TEE — AWS Nitro Enclave Attestation

For high-value decisions, Heron's decision logic runs inside an AWS Nitro Enclave — a hardware-isolated environment where not even the host VM can read memory or tamper with execution.

Architecture

┌─ Host VM (EC2 c6a.xlarge) ─────────────────────────────────────────────┐
│  tee_cycle.sh: checks if rebalance is due (free, read-only)            │
│  If yes → builds source tarball → launches enclave                     │
└────────────────────────────┬───────────────────────────────────────────┘
                             ▼
┌─ Nitro Enclave (isolated) ─────────────────────────────────────────────┐
│  Runs the SAME decision logic (swarm, net-edge, plan)                  │
│  Produces: plan_hash, attestation_document (PCR measurements)          │
│  Signs the decision with enclave-held key                              │
└────────────────────────────┬───────────────────────────────────────────┘
                             ▼
┌─ Attestation document ─────────────────────────────────────────────────┐
│  PCR0: enclave image hash (proves which code ran)                      │
│  PCR1: kernel hash                                                     │
│  PCR2: application hash                                                │
│  user_data: plan_hash binding (proves THIS decision came from THAT code)│
│  AWS certificate chain: proves it ran on real Nitro hardware           │
└────────────────────────────┬───────────────────────────────────────────┘
                             ▼
┌─ On-chain submission ──────────────────────────────────────────────────┐
│  Host submits the transaction (enclave cannot access network)          │
│  Attestation stored alongside the decision in history                  │
│  Anyone can verify: code hash + plan_hash + AWS signature              │
└────────────────────────────────────────────────────────────────────────┘

What TEE Proves

Claim	How
Decision made by exact repo code	PCR0 = enclave image hash of the built code
Plan matches on-chain tx	plan_hash in attestation user_data = submitted tx content
No tampering mid-flight	Not even the host operator could alter the decision
Real hardware	AWS certificate chain proves Nitro, not a simulator

PCR Measurements

PCR	Contents
PCR0	Enclave image hash (which binary ran)
PCR1	Kernel hash
PCR2	Application hash

These are measured at launch and locked — any code change produces different PCRs.

When TEE Runs

Trigger	Description
On deposit	First decision for a new vault
Scheduled	Every 6 hours for active vaults
Max frequency	6 launches/day per vault (cost control — each launch ~$1 AWS)
Cooldown	1 hour between launches

Verification Flow

Anyone can verify a TEE-attested decision:

Download the attestation document (GET /api/tee/download)
Decode the CBOR/COSE envelope
Walk the X.509 certificate chain to AWS's self-signed Nitro root
Verify the signature
Check PCR0 matches the repo's build hash
Check user_data field contains the expected plan_hash

Server-Side Verification

The backend also provides on-demand verification:

POST /api/tee/verify
→ Parses COSE_Sign1 envelope
→ Walks X.509 chain to AWS Nitro root
→ Verifies signature
→ Cross-checks PCRs + plan_hash binding
→ Returns checklist of what was verified

API

Endpoint	Description
`GET /api/tee`	Current attestation status and metadata
`POST /api/tee/verify`	Run cryptographic verification on demand
`GET /api/tee/download`	Full attestation document as downloadable JSON

Honest Framing

The current TEE integration is a verified spike run — the enclave was launched, produced a real hardware-signed attestation, and was terminated to stop billing. It is not a continuously-running TEE service. The attestation itself is real hardware-signed proof captured on 2026-07-28.

Roadmap

Migrating TEE attestation from AWS Nitro to GCP Confidential Computing (Confidential VMs with AMD SEV-SNP) to unify infrastructure under a single cloud provider.

Verifiable Debate Ledger Deposit