Open Limits

Open Limits

An honest statement of what this system does and does not cover.

Software-only by design

The engine proves tampering when the agent is honest or when we can re-measure, but a fully compromised agent with a stolen signing key can lie. Closing that gap requires hardware: TPM/TEE key sealing, remote attestation, and chip-signed measurements.

What the software layer does close:

• Key swaps - KEY_MISMATCH, enforced by the public key pinned into baseline.json at enrollment.
• Forgeable history - boss-signed, hash-chained witness.jsonl that a stolen agent key cannot rewrite.
• Redirected chain file - the baseline pins chainContract + chainId at enrollment; any mismatch refuses chain mode (ledger fallback + boot log).
• Chain lies - after each mined anchor the record is read back from the chain (CHAIN_MISMATCH on divergence; the check is skipped gracefully when the RPC read fails).
• Ops visibility - /metrics (Prometheus text) and /api/status (including chainPinned, lastReadback, batchRoot) on the localhost dashboard.

A compromised Checker can sign false hashes with a stolen key; TPM/TEE is the path to closing that. In split deployments, keep the witness key on the Boss host only. This single-box deployment keeps both keys on the same machine.

Simplifications

• Boss file re-read works because this runs on a single machine; a remote verifier would use only the signed measurement, baseline, and chain.
• Memory hashing covers AgentState{mode,limit,version} (a whitelist), not the full heap, which never stabilizes across runs.
• ledger.jsonl is a tamper-evident fallback (both it and witness.jsonl rotate to timestamped archives past 50k lines); the chain event log is authoritative.

Stack and scope

• JDK-only (javac/java, no Maven/Spring/Gradle/Javalin/web3j wrapper required).
• Binary tamper is secondary on Windows (locked JAR / classes directory); the config edit and memory endpoint are the live attack paths.
• File reads retry for 200ms; a missing file counts as tamper.

Stretch goals

Split the Checker and Boss onto separate hosts, hold keys in a TPM/HSM, keep the baseline and public key in a Boss-controlled vault, anchor to a real L2 or permissioned chain, and adopt full TPM/TEE attestation.

Full threat model

The detailed assumption-by-assumption threat model lives in the repository: docs/THREAT_MODEL.md.