Reviewers should read this list before opening issues. The Sigil engineering team reads it before claiming a feature works. The full per-area audits live in docs/security/*-AUDIT.md.

​
Consensus and MACA

  • MACA aggregates per-claim verification quorum within an epoch. Block finality is provided separately by sigil-consensus (BFT).
  • Conflicting attestations from independent validators yield outcome = Inconclusive; the validators are not economically slashed at MACA. Slashing is implemented at the block-validator level in sigil-consensus.
  • The MACA validator set is operator-pinned in genesis (ComputePolicy::proposer_dids, beacon_dids). On-chain dynamic rotation lands in a follow-on protocol slice.

​
Provider hardware claims

  • The capabilities JSON in provider records is opaque and not validated by the chain. The chain stores claims as-is.
  • There is no typed ProviderCapabilityAttestationStatus enum yet. Future work distinguishes self-declared, benchmark-attested, TEE-attested, sentinel-probed, and verified states.
  • There is no periodic sentinel re-probe of claimed hardware. ReputationSignalKind::Available exists but is reputation-only, not capability-binding.
  • T1 (optimistic) settlement trusts the provider’s job description until challenged. The challenge window is the only remediation path. Price T1 jobs accordingly.

​
TEE verification

​
AMD SEV-SNP

  • No real reference report fixture is bundled. Operators provide one via SIGIL_SEV_SNP_FIXTURE_DIR.
  • No dynamic VCEK fetch path is built into the chain. Operators rotate VCEKs via genesis. Tooling supports the AMD KDS chain fetch (sigil-tee-material amd-sev-snp fetch).
  • REPORT_DATA receipt-binding is gated by policy.require_receipt_binding. Operators that do not enable it accept reports without an explicit nonce.

​
Intel SGX DCAP

  • Live PCS or PCCS dynamic fetch is not part of the chain. Operators rotate Intel collateral via genesis updates on Intel’s PCS schedule.
  • Per-FMSPC TCB Info for mixed-CPU fleets in one chain is not implemented. Single FMSPC per chain genesis.
  • nextUpdate clock-time enforcement is operator-managed via genesis rotation, not chain-side wall-clock.

​
Intel TDX

  • Same rotation gaps as SGX DCAP.
  • Quote v5 and TD Report v1.5 are not supported. The verifier targets Quote v4 and TD Report v1.0.
  • TD_ATTRIBUTES and XFAM policy gates are parsed but not enforced beyond shape.

​
Arm CCA

  • Arm has not published a stable production root CA for IAK provisioning. Operators pin IAK public keys directly via pinned_iak_pubkeys_sec1. When Arm publishes a root, a follow-on phase adds the chain.
  • Platform-token / realm-token cross-binding is deferred. The verifier validates the realm token only.
  • CCA platform-lifecycle, TCB, and SW-component claims are not yet enforced.
  • REM (Realm Extensible Measurement) per-register policy is not yet enforced.

​
Tooling — sigil-tee-material

  • HTTPS fetch uses operator-controlled DNS and TLS roots. Pin Intel and AMD certificate fingerprints separately if the threat model requires bypassing the system root store.
  • Arm CCA has no fetch subcommand by design; no public Arm endpoint exists.
  • Bundle expiry is best-effort. When a CRL or TCB Info has a parseable nextUpdate, the bundle’s expiresAt is set; otherwise None. Operators monitor rotation cadence themselves.

​
GAL and OAS lineage

  • AgentLineageProof2025 is the only supported proof format. Future formats require new resolver rules.
  • ENR revocation propagates within a shard only. Cross-shard propagation is a follow-on slice.
  • OrgRootSource trust depends on the resolver’s RPC client. Use HttpSigilAnchorClient against a trusted chain RPC, not a custom implementation.

​
Compute marketplace

  • Storage-receipt settlement is not shipped. Out of scope for v1.
  • No on-chain micropayment streaming. Settlement is per-receipt, not per-second or per-token mid-stream.
  • No cross-chain settlement. MINT settlement is on-Sigil only.

​
Wallet and RPC

  • Wallet UX beyond the launch-required RPC smoke surface is follow-on work. Typed gal_* helpers exist; richer flows ship later.
  • No hardware-wallet integration in the launch wallet binary. Software keys only.

​
Deployment

  • Sigil mainnet Kubernetes manifests are source-controlled but not live; production launch depends on final image digests, live operator secrets, final signed genesis publication, DNS/cert-manager, and Prometheus Operator CRDs.
  • No automated genesis-rotation tooling for compute_params.<vendor>_trust_anchors. Operators rotate via genesis upgrades.

​
Cross-chain

  • Bridges are an explicit non-goal for v1.0.
  • IBC integration lands in v1.1.
  • L0 / subnet primitives are out of scope and forbidden in public marketing for at least 18 months post-mainnet.

​
How to read this list

Each entry is enforceable. If a reviewer can demonstrate a feature does work despite an entry here, that is a documentation defect — open an issue at github.com/l1feai/sigil/issues.

​
See also