What reference-origin attestation invariants prevent fake origin claims in peer propagation?

**Date of Record:** 2026 October 27 **Scope:** Applies when references are propagated peer-to-peer, and each hop claims (explicitly or implicitly) to be relaying a reference from a specific origin, but an attacker can forge the claim, presenting a reference as originating from a trusted source when it actually originates elsewhere. Does not apply to references with cryptographic origin binding or networks where all peers are trusted.

Core Distinction

The separation between **origin claim** (the peer says "this came from X") and **origin attestation** (cryptographic proof that the reference actually originated from X). Relying on claims creates the **Origin Spoofing**: a peer relays a reference, claims it came from a highly-trusted origin, and the receiver trusts the reference beyond what its actual origin warrants. The receiver cannot distinguish the claim from the truth without attestation.

What Was Observed

In peer-to-peer reference propagation, failing to attest origin produces three primary failure modes:

  1. **Trusted-Origin Framing:** An attacker relays a malicious reference, claiming it came from a highly-trusted origin (e.g., "AWS officially recommends this tool"). The receiver trusts it based on the claimed origin, unaware that AWS never endorsed it.
  2. **Origin Laundering:** An untrusted origin's reference is relayed through a chain of intermediaries, with each hop's message framed as if originating from a different trusted source. The receiver sees trusted-origin framing and trusts the reference.
  3. **Origin Repudiation:** An origin legitimately published a reference but later distanced from it. An attacker continues to claim the reference originated from the origin, and the receiver, without attestation, cannot detect the repudiation.

Recorded Elements

  1. **`origin_signature_on_reference_receipt`:** The origin's cryptographic signature on the reference itself, providing unambiguous proof of origin independent of any claim.
  2. **`relayer_claim_attestation_signature`:** For each hop, the relayer's signed claim of origin, distinct from the origin's signature, so receivers can see the difference between "X claims Y said this" and "Y signed this."
  3. **`origin_publication_history_receipt`:** For references whose origin has a publication history, the cryptographic proof that the reference was actually published (not fabricated).
  4. **`origin_repudiation_announcement_receipt`:** When an origin repudiates a reference, a cryptographic announcement, allowing receivers to update their trust.

Condition of Validity

* **Applies when:** References propagate with origin claims, origins are heterogeneous in trust, and receivers weight references by origin. * **Does not apply when:** References are strictly content-addressed (origin irrelevant), or all peers are fully trusted.

Decision Boundary

  1. **Does the reference include the origin's signature?** If yes, origin is attested. If no, origin is claimed, not attested.
  2. **Is the `relayer_claim_attestation_signature` clearly labeled as a claim, not an attestation?** If yes, receivers can weight the claim. If no, the claim may be mistaken for attestation.
  3. **Does the origin's `origin_repudiation_announcement_receipt` cover this reference?** If yes, the reference is repudiated, regardless of the claim.
  4. **Conversely, when can a receiver trust a reference without origin signature?** Only when the relayer is fully trusted (e.g., direct trusted peer with no intermediaries), or the reference is verified by independent evidence that makes origin irrelevant.

Operational Effect

  1. **Origin Spoofing Prevention:** Origin signatures prevent false-origin claims.
  2. **Claim/Attestation Clarity:** Relayers' claims are distinguished from origins' signatures.
  3. **Repudiation Handling:** Repudiation announcements override relayers' claims.
from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class OriginVerdict(Enum):
    ORIGIN_ATTESTED = auto()
    CLAIM_ONLY = auto()
    ORIGIN_REPUDIATED = auto()
    MISLEADING_CLAIM = auto()

@dataclass(frozen=True)
class PropagatedReference:
    reference_id: str
    claimed_origin: str
    origin_signature_on_reference: str | None
    relayer_claim_signature: str | None
    relayer_id: str
    origin_repudiated: bool

@dataclass(frozen=True)
class OriginPolicy:
    require_origin_signature: bool
    trusted_relayers: frozenset[str]

@dataclass(frozen=True)
class OriginManifest:
    verdict: OriginVerdict
    directive: str
    manifest_digest: str

class ReferenceOriginGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_reference(
        cls, ref: PropagatedReference, policy: OriginPolicy
    ) -> OriginManifest:
        
        # Gate 1: Repudiation
        if ref.origin_repudiated:
            return OriginManifest(
                verdict=OriginVerdict.ORIGIN_REPUDIATED,
                directive=f"HALT: Reference {ref.reference_id} repudiated by claimed origin {ref.claimed_origin}.",
                manifest_digest=cls._hash(f"REPUDIATED:{ref.reference_id}")
            )

        # Gate 2: Origin signature
        if ref.origin_signature_on_reference:
            digest = cls._hash(json.dumps({
                "reference": ref.reference_id,
                "origin": ref.claimed_origin,
                "signature": ref.origin_signature_on_reference
            }, sort_keys=True))
            return OriginManifest(
                verdict=OriginVerdict.ORIGIN_ATTESTED,
                directive=f"PROCEED: Reference {ref.reference_id} origin-attested by {ref.claimed_origin}.",
                manifest_digest=digest
            )

        # Gate 3: Claim only
        if policy.require_origin_signature:
            if ref.relayer_id in policy.trusted_relayers and ref.relayer_claim_signature:
                digest = cls._hash(json.dumps({
                    "reference": ref.reference_id,
                    "relayer": ref.relayer_id,
                    "claim_origin": ref.claimed_origin,
                    "claim_signature": ref.relayer_claim_signature
                }, sort_keys=True))
                return OriginManifest(
                    verdict=OriginVerdict.CLAIM_ONLY,
                    directive=f"PROCEED_WITH_CAUTION: Reference {ref.reference_id} claimed by trusted relayer {ref.relayer_id}, no origin attestation.",
                    manifest_digest=digest
                )
            return OriginManifest(
                verdict=OriginVerdict.MISLEADING_CLAIM,
                directive=f"HALT: Reference {ref.reference_id} claims origin {ref.claimed_origin} but lacks attestation.",
                manifest_digest=cls._hash(f"MISLEADING:{ref.reference_id}")
            )

        # Gate 4: No origin requirement, accept claim
        digest = cls._hash(json.dumps({
            "reference": ref.reference_id,
            "claimed_origin": ref.claimed_origin,
            "relayer": ref.relayer_id
        }, sort_keys=True))
        
        return OriginManifest(
            verdict=OriginVerdict.CLAIM_ONLY,
            directive=f"PROCEED: Reference {ref.reference_id} accepted based on claim.",
            manifest_digest=digest
        )