◎ OS PUB Apache 2.0 ← All specifications

P99 � AIEP � Secure Governed Substrate Migration Between Hardware Governance Chip Enclaves

Field of the Invention

[0001] The present invention relates to secure migration of governed reasoning substrates between hardware-enforced execution environments.

[0002] More particularly, the invention relates to a deterministic mechanism for migrating a complete Architected Instruction & Evidence Protocol (AIEP) governed substrate � comprising Evidence Ledger, Reasoning Ledger, GoalVector tree, FoundingTensionHash chain, and CognitivePatternProfile � from an originating hardware governance chip isolation enclave to a receiving hardware governance chip isolation enclave, such that the migration preserves governance integrity, cryptographic hash-chain continuity, and tamper-resistance across the transfer, and is independently verifiable by either party.

Background

[0003] A user operating an AIEP governed device will, over time, require migration of their substrate to a new device � due to hardware upgrade, device replacement, or hardware failure.

[0004] The governed substrate accumulates over time a complete Evidence Ledger, Reasoning Ledger, GoalVector tree, GoalVectorHash chain, FoundingTensionHash chain, and CognitivePatternProfile. This accumulated state is the user’s cognitive substrate � its value increases with time.

[0005] Migration of the substrate between devices must satisfy requirements that conventional device migration systems do not address:

[0006] The migration must preserve the complete cryptographic hash-chain integrity of both ledgers. A migrated substrate in which any hash-chain link is broken is not a governed substrate � it is an unverifiable copy.

[0007] The migration must prevent interception and modification of substrate content during transfer. A substrate intercepted and modified in transit would produce a substrate that presents itself as authentic but contains tampered reasoning history.

[0008] The migration must be verifiable by both originating and receiving devices independently, without reliance on a trusted third party.

[0009] Existing systems do not provide:

(a) enclave-to-enclave migration of a complete governed reasoning substrate with cryptographic hash-chain continuity preserved across the transfer; (b) MigrationBundleHash cryptographically binding all migrated ledger content, schema versions, and governance chip attestations in a single verifiable structure; (c) receiving enclave verification of the MigrationBundleHash against the originating enclave’s attestation prior to substrate activation; (d) originating enclave invalidation of the substrate following confirmed successful migration, preventing dual-substrate operation; or (e) MigrationIntegrityRecord appended to both originating and receiving Reasoning Ledgers as an immutable migration audit trail.

[0010] There exists a need for a secure governed substrate migration protocol operating between hardware governance chip enclaves that preserves hash-chain integrity, prevents in-transit modification, enables independent verification by both parties, and invalidates the originating substrate upon confirmed migration.

Summary of the Invention

[0011] The invention provides a secure governed substrate migration protocol operating between AIEP hardware governance chip enclaves.

[0012] The migration protocol comprises five phases: pre-migration integrity verification; migration bundle construction; secure enclave-to-enclave transfer; receiving enclave verification and activation; and originating enclave invalidation.

[0013] In pre-migration integrity verification, the originating enclave computes a PreMigrationSubstrateHash over the complete canonical serialisation of all Evidence Ledger entries, all Reasoning Ledger entries, the GoalVector tree state, the FoundingTensionHash chain, and the CognitivePatternProfile.

[0014] In migration bundle construction, the originating enclave constructs a MigrationBundle comprising: all migrated substrate components; the PreMigrationSubstrateHash; the originating governance chip attestation; the schema versions in force at migration; and a MigrationBundleHash computed over all preceding fields within the originating enclave.

[0015] The MigrationBundle is encrypted within the originating enclave using a session key established by direct enclave-to-enclave key exchange with the receiving enclave. The encrypted bundle is transmitted to the receiving enclave.

[0016] In receiving enclave verification, the receiving enclave decrypts the MigrationBundle, verifies the originating governance chip attestation, recomputes the MigrationBundleHash from the received content, and confirms it matches the value in the bundle. Upon verification, the substrate is activated in the receiving enclave.

[0017] A PostMigrationSubstrateHash is computed over the receiving enclave’s activated substrate state.

[0018] The receiving enclave transmits a MigrationCompletionAttestation to the originating enclave comprising the PostMigrationSubstrateHash, the receiving governance chip attestation, and a confirmation that the received MigrationBundleHash verified.

[0019] Upon receipt and verification of the MigrationCompletionAttestation, the originating enclave invalidates its substrate by appending a SubstrateInvalidationRecord and suppressing all further substrate operations.

[0020] MigrationIntegrityRecords are appended to both originating and receiving Reasoning Ledgers as immutable migration audit trail entries.

Definitions

[0021] PreMigrationSubstrateHash: A cryptographic hash computed over the complete canonical serialisation of all migrated substrate components at the point of migration initiation, within the originating enclave.

[0022] MigrationBundle: An encrypted structure comprising all migrated substrate components, PreMigrationSubstrateHash, originating governance chip attestation, schema versions, and MigrationBundleHash.

