jcp: let an action receipt name the attested environment it was recorded in #73
Loading…
Reference in a new issue
No description provided.
Delete branch "jcp/environment-binding"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
A JCP receipt proves that this steward decided this, and signed it. It says nothing about the machine the steward was running on.
Sandbox roots a separate chain in hardware — measured boot, TEE quote, append-only audit head — and the two chains never referred to each other:
Both halves were built and neither named the other, so a compromised harness could emit a perfectly valid, perfectly verifiable chain of decisions.
EnvironmentBindingis the reference from the action chain to the attested one: the attestation's content address, plus the tier it claims so a mismatch against the resolved attestation is detectable without resolving it first.It is a pointer, not evidence
The docs say that in those words, because it is the whole distinction. A host that will misreport a decision can equally name an attestation it did not earn. The binding is worth something only once a verifier resolves the id, checks it verifies under a Supervisor key it trusts, and confirms it covers this host and this window — all of which is
sandbox-attest's work.This crate takes no dependency on
sandbox-attestand performs no resolution, deliberately.environment_ofreturningSomemeans "the host named something to go and check", never "attested". A test pins that an id resolving to nothing at all is still structurally accepted here, so nobody mistakes acceptance for appraisal.Compatibility, proven
Absent, the field is omitted and
to_jcr1_wire_in_environment(.., None)is byte-for-byte the historical wire — asserted by equality againstto_jcr1_wire, not described. Re-runninggen-vectorsleft every tracked vector unchanged.A malformed binding reads as absent rather than as a partial claim: a tier with no attestation id names nothing, and an unparseable id is not a claim.
Provenance of the finding
Surfaced by the 2026-08-29 sweep inside its refutation of the IETF agent audit-trail draft. The draft's own framing — "a compromised harness can emit a valid chain" — was the one part that survived contact with the code, and it described a hole TX had both halves for.
Verification
264 jcp-rs tests pass (4 new) · conformance passes all classes · tracked vectors unchanged after regeneration · no clippy warnings in
jcp-receipt.A JCP receipt proves that this steward decided this, and signed it. It says nothing about the machine the steward was running on. Sandbox roots a separate chain in hardware — measured boot, TEE quote, append-only audit head — and the two chains never referred to each other: `grep attestation` returned zero matches in `jcp-receipt` and `joule-ui-interaction`. Both halves were built and neither named the other, so a compromised harness could emit a perfectly valid, perfectly verifiable chain of decisions. `EnvironmentBinding` is the reference from the action chain to the attested one: the attestation's content address, plus the tier it claims so a mismatch against the resolved attestation is detectable without resolving it first. **It is a pointer, not evidence, and the docs say so in those words.** A host that will misreport a decision can equally name an attestation it did not earn. The binding is worth something only once a verifier resolves that id, checks it verifies under a Supervisor key it trusts, and confirms it covers this host and this window — all of which is `sandbox-attest`'s work. This crate takes no dependency on it and performs no resolution, deliberately: a `Some` from `environment_of` means "the host named something to go and check", never "attested". A test pins that an id resolving to nothing at all is still structurally accepted here, so nobody mistakes acceptance for appraisal. Absent, the field is omitted and `to_jcr1_wire_in_environment(.., None)` is byte-for-byte the historical wire — asserted by equality against `to_jcr1_wire`, not described. Re-running `gen-vectors` left every tracked vector unchanged. A malformed binding reads as absent rather than as a partial claim: a tier with no attestation id names nothing, and an unparseable id is not a claim. Surfaced by the 2026-08-29 sweep, inside its refutation of the IETF agent audit-trail draft — the draft's own framing ("a compromised harness can emit a valid chain") was the one part of it that survived contact with the code, and it described a hole TX had both halves for. Verified: 264 jcp-rs tests pass (4 new), conformance passes all classes, tracked vectors unchanged after regeneration, no clippy warnings in jcp-receipt.