{
  "bundle_id": "confidential-enclave-attestation-v2",
  "bundle_type": "confidential_enclave_attestation_evidence",
  "published_at": "2026-09-23T00:00:00Z",
  "system": "CAIN enclave attestation (Channel 9)",
  "status": "SOFTWARE_SIMULATION_ONLY",
  "attestation_class_available": "SOFTWARE_VERIFIED",
  "hardware_attested": false,
  "what_exists": [
    "An in-process Ed25519 quoting key signs a report binding a node public key (report_data) and a code measurement.",
    "The verifier checks expiry, report_data binding, allowed measurements and that Ed25519 signature; a valid software quote returns VALID_SOFTWARE_SIMULATED_QUOTE."
  ],
  "what_does_not_exist": [
    "No Intel SGX/TDX, AMD SEV-SNP or AWS Nitro quote is produced or parsed.",
    "No quote is verified against a vendor root (Intel PCS, AMD KDS, AWS Nitro root).",
    "No key is sealed in enclave memory; the host running CAIN has no confidential-computing hardware.",
    "No FIPS 140-3 HSM boundary exists."
  ],
  "verifier_behaviour": {
    "report_claiming_hardware_enclave_type": "rejected: HARDWARE_VERIFICATION_NOT_IMPLEMENTED",
    "ed25519_unavailable": "rejected: UNVERIFIED_NO_CRYPTO (was: accepted as VALID_HARDWARE_ATTESTATION)",
    "VALID_HARDWARE_ATTESTATION": "reserved; never returned"
  },
  "supersedes": {
    "sha256": "e06626b4b0daaed4f8f2a4b34b4bb63d13c9aa6857ffae3068d4e03c1394ea17",
    "reason": "The previous version declared status PRODUCTION_OPERATIONAL and SGX, SEV-SNP, Nitro and FIPS-140-3 HSM attestation OPERATIONAL, and stated that signing keys were sealed inside enclave memory. None of that existed; the verifier accepted software-signed quotes as hardware attestation.",
    "previous_status": "PRODUCTION_OPERATIONAL",
    "retrievable_from": "git history of platform-gateway/frontend/proof/bundle/v2/confidential-enclave-attestation.json"
  },
  "source_modules": [
    "cain/enclave.py",
    "platform-gateway/cain_enclave_attestation.py"
  ]
}