dev.cocore.compute.attestation
Schema Diff
+17 -1
Compatibility Analysis
Backward Compatible
Backward compatible. 4 non-breaking changes.
Non-Breaking Changes (4)
- AddedVertex AddedVertex { vertex_id: "dev.cocore.compute.attestation:body.encScheme" }
- AddedVertex AddedVertex { vertex_id: "dev.cocore.compute.attestation:body.sigScheme" }
- AddedEdge AddedEdge { src: "dev.cocore.compute.attestation:body", tgt: "dev.cocore.compute.attestation:body.encScheme", kind: "prop", name: Some("encScheme") }
- AddedEdge AddedEdge { src: "dev.cocore.compute.attestation:body", tgt: "dev.cocore.compute.attestation:body.sigScheme", kind: "prop", name: Some("sigScheme") }
Migration Guidance
Added Elements
AddedVertex { vertex_id: "dev.cocore.compute.attestation:body.encScheme" }AddedVertex { vertex_id: "dev.cocore.compute.attestation:body.sigScheme" }
Additional Notes
- Non-breaking: AddedEdge { src: "dev.cocore.compute.attestation:body", tgt: "dev.cocore.compute.attestation:body.encScheme", kind: "prop", name: Some("encScheme") }
- Non-breaking: AddedEdge { src: "dev.cocore.compute.attestation:body", tgt: "dev.cocore.compute.attestation:body.sigScheme", kind: "prop", name: Some("sigScheme") }
1
1
{
2
2
"$type": "com.atproto.lexicon.schema",
3
3
"defs": {
4
4
"main": {
5
5
"key": "tid",
6
6
"record": {
7
7
"properties": {
8
8
"antiDebug": {
9
9
"description": "True iff the process denied debugger attachment at startup (PT_DENY_ATTACH). Required for `attested-confidential`. Optional / additive; absent treated as false.",
10
10
"type": "boolean"
11
11
},
12
12
"appAttest": {
13
13
"description": "Optional Apple App Attest evidence — the second, MDM-free path to trustLevel 'hardware-attested'. The provider's signed helper calls DCAppAttestService with `clientDataHash = sha256(publicKey)` (this record's receipt-signing key), so Apple's attestation commits to the signing key by construction. Verifiers MUST, offline: (1) CBOR-decode `object`, requiring fmt 'apple-appattest'; (2) verify the attStmt x5c chain to the embedded Apple App Attest Root CA; (3) recompute `nonce = sha256(authData || sha256(publicKey))` and require it to equal the credential certificate's nonce extension (OID 1.2.840.113635.100.8.2) — THIS is the binding to the signing key; (4) check authData's rpIdHash == sha256(App ID 'TEAMID.dev.cocore.provider'), the AAGUID is the genuine-hardware appattest value, and credentialId == sha256(attested public key) == `keyId`. A bound, valid App Attest object earns 'hardware-attested' exactly as a bound mdaCertChain does. It proves genuine, un-tampered Apple hardware holds a Secure-Enclave key bound to the signing key; it does NOT by itself prove the signing key is SE-resident nor that the running binary is honest (those are carried by the SE-backed signing identity + hardened-runtime + cdHash known-good gate, same self-measurement ceiling as the MDA path).",
14
14
"properties": {
15
15
"keyId": {
16
16
"description": "The App Attest key identifier (the SHA-256 of the attested public key) DCAppAttestService.generateKey returned. Verifiers cross-check this equals the credentialId in authData.",
17
17
"maxLength": 64,
18
18
"type": "bytes"
19
19
},
20
20
"object": {
21
21
"description": "The CBOR App Attest attestation object returned by DCAppAttestService.attestKey, as produced for `clientDataHash = sha256(publicKey)`. Contains fmt, attStmt (x5c + receipt), and authData.",
22
22
"maxLength": 16384,
23
23
"type": "bytes"
24
24
}
25
25
},
26
26
"required": [
27
27
"object",
28
28
"keyId"
29
29
],
30
30
"type": "object"
31
31
},
32
32
"attestedAt": {
33
33
"format": "datetime",
34
34
"type": "string"
35
35
},
36
36
"authenticatedRootEnabled": {
37
37
"type": "boolean"
38
38
},
39
39
"binaryHash": {
40
40
"description": "SHA-256 hex of the cocore-provider binary that produced this attestation. Back-compat measure of the whole file on disk. For trust decisions `cdHash` supersedes it: the OS enforces the code-signing cdhash, not a whole-file digest, so a verifier deciding `tier` MUST prefer `cdHash` when present and treat `binaryHash` as informational.",
41
41
"maxLength": 64,
42
42
"minLength": 64,
43
43
"type": "string"
44
44
},
45
45
"cdHash": {
46
46
"description": "Lowercase hex of the code-signing directory hash (cdhash) the OS actually enforces for the running cocore-provider binary, read from the live process (SecCodeCopySelf / SecCodeCopySigningInformation, fallback csops CS_OPS_CDHASH). This is the measured identity a confidential-tier verifier checks against the known-good set — unlike `binaryHash` it reflects exactly what library validation and `get-task-allow=false` protect. Optional / additive; absent caps the work at `best-effort`.",
47
47
"maxLength": 64,
48
48
"minLength": 40,
