ProofID 101 in plain English
Informative. The normative text is SPEC.md.
The problem
A proof says a control stopped an attack. If the proof does not pin down exactly which control, which version, and which configuration, it can be moved to a different one: prove product X, ship product Y. If it does not say which machine sent the attack, the attack signal is the tester's word. If it does not say which sensor captured the evidence, anyone could have written it. If an agent's authority was never written down, nobody can show it went past it.
The fix
Give everything an identity, and treat two kinds of things differently.
- Things doing the testing sign. The arena, its interfaces, the ingress and egress points, targets that run sensors, the attack machines, the sensors, the witness. Each holds a key and signs what it emits. The keys live outside the arena, so tearing the arena down does not destroy them and a cloned arena cannot sign as the original.
- Things under test are fingerprinted. The control, the single rule, the whole solution, the agent. Each is identified by a fingerprint someone else captured. They never get a key from the test, because they must not help write their own proof.
One identity for the arena
The arena gets one root identity, and every component the arena operator runs is certified by it. Check the arena's identity once and you can check every component in it.
Some things must stay outside: the witness, the registry, the time beacon, and anyone reproving the run. If the arena certified them, they would only look independent.
What each identity is allowed to do
An identity proves who signed. It does not grant permission. Each identity has a scope: which job in the test it does and which kinds of records it may emit. A sensor cannot hand down a verdict. An agent gets credentials made for the test, limited to its declared policy, and revoked when the test ends.
The flow
- Before the run: build the list of every identity in the run, pull the independent ones from the registry, mint the arena's own, capture the fingerprints, and register the list with the test's sealed commitments.
- During the run: every record says who emitted it, what it is about, where it was captured, and which arena it came from.
- At teardown: revoke every arena identity and every agent credential, and register the revocations. The records stay checkable forever, because revoked identities stay in the registry.