Add the AttestationDecision host-attestation contract (T2-1) + examples (passed/failed-sip/failed-mdm) + validator + attestation-model.md docs (T2-2). activation_permitted is true IFF all 8 blocking checks pass; advisory checks (TELEMETRY_BOUNDARY/SEAM-013, DISPLAY_UUID_STABILITY/SEAM-008) warn only.
T2-3 (the runtime attest subcommand with real SIP/NVRAM/MDM/SEP/DNS/TLS probes) is deferred to a macOS attestation environment — it can't be verified on this host. This PR lands the CONTRACT, which is what T4-4 (agent-machine-provider referencing the AttestationDecision URN) depends on.
Source: Tranche Work Orders T2-1, T2-2, T2-4/5.
Add the AttestationDecision host-attestation contract (T2-1) + examples (passed/failed-sip/failed-mdm) + validator + attestation-model.md docs (T2-2). activation_permitted is true IFF all 8 blocking checks pass; advisory checks (TELEMETRY_BOUNDARY/SEAM-013, DISPLAY_UUID_STABILITY/SEAM-008) warn only.
T2-3 (the runtime
attestsubcommand with real SIP/NVRAM/MDM/SEP/DNS/TLS probes) is deferred to a macOS attestation environment — it can't be verified on this host. This PR lands the CONTRACT, which is what T4-4 (agent-machine-provider referencing the AttestationDecision URN) depends on.Source: Tranche Work Orders T2-1, T2-2, T2-4/5.