# Thirteen new LinkedIn products — live evidence, 2026-10-30

**Start here: [index.html](index.html) — the rendered proof page (14/14 routes, 13/13 cards).**

These are the developer's own checks, not an independent audit. The cases were written on 2026-10-30 for
this pass. `run.json` is the output of `python3 verify_new13.py --json run.json` against
**https://cainstudio.online**: **14/14 passed** (13 products; EU AI Act and ISO 42001 are counted
separately because the product exposes both). The hub's own card functions were run separately:
**13/13 cards** produced the outcome each one declares (`cards-run.txt`).

| File | What it is |
|---|---|
| `index.html` | the rendered proof page (this is what the evidence link opens) |
| `run.json` | `python3 verify_new13.py --json run.json` against cainstudio.online, 14/14 |
| `verify_new13.py` | the route verifier, standard library only |
| `check_cards.js` | runs the 13 cards through the hub's own `read()` functions, 13/13 |
| `cards-run.txt` | the card run's output |
| `REPRODUCE.txt` | the three commands, and what a pass does not mean |

| Product | Route | What the live run showed |
|---|---|---|
| MCP Attestor | `/mcp-attestor/scan` | poisoned description → grade **STUB, 4 HIGH**; live probe → **NOT_VERIFIED** (fail-closed) |
| Payment Mandate Guard | `/api/v1/payment-mandate-guard/run` | `walmart-deals.shop` → **DENY (LOOKALIKE_MERCHANT)**; `walmart.com` → **ALLOW** |
| Browser Agent Firewall | `/api/v1/browser-agent-firewall/run` | hidden Reddit comment → **HIJACK_STOPPED**, steps 2 and 4 blocked |
| Agent Autonomy Lease | `/api/v1/autonomy-guards/autonomy-lease/run` | self-signed level-5 lease → **DENY (SELF_ISSUED_LEASE)**; human lease → ALLOW |
| Self-Modification Firewall | `/api/v1/autonomy-guards/self-modification/run` | `shutdown.sh` edit → **DENY (SHUTDOWN_TAMPER)**; approved read → ALLOW |
| Data-Exfiltration Killswitch | `/api/v1/mcpgate/killswitch/simulate-exfiltration` | 50 MB burst → **tripped in 0.089 ms**, lines severed, signed receipt |
| Memory Authority Firewall | `/api/v1/memory-firewall/verify-drill` | forged reasoning → **TAINTED_FORGED_REASONING**, **5/5** checks |
| Swarm Collusion Defense | `/api/v1/swarm-collusion/verify-drill` | A→B→C→A → **BLOCKED_AUTHORITY_CYCLE**, signed |
| Capability Lease | `/fabric/caplease/issue` → `prepare-delegation` → `spend` | child asks for `wire_transfer` → **HTTP 403**; `read` → allowed; spend debits |
| ARGUS Behavioral Envelope | `/fabric/argus/envelope/evaluate` | path outside a LOW envelope → **VIOLATION** (tool + cumulative amount) |
| ATLAS Transaction Assurance | `/fabric/atlas/transaction/evaluate` | cross-org wire outside authority → **DENY**, 5 named problems |
| PQC Hybrid Signing | `/fabric/pqc/sign-hybrid` + `/verify-hybrid` | Ed25519 + **ML-DSA-65** verifies; tampered amount → **valid=false** |
| EU AI Act / ISO 42001 Evidence Notary | `/fabric/statutory/eu-ai-act/audit` + `/iso42001/audit` | **5/5** EU AI Act clauses; **7/7** ISO 42001 clauses |

## Reproduce

```bash
python3 verify_new13.py --json run.json     # 14/14 route checks
node check_cards.js                         # 13/13 cards through the hub's own read() functions
sha256sum -c SHA256SUMS
```

`verify_new13.py` uses the standard library only. `check_cards.js` uses Node 18+ (built-in `fetch`) and
reads `../../linkedin-products.js`, so it tests the same payloads the hub renders. Both exit non-zero if
any product stops failing closed or any card stops producing the outcome it declares.

**MCP Attestor rate limit:** the live probe is capped at 60/hour per IP. If our own repeated runs exhaust
it, the verifier passes on the static scan and says `live probe rate-limited (60/h); static scan is the
evidence`. The earlier 2026-10-30 run captured the probe's `NOT_VERIFIED` (see this README's table); the
`run.json` in this bundle is the later run and records the cap.

## Limits (do not oversell)

- **Same-project checks only.** No third party has reviewed these products; no customer runs them.
- A pass means the product failed closed on the input shown. It does not prove the product is safe or
  complete.
- **MCP Attestor:** the static scan is heuristic; the live probe only runs curated samples today, not an
  arbitrary customer URL. `NOT_VERIFIED` means "could not prove", never "safe".
- **Payment Mandate Guard:** not a certified AP2 / Visa TAP / Mastercard Agent Pay / ACP / x402
  implementation; it judges the cart the agent presents, not what the merchant ships later.
- **Browser Agent Firewall:** sees only what the runtime reports; no browser vendor integration.
- **Autonomy Lease / Self-Modification:** simulated scenarios; not a stage in the MCPGate proxy; the tool
  adapter must report cost and irreversibility honestly.
- **Killswitch:** the public demo runs on an isolated killswitch (`link_quarantine=False`), so
  `quarantine_enacted` is false; it never touches production; the 0.089 ms is an in-process measurement.
- **Memory Authority Firewall:** a drill against a fresh reference world; separate from MemGuard, which is
  still held.
- **Swarm Collusion:** simulated authority graph; no LangGraph/CrewAI/AutoGen adapter yet.
- **Capability Lease:** the public demo writes leases to the live SQLite store and is not tenant-isolated
  for walk-up visitors; do not put secrets in it.
- **ARGUS:** evaluates an envelope against a path you supply; it does not bind a customer's downstream
  execution; state is replayed per call, not durable.
- **ATLAS:** deterministic evaluation only; there is no live cross-org counterparty in this demo.
- **PQC:** software keys; no HSM, no FIPS 140 validation; one keypair, not a full crypto inventory.
- **Statutory notary:** the route's own string `AUDIT_CERTIFIED_FULL_CONFORMANCE` is CAIN's self-mapped
  control report, **not a certification, not a notified-body assessment, not legal advice**.

Every verdict is the reply of the live engine at the time you run it. Your run is the evidence; this
folder is our record of ours.