Skip to content

docs(security): describe both external API surfaces in cvm-boundaries - #1119

Open
kvinwang wants to merge 1 commit into
nextfrom
docs/cvm-boundaries-v1
Open

docs(security): describe both external API surfaces in cvm-boundaries#1119
kvinwang wants to merge 1 commit into
nextfrom
docs/cvm-boundaries-v1

Conversation

@kvinwang

Copy link
Copy Markdown
Collaborator

Follow-up to #1116. docs/security/cvm-boundaries.md documents what crosses the CVM boundary, and its public-listener section predated the v0/v1 split: it showed a single Worker service with Health bolted onto the frozen method table by a parenthetical, and named AttestAppKey — a method that briefly existed on next and that #1116 reversed back to the frozen GetAttestationForAppKey.

Since that section is the reference for what an unauthenticated caller can reach, a stale method table there is worse than an incomplete one.

What changed

Two tables, one per surface. The frozen Worker at /prpc (alias /prpc/v0) with its three v0.5.11 methods, and the v1 Worker at /prpc/v1 with Info, Version, Health. Correct return types on both.

The invariant is stated, not implied. Neither surface returns key material and neither lets a caller choose what gets signed or attested. That — not the method list — is what makes the listener safe to expose, and it is why the internal socket is not a CVM boundary at all: it is reachable only by the application itself.

The cost/exposure bullets now cover v1. The existing analysis of Health's narrow oracle and GetAttestationForAppKey's per-call attestation is kept and extended with: why GetAttestationForAppKey has no v1 counterpart (a v1 app attests its own key through the internal socket, so the public listener never gained a second attestation-on-demand entry point); the difference between the frozen Info, which decodes identity from a boot attestation per call, and the v1 Info, which serves it from a cache decoded once at startup so an anonymous caller cannot drive quote generation; and the two Info methods' different public_tcbinfo reach — the frozen one always serves key_provider_info, v1 blanks it and carries no measurement registers at all.

Links now point at guest-api-v1.md as the normative v1 reference and at both protos.

No behavior change; documentation only.

The public-listener section predated the v0/v1 split: it showed one Worker
service with Health bolted onto the frozen method table by a footnote, and
said nothing about how the two surfaces bound what an anonymous caller can
cost or learn. Split the method list into the frozen surface and the v1
surface, state the invariant that makes the listener safe to expose (no key
material, no caller-chosen signing or attestation -- that lives on the
internal socket, which is not a CVM boundary), and extend the cost/exposure
bullets to the v1 methods: cached identity behind Info, the retry throttle,
the deliberate absence of a v1 attestation-on-demand entry point, and the
public_tcbinfo reach difference between the two Info methods. Point at
guest-api-v1.md as the normative reference and at agent_rpc_v1.proto
alongside the frozen proto.
Copilot AI lite review requested due to automatic review settings August 24, 2026 16:13

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants