[imran-siddique]

Closes the open decisions on #439. The RFC had drifted from the code in three ways and was still marked "pending approval" while the implementation moved underneath it. Docs only.

1. Section 7's tier table was stale

Row three described cMCP's TPM tier as an "unsigned self-reported PCR digest". That stopped being true across #441 through #451: the quote is signed, the chain is verified where the host allows it, and the gateway is measured into a TPM_NT_EXTEND NV index.

The row now states what actually ships, plus the two caveats a one-line summary would bury:

• chain verification is host-dependent, because Azure runs two vTPM CA hierarchies and one carries no AIA (security(tee): source and pin the Global Virtual TPM CA - 03 root, or Azure provenance is host-dependent #453)
• the gateway measurement is not yet signed evidence, since the NV index value travels as an ordinary read

2. Section 5 P2 records the binding decision

Because extends accumulate, one certified value cannot be checked against anything. Decided: certify twice, bracketing the extend.

V0 = NV_Certify(index)     <- TPM-signed
NV_Extend(gateway_digest)
V1 = NV_Certify(index)     <- TPM-signed

verifier: V1 == H(V0 || expected_gateway_digest)

Both values are TPM-signed, so nothing is collector-asserted, and the verifier holds no state. It deliberately does not attempt to prove the history behind V0, which would require the verifier to remember prior attestations.

The alternative that looks simpler and is not sound is recorded too: reading the index and committing the result into the quote's qualifying data means the collector asserts the value it read, and a compromised gateway is the adversary.

3. Sealing moves ahead of the event log

P3 and P4 swap. The event log is 0 bytes on both Azure and GCP, so replay cannot be validated on any cloud vTPM we can provision, and it is gated on physical client hardware. Sealing the TRACE signing key is reachable today and is the step that converts measurement into enforcement, so it earns more trust per unit of effort. It still depends on P2 finishing, since the policy it seals against is the NV index.

Checked repo-wide for stale P3/P4 cross-references; there are none.

4. Section 8: decisions taken, not approvals requested

The section listed approvals needed from three reviewers. Those decisions have now been made, so it records them with pointers to where each lives. What remains genuinely open is in section 6 and is not ours to settle: client firmware TPM vendor root distribution, and whether Microsoft publishes the Global Virtual TPM CA - 03 chain in a citable location (#453).

Note on the second commit

STATUS.md was already modified in my working tree when I came to commit, and I did not author it. There are no git hooks or .claude automations in this repo that write it, so I could not determine the source; a concurrent session is the likeliest explanation. It is one table row, I reviewed it, and it is accurate and consistent with the 2026-08-01 hardware run. It is committed separately so its provenance stays distinguishable from the RFC edits. Worth a second pair of eyes on that one line.

🤖 Generated with Claude Code