Build on hardware-rooted device trust

One integration, one question answered: is this a real, distinct, healthy device? Shield is a drop-in device-verification call you put in front of the actions abuse targets.

Five plain ideas. Each term is defined before any jargon.

• Device — a physical machine, identified by the security chip built into it (its TPM, Secure Enclave, or Android security key). Enrolled once.
• Attestation— the device cryptographically proving it's a specific, real, physical machine (not a script, not a rented cloud server), checked against your rules. By default, your app collects a sealed evidence bundle from the machine (no keys, no Root Herald contact) and hands it to your server; your server calls Root Herald with its secret key (rh_sk_) and a named policy, and gets the answer back directly.
• Chip kind (TPM class) — what kind of chip is at the root: hardware, firmware-tpm, cloud-vtpm (a rented cloud server or software emulator pretending to be a real chip), mobile-hardware, emulated. You decide which kinds you accept; full table in the taxonomy reference.
• Acceptance policy — your rule for how strict to be: which chip kinds and assurance levels pass. The default (rootherald:builtin:strict-hardware) rejects every virtual or emulated chip.
• Verdict — the answer your server gets back: a pass / warn / fail plus a stable, anonymous per-device ID (device.ueid, no personal data). It's returned directly by rh.verify() — no token to handle. The typed AttestationVerdict also carries the assurance level (acr) and a device health status (earStatus: affirming / warning / contraindicated).

{
  "acr": "urn:rootherald:device:high",
  "device": {
    "ueid": "2f9c8a14…",                 // stable per-tenant device id (no PII)
    "verdict": "pass",                   // pass | warn | fail
    "earStatus": "affirming",            // affirming | warning | contraindicated
    "attestationType": "tpm20",
    "secureBootVerified": true,
    "trustworthinessVector": { "hardware": 2, "configuration": 2 }
  }
}