Trust model

This page is for the reader who wants to know exactly what enforces each claim and what happens when an assumption fails. It is organized so the limits can be found without reading everything: what is trusted, what is assumed, what is guaranteed and by what, what an attacker is prevented from doing, what is only detected, what is neither, and what the verifier has to do for any of it to hold.

What is trusted, and what is not

Trusted

The enclave image identified by its PCR0 measurement, which is published and reproducible from source.
The AWS Nitro hardware root of trust and its security module, which draws the entropy and signs the attestations.
The AWS Nitro Root CA G1, embedded in the verifier as a constant.
Ed25519 and SHA-256.
The verifier’s own execution, on the reader’s machine.

Not trusted

The EC2 host the enclave runs on. It is a transport.
The network, this website, and the host that hands the enclave Base block headers. The enclave hashes and checks each header itself, and one lookup on Base confirms the block.
BitGraph’s copy of proofs, floor headers and earlier anchors. It is a convenience under a compliance lock, not the evidence.
The client that hashes the file, including this site’s own page. A client can hash whatever it likes.
The operator, Argento Computing Inc.

The trust root is one vendor and one build: Amazon’s hardware and the published enclave image. Accepting that root is a one-time decision by the reader, not an ongoing dependency. After it, a proof stands on its own, in as many copies as it is made, with nothing of BitGraph’s required to be online. The word for that is portable and independently verifiable, not decentralized.

Assumptions, and what fails with them

Assumption	If it fails
Boundary isolation	If the enclave’s memory or key can be read from outside, every guarantee under that epoch’s key collapses. Earlier epochs are untouched: their keys no longer exist.
Honest measurement	If the hardware misreports PCR0, an image other than the published one could pass as it. This is delegated to the vendor and is why the root is Amazon’s.
Reproducible build	If the pinned build stops reproducing the published PCR0, the measurement means only “some image AWS measured”. The build pins every input and can be checked by anyone; a lapse is a defect to report.
Nonce freshness	A predictable or repeated nonce would let a position be precomputed or replayed within an epoch. The nonce is 32 bytes from the hardware generator.
Monotonic counter	If the counter repeated or moved backward within an epoch, positions inside it would be ambiguous. The counter is per chain, single-threaded, and in enclave memory.
Position before digest	If a position record could be minted after a digest had reached the enclave, the position would be a label. The position record has no field for a digest and is signed at allocation; the commit signature covers its hash.
Honest Base blocks	The floor is a Base block’s time, which the enclave checks against Base mainnet’s schedule for its number and against its own clock. That the block is Base’s own is confirmed by one lookup on Base, by number, comparing the hash. Coinbase runs Base’s sequencer; if Base’s record of its own blocks were wrong, the floor would be too. The floor is the newest block, not a confirmed one: a reorganization near it can orphan it, and the lookup then fails, so that bound is lost rather than silently wrong. Earlier proofs’ floors rest the same way on Ethereum block times.
A strict verifier policy	A verifier that accepts any measurement, or skips the attestation, has verified a signature by an unknown key. Everything below the cryptographic class depends on the reader pinning PCR0.

What is guaranteed, by class

Each class names what it assumes and what weakens it. They are not interchangeable, and a verifier that checks one has not checked the others.

Cryptographic: The Ed25519 signature is valid over the canonical signed body under the proof’s public key. Assumes the security of Ed25519 and SHA-256 and correct canonicalization. Trusts nothing beyond the mathematics and the reconstruction logic.
Causal ordering: A position existed, signed and without a digest, before this digest was bound to it. Assumes the boundary is uncompromised and is the published image. Weakened to “some key asserted this” by any verifier that does not pin the measurement.
Sequence: This proof occupies a position linked to its predecessor by the previous-proof hash, within a named epoch. Assumes the reader holds the neighboring proofs to check the links. Counters alone do not establish order across a gap.
Integrity: Every field in the signed body is tamper-evident. metadata, timestamps and claims sit outside the signature and are advisory; the attestation, the agency envelope and the position record are outside it but self-authenticating.
Exact bits: The proof is about one byte sequence. Any transformation that changes a byte produces a file the proof does not cover.
Privacy: Only the digest is committed. Assumes the client hashes locally, which is true of this site, the SDK and the MCP server and is a property of each client, not of the protocol. Recording is not private: the digest, the position and its floor block are published.
Portability: Verification is offline and requires no BitGraph service. The external references are lookups on public chains, against any node or explorer: that the floor block is Base’s own (Ethereum’s, on earlier proofs), and that the ceiling’s block is Base’s own.
Temporal: From the proof alone, one direction. The position was placed after the block its proof names as the floor was made: the enclave hashed that block’s header itself, and a block’s hash exists only once the block does. After the commit, the next BitGraph in the chain carries this proof’s hash: a bound in position, which does not convert to a wall-clock bound and is not claimed as one.
Ceiling in time: After a commit, the ceiling writer puts a Merkle root over new records’ proof hashes into a Base transaction from its published address. The record existed by that block’s time. The writer can make a ceiling late, or not at all, but never early: a proof hash does not exist before its commit. That is why its key needs no enclave: it is an ordinary key, held by the operator on BitGraph’s host. Until Base posts the block’s data to Ethereum the ceiling rests on Base’s sequencer; after, on Ethereum. The status a ceiling file states is what BitGraph’s Base node reported when the file was written, not something the file proves; any Base node answers it again.
Attestation: The Nitro document’s user data equals SHA-256 of this proof’s signed body, and the document chains to the AWS Nitro Root CA G1. Assumes the reader parses and validates it; the core verifier deliberately leaves that to the audit package.
Deployment: Proofs from the public service carry enforcement: "measured-tee" and the published PCR0. BitGraph’s copy is under a ten-year compliance lock, so the operator cannot delete what it holds. That is an operational fact about this deployment, not a protocol guarantee.

