# AERE AI Trust Chain

Trust infrastructure for an AI result, built only from pieces that already exist and are verified on their own: the agent's
post-quantum identity, the attestation of the model artifact, the host's runtime record, the agent's policy and signed ledger, the
Proof of AI envelope of the output, and the chain as the witness of time. This component adds **no new proof**: it adds the
**links** between those proofs, in one bundle, judged by one verifier that calls the existing verifiers and checks only that the
digests, the identities and the times agree.

| facet | what proves it | the link checked here |
|---|---|---|
| identity | `agents/` (agentId derived from an ML-DSA-65 key) | the ledger, the bundle and the output name the id the key derives |
| version | Proof of Software attestation of the model artifact (hybrid signature) | the output's `model.weightsSha256` is an artifact of the attestation; the version labels agree |
| runtime | the verify-layer sidecar's `runtime` record in its audit log (chain, head) | the host ran that same artifact (`matches`), before the output; the record is an entry of an intact log that continues the attested head |
| permissions | the agent's policy and ledger (`agents/`) | the ledger verifies; an **allowed** entry links the output by its provenance hash; the entry's time matches the output's |
| provenance | the Proof of AI envelope (AIP-23; digests only) | the envelope verifies with the AIP-23 reference verifier; notarized, its finality is read under a post-quantum certified anchor |
| witness | the ledger head notarized on Aere (`agents/agent-ancora.mjs`) | the heads read back through the reference verifier become the ledger's time anchors; without them every time is the key holder's statement |

Verdict: `VALID` when every present level PASSED **and** the witness PASSED; `INVALID` when a level FAILED; `PARTIAL` otherwise
(an UNMEASURED level, or no witness). Every level reports what it rests on. A verdict says that the bytes link and who vouches for
each link. It does not say the model is good, the host is honest, or the output is true.

```
import { construieste, verifica } from './lant-de-incredere.mjs';
const bundle = construieste({ ledger, policy: { policy, policyHash }, proofOfAi, software: { attestation }, runtime: { record, auditLog, head }, witness: { heads: [notarizedHead], chainId: 28001 } });
const v = await verifica(bundle, { rpc: 'https://testnet-rpc.aere.network', chain: 28001 });   // rpc: only for notarized pieces
```

## What it is not

- Not an attestation of execution in a TEE: the runtime record is the **host's declaration**, as the sidecar says; what is checkable
  without trusting the host is that the declaration was made before the output and sits in a history published outside the host.
- Not a judgement of the signer of the model attestation: who holds the signing keys is `pos.mjs verify --signer`'s question.
- Not a judgement of the content: prompts, inputs and outputs are digests; the verifier proves that bytes with these hashes were
  named, not what they say.

## Probes

```
AERE_VERIFY_PROOF=<verify-proof.mjs from aere-node> node proba-lant-de-incredere.mjs   # no network: 13 rows (the chain, then every link broken on purpose)
AERE_VERIFY_PROOF=... node proba-lant-de-incredere.mjs --control-negativ               # 8 plantings in a copy of the verifier; each must turn its fixture red
AERE_VERIFY_PROOF=... AERE_NOTARY_KEY_FILE=<key> AERE_ETHERS_DIR=<dir with node_modules/ethers> node proba-lant-de-incredere.mjs --viu
                                                                                       # plus the witness on testnet 28001 (a notarization paid with a test key)
```

The probes use the real children beside this component: the verify-layer sidecar (record, attest-head), the agents (ledger, policy,
anchor), proof-of-ai, and the AIP-23 reference verifier named by `AERE_VERIFY_PROOF` (without it the probe exits 2, NEMASURAT). The
model artifact and its Proof of Software attestation are a committed fixture (`fixturi/`: 4 KB of random bytes attested with
laboratory keys by `pos.mjs`, which is not part of this component; the digest is recomputed from the bytes, never read from the
attestation). `--viu` writes its evidence in `dovezi/`.