fix(security): anchor audit chain root in TEE attestation to prevent chain substitution (AUDIT-002) - #258
Merged
Conversation
imran-siddique
force-pushed
the
fix/audit-002-chain-external-anchor
branch
from
June 8, 2026 20:56
e299610 to
ce9741b
Compare
…chain substitution (AUDIT-002) verify_chain() now checks the chain_root against an externally-committed anchor value that is derived from a per-session TEE attestation nonce (SHA-256 of chain_root_bytes || session_id_bytes). An attacker who discards _entries and constructs a fresh self-consistent chain will get a different root that fails the anchor check even though all internal hash links pass. In dev / Level-0 mode (software-only TEE) verify_chain emits a warning instead of failing. Closes #146. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…loses #47) (#260) 29 tests organized into five classes — TestAudit001 through TestAudit005 — covering monotonic timestamps, TEE anchor / chain substitution prevention, canonical entry format with SHA-256 hashing, contiguous prev_entry_hash chaining, and TRACE Claim sequence_number / prev_claim_hash linking. Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
imran-siddique
force-pushed
the
fix/audit-002-chain-external-anchor
branch
from
June 8, 2026 21:09
ce9741b to
5cdcf1a
Compare
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
set_tee_anchor(chain_root)toAuditChain— records the chain root as an externally-committed value thatverify_chain()checks in addition to internal hash links.SessionManager.create_session()now derives a per-session nonce asSHA-256(chain_root_bytes || session_id_bytes), passes it toctx.tee_provider.get_attestation_report()(committing the root into TEE evidence), then callschain.set_tee_anchor(chain_root).verify_chain()fails if the currentchain_rootno longer matches the anchored value — a replaced chain has a different root and cannot pass this check even if all internal hash links are valid. In dev / Level-0 mode (no anchor set), a warning is logged but verification does not fail.Closes #146.
Test plan
test_audit_chain_anchor.py(13 new tests):test_set_tee_anchor_accepts_matching_chain_root— happy path anchor settest_set_tee_anchor_rejects_mismatched_value— programming-error guardtest_verify_chain_warns_when_no_anchor— dev mode warningtest_verify_chain_fails_on_chain_substitution— attack path: graft replacement_entries, verify failstest_create_session_sets_tee_anchor— anchor present aftercreate_sessiontest_create_session_anchor_nonce_encodes_chain_root— nonce derivation verifiedtest_verify_chain_fails_after_chain_substitution_via_session_manager— end-to-end attack pathtest_tee_provider_failure_still_sets_anchor— resilience pathtest_session_manager.py— all 19 existing tests pass withtee_providermock added to_make_ctx.Generated with Claude Code