Skip to main content
The report-data binding commits a report to the signing address plus your nonce. Two invariants govern how that binding is validated in the nested model attestation, which is gate 6 of the seven-gate baseline. They decide what a baseline-verified result actually proves. A binding is the link that says this attestation belongs to this specific thing. An attestation signed correctly but bound to nothing is a notarized signature on a blank page: genuine, and proof of nothing in particular.

​
Binding Uses the Signing Address Only

The binding is keyed on the signing address, not the model public key. The address is the stable, comparable handle that gets recomputed and matched against the report data. Keying on the address alone would leave a gap, which the second invariant closes.

​
An Entry Without a Model Public Key Is Not a Binding

When the model attestation is walked looking for a binding, an evidence entry lacking a model public key does not count as one. An address match alone is not accepted: the model public key must be present for the entry to qualify. So the model public key is always validated as part of accepting a binding. You never reach a state where an address binding is confirmed while the model public key is missing. Without this, someone presenting an entry that matched the expected signing address but carried no model public key could pass it off as a valid binding without ever committing to a model identity. Every accepted binding ties together both the signing address and a concrete model public key. (The signing key and the model public key are two names for the same value, so there is one key in play here. See the note on the pipeline page.)

​
The Two Signing Addresses Stay Separate

There are two signing addresses in play, the top-level one and the model’s. Nito keeps them separate, and the baseline does not require them to be equal. It would be easy to assume a valid attestation means the top-level report and the model share one signing identity. That is not the invariant. Each binding is checked on its own terms. A baseline-verified result confirms that each binding held against its own address, not that a single signer stands behind both.

The Seven-Gate Baseline

Gate 6, where this is enforced.

Report-Data Binding

How the binding is recomputed and compared.

Attestation Pipeline

The flow this sits inside.