aere-quantum/ai-trust

AERE AI Trust Chain

Trust infrastructure for an AI result, built only from pieces that already exist and are verified on their own: the agent's post-quantum identity, the attestation of the model artifact, the host's runtime record, the agent's policy and signed ledger, the Proof of AI envelope of the output, and the chain as the witness of time. This component adds no new proof: it adds the links between those proofs, in one bundle, judged by one verifier that calls the existing verifiers and checks only that the digests, the identities and the times agree.

facet	what proves it	the link checked here
identity	agents/ (agentId derived from an ML-DSA-65 key)	the ledger, the bundle and the output name the id the key derives
version	Proof of Software attestation of the model artifact (hybrid signature)	the output's model.weightsSha256 is an artifact of the attestation; the version labels agree
runtime	the verify-layer sidecar's runtime record in its audit log (chain, head)	the host ran that same artifact (matches), before the output; the record is an entry of an intact log that continues the attested head
permissions	the agent's policy and ledger (agents/)	the ledger verifies; an allowed entry links the output by its provenance hash; the entry's time matches the output's
provenance	the Proof of AI envelope (AIP-23; digests only)	the envelope verifies with the AIP-23 reference verifier; notarized, its finality is read under a post-quantum certified anchor
witness	the ledger head notarized on Aere (agents/agent-ancora.mjs)	the heads read back through the reference verifier become the ledger's time anchors; without them every time is the key holder's statement

Verdict: VALID when every present level PASSED and the witness PASSED; INVALID when a level FAILED; PARTIAL otherwise (an UNMEASURED level, or no witness). Every level reports what it rests on. A verdict says that the bytes link and who vouches for each link. It does not say the model is good, the host is honest, or the output is true.

import { construieste, verifica } from './lant-de-incredere.mjs';
const bundle = construieste({ ledger, policy: { policy, policyHash }, proofOfAi, software: { attestation }, runtime: { record, auditLog, head }, witness: { heads: [notarizedHead], chainId: 28001 } });
const v = await verifica(bundle, { rpc: 'https://testnet-rpc.aere.network', chain: 28001 });   // rpc: only for notarized pieces

What it is not

• Not an attestation of execution in a TEE: the runtime record is the host's declaration, as the sidecar says; what is checkable without trusting the host is that the declaration was made before the output and sits in a history published outside the host.
• Not a judgement of the signer of the model attestation: who holds the signing keys is pos.mjs verify --signer's question.
• Not a judgement of the content: prompts, inputs and outputs are digests; the verifier proves that bytes with these hashes were named, not what they say.

Probes

AERE_VERIFY_PROOF=<verify-proof.mjs from aere-node> node proba-lant-de-incredere.mjs   # no network: 13 rows (the chain, then every link broken on purpose)
AERE_VERIFY_PROOF=... node proba-lant-de-incredere.mjs --control-negativ               # 8 plantings in a copy of the verifier; each must turn its fixture red
AERE_VERIFY_PROOF=... AERE_NOTARY_KEY_FILE=<key> AERE_ETHERS_DIR=<dir with node_modules/ethers> node proba-lant-de-incredere.mjs --viu
                                                                                       # plus the witness on testnet 28001 (a notarization paid with a test key)

The probes use the real children beside this component: the verify-layer sidecar (record, attest-head), the agents (ledger, policy, anchor), proof-of-ai, and the AIP-23 reference verifier named by AERE_VERIFY_PROOF (without it the probe exits 2, NEMASURAT). The model artifact and its Proof of Software attestation are a committed fixture (fixturi/: 4 KB of random bytes attested with laboratory keys by pos.mjs, which is not part of this component; the digest is recomputed from the bytes, never read from the attestation). --viu writes its evidence in dovezi/.