| Filename | Latest commit message | Latest commit date |
|---|---|---|
41dcdb9484
All checks were successful
no-vanity-metrics / Scan committed Markdown for vanity metrics (pull_request) Successful in 3s
The previous commit made the sealed tier true. It did not make it checkable. Below S6 the standard requires no evidence at all — §7.5 says so outright, and `validate_structure` enforces evidence only at S6 (TEE) and S7 (locality) — so `tier = "S2"` is the host's word with a signature around it, and the honest `S0` the last commit produced is equally just the host's word. §7.9 adds an optional `mechanism`: the enforcement runtime (name AND version) plus a commitment to the policy profile applied and the egress allowlist installed. An attestation carrying one is `sandbox.attestation/2`; without one it stays `/1` and canonicalizes to byte-identical JSON, so every attestation sealed before this section — and every published vector — verifies unchanged. That is the same add-field/bump-profile/dispatch shape used for `payload_hash`. What this is careful not to claim: a mechanism is NOT proof of isolation, and both the SPEC text and the type docs say so. A host willing to misstate its tier can misstate its profile; a commitment made by the party under scrutiny cannot bootstrap its own trustworthiness. What changes is the shape of the claim — an unadorned tier label is unfalsifiable, while a profile_id is checkable against a known-good profile a relying party already trusts, and a false one is a specific, attributable lie about a named artifact. A party that needs proof rather than assertion still requires S6+. Design notes: - The commitment length-prefixes each field rather than concatenating them. Bare concatenation is not injective: "seatbelt/14" + "5;deny-net" and "seatbelt/145" + ";deny-net" would collide. C11 asserts they no longer do. - Requiring a mechanism is a *relying-party* check, not a producer obligation. Making it mandatory would retroactively invalidate every honest attestation sealed before §7.9, and a standard does not get to make historical records non-conformant. It lives in `require_mechanism_evidence()`, the same posture §7.5 already takes for isolation proof. - A mechanism at S0 is rejected, not ignored. S0 is unconfined; describing a boundary that does not exist is incoherent rather than merely redundant. - `Executor::mechanism()` defaults to `None` — as with `attained_tier()`, the component that did the work is the one that gets to describe it, and silence beats invention. `run_and_seal` takes it from the executor; the bare `seal_run` primitive keeps its old signature and passes `None`. - `WasmExecutor` is a real producer, so the field is not decorative: it commits to fuel metering, the fuel budget and the memory cap — deliberately NOT `uj_per_million_fuel`, an accounting coefficient that confines nothing and would make two identically-confined runs disagree when someone retunes it. - wasmtime exposes no version constant and Cargo gives no compile-time access to a dependency's resolved version, so `WASMTIME_VERSION` is hand-maintained and a test fails the build if it drifts from Cargo.lock. A stale value would attest confinement to a runtime that did not run. Verified: 194 workspace tests pass, conformance passes with no skips across all 11 classes. C4 attestation.json — a published vector — still passes untouched, which is the backward-compatibility claim holding in practice rather than in argument. |
||
| .. | ||
| attestation.md | ||
| build.md | ||
| capabilities.md | ||
| conformance.md | ||
| durable-runs.md | ||
| eat.md | ||
| environment-manifest.md | ||
| mcp.md | ||
| receipts.md | ||
| tiers.md | ||