# Bulla Attestation Boundary 0.1 (experimental)

Status: `experimental · SOURCE_ONLY · project-operated · fixture-bound`

This profile asks what two public attestation artifacts establish under exact
receiver-pinned roots, policies, verifier bytes, and evidence bytes. It reports
six independent subclaims instead of converting a valid signature into a claim
about execution.

The source lock also pins the Python distribution names and versions used by
the vendored verifiers. Version substitution is a verifier-closure change and
fails; package-archive byte identity beyond those pinned versions is not
established.

The accepted AIR vector establishes its signed platform, model, request, nonce,
and response commitments under the pinned AIR key and profile. The bare signer
key is not bound to a device identity. The vector also does not establish that
the committed model processed the committed request to produce the committed
response.

The accepted NVIDIA sample establishes a valid certificate path and signature
over the recorded Hopper report under the pinned device root and evaluation
time. The supplied RIM versions and measurements do not conform to that
recorded sample, so this profile does not claim RIM conformity. The sample is
not a live challenge to a Glyph-operated H100. `HOPPER_ATTESTATION_REPORT`
names the receiver-pinned parser profile; it is not projected as a signed
architecture field in the report.

The artifacts do not share an authenticated event binding. Their individual
results therefore remain separate, and the combined execution relation is
`NOT_ESTABLISHED`. Live-H100 collection is `UNCHECKABLE` because no live
evidence was supplied.

## Acceptance cuts

The report includes inclusion-minimal declared control sets for each established
conclusion. These are **acceptance cuts** in the frozen verifier dependency
graph. They are not empirical attacker capability, correlated-failure analysis,
or compromise sets.

## Boundary

The report never establishes worldly occurrence, provider identity,
`output = Infer(model, request)`, live Glyph H100 execution, RIM conformity
where the pinned sample disagrees, or independent operation. Everything in this
directory is source-only research and is excluded from the Bulla wheel, sdist,
stable exports, and CLI.
