Skip to content
ELEMENT 31

Attestation

Attestation is the step in which a Czar node proves what it is running, its sealed, signed, read-only image and its sealing state, before it joins a Grid or accepts a task.

· 2 min read

IN SHORT

Attestation is the step in which a Czar node proves what it is running, meaning its sealed, signed, read-only software image and its sealing state, before it is allowed to join a Grid or accept a task. It turns the claim that a node is still sealed and unchanged into evidence the pool checks for itself, rather than a reassurance from the installer.

Attestation is the step in which a Czar node proves what it is running, its sealed, signed, read-only software image and its sealing state, before it is allowed to join a Grid or accept a task.

Why it matters

A sealed appliance is only as trustworthy as the evidence that it is still sealed and still running the image it shipped with. Without attestation, a site would be relying on the enclosure looking intact and on the installer's word.

Attestation turns that into something the pool checks for itself. A node that cannot show the expected image does not serve. A node that was altered in transit, or whose software drifted, is refused rather than quietly admitted.

For the operator, this is the difference between a reassurance and a record. The security officer can answer the question of what is running on the rack from the Grid's own evidence.

How it works at Element 31

Every Czar carries a sealed, signed, read-only software image. Before a node joins a Grid, it attests that image and its sealing to the Grid. Before it accepts a site task, it attests again. Watchman, the integrity verification in Substrate, performs these checks on an ongoing basis.

Attestation works alongside the provenance record. Provenance says where the node came from and how it was integrated, sealed, and loaded. Attestation says that the node in the rack right now matches that record.

The same rule applies on every route and posture. A node shipped under a robot vendor's name as Czar Chassis attests exactly as a Facility Direct node does. An air-gapped node attests without any path out of the building, and a signed update bundle must verify before the node will take it.

Attestation also appears on the customer side of remote support. On a sovereign site, an uplink window for a remote session is approved only after the customer attests its own conditions: data disks detached, network isolated, console supervised, authority confirmed. The window then expires on its own. The Technology page places attestation in the wider design.

Questions this raises

What exactly does a node attest?
That it is running the sealed, signed, read-only software image it is supposed to run and that its sealing is intact. Watchman, the integrity verification in Substrate, performs the check before join, before a task, and on an ongoing basis.
What happens if attestation fails?
The node does not serve. The Grid refuses a node whose image or sealing does not match the record, whether it was altered in transit or its software drifted after install. Refusal is the safe outcome.
Is attestation different on a Czar Chassis node?
No. A node shipped under a robot vendor's name attests exactly as a Facility Direct node does. Air-gapped nodes attest without any path out of the building, and a signed update must verify before the node will take it.

KEEP READING

Related.