49
49
"type": "string"
50
50
},
51
51
"chipName": {
52
52
"maxLength": 64,
53
53
"type": "string"
54
54
},
55
55
"coreDumpsDisabled": {
56
56
"description": "True iff core dumps were disabled at startup (RLIMIT_CORE=0), so a crash cannot spill plaintext to disk. Required for `attested-confidential`. Optional / additive; absent treated as false.",
57
57
"type": "boolean"
58
58
},
59
+
"encScheme": {
60
+
"description": "Curve/scheme for `encryptionPubKey`. 'x25519' (default when absent) = a software X25519 key, which is extractable — the operator can lift it and decrypt the prompt off-box. 'p256-ecies-se' = a Secure-Enclave-resident P-256 key where ECIES key agreement runs inside the SEP and the private key is non-extractable. REQUIRED for `attested-confidential` (ADR-0003) so the decryption key cannot leave the measured machine.",
61
+
"knownValues": [
62
+
"x25519",
63
+
"p256-ecies-se"
64
+
],
65
+
"type": "string"
66
+
},
59
67
"encryptionPubKey": {
60
-
"description": "X25519 public key (base64) bound to the same Secure Enclave identity. Proves a single device controls both signing and request-encryption keys.",
68
+
"description": "Public key (base64) a requester seals the prompt to. Its curve/scheme is given by `encScheme` (X25519 by default; a Secure-Enclave-resident P-256 key under 'p256-ecies-se'). Bound to the same device identity as `publicKey` — the selfSignature over this record authenticates it.",
61
69
"maxLength": 128,
62
70
"type": "string"
63
71
},
64
72
"engineLibHash": {
65
73
"description": "SHA-256 hex of the dynamic library that runs the in-process inference engine (e.g. `libCoCoreMLX.dylib`). When the engine is a separately-loaded dylib rather than code statically inside the agent binary, the `cdHash` does not cover it, so a confidential verifier pins this too. Enforced library validation already blocks a different team's dylib; this additionally locks the hash within the provider team's own blessed releases. Absent when inference runs in a subprocess or fully inside the measured binary. Optional / additive.",
66
74
"maxLength": 64,
67
75
"minLength": 64,
68
76
"type": "string"
69
77
},
70
78
"envScrubbed": {
71
79
"description": "True iff dynamic-linker injection vectors (DYLD_*) were scrubbed from the environment at startup. Required for `attested-confidential`. Optional / additive; absent treated as false.",
72
80
"type": "boolean"
73
81
},
74
82
"expiresAt": {
75
83
"description": "Receipts that strong-ref this attestation are only considered fresh if completedAt < expiresAt. Default 24h after attestedAt.",
76
84
"format": "datetime",
77
85
"type": "string"
78
86
},
79
87
"getTaskAllow": {
80
88
"description": "Value of the get-task-allow entitlement on the running binary. MUST be false for `attested-confidential` — a true value means another process (even the owner) can attach a debugger and read process memory, defeating confidentiality. Optional / additive; absent treated as true (the unsafe default) so a missing value never silently earns the confidential tier.",
81
89
"type": "boolean"
82
90
},
83
91
"hardenedRuntime": {
84
92
"description": "True iff the running binary is signed with the hardened runtime (CS_RUNTIME). Required for `attested-confidential`. Optional / additive; absent treated as false.",
85
93
"type": "boolean"
86
94
},
87
95
"hardwareModel": {
88
96
"description": "DMI string, e.g. 'Mac15,8'.",
89
97
"maxLength": 64,
90
98
"type": "string"
91
99
},
92
100
"inProcessBackend": {
93
101
"description": "True iff inference runs INSIDE this measured, signed binary (native in-process engine) rather than in an owner-controlled subprocess/interpreter. This is THE load-bearing confidentiality property — if false, the prompt is handed to a process the attestation does not cover, so the work can never be `attested-confidential`. Optional / additive; absent treated as false.",
94
102
"type": "boolean"
95
103
},
96
104
"libraryValidation": {
97
105
"description": "True iff library validation is enforced (the binary will not load libraries signed by a different team / unsigned code). Closes the dylib-injection path. Required for `attested-confidential`. Optional / additive; absent treated as false.",
98
106
"type": "boolean"
99
107
},
100
108
"mdaCertChain": {
101
109
"description": "Optional Apple Managed Device Attestation certificate chain (DER), leaf first. One of two paths to trustLevel 'hardware-attested' (the other is `appAttest`). Verifiers MUST: (1) verify every adjacent link to the embedded Apple Enterprise Attestation Root CA, enforcing BasicConstraints (non-leaf certs are CAs, the leaf is an end-entity); and (2) BIND the chain to this record's `publicKey` by EITHER the leaf's P-256 public key EQUALLING `publicKey`, OR the Apple freshness extension (OID 1.2.840.113635.100.8.11.1) committing to it as `freshnessCode == sha256(publicKey)`. Without a binding a valid Apple chain for one device could be stapled onto an unrelated signing key, so a chain that verifies but isn't bound MUST NOT earn 'hardware-attested'.",
