dev.cocore.compute.attestation
Schema Diff
+17 -1
Compatibility Analysis
Backward Compatible
Backward compatible. 4 non-breaking changes.
Non-Breaking Changes (4)
- AddedVertex AddedVertex { vertex_id: "dev.cocore.compute.attestation:body.encScheme" }
- AddedVertex AddedVertex { vertex_id: "dev.cocore.compute.attestation:body.sigScheme" }
- AddedEdge AddedEdge { src: "dev.cocore.compute.attestation:body", tgt: "dev.cocore.compute.attestation:body.encScheme", kind: "prop", name: Some("encScheme") }
- AddedEdge AddedEdge { src: "dev.cocore.compute.attestation:body", tgt: "dev.cocore.compute.attestation:body.sigScheme", kind: "prop", name: Some("sigScheme") }
Migration Guidance
Added Elements
AddedVertex { vertex_id: "dev.cocore.compute.attestation:body.encScheme" }AddedVertex { vertex_id: "dev.cocore.compute.attestation:body.sigScheme" }
Additional Notes
- Non-breaking: AddedEdge { src: "dev.cocore.compute.attestation:body", tgt: "dev.cocore.compute.attestation:body.encScheme", kind: "prop", name: Some("encScheme") }
- Non-breaking: AddedEdge { src: "dev.cocore.compute.attestation:body", tgt: "dev.cocore.compute.attestation:body.sigScheme", kind: "prop", name: Some("sigScheme") }
1
1
{
2
2
"id": "dev.cocore.compute.attestation",
3
3
"defs": {
4
4
"main": {
5
5
"key": "tid",
6
6
"type": "record",
7
7
"record": {
8
8
"type": "object",
9
9
"required": [
10
10
"publicKey",
11
11
"encryptionPubKey",
12
12
"chipName",
13
13
"hardwareModel",
14
14
"serialNumberHash",
15
15
"osVersion",
16
16
"binaryHash",
17
17
"sipEnabled",
18
18
"secureBootEnabled",
19
19
"secureEnclaveAvailable",
20
20
"authenticatedRootEnabled",
21
21
"selfSignature",
22
22
"attestedAt",
23
23
"expiresAt"
24
24
],
25
25
"properties": {
26
26
"tier": {
27
27
"ref": "dev.cocore.compute.defs#tier",
28
28
"type": "ref",
29
29
"description": "The provider's self-asserted confidentiality tier for work done under this attestation. ADVISORY ONLY: a verifier MUST recompute the tier from the evidence in this record (bound mdaCertChain, cdHash ∈ known-good, posture booleans) and the session handshake, and MUST NOT trust this field. Present so consumers can display the provider's claim before verifying. Optional / additive; absent equivalent to `best-effort`."
30
30
},
31
31
"cdHash": {
32
32
"type": "string",
33
33
"maxLength": 64,
34
34
"minLength": 40,
35
35
"description": "Lowercase hex of the code-signing directory hash (cdhash) the OS actually enforces for the running cocore-provider binary, read from the live process (SecCodeCopySelf / SecCodeCopySigningInformation, fallback csops CS_OPS_CDHASH). This is the measured identity a confidential-tier verifier checks against the known-good set — unlike `binaryHash` it reflects exactly what library validation and `get-task-allow=false` protect. Optional / additive; absent caps the work at `best-effort`."
36
36
},
37
37
"teamId": {
38
38
"type": "string",
39
39
"maxLength": 64,
40
40
"description": "Apple Developer Team Identifier from the code signature of the running binary. A confidential-tier verifier pins this to the expected cocore signing team so a validly-signed but unrelated binary cannot pass. Optional / additive."
41
41
},
42
42
"chipName": {
43
43
"type": "string",
44
44
"maxLength": 64
45
45
},
46
46
"antiDebug": {
47
47
"type": "boolean",
48
48
"description": "True iff the process denied debugger attachment at startup (PT_DENY_ATTACH). Required for `attested-confidential`. Optional / additive; absent treated as false."
49
49
},
50
50
"appAttest": {
51
51
"type": "object",
52
52
"required": [
53
53
"object",
54
54
"keyId"
55
55
],
56
56
"properties": {
57
57
"keyId": {
58
58
"type": "bytes",
59
59
"maxLength": 64,
60
60
"description": "The App Attest key identifier (the SHA-256 of the attested public key) DCAppAttestService.generateKey returned. Verifiers cross-check this equals the credentialId in authData."
61
61
},
62
62
"object": {
63
63
"type": "bytes",
64
64
"maxLength": 16384,
65
65
"description": "The CBOR App Attest attestation object returned by DCAppAttestService.attestKey, as produced for `clientDataHash = sha256(publicKey)`. Contains fmt, attStmt (x5c + receipt), and authData."
