# EXTERNALLY / ENVIRONMENTALLY BLOCKED — HARDWARE OR CLOUD ATTESTATION HOST REQUIRED

## WHAT IS IMPLEMENTED

Fail-closed high-assurance issuance and offline verification; release/provenance,
measurement, source signatures, deterministic semantics, signed trust state,
monotonic ledger and protected-head quorum, nonce, runtime-key and certificate
bindings. Provider-neutral acquisition dispatch supports Azure SGX report-data and
quote submission, AWS Nitro measured NSM helper interface, and Google Confidential
Space OIDC request transport. Software verifiers cover Azure RS256 SGX, Nitro
COSE ES384/PKIX and Confidential Space RS256 with pinned roots. Hardware acquisition
cannot silently fall back to a software quote. Host preflight and output-check
commands, deployment/approval instructions and permanent negative tests are included.

## WHAT HAS BEEN SOFTWARE-TESTED

Positive and hostile internally generated provider signatures; stale/replayed
tokens, nonces, measurements/PCR/debug state, key/environment/chain substitution,
release/state/ledger/policy/checkpoint bindings and revoked authority. GCP acquisition
request/response contract, limits and failure status pass in-memory HTTP tests.
Actual native Unix-socket listen is denied here (EPERM); do not treat that fixture
as socket interoperability. Missing Nitro helper refuses. The NSM helper's Python
syntax can be checked, but the official C ABI has not executed without libnsm/device.
Exact campaign populations and source hashes are recorded in assurance/v128.

## OFFICIAL VECTOR COVERAGE

The official AWS commercial root matches its published SHA-256 fingerprint.
The aws-samples historical att_doc_sample.bin authenticates its original COSE
signature and X.509 chain at the document's timestamp, and rejects as a current
Finality certificate. Sources, bytes, license and hashes are retained in
assurance/v128/provider-vectors. No official signed Azure vector was obtained.
Google's published example removes the signature, so it was not treated as a
signed vector. Generated provider fixtures are explicitly seller-controlled.

## WHAT HAS NOT BEEN REAL-HARDWARE-TESTED

No Finality measured image has been built/booted on SGX, Nitro or Confidential Space.
No approved production measurement, real issuance token, hardware-confined key,
no-export/raw-sign escape test, real provider key rotation, native CS socket run,
Nitro vsock ingress or host disaster recovery is established. No Gramine/Nitro/cloud
CLI, confidential device, Docker/container runtime or cloud credentials exists here.
The user confirmed “No host yet.” These are blockers, never synthetic passes.

## EXACT RESOURCES NEEDED

At least one: (a) SGX-capable host with reviewed Gramine/DCAP and Azure Attestation;
(b) enclave-enabled EC2 parent, nitro-cli/allocator/build runtime and measured NSM
library plus reviewed vsock ingress; (c) production Confidential Space project,
supported confidential machine, launcher socket, digest-pinned workload and service
account. Also: protected separately administered approval/head keys and floors,
authenticated provider root registry, builder and transparency service, independent
offline checker host, and durable evidence storage. Accounts/keys are provisioned
by their actual owners; this program does not invent outside operators.

## EXACT COMMANDS TO RUN

Follow research/enclave/DEPLOYMENT.md for provider provisioning and commands.
In the measured runtime: `node research/enclave/host-preflight.mjs PROVIDER` then
run the fixed issuer entrypoint with signed-request.json through reviewed ingress.
On the checker: `node research/operations/finality.mjs verify-runtime-chain
PACKAGE POLICY ARTIFACT LOCK SBOM`. Run `node research/enclave/check-hardware-output.mjs
PACKAGE POLICY ARTIFACT LOCK SBOM INDEPENDENTLY_PINNED_POLICY_SHA256 NEW_RECEIPT`.
Software regressions: `node --test tests/attested-finality.test.mjs
tests/trust-ledger.test.mjs tests/trust-ledger-adversarial.test.mjs
tests/provider-adapters.test.mjs tests/attestation-acquisition.test.mjs`.
Publication check: `node assurance/v128/release-gate.mjs --require-publish`.

## EXPECTED SUCCESS CRITERIA

Reviewed real host session; genuine pinned-provider authentication of approved
non-debug measurement; complete reproducible/verified source-to-runtime evidence;
runtime-confined issuer key; fresh separately protected heads; truthful required
source quorum; exact offline acceptance on a separate checker. Every required
negative case refuses. Host identity, custody and trusted-file coverage are reviewed,
not inferred merely from token verification. Real hardware gate remains HOLD until
these captured facts are accepted under the release approval policy.

## EXPECTED FAILURE CRITERIA

Missing device/root/current heads/approval, invalid binary/PCR/measurement, debug or
wrong hardware, stale policy/state/checkpoint, revoked key/release, copied quote,
wrong nonce/key/environment, malformed signature or unverifiable semantics: no
high-assurance FINAL. A software fixture, successful preflight, official historical
sample, draft recipe, or internally signed output receipt cannot satisfy hardware PASS.

## EVIDENCE TO CAPTURE

UTC session times and host/provider identity; exact source commit and clean diff;
locked toolchain/base image, artifact/manifest/EIF hashes, SBOM and provenance;
approved measured identity and signed release approvals; transparency entry,
inclusion/consistency and witness receipts; signed current ledger, revocations and
head packets with independently retained floor; buyer policy/nonce; raw quote/token
and issued certificate; independent offline verdicts and every negative input;
key-custody/no-export/escape-test observations; recovery/partition behavior. Store
receipts append-only. Do not capture secret keys or credentials in the audit package.

Issuer bootstrap now requires an intersecting policy approval quorum (>=2 distinct
keys) and the exact full provider-policy digest measured into the runtime. A buyer
approval credential alone cannot substitute provider roots or its policy. Legacy
single-signature requests fail. Actual protected approval custody remains a host
deployment and operator-authorization validation requirement.