cf8c56792f
ai-trust/ links six existing proofs (agent identity, model artifact attestation, host runtime record, policy and signed ledger,
Proof of AI envelope, on-chain witness) into one bundle judged by one verifier that checks only the links; 13/13 in the lab,
16/16 live on testnet 28001 (ledger head notarized). proof-of-ai/ is the AIP-23 envelope builder it uses. verifiable-data/
publishes append-only versions with an RFC 9162 root and a sorted index per field, range and equality queries proven correct
and complete, selective disclosure per field, availability by sampling, and the AIP-23 data envelope notarized (version 2 on
testnet 28001). agents/agent-ancora.mjs gains notarizeEnvelope({kind}), the general form of notarizeHead. Each README says what
is not built: zero-knowledge queries need a prover and are not here. No third party has reviewed any of this.
50 lines
4.2 KiB
Markdown
50 lines
4.2 KiB
Markdown
# AERE AI Trust Chain
|
|
|
|
Trust infrastructure for an AI result, built only from pieces that already exist and are verified on their own: the agent's
|
|
post-quantum identity, the attestation of the model artifact, the host's runtime record, the agent's policy and signed ledger, the
|
|
Proof of AI envelope of the output, and the chain as the witness of time. This component adds **no new proof**: it adds the
|
|
**links** between those proofs, in one bundle, judged by one verifier that calls the existing verifiers and checks only that the
|
|
digests, the identities and the times agree.
|
|
|
|
| facet | what proves it | the link checked here |
|
|
|---|---|---|
|
|
| identity | `agents/` (agentId derived from an ML-DSA-65 key) | the ledger, the bundle and the output name the id the key derives |
|
|
| version | Proof of Software attestation of the model artifact (hybrid signature) | the output's `model.weightsSha256` is an artifact of the attestation; the version labels agree |
|
|
| runtime | the verify-layer sidecar's `runtime` record in its audit log (chain, head) | the host ran that same artifact (`matches`), before the output; the record is an entry of an intact log that continues the attested head |
|
|
| permissions | the agent's policy and ledger (`agents/`) | the ledger verifies; an **allowed** entry links the output by its provenance hash; the entry's time matches the output's |
|
|
| provenance | the Proof of AI envelope (AIP-23; digests only) | the envelope verifies with the AIP-23 reference verifier; notarized, its finality is read under a post-quantum certified anchor |
|
|
| witness | the ledger head notarized on Aere (`agents/agent-ancora.mjs`) | the heads read back through the reference verifier become the ledger's time anchors; without them every time is the key holder's statement |
|
|
|
|
Verdict: `VALID` when every present level PASSED **and** the witness PASSED; `INVALID` when a level FAILED; `PARTIAL` otherwise
|
|
(an UNMEASURED level, or no witness). Every level reports what it rests on. A verdict says that the bytes link and who vouches for
|
|
each link. It does not say the model is good, the host is honest, or the output is true.
|
|
|
|
```
|
|
import { construieste, verifica } from './lant-de-incredere.mjs';
|
|
const bundle = construieste({ ledger, policy: { policy, policyHash }, proofOfAi, software: { attestation }, runtime: { record, auditLog, head }, witness: { heads: [notarizedHead], chainId: 28001 } });
|
|
const v = await verifica(bundle, { rpc: 'https://testnet-rpc.aere.network', chain: 28001 }); // rpc: only for notarized pieces
|
|
```
|
|
|
|
## What it is not
|
|
|
|
- Not an attestation of execution in a TEE: the runtime record is the **host's declaration**, as the sidecar says; what is checkable
|
|
without trusting the host is that the declaration was made before the output and sits in a history published outside the host.
|
|
- Not a judgement of the signer of the model attestation: who holds the signing keys is `pos.mjs verify --signer`'s question.
|
|
- Not a judgement of the content: prompts, inputs and outputs are digests; the verifier proves that bytes with these hashes were
|
|
named, not what they say.
|
|
|
|
## Probes
|
|
|
|
```
|
|
AERE_VERIFY_PROOF=<verify-proof.mjs from aere-node> node proba-lant-de-incredere.mjs # no network: 13 rows (the chain, then every link broken on purpose)
|
|
AERE_VERIFY_PROOF=... node proba-lant-de-incredere.mjs --control-negativ # 8 plantings in a copy of the verifier; each must turn its fixture red
|
|
AERE_VERIFY_PROOF=... AERE_NOTARY_KEY_FILE=<key> AERE_ETHERS_DIR=<dir with node_modules/ethers> node proba-lant-de-incredere.mjs --viu
|
|
# plus the witness on testnet 28001 (a notarization paid with a test key)
|
|
```
|
|
|
|
The probes use the real children beside this component: the verify-layer sidecar (record, attest-head), the agents (ledger, policy,
|
|
anchor), proof-of-ai, and the AIP-23 reference verifier named by `AERE_VERIFY_PROOF` (without it the probe exits 2, NEMASURAT). The
|
|
model artifact and its Proof of Software attestation are a committed fixture (`fixturi/`: 4 KB of random bytes attested with
|
|
laboratory keys by `pos.mjs`, which is not part of this component; the digest is recomputed from the bytes, never read from the
|
|
attestation). `--viu` writes its evidence in `dovezi/`.
|