66
66
}
67
67
},
68
68
"description": "Optional Apple App Attest evidence — the second, MDM-free path to trustLevel 'hardware-attested'. The provider's signed helper calls DCAppAttestService with `clientDataHash = sha256(publicKey)` (this record's receipt-signing key), so Apple's attestation commits to the signing key by construction. Verifiers MUST, offline: (1) CBOR-decode `object`, requiring fmt 'apple-appattest'; (2) verify the attStmt x5c chain to the embedded Apple App Attest Root CA; (3) recompute `nonce = sha256(authData || sha256(publicKey))` and require it to equal the credential certificate's nonce extension (OID 1.2.840.113635.100.8.2) — THIS is the binding to the signing key; (4) check authData's rpIdHash == sha256(App ID 'TEAMID.dev.cocore.provider'), the AAGUID is the genuine-hardware appattest value, and credentialId == sha256(attested public key) == `keyId`. A bound, valid App Attest object earns 'hardware-attested' exactly as a bound mdaCertChain does. It proves genuine, un-tampered Apple hardware holds a Secure-Enclave key bound to the signing key; it does NOT by itself prove the signing key is SE-resident nor that the running binary is honest (those are carried by the SE-backed signing identity + hardened-runtime + cdHash known-good gate, same self-measurement ceiling as the MDA path)."
69
69
},
70
+
"encScheme": {
71
+
"type": "string",
72
+
"description": "Curve/scheme for `encryptionPubKey`. 'x25519' (default when absent) = a software X25519 key, which is extractable — the operator can lift it and decrypt the prompt off-box. 'p256-ecies-se' = a Secure-Enclave-resident P-256 key where ECIES key agreement runs inside the SEP and the private key is non-extractable. REQUIRED for `attested-confidential` (ADR-0003) so the decryption key cannot leave the measured machine.",
73
+
"knownValues": [
74
+
"x25519",
75
+
"p256-ecies-se"
76
+
]
77
+
},
70
78
"expiresAt": {
71
79
"type": "string",
72
80
"format": "datetime",
73
81
"description": "Receipts that strong-ref this attestation are only considered fresh if completedAt < expiresAt. Default 24h after attestedAt."
74
82
},
75
83
"osVersion": {
76
84
"type": "string",
77
85
"maxLength": 64
78
86
},
79
87
"publicKey": {
80
88
"type": "string",
81
89
"maxLength": 256,
82
90
"description": "P-256 public key (base64). MUST equal the attestationPubKey of the provider record under the signing DID."
83
91
},
92
+
"sigScheme": {
93
+
"type": "string",
94
+
"description": "How `selfSignature` (and the `enclaveSignature` of receipts that strong-ref this attestation) is produced. 'p256' (default when absent) = raw ECDSA-P256 over the canonical bytes. 'appattest-assertion' = an Apple App Attest assertion from DCAppAttestService.generateAssertion, where the App Attest key IS this record's `publicKey` (so keyId == sha256(uncompressed publicKey)) and the signed message is carried as the assertion clientDataHash = sha256(canonical bytes). REQUIRED for `attested-confidential` (ADR-0003): only assertion signing proves the private key is Secure-Enclave-resident and non-exportable; a raw p256 key with any attestation is portable to another host.",
95
+
"knownValues": [
96
+
"p256",
97
+
"appattest-assertion"
98
+
]
99
+
},
84
100
"attestedAt": {
85
101
"type": "string",
86
102
"format": "datetime"
87
103
},
88
104
"binaryHash": {
89
105
"type": "string",
90
106
"maxLength": 64,
91
107
"minLength": 64,
92
108
"description": "SHA-256 hex of the cocore-provider binary that produced this attestation. Back-compat measure of the whole file on disk. For trust decisions `cdHash` supersedes it: the OS enforces the code-signing cdhash, not a whole-file digest, so a verifier deciding `tier` MUST prefer `cdHash` when present and treat `binaryHash` as informational."
93
109
},
94
110
"sipEnabled": {
95
111
"type": "boolean"
96
112
},
97
113
"envScrubbed": {
98
114
"type": "boolean",
99
115
"description": "True iff dynamic-linker injection vectors (DYLD_*) were scrubbed from the environment at startup. Required for `attested-confidential`. Optional / additive; absent treated as false."
100
116
},
101
117
"getTaskAllow": {
102
118
"type": "boolean",
103
119
"description": "Value of the get-task-allow entitlement on the running binary. MUST be false for `attested-confidential` — a true value means another process (even the owner) can attach a debugger and read process memory, defeating confidentiality. Optional / additive; absent treated as true (the unsafe default) so a missing value never silently earns the confidential tier."
104
120
},
105
121
"mdaCertChain": {
106
122
"type": "array",
107
123
"items": {
108
124
"type": "bytes",
109
125
"maxLength": 8192
110
126
},
111
127
"maxLength": 8,
112
128
"description": "Optional Apple Managed Device Attestation certificate chain (DER), leaf first. One of two paths to trustLevel 'hardware-attested' (the other is `appAttest`). Verifiers MUST: (1) verify every adjacent link to the embedded Apple Enterprise Attestation Root CA, enforcing BasicConstraints (non-leaf certs are CAs, the leaf is an end-entity); and (2) BIND the chain to this record's `publicKey` by EITHER the leaf's P-256 public key EQUALLING `publicKey`, OR the Apple freshness extension (OID 1.2.840.113635.100.8.11.1) committing to it as `freshnessCode == sha256(publicKey)`. Without a binding a valid Apple chain for one device could be stapled onto an unrelated signing key, so a chain that verifies but isn't bound MUST NOT earn 'hardware-attested'."