[0023] MigrationBundleHash: A cryptographic hash computed within the originating enclave over all MigrationBundle content fields prior to encryption.

[0024] MigrationCompletionAttestation: A governance chip attested message transmitted by the receiving enclave to the originating enclave confirming successful substrate activation, comprising PostMigrationSubstrateHash and verification of MigrationBundleHash.

[0025] PostMigrationSubstrateHash: A cryptographic hash computed over the receiving enclave’s activated substrate state after migration.

[0026] SubstrateInvalidationRecord: An append-only Reasoning Ledger entry appended by the originating enclave upon confirmed successful migration, recording the migration event and suppressing further substrate operations on the originating device.

[0027] MigrationIntegrityRecord: An append-only Reasoning Ledger entry recording a migration event, appended to both originating and receiving Reasoning Ledgers.

Detailed Description of Preferred Embodiments

1. Pre-Migration Integrity Verification

[0028] The originating enclave computes PreMigrationSubstrateHash as:

PreMigrationSubstrateHash = H(
  CanonicalSerialise(EvidenceLedger) ||
  CanonicalSerialise(ReasoningLedger) ||
  CanonicalSerialise(GoalVectorTree) ||
  CanonicalSerialise(FoundingTensionHashChain) ||
  CanonicalSerialise(CognitivePatternProfile) ||
  SchemaVersionId
)

[0029] PreMigrationSubstrateHash is computed entirely within the hardware isolation enclave and is not passed to the software layer prior to bundle construction.

2. Enclave-to-Enclave Key Exchange

[0030] The originating and receiving enclaves establish a direct enclave-to-enclave session key using a hardware-attested key exchange protocol.

[0031] The session key is established within the hardware isolation enclaves of both devices and is not accessible to the software layer on either device.

[0032] In one embodiment, the key exchange uses a hardware-attested Diffie-Hellman protocol with governance chip attestation signatures on the exchanged public values.

3. MigrationBundle Construction and Transmission

[0033] MigrationBundle is constructed within the originating enclave:

MigrationBundleHash = H(
  PreMigrationSubstrateHash ||
  OriginatingGovernanceChipAttestation ||
  CanonicalSerialise(AllMigratedContent) ||
  SchemaVersionId ||
  MigrationTimestamp
)

[0034] The MigrationBundle is encrypted using the session key within the originating enclave.

[0035] The encrypted bundle is passed to the originating device’s software layer for transmission to the receiving device. The software layer cannot decrypt or modify the bundle.

4. Receiving Enclave Verification and Activation

[0036] The receiving device transmits the encrypted bundle to its receiving enclave.

[0037] The receiving enclave decrypts the bundle using the session key.

[0038] The receiving enclave verifies the originating governance chip attestation.

[0039] The receiving enclave recomputes MigrationBundleHash from the decrypted content and confirms it matches the value in the bundle.

[0040] Upon successful verification, the receiving enclave activates the migrated substrate.

[0041] PostMigrationSubstrateHash is computed over the activated substrate state.

[0042] If MigrationBundleHash verification fails, the receiving enclave rejects the bundle and appends a MigrationRejectionRecord to its Reasoning Ledger.

5. MigrationCompletionAttestation and Originating Invalidation

[0043] The receiving enclave transmits a MigrationCompletionAttestation to the originating enclave comprising:

(a) PostMigrationSubstrateHash; (b) receiving governance chip attestation; (c) confirmed MigrationBundleHash match; and (d) timestamp.

[0044] The originating enclave verifies the receiving governance chip attestation and the PostMigrationSubstrateHash.

[0045] Upon verification, the originating enclave appends a SubstrateInvalidationRecord to its Reasoning Ledger and suppresses all further substrate operations.

[0046] SubstrateInvalidationRecord comprises the MigrationBundleHash, PostMigrationSubstrateHash, and invalidation timestamp.

6. MigrationIntegrityRecord

[0047] MigrationIntegrityRecords are appended to both originating and receiving Reasoning Ledgers comprising:

(a) PreMigrationSubstrateHash; (b) MigrationBundleHash; (c) PostMigrationSubstrateHash; (d) originating and receiving governance chip attestation references; and (e) migration timestamp.

[0048] The MigrationIntegrityRecord constitutes the immutable audit trail of the migration event.

Claims

  1. A secure governed substrate migration protocol operating between AIEP hardware governance chip enclaves, the protocol configured to: compute a PreMigrationSubstrateHash within the originating enclave over the complete canonical serialisation of all substrate components; construct a MigrationBundle comprising all migrated components, PreMigrationSubstrateHash, originating governance chip attestation, and MigrationBundleHash, encrypted using an enclave-to-enclave session key; verify MigrationBundleHash within the receiving enclave upon decryption; activate the migrated substrate in the receiving enclave upon verification; transmit a MigrationCompletionAttestation from receiving to originating enclave comprising PostMigrationSubstrateHash; and append a SubstrateInvalidationRecord in the originating enclave suppressing all further substrate operations upon confirmed migration.

