boundaryattest-export

BoundaryAttest-gated export/import

This optional example signs an exact agentenv export bundle with BoundaryAttest's Python Interop Profile v0.1 example, then refuses to run agentenv import until all of these checks pass:

1. BoundaryAttest accepts the strict three-field envelope, expected Ed25519 public key, canonical claim, and signature.
2. The claim says server_attested, agentenv.export_bundle, success, and a supported export_kind (full_dag or snapshot).
3. SHA-256 of the received bundle bytes matches claim.artifact_hash.
4. agentenv import reads the same private staged copy that was hashed.

The final step avoids a check/use race: changing the received path after it was hashed cannot switch the bytes that agentenv imports.

Run the fixture

Keep BoundaryAttest as a separate checkout; no Python or crypto dependency is added to the agentenv binary. This example is tested against BoundaryAttest commit 89c6c4706b368651c2549d7e43de08c24f3079e5.

git clone https://github.com/cullenmeyers/BoundaryAttest.git /tmp/BoundaryAttest
git -C /tmp/BoundaryAttest checkout 89c6c4706b368651c2549d7e43de08c24f3079e5

make verify-boundaryattest BOUNDARYATTEST_DIR=/tmp/BoundaryAttest

The Docker target creates a parent with two branch tips, tags candidate B as winner, exports the complete DAG, signs its digest, verifies and imports it into an empty root, and checks that HEAD, both branches, the tag, and their files survived. It also proves that import is not reached for:

• a one-byte bundle change (artifact_hash_mismatch);
• an edited signed claim (invalid_signature);
• a different expected key (public_key_id_mismatch);
• an extra envelope field (strict-envelope rejection); and
• a validly signed client_observed claim (agentenv semantic-policy rejection).

On Linux, the same fixture can run without Docker:

python3 -m venv /tmp/agentenv-boundaryattest-venv
/tmp/agentenv-boundaryattest-venv/bin/pip install \
  -r /tmp/BoundaryAttest/examples/python-interop-v0.1/requirements.txt
go build -o /tmp/agentenv .

PATH=/tmp/agentenv-boundaryattest-venv/bin:$PATH \
  bash examples/boundaryattest-export/demo.sh \
  /tmp/BoundaryAttest/examples/python-interop-v0.1 /tmp/agentenv

Adapter usage

The receiver supplies the bundle, receipt, an independently trusted public key, an empty destination root, and a local BoundaryAttest reference checkout:

python3 examples/boundaryattest-export/verify_and_import.py \
  environment.agentenv.gz \
  environment.agentenv.gz.receipt.json \
  host-public-key.pem \
  --interop-dir /path/to/BoundaryAttest/examples/python-interop-v0.1 \
  --agentenv /usr/local/bin/agentenv \
  --import-root /fresh/agentenv-root

The signer and receipt store belong outside the rewindable rootfs. The checked-in BoundaryAttest demo key is only a deterministic test fixture; use a separately managed host/orchestrator key in a real handoff.

Passing this gate proves that the expected key signed the claim and that the imported bytes match its artifact digest. It does not prove the claim was true, the export was authorized, the internal snapshots are tamper-evident, or either runtime was uncompromised.