Live engine

48-hour delivery

PROOFLOOP. Any AI can write the fix. We prove it.

Anyone can call a frontier model. Almost nobody can prove what it did.

FALSEWORK finds the code that looks finished but fakes its result. KEYSTONE fixes it and proves the fix with a test the model did not write. CAIN-42 notarizes the record on a four-replica Byzantine cluster. You get one signed artifact you can re-check offline, without us.

Pay $500 — PROOFLOOP pilot Need a whole repo? $1,500 Verify PROOFLOOP first

$500 · 48 hours · one Python module. After payment you land on a private upload page: send the file and one sentence about the defect, and FALSEWORK's findings appear on your order page in seconds. Lost the page? Open cainstudio.online/loop-paid.html and use your checkout email. If we cannot produce a signed, proved fix, the pilot is refunded in full. The $1,500 audit covers a whole repository.

Six stages. Each one removes a way to cheat.

This is the whole differentiator. Not the model, not the dashboard, not the scanner. The closing loop: a deterministic verdict, an independent proof, a signature, a quorum, and an export the buyer can run without us.

14 scenes · about 15 minutes

Watch PROOFLOOP explained, end to end

A long, captioned walkthrough of the whole loop: the fabricated result, the diff that proves nothing, the independent test, the signature, the quorum, the export, and the honest limits. The presenter is an animated character, not a real person. The visuals and captions start on their own; browsers block sound until you interact, so one tap turns the voice on.

Prefer to read? The six stages are below, each linked to the live artifact that proves it. Or skip to the three commands.

DETECT — FALSEWORK

A deterministic detector, not a model, decides there is a defect. AST and rule checks find fabricated metrics, success verdicts that are given rather than established, checks that can never fail, route-to-engine mismatches, and shipped mocks. No model client, no network in the detector.

Engine and method → Sample report →

ACT — the fixer

A frontier model or a human/CI actor writes the fix. The file is passed as data, not instructions. The record names which actor did it, so you can swap the model without changing the guarantee.

How the actor is bound →

PROVE — the independent test

A reference test the fixer did not write must fail on the original file and pass on the fixed file, inside bubblewrap: no network, read-only system, 256 MB, 20 seconds. A same-lab, unknown-lab, self-authored or undeclared test is refused as independent.

What the run proves → Exactly what each proof covers →

SIGN — canonical JSON, SHA-256, Ed25519

The finding, the diff, the test, the hashes and the verdict become one canonical record, hashed, chained to the previous record, and signed. All checks hold → VERIFIED_FIX. Anything short of one → NOT_VERIFIED, with the reasons.

Live ledger and verdicts → Verify the whole chain now →

ANCHOR — the quorum

The record hash is ordered and committed by a live four-replica Byzantine cluster: four US regions, one faulty replica tolerated, quorum three of four. The replicas sign their own votes and the receipt ships inside the bundle. Consensus notarizes; it never authorizes.

Live cluster status → How the receipt verifies →

EXPORT — the verifier

A ZIP with the signed record, the reviewer evidence, the issuer key and a standalone verifier that imports no CAIN code. The published sample is a live model-backed VERIFIED_FIX (Claude Opus 5.5, independent acceptance test), notarized on cain-mr-02 at sequence 1526491. Pin the key yourself. Change one byte and it prints TAMPERED OR INVALID.

Download the anchored sample → Verify it on your machine →

Why PROOFLOOP, and not a diff

The typical approach

The model writes the fix and a test that agrees with it.
A failed fix can still look like a fix.
You verify by trusting the vendor.
A passing test is the end of the story.
The evidence is a PDF or a dashboard.

This loop

The reference test is independent and must fail on the old code first.
Short of every check → NOT_VERIFIED, with reasons.
You pin a key and re-check offline.
Detector re-scan + fix-safety guard + hash chain + quorum receipt.
The evidence is a signed record with a standalone verifier.

We are not claiming that no one else anywhere does something like this. We are claiming that ours does it today, and that you can falsify our output without our permission. That is a narrower claim, and it is the only one worth making.

Don't believe this page. Run it.

