# Reproducing this bundle

Repository state: git `6776d7ade1994d70f8a0a1b251833b588f2b1b39`. The source repository is private; this bundle publishes outcomes (results, counts, defect descriptions and
regression-test names), not implementation. File paths, module names and source are withheld on purpose.

Test evidence: one pytest process per suite, run serially in an isolated copy of the tree (parallel or concurrent runs share on-disk stores and give false
failures). The suite list and results are in `test-run.txt`; the suites themselves are not published.

Validate a published copy with no CAIN code at all:

    curl -sO https://<site>/<bundle-path>/verify_bundle.py.txt && mv verify_bundle.py.txt verify_bundle.py
    python3 verify_bundle.py https://<site>/<bundle-path>/

## Limitations (read these)
* Self-attested: produced and signed by the same host that runs the system; not an independent audit.
* All three sites are one host: identical bytes on three domains prove consistency, not independent trust domains.
* The tests are ours. The verifier checks hashes, signature and internal consistency of the numbers; it does not re-run tests.
* Chaos ran 45 s with simulated network faults; not a soak test. Performance is one host, one process.
* 3 attack types have no handler because no real control exists to attack (COUNTERFACTUAL_MANIPULATION,
  CROSS_TENANT_EVIDENCE_ACCESS, FAKE_POSITIVE_EVIDENCE); they report INCONCLUSIVE, never blocked.
* The keyword-heuristic 'reality map' is deliberately NOT part of this bundle: two generators wrote the same path with
  conflicting statuses, and neither is proof of a capability.
* Status: PRE-PRODUCTION.