# The attested tier — "unobservable in use"

> **Status: built and independently verifiable. NOT what serves your traffic today.**
> Every measurement below was taken on real AWS Nitro hardware and every check is one you can run yourself.
> But no production Space runs inside an enclave right now. When one does, `/cert.json` will carry an
> `enclave` block and this line will say so. Until then, treat this as a demonstrated capability, not a
> deployed property — and see [Verify It Yourself](./verify.md) for what *is* live.

Everything else on this site proves things about code we **publish**: the app's egress is locked, the store holds only
ciphertext, the deployed render is a reproducible build of source you can read. All of it stops at one wall.

**None of it proves what the machine actually loaded.** Between the ciphertext arriving and the answer going back,
plaintext exists in memory on a server we operate. Read [Verify It Yourself](./verify.md) closely and it says so: the
one thing you cannot check is that the render is *unobservable in use*.

This is the tier that closes that.

## What changes

Your room key already travels sealed to a service public key rather than in the clear
(`spaces/public/mkseal.js`). That module was written for this moment, and said so in its own header: *today the
private half lives in the service; tomorrow it can live only inside an attested enclave, and nothing on this side
changes.*

In the attested tier, that recipient keypair is **generated inside an AWS Nitro enclave**, at boot, and never written
or exported. Its public half is bound into a hardware-signed attestation document. Verify the document, and you are
sealing your room key to a key that provably exists only inside a specific, measured image.

"We cannot read your room" stops being a policy and becomes a property.

## The four things you can check

Nothing here asks you to trust us, and none of it requires our cooperation beyond us publishing what we already do.

**1. The document is genuine AWS hardware.** A Nitro attestation document is signed by a key in hardware the operator
cannot reach. Our verifier (`spaces/public/nitroVerify.js`) checks the COSE signature and walks the certificate chain
to the **AWS Nitro root G1, pinned in the source** — the document carries its own copy of that root and we discard it,
because a verifier that trusts the anchor its input supplied is not verifying anything.

It runs in your browser. WebCrypto cannot walk an X.509 chain, so the chain walker is written out in
`spaces/public/x509.js` — about 180 lines, ECDSA only.

**2. The image is the one you can rebuild.** PCR0 is a SHA-384 measurement of the running image.
`infra/enclave/build-eif.sh` reproduces it from published source. Four things are pinned because each is an input:
the base image by digest, `SOURCE_DATE_EPOCH`, buildkit by digest, and the nitro-cli version.

This is the part most projects skip. A measurement you cannot reproduce only tells you the image hasn't changed since
*we* built it — which is the "trust us" the whole ladder exists to escape.

**3. PCR8, from the certificate rather than our word for it.** A signed image also reports PCR8, a measurement of the
signing certificate. We publish **the certificate**, not just the number, so you derive PCR8 yourself:
`SHA-384(48 zero bytes ‖ SHA-384(certificate DER))`. Our verifier prefers the value it computed and **rejects a
cert.json whose stated PCR8 contradicts its own certificate**. A dishonest number is caught by arithmetic.

*(AWS's own documentation describes PCR8 differently — as a hash of the certificate's "fingerprint" — which does not
match their code and yields a different value. We follow the code, and confirmed it against real hardware.)*

**4. Liveness, if you ask for it.** An attestation document with no challenge proves an enclave *existed*, not that it
is the one answering you. Send a nonce; it comes back inside the signed document or the check fails. Our verifier
reports `fresh: false` when no nonce was supplied, so a stale proof can never be presented as a live one.

## What it still does not buy

This section is the point of the page. A security claim that only lists what it covers is marketing.

- **Model egress is untouched.** The enclave establishes TLS itself, so neither we nor the parent instance can read a
  model call — but the model vendor receives your plaintext, because that is what the room is *for*. Attestation
  protects the key and the code. It cannot make a remote API stop seeing its input.
- **PCR0 proves the image, not the behaviour.** It proves the running code is the code you can rebuild. Whether that
  code does what we say is what reading it is for; reproducibility makes reading it worthwhile, not unnecessary.
- **Metadata remains.** Which room is active and when, message sizes and timing — an enclave changes none of it.
- **The image is large.** Running the existing pipeline means an interpreter, a libc and ~86 MB of dependencies, all
  measured. The measurement is exactly as sound; the *audit* is a much bigger job than reading two files. A minimal
  variant exists for cases where the smaller claim matters more than the existing code.
- **Availability is still ours to break.** The parent instance can refuse to forward your request. It cannot read it.

## Measured, not asserted

On real hardware, 2026-07-29 — and the last row is the one that matters, because it is the product rather than a
component of it:

| check | result |
|---|---|
| attestation verified against the pinned AWS root, with our own nonce | ok — PCRs 0/1/2/8, `fresh: true` |
| PCR0 vs an independent rebuild from published source | match |
| PCR8 vs the published signing certificate | match |
| room key sealed by the unmodified client, opened inside the enclave | opened |
| the enclave asked to hand the key back | it returns `HMAC(key, challenge)`, never the key |
| a sealed blob replayed as a different operation | refused |
| one ciphertext bit flipped | refused |
| verification in a browser | 1.8–22 ms |
| **the full agent — model, tools, Places, map widget — answering in a real room** | **works** |

That last line is not a reduced demo. It is the deployed handler, unmodified, with its tools, reached from a phone:
the attestation verified in the browser, the room key sealed to a key born inside measured hardware, the reply
generated in the enclave, sealed, stored on a parent that cannot open it, and rendered.

The verifier is also exercised against genuine attestation documents from unrelated production enclaves, so it is
known to handle real AWS output and not merely our own.

## What is left

Everything above is demonstrated, and **none of it is switched on**. What remains is operational rather than unknown:

- **Routing and lifecycle.** One instance, started by hand. Production means a fleet behind the API, health checks,
  and measurements rolled into `/cert.json` on every deploy.
- **Audit surface.** Running the existing pipeline means an image of ~250 MB rather than the 5.6 MB minimal variant.
  The measurement is exactly as sound; reading it is a much bigger job.

Two things that *were* on this list are now done, and both are the kind of claim worth stating precisely:

**Secrets are released only to a measured enclave.** Credentials are sealed under a KMS key that refuses to decrypt
unless the request carries an attestation matching our signing identity. An account administrator is denied. The host
holding the IAM role, using the very credentials the enclave uses, is denied. The enclave is allowed. The parent hands
over ciphertext and gets back a list of *names* — never a value.

**Storage is durable and still unreadable.** Sealed blobs live in S3. Read back with account-admin credentials, a
conversation is an IV, a ciphertext, and one recipient: the room. Not the operator.

When a Space really runs in an enclave, `/cert.json` will carry an `enclave` block naming the PCRs, and a Test 8 will
appear on the verify page. Until then this page describes a capability, not a property of your room.

Read next: [Verify It Yourself](./verify.md) for what is live today, and [The double blind](./the-double-blind.md) for
the model this completes.