spec: image-trust contracts — measured, not asserted, for OS and agent images - #287
Merged
Conversation
…t images Applies the Assay's measured-not-asserted discipline to images. The estate already had Measurement (may-I-rely-on-this-number, gateEligible ceiling) but nothing forced an image's trust to be measured or the promotion gate to consume it — and agents had no image-artifact identity at all. - ImageTrustReport: per-dimension trust checks (reproducibility, attestation_verify, sbom_completeness, signature_verify, measured_boot, provenance_depth), each carrying a Measurement via $ref, plus a render-time projectedTrust ok/sad/bad. Unifies OS and agent images through subjectKind. Reusing Measurement by $ref means its invariants apply for free — a declared/assumed check cannot reach ok, a measured one must name its instrument (both verified biting). - AgentImage: agent runtime-artifact identity + provenance parallel to OSImage, distinct from process-level AgentPassport — so agents are measured like OS images. - ImagePromotionGate: requires trustReportRef when decision=approved (non-breaking if/then). The validator adds the cross-document rule: approved must reference a report projecting ok. Closes the self-assertable-approval gap (Assay F2) for images. validate-image-trust-examples enforces projection soundness + gate soundness. Passes the referential-integrity gate (338 schemas, all 136 $refs resolve). 5 negative tests confirmed biting; examples for an ok OS image + a sad agent image.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Applies the Assay's measured-not-asserted discipline to images, unified across OS and agents (your ask: images measured the same way, for both).
The gap this closes
The estate already had
Measurement(the "may I rely on this number" primitive with agateEligibleceiling) — but:OSImage.provenance/AgentPassportcarry only asserted refs and booleans, no measured outcome of verifying them.ImagePromotionGate.decision: approvedwas self-assertable — no gate-eligible evidence required. That's the exact F2 bug the Assay hardening removed, at image scale.What's added
ImageTrustReport— per-dimension measured checks (reproducibility,attestation_verify,sbom_completeness,signature_verify,measured_boot,provenance_depth), each carrying aMeasurementvia$ref, plus a render-timeprojectedTrust(ok/sad/bad). Unifies OS and agent images viasubjectKind.AgentImage— agent runtime-artifact identity + provenance, parallel toOSImage(distinct from process-levelAgentPassport).ImagePromotionGate— now requirestrustReportRefwhendecision: approved(non-breakingif/then).Reuse, not reinvention
Each check
$refsMeasurement.json, so Measurement's own invariants apply for free: adeclared/assumedcheck is gate-ineligible by shape (can't reachok), ameasuredone must name itsinstrument.measured_bootis fed by the existingBootProofRecord/AttestationEvidence.Enforcement (all verified biting)
validate-image-trust-examples:projectedTrustrecomputed from the checks;approvedmust reference a report projectingok(the cross-document halfif/thencan't express).Negative tests confirmed: approved-without-ref → rejected; declared+gateEligible → rejected (via the Measurement
$ref); measured-without-instrument → rejected; a gate-eligible failure →bad; approved→sad-report → rejected. Passes the referential-integrity gate (338 schemas, all 136$refsresolve). Examples: anokOS image, asadagent image (declared SBOM), anAgentImage, and the gate wired to the OS report.Same shape as the Assay, one level over:
AssayStandard→ReasoningAssayfor claims;Measurement→ImageTrustReport→ImagePromotionGatefor images.