> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pesapay.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Trust bundle

> The signed list of every enclave and verifier key a consumer may trust.

The trust bundle names every fleet member a consumer may trust, with the keys each one publishes per epoch. The SDK, the allocator, the verifier and the on-chain claim check all read it.

## Contents

```rust theme={null}
pub struct TrustBundle {
    pub version: u64,
    pub issued_at: u64,
    pub members: Vec<Member>,
    pub revocations: Vec<Revocation>,
    pub signature: Vec<u8>,           // operator key, held in an HSM
    pub rekor_inclusion: RekorProof,  // public transparency log entry
}

pub struct Member {
    pub member_id: String,
    pub role: Role,                   // K | T | Verifier
    pub cell: String,
    pub cloud: String,                // "gcp" | "aws"
    pub family: Family,               // SevSnp | Tdx
    pub chip_id: [u8; 64],            // AMD SEV-SNP chip ID
    pub measurement: Vec<u8>,         // enclave image measurement
    pub tcb_floor: TcbFloor,          // minimum firmware version
    pub ratls_spki: Vec<EpochKey>,    // RA-TLS key per epoch
    pub receipt_key: Vec<EpochKey>,   // K and T receipt keys
    pub claim_key: Vec<EpochKey>,     // verifier claim keys
    pub epochs: Vec<EpochValidity>,
    pub status: MemberStatus,
    // ...
}
```

Each member is pinned by chip ID, image measurement and key epoch. Pinning the chip, not only the image, matters because a compromised chip can forge attestation reports for any firmware version.

## Claim keys

A verifier makes a fresh Ed25519 claim key for each epoch inside the enclave. The key is never stored or exported, so a new epoch is a new key. The verifier's public key reaches consumers through the bundle before the verifier signs with it.

## Rules for consumers

* **Pin the operator key.** It is configuration, never fetched. A bundle is believed only if this key signed it.
* **Never go backwards.** Keep the highest version you accepted and refuse a lower one, so a stale copy cannot undo a revocation.
* **Stay fresh.** Backends fetch at least every 60 seconds and stop accepting claims after 30 minutes without a fresh copy. Apps refetch before their copy is 30 minutes old.
* **Revocation wins.** A claim from a revoked member, or from a closed epoch, fails even before its `expires_at`.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.