56 lines
4.8 KiB
Markdown
56 lines
4.8 KiB
Markdown
# AERE AI Trust Chain
|
|
|
|
Trust infrastructure for an AI result, built only from pieces that already exist and are verified on their own: the agent's
|
|
post-quantum identity, the attestation of the model artifact, the host's runtime record, the agent's policy and signed ledger, the
|
|
Proof of AI envelope of the output, and the chain as the witness of time. This component adds **no new proof**: it adds the
|
|
**links** between those proofs, in one bundle, judged by one verifier that calls the existing verifiers and checks only that the
|
|
digests, the identities and the times agree.
|
|
|
|
| facet | what proves it | the link checked here |
|
|
|---|---|---|
|
|
| identity | `agents/` (agentId derived from an ML-DSA-65 key) | the ledger, the bundle and the output name the id the key derives |
|
|
| version | Proof of Software attestation of the model artifact (hybrid signature) | the output's `model.weightsSha256` is an artifact of the attestation; the version labels agree |
|
|
| runtime | the verify-layer sidecar's `runtime` record in its audit log (chain, head) | the host ran that same artifact (`matches`), before the output; the record is an entry of an intact log that continues the attested head |
|
|
| permissions | the agent's policy and ledger (`agents/`) | the ledger verifies; an **allowed** entry links the output by its provenance hash; the entry's time matches the output's |
|
|
| provenance | the Proof of AI envelope (AIP-23; digests only) | the envelope verifies with the AIP-23 reference verifier; notarized, its finality is read under a post-quantum certified anchor |
|
|
| witness | the ledger head notarized on Aere (`agents/agent-ancora.mjs`) | the heads read back through the reference verifier become the ledger's time anchors; without them every time is the key holder's statement |
|
|
|
|
Verdict: `VALID` when every present level PASSED **and** the witness PASSED; `INVALID` when a level FAILED; `PARTIAL` otherwise
|
|
(an UNMEASURED level, or no witness). Every level reports what it rests on. A verdict says that the bytes link and who vouches for
|
|
each link. It does not say the model is good, the host is honest, or the output is true.
|
|
|
|
Since 2026-10-03 the verdict also carries `rules`: the reason code of every level that failed, sorted (`reason` is only the first
|
|
of them). The chain inherits what its children refuse. Since that same day the agents' ledger verifier refuses a ledger whose agent
|
|
key is not an ML-DSA-65 key, and the audit log verifier refuses a head whose signature declares `ml-dsa-65` and was made with a
|
|
classical key; a bundle that carries either is `INVALID` here, as `ledger-invalid` or `audit-head`. Measured on 2026-10-05 by rows
|
|
F11, F12 and F13 of the probe below, each with its planting in the negative control.
|
|
|
|
```
|
|
import { construieste, verifica } from './lant-de-incredere.mjs';
|
|
const bundle = construieste({ ledger, policy: { policy, policyHash }, proofOfAi, software: { attestation }, runtime: { record, auditLog, head }, witness: { heads: [notarizedHead], chainId: 28001 } });
|
|
const v = await verifica(bundle, { rpc: 'https://testnet-rpc.aere.network', chain: 28001 }); // rpc: only for notarized pieces
|
|
```
|
|
|
|
## What it is not
|
|
|
|
- Not an attestation of execution in a TEE: the runtime record is the **host's declaration**, as the sidecar says; what is checkable
|
|
without trusting the host is that the declaration was made before the output and sits in a history published outside the host.
|
|
- Not a judgement of the signer of the model attestation: who holds the signing keys is `pos.mjs verify --signer`'s question.
|
|
- Not a judgement of the content: prompts, inputs and outputs are digests; the verifier proves that bytes with these hashes were
|
|
named, not what they say.
|
|
|
|
## Probes
|
|
|
|
```
|
|
AERE_VERIFY_PROOF=<verify-proof.mjs from aere.network/tools> node proba-lant-de-incredere.mjs # no network: 16 rows (the chain, then every link broken on purpose)
|
|
AERE_VERIFY_PROOF=... node proba-lant-de-incredere.mjs --control-negativ # 11 plantings in a copy of the verifier; each must turn its fixture red
|
|
AERE_VERIFY_PROOF=... AERE_NOTARY_KEY_FILE=<key> AERE_ETHERS_DIR=<dir with node_modules/ethers> node proba-lant-de-incredere.mjs --viu
|
|
# plus the witness on testnet 28001 (a notarization paid with a test key)
|
|
```
|
|
|
|
The probes use the real children beside this component: the verify-layer sidecar (record, attest-head), the agents (ledger, policy,
|
|
anchor), proof-of-ai, and the AIP-23 reference verifier named by `AERE_VERIFY_PROOF` (without it the probe exits 2, NEMASURAT). The
|
|
model artifact and its Proof of Software attestation are a committed fixture (`fixturi/`: 4 KB of random bytes attested with
|
|
laboratory keys by `pos.mjs`, which is not part of this component; the digest is recomputed from the bytes, never read from the
|
|
attestation). `--viu` writes its evidence in `dovezi/`.
|