Threats

Prevented: impossible without breaking an assumption above

Retroactive position fabrication. No operation produces a position signature over a body containing a digest.
Double consumption. The position is deleted synchronously on lookup; the event loop is single-threaded.
Position swapping. The position record’s hash is inside the signed body.
Forgery under a closed epoch’s key. Keys live only in enclave memory and are destroyed at restart.
Silent epoch continuation. Initialization is fail-closed; a genesis must be explicit.
Tampering with signed fields in transit. Any edit breaks the signature.
Downgrading the tier field. enforcement is signed.

Detected: possible, but leaves evidence

Forked epochs. A verifier that has seen both successors of one predecessor rejects the second. The registry is per verifier process, so a fork whose branches are never seen together is not detected; this is detection, not prevention.
Rollback of the chain. A replayed predecessor produces two proofs naming the same previous hash, which the audit tool reports.
Substitution or backdating within a sequence. An entry cannot occupy a position earlier than the one it took.
Attestation failure. Reported by the audit tool, never silently ignored.

Neither prevented nor reliably detected

Compromise of the boundary or its key. Forged proofs under that epoch’s identity are indistinguishable from real ones. The damage is contained to one epoch, identified permanently by its identifier, and recovered by quarantining it. It is not retroactively repairable.
A malicious client. It hashes whatever it wants; BitGraph positions that digest faithfully.
A compromised build pipeline. Mitigated only by the reproducible build. If that lapses, PCR0 means “some image AWS measured”.
Measurement drift. A legitimate rebuild changes PCR0. Verifiers pinning the old value reject valid proofs; there is no automated allowlist distribution, so a reader obtains the current measurement out of band.
A malicious operator. Can refuse service, hand the enclave an older Base header than the newest (a looser floor, still true, and never lower than the last one), decline to write a ceiling, or lose its copy. Cannot forge or, given the compliance lock, delete what the copy holds.
Base censorship or outage. The enclave opens no position without a Base floor, so recording stops rather than producing floorless proofs, and ceilings wait. Ordering within an epoch survives. Across epochs, the public blocks are the only common reference, so a sustained outage leaves a new epoch unrelatable to the old one by public evidence.
Collusion among independent boundaries. Two enclaves are two sequences with no global order. The protocol does not arbitrate between them.
Omission. A record that was never made leaves no trace. Counter gaps are expected, so a gap never shows an omission; only an external expectation of what should be there can.
A malicious verifier. It can lie to its own user. The mitigation is that anyone can repeat the verification.
Denial of service. Rate limits exist at the host and are not a security boundary.

Privacy exposures

Public digests. Every recorded digest, position and floor block is published, permanently.
Dictionary confirmation. Digests are not salted. For a low-entropy file, such as a short document from a known template, anyone can hash candidates and confirm whether one was recorded. State this to anyone with sensitive low-entropy content.
Correlation. Recording many files from one workflow leaves an adjacency pattern in the counters, even though contents do not.
Operator visibility. The host sees source addresses and digests.
Attribution is permanent. The signed attribution field, and any metadata a client attaches, cannot be removed later. Put nothing private there.
No deletion. The lock on BitGraph’s copy applies to everyone, including the operator.

What a verifier is responsible for

Pin the measurement. Set allowedMeasurements to the PCR0 you accept and require measured-tee. The published value is 5a947cc66095adcceefa9e5ece5d1416dfe08c3470df1bcaa5b2bc5267b0480e6cdc172fe077cd06b0afb07614307973 (enclave v10, from 2026-10-07 23:59 UTC; earlier images in PINS.md), and you can rebuild it yourself.
Require and validate the attestation. The core verifier does not parse it; the audit package does, chaining to the embedded Nitro root and checking user data against the signed body.
Check the artifact binding. A result whose artifactBinding is not-checked has not tied the proof to any file.
Hold the neighbors for chain claims. Order across a gap is not established by counters alone.
Hold the floor and the ceiling for temporal claims. The floor is signed into the proof; confirm its block with one lookup on Base. The ceiling is the ceiling file, which an export carries once it exists. An earlier proof’s Ethereum floor needs its block header, which its export carries.
Treat unsigned fields as advisory. metadata, timestamps and claims are never evidence.
Refuse debug enclaves. A measurement of all zeros means a debug-mode enclave; treat its proofs as software tier.

Review status

The properties above are argued from the published source and from the reproducible measurement. The implementation has not had an independent security audit. In particular, single-use consumption under concurrency is argued from the runtime’s single-threaded event loop rather than tested adversarially, and fork detection is per verifier process. Anyone evaluating BitGraph for a setting where these matter should read the source, rebuild the measurement, and run the negative cases against the verifier before relying on it.

Where next

LimitsThe non-claims, stated one by one.
Self-host a TEERebuild the enclave image and confirm the published PCR0 yourself.
VerificationThe checks, the results, and what they cannot conclude.
Audit a bundleCheck many proofs, their order, floors and ceilings, offline.