| .. | ||
| dovezi | ||
| fixturi | ||
| lant-de-incredere.mjs | ||
| proba-lant-de-incredere.mjs | ||
| README.md | ||
AERE AI Trust Chain
Trust infrastructure for an AI result, built only from pieces that already exist and are verified on their own: the agent's post-quantum identity, the attestation of the model artifact, the host's runtime record, the agent's policy and signed ledger, the Proof of AI envelope of the output, and the chain as the witness of time. This component adds no new proof: it adds the links between those proofs, in one bundle, judged by one verifier that calls the existing verifiers and checks only that the digests, the identities and the times agree.
| facet | what proves it | the link checked here |
|---|---|---|
| identity | agents/ (agentId derived from an ML-DSA-65 key) |
the ledger, the bundle and the output name the id the key derives |
| version | Proof of Software attestation of the model artifact (hybrid signature) | the output's model.weightsSha256 is an artifact of the attestation; the version labels agree |
| runtime | the verify-layer sidecar's runtime record in its audit log (chain, head) |
the host ran that same artifact (matches), before the output; the record is an entry of an intact log that continues the attested head |
| permissions | the agent's policy and ledger (agents/) |
the ledger verifies; an allowed entry links the output by its provenance hash; the entry's time matches the output's |
| provenance | the Proof of AI envelope (AIP-23; digests only) | the envelope verifies with the AIP-23 reference verifier; notarized, its finality is read under a post-quantum certified anchor |
| witness | the ledger head notarized on Aere (agents/agent-ancora.mjs) |
the heads read back through the reference verifier become the ledger's time anchors; without them every time is the key holder's statement |
Verdict: VALID when every present level PASSED and the witness PASSED; INVALID when a level FAILED; PARTIAL otherwise
(an UNMEASURED level, or no witness). Every level reports what it rests on. A verdict says that the bytes link and who vouches for
each link. It does not say the model is good, the host is honest, or the output is true.
Since 2026-10-03 the verdict also carries rules: the reason code of every level that failed, sorted (reason is only the first
of them). The chain inherits what its children refuse. Since that same day the agents' ledger verifier refuses a ledger whose agent
key is not an ML-DSA-65 key, and the audit log verifier refuses a head whose signature declares ml-dsa-65 and was made with a
classical key; a bundle that carries either is INVALID here, as ledger-invalid or audit-head. Measured on 2026-10-05 by rows
F11, F12 and F13 of the probe below, each with its planting in the negative control.
import { construieste, verifica } from './lant-de-incredere.mjs';
const bundle = construieste({ ledger, policy: { policy, policyHash }, proofOfAi, software: { attestation }, runtime: { record, auditLog, head }, witness: { heads: [notarizedHead], chainId: 28001 } });
const v = await verifica(bundle, { rpc: 'https://testnet-rpc.aere.network', chain: 28001 }); // rpc: only for notarized pieces
What it is not
- Not an attestation of execution in a TEE: the runtime record is the host's declaration, as the sidecar says; what is checkable without trusting the host is that the declaration was made before the output and sits in a history published outside the host.
- Not a judgement of the signer of the model attestation: who holds the signing keys is
pos.mjs verify --signer's question. - Not a judgement of the content: prompts, inputs and outputs are digests; the verifier proves that bytes with these hashes were named, not what they say.
Probes
AERE_VERIFY_PROOF=<verify-proof.mjs from aere.network/tools> node proba-lant-de-incredere.mjs # no network: 16 rows (the chain, then every link broken on purpose)
AERE_VERIFY_PROOF=... node proba-lant-de-incredere.mjs --control-negativ # 11 plantings in a copy of the verifier; each must turn its fixture red
AERE_VERIFY_PROOF=... AERE_NOTARY_KEY_FILE=<key> AERE_ETHERS_DIR=<dir with node_modules/ethers> node proba-lant-de-incredere.mjs --viu
# plus the witness on testnet 28001 (a notarization paid with a test key)
The probes use the real children beside this component: the verify-layer sidecar (record, attest-head), the agents (ledger, policy,
anchor), proof-of-ai, and the AIP-23 reference verifier named by AERE_VERIFY_PROOF (without it the probe exits 2, NEMASURAT). The
model artifact and its Proof of Software attestation are a committed fixture (fixturi/: 4 KB of random bytes attested with
laboratory keys by pos.mjs, which is not part of this component; the digest is recomputed from the bytes, never read from the
attestation). --viu writes its evidence in dovezi/.