| Filename | Latest commit message | Latest commit date |
|---|---|---|
9ea6705110
All checks were successful
no-vanity-metrics / Scan committed Markdown for vanity metrics (pull_request) Successful in 5s
`Locality { region: String, jurisdiction: String }` — two free-text strings,
supplied by the party under audit, checked for presence and nothing else, at the
one tier whose entire purpose is jurisdictional. SPEC §7.7 already said a host
"MUST NOT seal an S7 run whose execution it cannot bind to the stated locality",
which was an obligation with no mechanism behind it. It is the weakest normative
claim in the ladder and the first thing a data-residency auditor attacks.
Round-trip time to an anchor of known position bounds distance: a signal cannot
outrun light, so `rtt/2 × c` is the farthest the host can be from that anchor.
The asymmetry is what makes it worth anything — **latency is trivial to add and
impossible to remove** — so a host can always appear farther away than it is and
never closer than physics permits.
What that buys is narrow, and the code is named for it. The evidence
**falsifies; it does not verify**:
- It can refute a claim. If the claimed position is farther from an anchor than
light could travel in the observed time, the claim is impossible, and that
conclusion does not rest on trusting anyone.
- It can never confirm one. Surviving every bound means "not excluded" and
nothing more: the feasible region is an intersection of discs that routinely
spans several jurisdictions. So the passing verdict is `NotRefuted`, there is
deliberately no `is_proven`, and §7.7 forbids reporting a surviving claim as
proven, verified, or attested.
Three rules that matter more than the arithmetic:
- **Only an independent anchor's signed observation counts.** A round-trip time
the host measured about itself is the same unchecked assertion as the region
string it was meant to improve on — now with a number attached. Unsigned
observations return `Unsubstantiated` rather than being blended in, and that
holds even when they would *refute*: the rule is about provenance, not about
which answer they happen to give.
- **A host cannot seal an attestation its own evidence refutes.** That is not a
marginal judgement about trust; it is a physical impossibility the host itself
just recorded.
- **The bound uses vacuum c, not a fibre constant.** This costs sensitivity and
buys certainty in the only direction that matters: a refutation under vacuum-c
cannot be argued away by an unusual path.
It is timing-derived, so by this codebase's own rule (`TimingIsNotAShunt`, §6.3)
it is its own evidence class — it never reaches the standing of the verified
`tee` evidence at S6 and carries no `Provenance` at all.
Absent, the field is omitted and the canonical bytes are unchanged, so S7
attestations sealed before this section still verify — C12 asserts that
alongside the refutation, the unsigned-observation rule, and the below-S7
rejection.
Verified: 203 workspace tests pass, conformance passes all 12 classes with no
skips, published vectors unchanged on disk, no clippy warnings in the new file.
|
||
| .. | ||
| sandbox-attest | ||
| sandbox-build | ||
| sandbox-capability | ||
| sandbox-cli | ||
| sandbox-conformance | ||
| sandbox-exec-microvm | ||
| sandbox-exec-wasm | ||
| sandbox-jcp | ||
| sandbox-mcp | ||
| sandbox-meter | ||
| sandbox-proof | ||
| sandbox-proof-wasm | ||
| sandbox-runtime | ||
| sandbox-schema | ||
| sandbox-tee | ||