open-standards/sandbox/SECURITY.md

Security

This standard is built from proven primitives, composed in one new way. The primitives are not re-litigated here; the composition and its boundaries are.

Primitives

• Content addressing — BLAKE3-256 over deterministic CBOR (SPEC §3–§4). Identity is the hash of the canonical bytes; a changed artifact is a changed id.
• Sealed receipts — JCR-1 (det-CBOR + COSE/EdDSA), the family's signed-receipt format (SPEC §6).
• Attestation — Ed25519 over the JCS-canonical form (SPEC §7), the same primitive as ARL-S, so the two interoperate.
• Confidential evidence — AMD SEV-SNP report verification: ECDSA-P384/SHA-384 against a VCEK chained to the AMD root (SPEC §7.6, sandbox-tee). Verification is hardware-independent and complete; generation requires the CPU security processor, and the reference says so rather than faking it.
• Deny-by-default capabilities — every resource a unit may touch is named by an explicit grant; anything unnamed is denied (SPEC §5).

The reference proves these run and self-attest across substrates, operating systems, clouds, and accelerator classes — each cell of proof/matrix.jsonl is a signature over a real run referencing an attestation that itself verifies. A host records what it cannot prove as unavailable, never as passed.

The composition: isolation across a heterogeneous fabric

The new part is making the unit of isolation a heterogeneous unit of work across CPU/GPU/NPU/TPU/photonic/quantum, with the accelerator a first-class metered and attested line item rather than an opaque passthrough. The isolation ladder (S0–S7) runs a unit at the lowest tier its grants require; escalation is the escape hatch, not the default.

Shared-resource side channels

Logical isolation separates memory and code. It does not partition the physical resources a tier shares — and a shared resource is a channel. At S0–S2 the host kernel and device I/O paths are shared, so co-tenants can observe one another through contention, with no privileged access on either side.

Worked example — storage-contention fingerprinting (FROST)

A current, well-credentialed instance is FROST (Fingerprinting Remotely using OPFS-based SSD Timing, Weissteiner et al., Graz University of Technology / Liebherr-Transportation Systems, 2026; disclosed to Google, Mozilla, Apple). A page in an ordinary browser sandbox writes an oversized file through the Origin Private File System — large enough to exceed the OS page cache — then times continuous random 4 KiB reads. Every read hits the physical SSD; when other tabs or applications do their own I/O, the contention shows up as latency spikes the page reads off from JavaScript, fingerprinting active sites and applications (~89%/~96% reported) with no permission prompt and no exploit. It breaks no logical boundary; it rides a physical one the sandbox never partitioned.

This is the general shape, not a storage-only quirk: any tier that shares a device shares a contention channel through it.

What the standard does about it

The standard does not claim to abolish physical channels. It gives the structure to reason about, bound, and price them, with two levers and one inversion:

1. Bound it — capability (I/O ceiling). A StorageGrant may carry sustained-I/O ceilings (max_iops, max_read_bps; SPEC §5.2). Deny-by-default extends from which I/O to how much: a unit whose rate is capped cannot drive the high-rate random-read storm a contention channel needs. Enforced in sandbox-capability (Enforcer::may_sustain_io), bound into grants_content_id, and attested — so the ceiling a run claimed is part of its signed record.
2. Close it — tier partitioning. Where throttling is not enough, the floor rises: S3 partitions device I/O so contention no longer crosses the boundary; S5 (direct device assignment) removes the shared device entirely. Tier minimization is side-channel-aware (SPEC §2.4): a workload sensitive to — or, as an untrusted neighbor, capable of — cross-tenant leakage has its floor raised, by the ceiling lever held at S2 or by partitioning at S3+.
3. Price it — measurement (the inversion). The same physics, measured cooperatively by the host and disclosed, is honest telemetry for a resource the platform otherwise cannot meter. sandbox-meter::StorageActivity reports observed iops/bytes/contention_ns and a model-based energy figure. It is a distinct axis (never folded into a compute device class) and never HwShunt — a timing channel is not a hardware shunt, and the provenance discipline (SPEC §6.3) is enforced for it. What leaks information undisclosed becomes auditable joules disclosed.

Provenance honesty

Every energy figure carries a provenance tag — HwShunt (measured at a hardware interface for that class), ModelBased (a model calibrated on the host), or Estimator (a coarse constant, or a nominal coefficient no host calibrated) — and the (provenance, measured) coupling is enforced (SPEC §6.3, vector class C3). The standard's claim is that the figure is reported and honestly tagged, never that an estimate is a measurement. Remote silicon a prover does not own is metered by token-level Estimator, not dressed as measured; a contention probe's figure is an Estimator, not a shunt.

Reporting

Security issues in the reference implementation: open an issue at https://github.com/Transaction-Science/open-standards, or contact [email protected]. This document covers the standard and its reference; it is not a deployment's security posture, which depends on the host, the tiers it advertises, and the grants it issues.