From 88658a1a9f7737d7cdb9d380ea7233952e69276d Mon Sep 17 00:00:00 2001 From: cptfinch Date: Sat, 26 Sep 2026 13:48:06 +0100 Subject: [PATCH] Note SPIFFE/SPIRE as the open standard for the remote-attestation direction The strategic horizon section already covers vendor OIDC, process-tree attestation, and TPM, but doesn't name SPIFFE/SPIRE despite the whole direction (short-lived, cryptographically attested workload identity) being SPIFFE-shaped. Also calls out the concrete forcing function: Claude Code supports remote/cloud-run agent sessions, not just local ones, and local-session trust doesn't hold once minting can happen from a non-local session. --- DESIGN.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/DESIGN.md b/DESIGN.md index 9e5e7b1..3120d16 100644 --- a/DESIGN.md +++ b/DESIGN.md @@ -33,6 +33,15 @@ Deliberately *not* filed as issues: these are directions, not scheduled work. Each gets picked up when there's a forcing function, and becomes an ADR before any code lands. +- **SPIFFE/SPIRE-aligned workload attestation.** The actual open standard for + this problem — cryptographically attested, short-lived workload identity + (X.509-SVID / JWT-SVID) issued per-workload rather than trusted by virtue of + the calling OS session. Today "who can mint" means "whoever is logged into + this local session," which holds up fine on one laptop but stops holding + once minting can happen from a remote or cloud-run agent session (Claude + Code supports both). A SPIFFE SVID composes the same way a vendor-OIDC token + would — just another caveat type. **Forcing function**: the day a non-local + (cloud/remote) session needs to mint. - **Vendor OIDC tokens (Sigstore pattern).** Anthropic / Cursor / Microsoft run an OIDC issuer for their dev tools; `llms` verifies the JWT against their JWKS. Composes naturally as a caveat type. **Blocked on vendor cooperation** —