Prove what a machine attested it did. Every custody tick of a fabrication run — TPM-bound, chained with BLAKE3, sealed at session boundary — verifiable offline, with no vendor infrastructure in the loop.
axm-sfn turns a fabrication node — a Klipper/Moonraker 3D printer today, any CNC or industrial machine tomorrow — into a node that cannot lie about what it made. At session boundary the Python spoke compiles the custody hot buffer into a signed AXM Layer 2 journal shard through the frozen axm-genesis kernel. Genesis compiles and signs; the spoke only reads and hands over evidence.
Every custody packet is signed by a TPM 2.0 RSA-PSS key that never leaves the node; quotes bind PCR platform state to points in the chain. A VM cannot impersonate a physical node — the hardware attests, offline, to what it did.
A 1 Hz custody clock ticks whether or not the printer talks — silence is recorded, not ignored. Packets are chained with BLAKE3 into a gap-free stream; any discontinuity is E_BUFFER_DISCONTINUITY, the same hard failure as a forged signature.
The TPM's classical RSA signatures ride inside the shard's post-quantum axm-hybrid1 seal. An RSA break in 2040 cannot forge a shard sealed in 2026 — the hybrid seal is a cryptographic time capsule over the hardware evidence.
One tamper-evident path from the printer host to a kernel-sealed shard. The Go daemon owns the hot loop; the Python spoke owns exactly one thing — handing evidence to the kernel in a single compile pass. Nothing here reimplements signing, hashing, or Merkle construction.
Runs next to Klipper on the printer host. A 1 Hz custody ticker snapshots Moonraker state, evaluates the Material-Process Profile, calls tpm.SignPacket(), and computes the BLAKE3 chain link — independent of Moonraker event arrival.
Packets append to a SQLite WAL hot buffer (buffer.db) that survives network outages and power loss. The optional uploader emits local segment digests for monitoring — it is not the shard seal.
At session boundary the spoke reads buffer.db read-only, serializes custody to cam_latents.bin (AXLF/AXLR), and hands the stream, the verbatim packet bytes, and the TPM evidence to compile_generic_shard via extra_content / extra_ext (RFC 0006). No reseal, no injection.
The axm-genesis kernel computes the Merkle root, signs with axm-hybrid1 (Ed25519 ‖ ML-DSA-44), derives the sh1_ identity from the manifest bytes, and self-verifies. Out comes an AXM Layer 2 journal shard any party can verify offline.
Three canonical JSONL extension tables ride under the shard's axm-hybrid1 Merkle seal. Each indexes bytes stored in content/ by (offset, length, sha256) — the archival rule is hash-over-stored-bytes, so a spec-only verifier never has to reproduce the compiler's canonicalization. All three are sealed in one pass; packets@1 and tpm-attestation@1 are registered in the kernel by RFC 0006.
| Extension table | Stored in | What it carries |
|---|---|---|
| ext/streams@1.jsonl | content/cam_latents.bin | AXLR record locators: frame_id → offset / length / status / chain hash into the custody stream. |
| ext/packets@1.jsonl | content/packets.bin | The verbatim canonical packet bytes, indexed by (seq, offset, length, packet_sha256). Hash-over-stored-bytes binds each AXLR record to its packet. |
| ext/tpm-attestation@1.jsonl | content/tpm-attestation.bin | TPM trust chain: per-packet signatures, quotes (PCRs, nonce, attest blob), signing-key + AK public areas, and the EK certificate chain. |
The TPM table is named tpm-attestation@1 to stay distinct from RFC 0005's unrelated attestations@1 (proof-of-when). A session recorded without a TPM produces no such table — absence is the honest statement that no hardware evidence exists.
Same kernel, same shard format, three domains. Each spoke seals a different question; none of them forks the kernel.
What may fly, under which ceiling — a one-shot seal over a drone-show specification, with the LAANC ceiling enforced at compile time.
What is running on a deployed asset and how it got there — a supersedes chain of record shards over time.
What the machine attested it did — TPM-bound fabrication session journals, sealed at session boundary. This spoke.