102
110
"items": {
103
111
"maxLength": 8192,
104
112
"type": "bytes"
105
113
},
106
114
"maxLength": 8,
107
115
"type": "array"
108
116
},
109
117
"metallibHash": {
110
118
"description": "SHA-256 hex of the precompiled Metal shader library (`mlx.metallib` or equivalent) the in-process inference engine loads at runtime. The GPU kernels that touch the plaintext live here, so a confidential verifier pins this to a known-good value alongside `cdHash`. Absent when no native engine is loaded (e.g. the subprocess/best-effort backend). Optional / additive.",
111
119
"maxLength": 64,
112
120
"minLength": 64,
113
121
"type": "string"
114
122
},
115
123
"osVersion": {
116
124
"maxLength": 64,
117
125
"type": "string"
118
126
},
119
127
"publicKey": {
120
128
"description": "P-256 public key (base64). MUST equal the attestationPubKey of the provider record under the signing DID.",
121
129
"maxLength": 256,
122
130
"type": "string"
123
131
},
124
132
"rdmaDisabled": {
125
133
"type": "boolean"
126
134
},
127
135
"secureBootEnabled": {
128
136
"type": "boolean"
129
137
},
130
138
"secureEnclaveAvailable": {
131
139
"type": "boolean"
132
140
},
133
141
"selfSignature": {
134
142
"description": "Secure Enclave P-256 signature (DER) over a sorted-key canonical JSON of every other field in this record. Verifiers MUST reconstruct the canonical JSON byte-for-byte before checking.",
135
143
"maxLength": 256,
136
144
"type": "bytes"
137
145
},
138
146
"serialNumberHash": {
139
147
"description": "SHA-256 hex of (serialNumber || providerDID). Hashed so the public record never leaks raw serials. When an mdaCertChain is present, the serialNumber MUST be the one the verified MDA leaf attests (not a self-reported value), so the hashed device identity is anchored to the chain.",
140
148
"maxLength": 64,
141
149
"minLength": 64,
142
150
"type": "string"
143
151
},
152
+
"sigScheme": {
153
+
"description": "How `selfSignature` (and the `enclaveSignature` of receipts that strong-ref this attestation) is produced. 'p256' (default when absent) = raw ECDSA-P256 over the canonical bytes. 'appattest-assertion' = an Apple App Attest assertion from DCAppAttestService.generateAssertion, where the App Attest key IS this record's `publicKey` (so keyId == sha256(uncompressed publicKey)) and the signed message is carried as the assertion clientDataHash = sha256(canonical bytes). REQUIRED for `attested-confidential` (ADR-0003): only assertion signing proves the private key is Secure-Enclave-resident and non-exportable; a raw p256 key with any attestation is portable to another host.",
154
+
"knownValues": [
155
+
"p256",
156
+
"appattest-assertion"
157
+
],
158
+
"type": "string"
159
+
},
144
160
"sipEnabled": {
145
161
"type": "boolean"
146
162
},
147
163
"teamId": {
148
164
"description": "Apple Developer Team Identifier from the code signature of the running binary. A confidential-tier verifier pins this to the expected cocore signing team so a validly-signed but unrelated binary cannot pass. Optional / additive.",
149
165
"maxLength": 64,
150
166
"type": "string"
151
167
},
152
168
"tier": {
153
169
"description": "The provider's self-asserted confidentiality tier for work done under this attestation. ADVISORY ONLY: a verifier MUST recompute the tier from the evidence in this record (bound mdaCertChain, cdHash ∈ known-good, posture booleans) and the session handshake, and MUST NOT trust this field. Present so consumers can display the provider's claim before verifying. Optional / additive; absent equivalent to `best-effort`.",
154
170
"ref": "dev.cocore.compute.defs#tier",
155
171
"type": "ref"
156
172
}
157
173
},
158
174
"required": [
159
175
"publicKey",
160
176
"encryptionPubKey",
161
177
"chipName",
162
178
"hardwareModel",
163
179
"serialNumberHash",
164
180
"osVersion",
165
181
"binaryHash",
166
182
"sipEnabled",
167
183
"secureBootEnabled",
168
184
"secureEnclaveAvailable",
169
185
"authenticatedRootEnabled",
170
186
"selfSignature",
171
187
"attestedAt",
172
188
"expiresAt"
173
189
],
174
190
"type": "object"
175
191
},
176
192
"type": "record"
177
193
}
178
194
},
179
195
"description": "A snapshot of a provider machine's hardware and software state, signed by its Secure Enclave. Content-addressed: many receipts strong-ref the same attestation record until the underlying state changes (binary upgrade, OS update, key rotation).",
180
196
"id": "dev.cocore.compute.attestation",
181
197
"lexicon": 1
182
198
}