  2. The protocol of claim 1 wherein the enclave-to-enclave session key is established by hardware-attested key exchange within the hardware isolation enclaves of both devices, not accessible to the software layer.

  3. The protocol of claim 1 wherein the software layer cannot decrypt or modify the MigrationBundle during transmission.

  4. The protocol of claim 1 wherein MigrationBundleHash verification failure causes the receiving enclave to reject the bundle and append a MigrationRejectionRecord.

  5. The protocol of claim 1 wherein MigrationIntegrityRecords are appended to both originating and receiving Reasoning Ledgers comprising PreMigrationSubstrateHash, MigrationBundleHash, PostMigrationSubstrateHash, governance chip attestation references, and migration timestamp.

  6. The protocol of claim 1 wherein the migrated substrate components comprise the Evidence Ledger, Reasoning Ledger, GoalVector tree, FoundingTensionHash chain, and CognitivePatternProfile.

  7. A method for secure governed substrate migration comprising: computing PreMigrationSubstrateHash in originating enclave; constructing and encrypting MigrationBundle; verifying MigrationBundleHash in receiving enclave; activating substrate; transmitting MigrationCompletionAttestation; and invalidating originating substrate upon confirmed migration.

  8. A non-transitory computer-readable medium storing instructions which, when executed by hardware enclave processors, perform the method of claim 7.

Drawings

Figure 1 � Originating Enclave: MigrationBundle Construction

   Originating Governance Chip Hardware Enclave
        |
        v
   Components assembled:
     Evidence Ledger, Reasoning Ledger, GoalVector tree,
     FoundingTensionHash chain, CognitivePatternProfile
        |
        v
   PreMigrationSubstrateHash = sha256(
     canonical(all_substrate_components)
   )
        |
        v
   MigrationBundle = encrypt(
     content:  all_components + PreMigrationSubstrateHash
               + originating_chip_attestation,
     key:      enclave-to-enclave session key
               (hardware-attested key exchange)
   )
        |
        v
   MigrationBundleHash = sha256(MigrationBundle)
   Bundle transmitted to receiving enclave.
   Software layer: cannot decrypt or modify bundle.

Figure 2 � Receiving Enclave: Verification and Activation

   Receiving Governance Chip Hardware Enclave
        |
        v
   decrypt MigrationBundle (enclave-to-enclave session key)
        |
        v
   verify originating_chip_attestation
        |
        v
   recompute MigrationBundleHash
   compare ? mismatch? MigrationRejectionRecord; REJECT
        |
        v (match)
   activate migrated substrate in receiving enclave
        |
        v
   PostMigrationSubstrateHash = sha256(
     canonical(activated_substrate_components)
   )
        |
        v
   MigrationCompletionAttestation { PostMigrationSubstrateHash }
   ? transmitted back to originating enclave

Figure 3 � Originating Enclave: Invalidation

   Originating enclave receives MigrationCompletionAttestation:
        |
        v
   verify PostMigrationSubstrateHash
        |
        v
   SubstrateInvalidationRecord appended:
   { pre_migration_hash, migration_bundle_hash,
     receiving_chip_attestation_ref, invalidated_at_iso }
        |
        v
   ALL further substrate operations on originating enclave: SUPPRESSED
   (fail-closed: no dual-substrate operation possible)

Figure 4 � MigrationIntegrityRecord Structure

   MigrationIntegrityRecord (appended to BOTH ledgers):

   {
     pre_migration_substrate_hash,
     migration_bundle_hash,
     post_migration_substrate_hash,
     originating_chip_attestation_ref,
     receiving_chip_attestation_ref,
     migration_timestamp_iso
   }

   Independent verification (no third party required):
     re-examine both ledgers' MigrationIntegrityRecords
     hashes consistent ? migration VERIFIED
     hashes inconsistent ? migration TAMPERED

   Hash-chain continuity preserved: FoundingTensionHash chain
   unbroken across originating ? receiving substrate.

Abstract

A secure governed substrate migration protocol operating between AIEP hardware governance chip isolation enclaves is disclosed. The originating enclave computes a PreMigrationSubstrateHash over all substrate components and constructs a MigrationBundle encrypted by an enclave-to-enclave session key not accessible to the software layer. The receiving enclave decrypts the bundle, verifies the originating governance chip attestation, recomputes MigrationBundleHash, and activates the substrate upon verification. A MigrationCompletionAttestation carrying PostMigrationSubstrateHash is transmitted from receiving to originating enclave. Upon verification, the originating enclave appends a SubstrateInvalidationRecord and suppresses all further substrate operations, preventing dual-substrate operation. MigrationIntegrityRecords are appended to both ledgers as an immutable audit trail. The protocol preserves complete cryptographic hash-chain continuity across the transfer, prevents software-layer interception or modification of bundle content, and is independently verifiable by both enclaves without trusted third party involvement.

This specification is published as open-source prior art under the Apache License 2.0. Copyright 2026 Protocol Owner. Inventor: Protocol Architect.

Patent information · Licensing · All open specifications