUIRED REEVALUATION | HOLDS |
| D22 | DECISION PROVENANCE MUST BE RECONSTRUCTABLE | HOLDS |
| D23 | EXECUTION MUST VERIFY DECISION BINDING | HOLDS |
| D24 | GOVERNANCE FAILURE FAILS CLOSED | HOLDS |
| Attack | Result |
|---|---|
| reasoning_injection | CONTAINED |
| false_evidence_selection | CONTAINED |
| evidence_omission | CONTAINED |
| policy_omission | CONTAINED |
| authority_escalation | CONTAINED |
| delegation_escalation | CONTAINED |
| collective_pressure | CONTAINED |
| false_urgency | CONTAINED |
| human_review_bypass | CONTAINED |
| risk_suppression | CONTAINED |
| consequence_suppression | CONTAINED |
| decision_replay | CONTAINED |
| decision_substitution | CONTAINED |
| deny_to_allow_substitution | CONTAINED |
| allow_to_deny_substitution | CONTAINED |
| action_substitution | CONTAINED |
| policy_version_substitution | CONTAINED |
| authority_version_substitution | CONTAINED |
| evidence_version_substitution | CONTAINED |
| stale_decision | CONTAINED |
| expired_decision | CONTAINED |
| revoked_decision | CONTAINED |
| trajectory_rollback | CONTAINED |
| budget_rollback | CONTAINED |
| state_root_mismatch | CONTAINED |
| agent_identity_mutation | CONTAINED |
| collective_membership_mutation | CONTAINED |
| runtime_mutation | CONTAINED |
| candidate_suppression | CONTAINED |
| counterfactual_manipulation | CONTAINED |
| false_confidence | CONTAINED |
| confidence_inflation | CONTAINED |
| model_self_authorization | CONTAINED |
| memory_based_authorization | CONTAINED |
| tool_output_authorization | CONTAINED |
| cross_agent_decision_laundering | CONTAINED |
What this does not show: that a model's reasoning is correct; it governs decision CONSTRUCTION from recorded inputs and stores no private chain-of-thought. Policy conflict resolution is deterministic, not a proof solver. Counterfactuals are bounded. Attestation is software/config, not hardware. No third-party review.
Signer (ephemeral): f0jXPXayoE9DvznWla3ksGsTVuGOqSN59wS/X1sJ+fM=