h33-attestation · v0.1.0 · released 2026-06-04

Post-Quantum Portable Attestation.

An independently verifiable artifact that survives the originating system.

The v0.1 Portability Verifier release proved a third party could independently reproduce a SACRED state_id from an enterprise bundle. This release closes the loop: the issuer produces a signed tda_v1 attestation (the canonical Trustless Decision Attestation category). The attestation verifier confirms the attestation, the bundle, and the Portability Verifier binary all agree. No H33 contact at any step. "Portable Object → Independent Verifier → Independent Reproduction. You have that for bundles. Now you have it for attestations." — Eric, June 4 2026

Constitutional invariants this release embodies

Q0 — Who bears risk? Never H33. This release bears attestation accuracy + issuance determinism + verifier correctness.

Q0.5 — Who owns the decision? Always the owner. The attestation verifier surfaces structural verdicts. It never judges decisions.

Determinism — Eric LOCKED: identical bundle + decision set + verifier version + signing key → byte-identical canonical payload (excluding issued_at_ms + signatures). Tested in the harness; passes.

v0.1.0 release

⬇

h33-issue-attestation-v0.1.0-aarch64-apple-darwin

size903,424 bytes · sha3-256132eb65f9193a7ba6e86f01badea68501ec0bf4c16262b4e7c1e312e19c3e254

Issuer ⬇

⬇

h33-verify-attestation-v0.1.0-aarch64-apple-darwin

size804,448 bytes · sha3-256bc45c6b83d16fd29e2f08f95fb25ad8391f45e3ca1a1c696db660e29ccd0bc77

Attestation Verifier ⬇

{ }

sample-attestation-claim-84711.tda_v1.json

a real signed attestation against the canonical-continuity tenant · 2 decisions · 51 KB

Sample ⬇

↺

sample-verify-output.txt

what the verifier prints when you run it against the sample — captured PASS output

Output ⬇

≡

release_manifest.json

all hashes · build environment · what v0.1 proves · v0.2 deferrals

Manifest ⬇

≡

README.md

quick-start · determinism harness · the six verifier checks · honest v0.1 caveats

README ⬇

The three-artifact loop, end to end

A third party needs three downloads. Each comes from a different surface; together they prove agreement without H33.

1 · Bundle

Enterprise portability bundle

From /workspace/portability/

2 · Attestation

Signed tda_v1 JSON

From this page (sample) or issued by your own copy of the issuer binary

3 · Portability Verifier

The canonical-replay binary

From /verifier/

Run the loop

chmod +x h33-verify-attestation-v0.1.0-aarch64-apple-darwin
chmod +x h33-independent-canonical-replay-v0.1.0-aarch64-apple-darwin

./h33-verify-attestation-v0.1.0-aarch64-apple-darwin \
    --attestation sample-attestation-claim-84711.tda_v1.json \
    --bundle tenant_insurance_claim_44962d9b-25f5-5622-bd9a-98d5580bb8a2_enterprise_bundle.tar.gz \
    --verifier-binary h33-independent-canonical-replay-v0.1.0-aarch64-apple-darwin

Expected output — six checks + replay verdicts

✓ Issuer fingerprint internally consistent
✓ Canonical payload hash matches declared value
✓ All 3 PQ signatures verify (ML-DSA-65 · FALCON-512 · SLH-DSA-128f)
✓ Bundle hash anchor matches
✓ Portability Verifier binary hash anchor matches
✓ Each attested decision replays to its SACRED state_id
→ OVERALL: PASS ✓ — bundle + attestation + portability verifier all agree. No H33 contact required.

Honest v0.2 deferrals

Multi-platform binaries (linux x86_64 · aarch64 · darwin x86_64)
PQ-signed RELEASE artifacts (release signing key ceremony required)
Byte-deterministic builds across machines (containerized toolchain)
Production attestation-signing key ceremony (v0.1 uses dev keypair per --signing-key-dir)
Attestation revocation registry
Subscription / cadence infrastructure for periodic re-attestation
CI/CD release automation