113
129
},
114
130
"metallibHash": {
115
131
"type": "string",
116
132
"maxLength": 64,
117
133
"minLength": 64,
118
134
"description": "SHA-256 hex of the precompiled Metal shader library (`mlx.metallib` or equivalent) the in-process inference engine loads at runtime. The GPU kernels that touch the plaintext live here, so a confidential verifier pins this to a known-good value alongside `cdHash`. Absent when no native engine is loaded (e.g. the subprocess/best-effort backend). Optional / additive."
119
135
},
120
136
"rdmaDisabled": {
121
137
"type": "boolean"
122
138
},
123
139
"engineLibHash": {
124
140
"type": "string",
125
141
"maxLength": 64,
126
142
"minLength": 64,
127
143
"description": "SHA-256 hex of the dynamic library that runs the in-process inference engine (e.g. `libCoCoreMLX.dylib`). When the engine is a separately-loaded dylib rather than code statically inside the agent binary, the `cdHash` does not cover it, so a confidential verifier pins this too. Enforced library validation already blocks a different team's dylib; this additionally locks the hash within the provider team's own blessed releases. Absent when inference runs in a subprocess or fully inside the measured binary. Optional / additive."
128
144
},
129
145
"hardwareModel": {
130
146
"type": "string",
131
147
"maxLength": 64,
132
148
"description": "DMI string, e.g. 'Mac15,8'."
133
149
},
134
150
"selfSignature": {
135
151
"type": "bytes",
136
152
"maxLength": 256,
137
153
"description": "Secure Enclave P-256 signature (DER) over a sorted-key canonical JSON of every other field in this record. Verifiers MUST reconstruct the canonical JSON byte-for-byte before checking."
138
154
},
139
155
"hardenedRuntime": {
140
156
"type": "boolean",
141
157
"description": "True iff the running binary is signed with the hardened runtime (CS_RUNTIME). Required for `attested-confidential`. Optional / additive; absent treated as false."
142
158
},
143
159
"encryptionPubKey": {
144
160
"type": "string",
145
161
"maxLength": 128,
146
-
"description": "X25519 public key (base64) bound to the same Secure Enclave identity. Proves a single device controls both signing and request-encryption keys."
162
+
"description": "Public key (base64) a requester seals the prompt to. Its curve/scheme is given by `encScheme` (X25519 by default; a Secure-Enclave-resident P-256 key under 'p256-ecies-se'). Bound to the same device identity as `publicKey` — the selfSignature over this record authenticates it."
147
163
},
148
164
"inProcessBackend": {
149
165
"type": "boolean",
150
166
"description": "True iff inference runs INSIDE this measured, signed binary (native in-process engine) rather than in an owner-controlled subprocess/interpreter. This is THE load-bearing confidentiality property — if false, the prompt is handed to a process the attestation does not cover, so the work can never be `attested-confidential`. Optional / additive; absent treated as false."
151
167
},
152
168
"serialNumberHash": {
153
169
"type": "string",
154
170
"maxLength": 64,
155
171
"minLength": 64,
156
172
"description": "SHA-256 hex of (serialNumber || providerDID). Hashed so the public record never leaks raw serials. When an mdaCertChain is present, the serialNumber MUST be the one the verified MDA leaf attests (not a self-reported value), so the hashed device identity is anchored to the chain."
157
173
},
158
174
"coreDumpsDisabled": {
159
175
"type": "boolean",
160
176
"description": "True iff core dumps were disabled at startup (RLIMIT_CORE=0), so a crash cannot spill plaintext to disk. Required for `attested-confidential`. Optional / additive; absent treated as false."
161
177
},
162
178
"libraryValidation": {
163
179
"type": "boolean",
164
180
"description": "True iff library validation is enforced (the binary will not load libraries signed by a different team / unsigned code). Closes the dylib-injection path. Required for `attested-confidential`. Optional / additive; absent treated as false."
165
181
},
166
182
"secureBootEnabled": {
167
183
"type": "boolean"
168
184
},
169
185
"secureEnclaveAvailable": {
170
186
"type": "boolean"
171
187
},
172
188
"authenticatedRootEnabled": {
173
189
"type": "boolean"
174
190
}
175
191
}
176
192
}
177
193
}
178
194
},
179
195
"$type": "com.atproto.lexicon.schema",
180
196
"lexicon": 1,
181
197
"description": "A snapshot of a provider machine's hardware and software state, signed by its Secure Enclave. Content-addressed: many receipts strong-ref the same attestation record until the underlying state changes (binary upgrade, OS update, key rotation)."
182
198
}