blog: reasoning about attestation chains — from TrustMee to Cerisier

[avrabe]

2657-word technical post — within 1500-2500 body target after subtracting frontmatter + references. Mid-range for the blog (peer posts at 1651 and 3599 words).

Argument arc

Sets up two recent academic papers as the two halves of a composition story for sigil's attestation chain reasoning:

• TrustMee (Aalto, Feb 2026) — engineering pattern for shipping signed Wasm verification components alongside attestation evidence. Single-shot, no formal soundness.
• Cerisier (Aarhus, April 2026) — Iris/Rocq program logic for modular reasoning about attestation, but only inside one capability machine. No remote, no time, no key rotation, no content-addressed storage.

Neither alone covers sigil's build-time, content-addressed, time-indexed chain. The post sketches what a sister-logic judgement over the post-quantum SLH-DSA migration would look like (one boxed judgement, glossed in English) and names the draft mapping + scenarios docs in the sigil repo (companion PR: pulseengine/sigil#114).

Companion artefacts

• docs: companion docs for attestation-trust-formalization (mapping + scenarios) sigil#114 — sigil-internal mapping doc + trust-evolution scenarios doc
• pulseengine/sigil predoc — `docs/security/attestation-trust-formalization.md`
• arXiv 2604.13638 — Cerisier
• arXiv 2602.13148 — TrustMee

Status / framing

• Internal milestone, low-cost.
• Defers the full PLDI / OOPSLA / CCS publication to the 2027 cycle once `scripts/mythos/` has run against sigil and there is empirical material.
• Honest framing preserved: first-pass paper reads were search-only; the sister logic does not yet exist.