From e40f3d56103ada52947b83f7ea45f5f17c917693 Mon Sep 17 00:00:00 2001 From: Imran Siddique Date: Thu, 11 Jun 2026 09:11:53 -0700 Subject: [PATCH] docs(startup-tpm): add cmcp verify step with interactive tamper demo Verify the captured claim and audit bundle in one command, then mutate a single field and watch the signature fail. Makes the tamper-evidence guarantee tangible in the quickstart. Requires agentrust-io/cmcp#287. Co-Authored-By: Claude Fable 5 --- startup-tpm/README.md | 46 ++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 45 insertions(+), 1 deletion(-) diff --git a/startup-tpm/README.md b/startup-tpm/README.md index 2d83d80..695852f 100644 --- a/startup-tpm/README.md +++ b/startup-tpm/README.md @@ -180,7 +180,51 @@ The response is the signed `RuntimeClaim` (see `trace-output/example-trust-recor You can also export the hash-chained audit log for a closed session: ```bash -curl "http://localhost:8443/audit/export?session_id=" | python3 -m json.tool +curl "http://localhost:8443/audit/export?session_id=" > bundle.json +``` + +--- + +## Step 7 — Verify the record (and try to tamper with it) + +Save the claim from Step 6 to `claim.json`, then verify it: + +```bash +cmcp verify claim.json --audit-bundle bundle.json +``` + +``` +[cmcp verify] schema PASS +[cmcp verify] signature PASS +[cmcp verify] attestation_freshness PASS +[cmcp verify] audit_chain PASS +[cmcp verify] audit_bundle PASS (3 entries) +[cmcp verify] RESULT: PASS (verified) +``` + +Now change anything — a counter, a tool name, one character — and verify again: + +```bash +python3 -c " +import json +c = json.load(open('claim.json')) +c['gateway']['call_summary']['tool_calls_total'] += 1 +json.dump(c, open('claim.json', 'w')) +" +cmcp verify claim.json +``` + +``` +[cmcp verify] signature FAIL +[cmcp verify] RESULT: FAIL (partially_verified) +``` + +The signature covers the whole canonical claim, so no field can be altered after the fact. The same holds for the audit bundle: editing any entry breaks both its hash chain and the bundle signature. This is the tamper-evidence guarantee in one command. + +In production, pin the approved hashes so a substituted policy or catalog also fails: + +```bash +cmcp verify claim.json --policy-hash sha256: --catalog-hash sha256: ``` ---