- promptseal: KEM X25519 → X-Wing (X25519 + ML-KEM-768), making the prompt-confidentiality envelope
POST-QUANTUM (secure if either half holds) — matching the strict-PQ posture of ML-DSA staking. The
proof layer was already PQ (keccak + information-theoretic Freivalds). 6/6 still green.
- attestation: a REAL TEE quote verifier (closes the audit's TEE stub). Verify() checks an ECDSA-P256
report signature, an x509 cert chain to a PINNED vendor root, a measurement allow-list, AND that the
report binds the operator's confidentiality key — so a sealed prompt opens ONLY inside the attested
enclave (custody end to end). 6/6 incl. forged-sig, unpinned-root (an attacker's own well-formed
quote is rejected), wrong-measurement, unbound-key, tampered-measurement.
- poi/scale_test.go: 1/10/100/1000-node scaling. VerifyOpening is per-node-independent → linear
aggregate throughput (542 → 542k proofs/sec) at constant latency, and fraud-caught probability
→ 1.0 as nodes grow. + BenchmarkVerifyOpening.
Seals a prompt to an operator's registered KEM key so it is NEVER plaintext on the wire and only
the chosen operator opens it (RFC 9180 base mode, X25519-HKDF-SHA256 + ChaCha20-Poly1305, over
cloudflare/circl). aad binds the request (intentID) — no cross-request replay. 6/6: round-trip,
wrong-key-can't-open, tampered-ciphertext-rejected, wrong-aad-rejected, observer-learns-nothing
(no plaintext in blob + two seals differ), malformed-key-rejected.
zeekay