Metadata-Version: 2.4
Name: pcc-verify
Version: 0.1.0
Summary: Verify your own Apple Intelligence requests against Apple's Private Cloud Compute transparency log
Project-URL: Repository, https://github.com/NagaYu/pcc-verify
Project-URL: Issues, https://github.com/NagaYu/pcc-verify/issues
Project-URL: Changelog, https://github.com/NagaYu/pcc-verify/blob/main/CHANGELOG.md
Author: NagaYu
License-Expression: MIT
License-File: LICENSE
Keywords: apple-intelligence,privacy,private-cloud-compute,transparency,verification
Classifier: Development Status :: 4 - Beta
Classifier: Environment :: Console
Classifier: Intended Audience :: Developers
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Topic :: Security
Classifier: Topic :: Security :: Cryptography
Requires-Python: >=3.10
Requires-Dist: cryptography>=42
Description-Content-Type: text/markdown

# pcc-verify

[![CI](https://github.com/NagaYu/pcc-verify/actions/workflows/ci.yml/badge.svg)](https://github.com/NagaYu/pcc-verify/actions/workflows/ci.yml)
[![PyPI](https://img.shields.io/pypi/v/pcc-verify)](https://pypi.org/project/pcc-verify/)
[![Python](https://img.shields.io/pypi/pyversions/pcc-verify)](https://pypi.org/project/pcc-verify/)
[![License: MIT](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)

**Check your own Apple Intelligence requests against Apple's Private Cloud
Compute transparency log — cryptographically, from your own exported data.**

Apple makes a strong commitment for Private Cloud Compute (PCC): every
production software release is recorded in a public, append-only,
cryptographically tamper-proof transparency log, and your device refuses to
send data to unlogged software. Apple also lets you export a record of your
own requests (Settings → Privacy & Security → Apple Intelligence Report).
But nothing connected the two — "PCC is verifiable" stayed a claim unless you
set up Apple's full Virtual Research Environment. This tool connects them:
it takes your exported report and checks each PCC request's attestation
against the public log.

## What this release actually achieves

**This is the full-verification shape** (of the
full / partial / interpretation-only outcomes considered in
[docs/FEASIBILITY.md](docs/FEASIBILITY.md)): the exported report contains,
per PCC node, complete attestation bundles — software measurements plus a
Merkle inclusion proof — and Apple's transparency log is publicly queryable.
For every request with attestation data, pcc-verify:

1. recomputes the **Merkle root** from the embedded inclusion proof and checks
   it against the signed log head your device trusted;
2. recomputes the **release digest** from the bundle's own OS and cryptex
   tickets (Apple's documented canonicalization) and checks it equals the
   digest committed in the log leaf — binding the proof to the actual
   software measurements;
3. verifies the log head's **ECDSA signature** against Apple's published
   log keys;
4. checks the release entry was **unexpired** at request time; and
5. (online) checks the log has only **grown** since your device saw it.

Honesty is a feature: entries the report gives no attestation data for are
reported as **`not-verifiable`** — never silently passed. Requests handled
on-device are reported as exactly that: nothing left your device, so there is
nothing to check against a cloud log.

## Quickstart

```sh
# with uv
uvx pcc-verify Apple_Intelligence_Report.json
# or
pip install pcc-verify
pcc-verify Apple_Intelligence_Report.json
```

To get a report file: Settings (iOS/iPadOS) or System Settings (macOS) →
Privacy & Security → Apple Intelligence Report → set the duration to
**7 days** (the 15-minute default captures almost nothing) → use Apple
Intelligence for a while → **Export Activity**.

```text
$ pcc-verify Apple_Intelligence_Report.json
pcc-verify 0.1.0 — Apple Intelligence Report verification

Mode: online (live transparency log consulted)
Requests routed to Private Cloud Compute: 12   (plus 34 handled on-device — …)

    9  verified
       The attestation data your device recorded for these requests chains,
       cryptographically, to a software release published in Apple's transparency log.
    3  not verifiable
       The exported report contains no attestation data for these requests, …
```

Useful flags: `--verbose` (per-check detail), `--json out.json`,
`--markdown out.md`, `--offline` (no network at all), and
`--save-keys keys.json` / `--keys keys.json` to pin Apple's log keys once and
verify fully offline afterwards. Exit code is 1 if anything is
`proof-invalid`, so it can gate CI-style automation.

