# Security This standard is built from proven primitives, composed in one new way. The primitives are not re-litigated here; the composition and its boundaries are. ## Primitives - **Content addressing** — BLAKE3-256 over deterministic CBOR (SPEC §3–§4). Identity is the hash of the canonical bytes; a changed artifact is a changed id. - **Sealed receipts** — JCR-1 (det-CBOR + COSE/EdDSA), the family's signed-receipt format (SPEC §6). - **Attestation** — Ed25519 over the JCS-canonical form (SPEC §7), the same primitive as ARL-S, so the two interoperate. - **Confidential evidence** — AMD SEV-SNP report verification: ECDSA-P384/SHA-384 against a VCEK chained to the AMD root (SPEC §7.6, `sandbox-tee`). Verification is hardware-independent and complete; generation requires the CPU security processor, and the reference says so rather than faking it. - **Deny-by-default capabilities** — every resource a unit may touch is named by an explicit grant; anything unnamed is denied (SPEC §5). The reference proves these run and self-attest across substrates, operating systems, clouds, and accelerator classes — each cell of `proof/matrix.jsonl` is a signature over a real run referencing an attestation that itself verifies. A host records what it cannot prove as *unavailable*, never as passed. ## The composition: isolation across a heterogeneous fabric The new part is making the unit of isolation a **heterogeneous unit of work** across CPU/GPU/NPU/TPU/photonic/quantum, with the accelerator a first-class metered and attested line item rather than an opaque passthrough. The isolation ladder (S0–S7) runs a unit at the **lowest tier its grants require**; escalation is the escape hatch, not the default. ## Shared-resource side channels Logical isolation separates memory and code. It does **not** partition the *physical* resources a tier shares — and a shared resource is a channel. At S0–S2 the host kernel and device I/O paths are shared, so co-tenants can observe one another through **contention**, with no privileged access on either side. ### Worked example — storage-contention fingerprinting (FROST) A current, well-credentialed instance is **FROST** (*Fingerprinting Remotely using OPFS-based SSD Timing*, Weissteiner et al., Graz University of Technology / Liebherr-Transportation Systems, 2026; disclosed to Google, Mozilla, Apple). A page in an ordinary browser sandbox writes an oversized file through the Origin Private File System — large enough to exceed the OS page cache — then times continuous random 4 KiB reads. Every read hits the physical SSD; when other tabs or applications do their own I/O, the contention shows up as latency spikes the page reads off from JavaScript, fingerprinting active sites and applications (~89%/~96% reported) with no permission prompt and no exploit. It breaks no logical boundary; it rides a physical one the sandbox never partitioned. This is the general shape, not a storage-only quirk: any tier that shares a device shares a contention channel through it. ### What the standard does about it The standard does not claim to abolish physical channels. It gives the structure to **reason about, bound, and price** them, with two levers and one inversion: 1. **Bound it — capability (I/O ceiling).** A `StorageGrant` may carry sustained-I/O ceilings (`max_iops`, `max_read_bps`; SPEC §5.2). Deny-by-default extends from *which* I/O to *how much*: a unit whose rate is capped cannot drive the high-rate random-read storm a contention channel needs. Enforced in `sandbox-capability` (`Enforcer::may_sustain_io`), bound into `grants_content_id`, and attested — so the ceiling a run claimed is part of its signed record. 2. **Close it — tier partitioning.** Where throttling is not enough, the floor rises: **S3** partitions device I/O so contention no longer crosses the boundary; **S5** (direct device assignment) removes the shared device entirely. Tier minimization is **side-channel-aware** (SPEC §2.4): a workload sensitive to — or, as an untrusted neighbor, capable of — cross-tenant leakage has its floor raised, by the ceiling lever held at S2 or by partitioning at S3+. 3. **Price it — measurement (the inversion).** The same physics, **measured cooperatively by the host and disclosed**, is honest telemetry for a resource the platform otherwise cannot meter. `sandbox-meter::StorageActivity` reports observed `iops`/`bytes`/`contention_ns` and a model-based energy figure. It is a distinct axis (never folded into a compute device class) and **never `HwShunt`** — a timing channel is not a hardware shunt, and the provenance discipline (SPEC §6.3) is enforced for it. What leaks information undisclosed becomes auditable joules disclosed. ## Provenance honesty Every energy figure carries a provenance tag — `HwShunt` (measured at a hardware interface for that class), `ModelBased` (a model calibrated on the host), or `Estimator` (a coarse constant, or a nominal coefficient no host calibrated) — and the (provenance, measured) coupling is enforced (SPEC §6.3, vector class C3). The standard's claim is that the figure is **reported and honestly tagged**, never that an estimate is a measurement. Remote silicon a prover does not own is metered by token-level `Estimator`, not dressed as measured; a contention probe's figure is an `Estimator`, not a shunt. ## Reporting Security issues in the reference implementation: open an issue at , or contact security@transaction.science. This document covers the standard and its reference; it is not a deployment's security posture, which depends on the host, the tiers it advertises, and the grants it issues.