{
  "disclosure": "DEMONSTRATION ONLY. The c=US root is a demonstration root; the directory behind these services is a fixture, not a live LDAP server. No network or OpenLDAP write occurred.",
  "date": "2026-10-03",
  "producedBy": "Claude (Anthropic), Claude Code, at Peter Bachman's request",
  "certificates": {
    "cUsRoot": {
      "file": "c-us-root.pem",
      "version": "X.509v3",
      "subject": "CN=Peter Bachman,OU=Root of Trust (YubiKey PIV\\, Demonstration),O=c=US Project (Demonstration),C=US",
      "issuer": "CN=Peter Bachman,OU=Root of Trust (YubiKey PIV\\, Demonstration),O=c=US Project (Demonstration),C=US",
      "san": [],
      "eku": [],
      "notBefore": "2026-10-01T21:56:42+00:00",
      "notAfter": "2031-09-30T21:56:42+00:00",
      "sha256": "D0F735A3FEE9316BA0AF39828B9D87FCFB39E8958DC3C39265E5BDBC590460E4"
    },
    "claudeMtlsClient": {
      "file": "claude-mtls-client-cert.pem",
      "version": "X.509v3",
      "subject": "CN=claude-agent mTLS client,OU=AI-Agents,O=c=US Project (Demonstration),C=US",
      "issuer": "CN=Managed CA ca946ed8a0fa60f0bbec9b3098aab788,OU=www.cloudflare.com,O=Cloudflare\\, Inc.,L=San Francisco,ST=California,C=US",
      "san": [],
      "eku": [
        "clientAuth"
      ],
      "notBefore": "2026-10-01T23:57:00+00:00",
      "notAfter": "2026-12-30T23:57:00+00:00",
      "sha256": "9EC5271AE068F262EF3D24D72B2B6538F625F9F0E1D587380B11C8D5E523F6CD"
    },
    "tpmAgent": {
      "file": "tpm-agent-cert.pem",
      "version": "X.509v3",
      "subject": "CN=tpm-agent-demo-001,OU=AI-Agents (TPM-attested),O=c=US Project (Demonstration),C=US",
      "issuer": "CN=Peter Bachman,OU=Root of Trust (YubiKey PIV\\, Demonstration),O=c=US Project (Demonstration),C=US",
      "san": [
        "wimse://cequs.com/agents/tpm-agent-demo-001"
      ],
      "eku": [
        "clientAuth"
      ],
      "notBefore": "2026-10-02T01:25:16+00:00",
      "notAfter": "2026-11-01T01:25:16+00:00",
      "sha256": "7E442AADD52F54018B2FC992D6B10AE11BB54530659D54E020C83F7E0B15B96F"
    },
    "claudeSigner": {
      "file": "claude-signer-cert.pem",
      "version": "X.509v3",
      "subject": "C=US,O=c=US Project (Demonstration),OU=AI-Agents,CN=Claude Sonnet 5 session ea476b28-d9ec-4be2-8903-d21abb78f164",
      "issuer": "CN=Peter Bachman,OU=Root of Trust (YubiKey PIV\\, Demonstration),O=c=US Project (Demonstration),C=US",
      "san": [],
      "eku": [],
      "notBefore": "2026-10-01T21:56:42+00:00",
      "notAfter": "2027-10-01T21:56:42+00:00",
      "sha256": "906131CFB8EE80C8207EBD13B942BC5A30DDE226AD2791CA42509D727B792F39"
    }
  },
  "tests": [
    {
      "name": "Claude's mTLS client certificate (YubiKey PIV slot 9A) to agent.sugarbushagent.com",
      "client": ".NET HttpClient with the Windows smart-card key provider; PIV PIN entered by the operator",
      "trust": "Cloudflare edge verifies the client certificate against the Cloudflare-managed client CA; the Worker maps the verified fingerprint to the directory entry and checks status, scope and grant window",
      "results": [
        {
          "request": "GET /whoami",
          "http": 200,
          "response": {
            "certificateFingerprintSha256": "9EC5271AE068F262EF3D24D72B2B6538F625F9F0E1D587380B11C8D5E523F6CD",
            "certificateAuthenticated": true,
            "certificateSubject": "CN=claude-agent mTLS client,OU=AI-Agents,O=c=US Project (Demonstration),C=US",
            "certificateIssuer": "CN=Managed CA ca946ed8a0fa60f0bbec9b3098aab788,OU=www.cloudflare.com,O=Cloudflare\\, Inc.,L=San Francisco,ST=California,C=US",
            "certificateNotAfter": "Dec 30 23:57:00 2026 GMT",
            "agent": {
              "identifier": "wimse://cequs.com/agents/claude",
              "dn": "cn=claude-agent,ou=AI-Agents,o=Cequs,c=US",
              "status": "active",
              "scopes": [
                "maple.measurement.read",
                "maple.lot.grade.propose"
              ],
              "grantStart": "2026-10-01T00:00:00Z",
              "grantEnd": "2026-12-31T23:59:59Z",
              "sponsor": "peter"
            }
          }
        },
        {
          "request": "POST /grade maple.lot.grade.propose (granted)",
          "http": 200,
          "allowed": true,
          "reason": "authorized certificate and directory grant"
        },
        {
          "request": "POST /grade maple.lot.grade.finalize (not granted)",
          "http": 200,
          "allowed": false,
          "reason": "requested scope is not granted"
        }
      ]
    },
    {
      "name": "TPM-held sensor agent key to farm.sugarbushagent.com",
      "client": "tlslite-ng 0.8.2, TLS 1.3; CertificateVerify signed inside the TPM 2.0 (TPM2_Sign)",
      "trust": "Cloudflare edge checks proof of possession; the Worker checks the chain to the c=US root and the farmer's grant",
      "results": [
        {
          "request": "GET /whoami",
          "http": 200,
          "tls": "TLS 1.3, 1 signature made inside the TPM",
          "certificateAuthenticated": true,
          "agentId": "wimse://cequs.com/agents/tpm-agent-demo-001",
          "issuer": "c=US root (YubiKey slot 82)",
          "grantStatus": "revoked (by the farmer at the end of the walkthrough)"
        },
        {
          "request": "Attacker: the sensor's real certificate with a different private key",
          "http": null,
          "result": "Cloudflare ended the TLS handshake (CertificateVerify failed)"
        },
        {
          "request": "Attacker: self-signed lookalike with the same name and agent ID",
          "http": 403,
          "result": "not issued by the c=US root"
        }
      ]
    }
  ],
  "related": {
    "tls13Interop": "https://github.com/tlsfuzzer/tlslite-ng/issues/563",
    "previousSignedMessage": "https://cequs.com/attestation/signed-messages/2026-10-02-tls13-client-cert/"
  }
}