## Privacy

Your exported report can contain your prompts and responses. **pcc-verify
never sends your report anywhere.** The only network access is to Apple's own
transparency-log endpoints (`init-kt-prod.ess.apple.com` and the
`*.apple.com` hosts it advertises), enforced by an allowlist in the code, and
those requests carry only protocol constants and tree identifiers. There is
no telemetry. `--offline` disables even that.

## What a verdict means (and what it cannot mean)

| Verdict | Meaning |
|---|---|
| `verified` | The attestation chains, cryptographically, to a release in Apple's public log: valid inclusion proof against a log head signed by Apple's published key, and the bundle's own measurements reproduce the logged release digest. |
| `proof-invalid` | A cryptographic check failed. This should never happen for genuine data — worth investigating and reporting. |
| `incomplete` | No check failed, but something material could not run (offline without pinned keys, unparseable ticket shape). Not a pass. |
| `not-verifiable` | The report carries no attestation data for this entry. Common and expected — the report only captures bundles for some nodes. |
| `unsupported` | Attestation data present but in a format this tool cannot decode (likely a newer OS). Please open an issue. |

Limits you should know about, stated plainly:

- **The report itself is unsigned JSON produced by your device.** pcc-verify
  verifies Apple's log commitment against what the device recorded; it cannot
  prove the device recorded truthfully or completely. (Verifying the device
  stack itself is what Apple's VRE and security bounty are for.)
- **Runtime properties leave no trace in the export**: OHTTP relay IP
  concealment, stateless deletion of your data after processing, key-release
  behavior. Those remain Apple claims outside any post-hoc tool's reach.
- Full SEP-attestation semantic validation (certificate-chain pinning to
  Apple's data-center CA, SEP register policy) is out of scope for v0.1.0;
  the fields are parsed and surfaced, not judged.

The full reasoning — what the export actually contains, how the log is
accessed, what Apple's license permits, and why this project is a clean-room
implementation — is in [docs/FEASIBILITY.md](docs/FEASIBILITY.md).

## How it verifies (for the curious)

The exported report embeds, per PCC node, an attestation bundle containing
the node's software measurements (OS + cryptex Image4 tickets) and a
transparency-log inclusion proof (leaf bytes, Merkle path, signed log head).
pcc-verify canonicalizes the tickets exactly as Apple documents (personalized
fields nulled, per-node signature dropped), rebuilds the DER `Release`
structure, hashes it, and requires that digest to equal the one in the log
leaf — then requires the leaf to hash up the Merkle path to the signed root.
Log keys come from Apple's public researcher endpoints (the same ones Apple
points security researchers at), discovered via Apple's KT init bag. Every
protocol fact is cited to the [PCC Security
Guide](https://security.apple.com/documentation/private-cloud-compute/) in
the source.

This project is MIT-licensed, standalone, and contains **no code from
`apple/security-pcc`** (whose restrictive license prohibits reuse — see the
note in [LICENSE](LICENSE) and the rules in
[CONTRIBUTING.md](CONTRIBUTING.md)).

## Related

- Apple: [PCC Security Guide](https://security.apple.com/documentation/private-cloud-compute/) ·
  [Security research on PCC](https://security.apple.com/blog/pcc-security-research/)
- Same author, same "verifiable trust, not just a claim" philosophy:
  `provably-local` (verify a developer's app makes no network calls) — this
  project targets Apple's cloud instead, and shares no code with it.
