CAIN-42 · E51 · universal governance

Keep your framework. Keep your model. Keep one security contract.

Agents propose actions. CAIN decides. The boundary enforces. Systems execute. Evidence remembers. The same policy, identity, approval and evidence path works across six framework tool-call shapes and any model provider — because the adapter normalizes the call and the runtime does the rest.

framework adapters

13/13

contract cases per adapter

78/78

conformance cases passed

cross-provider demo rows, one contract

unauthorized effects in the governed path

The contract

native tool call
  -> normalize            (strict, versioned GovernanceRequest)
  -> authenticate         (ASSERTED is not authenticated)
  -> authorize            (policy + delegation attenuation)
  -> approve when HIGH    (bound to exact parameters, single use)
  -> enforce              (single-use capability, verify + consume)
  -> execute              (only through the runtime)
  -> observe              (independent before/after snapshot)

Framework matrix

Framework	Native shape	Contract	Live framework
OpenClaw	action.tool / input	13/13	not tested here
LangGraph	{name, args, id}	13/13	not tested here
CrewAI	tool / tool_input	13/13	not tested here
AutoGen	function call	13/13	not tested here
OpenAI	function / responses tool call	13/13	no credentials
Anthropic	tool_use input	13/13	no credentials

No fake integration claims. The frameworks are not installed in this environment, so every adapter reports live_framework_tested=false. What is tested is normalization, identity, policy, approval, capability enforcement and consequence observation for each native shape.

Try it

curl -LO https://cainstudio.online/open-source/downloads/cain42-open-core-0.1.2.tar.gz
tar xzf cain42-open-core-0.1.2.tar.gz && cd cain42-open-core-0.1.2
pip install cryptography httpx pytest

python3 -c "from cain.governance.conformance import run_all; print(run_all()['summary'])"
python3 -c "from cain.governance.demo import run_demo; d=run_demo(); print(d['security_contract_identical'])"
python3 -m pytest tests/test_evolution51_adapters.py -q

What is honest

A native tool call that skips the adapter cannot be stopped by the adapter. That bypass is measured and reported.
Streaming, cancellation and provider-hosted execution control are not implemented; they are declared unsupported.
Session auth is HMAC, approver identity is a string, and no third-party audit exists.

← open core · E50 adversarial lab · claims