Interactive experiment

Boot binding trace

Choose a concrete trace. The model reports first instruction fetch and first sideload-key release separately; each row is a synthetic policy example.

Controls

Trace

Synthetic transaction scenarios only; not signature verification, RTL, DMA timing, key-manager behavior, or silicon evidence.

Static casesCurrent verified image: fetch and key release allowed. Stale version: both rejected. Digest A then fetch B: both rejected. Old boot_done from another transaction: both rejected. Invalid signature: first fetch and key release are rejected. Debug lifecycle requesting a production key: fetch is evaluated under fetch policy; production key release is rejected. These are independent boundaries.