jcp: let an action receipt name the attested environment it was recorded in #73

Merged

dcharlot merged 1 commit from jcp/environment-binding into main 2026-09-03 15:11:38 -04:00

Conversation 0 Commits 1 Files changed 1 +156 -1

2026-08-30

David Charlot

jcp: let an action receipt name the attested environment it was recorded in ...

A JCP receipt proves that this steward decided this, and signed it. It says
nothing about the machine the steward was running on. Sandbox roots a separate
chain in hardware — measured boot, TEE quote, append-only audit head — and the
two chains never referred to each other: `grep attestation` returned zero
matches in `jcp-receipt` and `joule-ui-interaction`. Both halves were built and
neither named the other, so a compromised harness could emit a perfectly valid,
perfectly verifiable chain of decisions.

`EnvironmentBinding` is the reference from the action chain to the attested one:
the attestation's content address, plus the tier it claims so a mismatch against
the resolved attestation is detectable without resolving it first.

**It is a pointer, not evidence, and the docs say so in those words.** A host
that will misreport a decision can equally name an attestation it did not earn.
The binding is worth something only once a verifier resolves that id, checks it
verifies under a Supervisor key it trusts, and confirms it covers this host and
this window — all of which is `sandbox-attest`'s work. This crate takes no
dependency on it and performs no resolution, deliberately: a `Some` from
`environment_of` means "the host named something to go and check", never
"attested". A test pins that an id resolving to nothing at all is still
structurally accepted here, so nobody mistakes acceptance for appraisal.

Absent, the field is omitted and `to_jcr1_wire_in_environment(.., None)` is
byte-for-byte the historical wire — asserted by equality against `to_jcr1_wire`,
not described. Re-running `gen-vectors` left every tracked vector unchanged.

A malformed binding reads as absent rather than as a partial claim: a tier with
no attestation id names nothing, and an unparseable id is not a claim.

Surfaced by the 2026-08-29 sweep, inside its refutation of the IETF agent
audit-trail draft — the draft's own framing ("a compromised harness can emit a
valid chain") was the one part of it that survived contact with the code, and it
described a hole TX had both halves for.

Verified: 264 jcp-rs tests pass (4 new), conformance passes all classes, tracked
vectors unchanged after regeneration, no clippy warnings in jcp-receipt.

ad2a41249f

• View at this point in history

2026-08-30 17:25:07 -04:00