Four commands for the signed record, three more for the quorum receipt. A machine you control. No account, no key from us.

curl -s -o bundle.zip https://cainstudio.online/evidence/keystone-live-2026-11-05/keystone-evidence-ks-20261105T225548Z-4f35c76d.zip
unzip -o bundle.zip -d ks
KEY=$(curl -s https://cainstudio.online/keystone/public-key | python3 -c 'import json,sys; print(json.load(sys.stdin)["public_key_b64"])')
cd ks && python3 verify_keystone.py --pinned-pub "$KEY"

Expected: RESULT: ALL RECORDS VALID and the fingerprint SHA256:2232b4add9b35d4016e5be270df4ed56e0dc9b39a0530ac69891073253aae90d. Change one byte and the same command prints TAMPERED OR INVALID. The verifier refuses to run without a pinned key, because a key that ships inside the ZIP proves nothing.

Then check that the four-replica cluster notarized this exact record (the --digest is the record's record_hash):

curl -s -O https://cainstudio.online/verify_qaas_receipt.py -O https://cainstudio.online/verify_pbft_qc_bundle.py
PIN=$(curl -s 'https://cainstudio.online/api/v1/live-cluster/membership?cluster=cain-mr-02' | python3 -c 'import json,sys; print(json.load(sys.stdin)["configuration_hash"])')
python3 verify_qaas_receipt.py quorum-receipt.json --pin "$PIN" --digest 171e88f4ee9cf58ca0d42a3eb28423d689a3858bde07f0254e584fa3f1fcd3ff

Expected: fourteen [PASS] lines and NOTARIZED. Change the digest by one character and it prints NOT_VERIFIED. Paid deliveries ship both receipt verifiers and a VERIFY.md with these steps already filled in.

Issuer public key · All CAIN-42 public keys

One module for $500. One repo for $1,500. PROOFLOOP either way.

$500PROOFLOOP pilot · one Python module, 48 hours

FALSEWORK scan, one finding fixed and proved with an independent reference test, signed record, quorum receipt when the operator key is configured, and the standalone verifier. If we cannot produce a signed, proved fix, the pilot is refunded in full.

$1,500Fabrication Audit · one Python repo, up to 5,000 files

Graded report, findings JSON, signed evidence ZIP, standalone verifier, 30-minute walkthrough. 48 hours from access.

$3,500 / $6,000Deep / diligence-grade

Larger scope, tests included, or a pre-raise/multi-repo review. 5–10 business days.

Pay the $500 pilot now: Stripe checkout. The receipt says CAIN-42 PROOFLOOP pilot. You then upload the file on your private intake page (your checkout email finds your payment) and follow every stage on your own order page. The 48-hour clock starts when we have your file and an agreed test.

Want the $1,500 audit instead? Reserve it with a $750 deposit; the $750 balance is invoiced on delivery. Prefer to send scope first? Send the repo size and deadline. If the bundle does not verify on your machine with the pinned key, the balance is not billed.

Fix + Prove attaches to any audit: $500 small, $1,500 standard, $2,500 complex. You supply one acceptance test that should fail today and pass when the finding is closed. We supply the patch and the signed record naming you as the test author. If the proof does not hold, the verdict is NOT_VERIFIED and the balance is not billed.

Included in every verified record: the record hash is notarized on the live four-replica CAIN-42 cluster when the operator key is configured. The anchored sample above includes its quorum receipt.

Reserve — $750 deposit Pay in full — $1,500 Book 20 minutes DM on LinkedIn

50% deposit, 50% on delivery. If the bundle does not verify on your machine with the pinned key, the balance is not billed. If we miss the turnaround, the deposit is refunded and you keep what was produced.

Exactly what you get

Precise, signed, and checkable without us

Each proof covers one finding, one independent test and the exact code we ran, so you know precisely what was proved.
FALSEWORK is deterministic: the same code gives the same answer every time. A person reviews every finding before it reaches you.
Every delivery is run by our team, end to end. The signed ledger and the offline verifier are live today.
You get evidence you can check yourself, not a certificate you have to take on trust.
A 3-of-4 server quorum notarizes every record, so no single server can rewrite it. Notarizing records the result exactly as proved.

Built by

FIRME AI CORPORATION, a California corporation, built by a three-person team. We build the detector, the prover and the evidence chain ourselves.

No customer is named on this page. The sample is ours. Numbers marked "live" come from the routes linked above.