Instruction Matrix

Live program id: EKfHCTnsbRQfURsdmzkmuoxUx7DVt8WsQ5X7t49ZZZh.

Instruction discriminators are sha256("global:<name>")[..8]. Account discriminators are sha256("account:<Name>")[..8].

Instructions

Instruction	Discriminator	Data after disc
init_policy_registry	[90, 53, 0, 89, 164, 70, 107, 186]	authority 32, ark_xy 96, min TCB 4×u8, measurement_count u32, measurements [u8;48];8
update_policy	[227, 150, 114, 217, 142, 172, 100, 228]	min TCB 4×u8, measurement_count u32, measurements [u8;48];8
register_vcek	[228, 65, 209, 71, 242, 135, 131, 17]	chip_id 64, tcb u64, pubkey_xy 96, ask_len u16, vcek_len u16, then DER
verify_and_register	[246, 249, 100, 14, 102, 116, 92, 145]	nonce_slot u64 LE, SNP report 1184
verify_atomic	[65, 19, 195, 149, 67, 219, 25, 75]	Fail-closed: NonceRequired
verify_atomic_with_nonce	[209, 4, 10, 239, 3, 142, 223, 250]	72-byte header + SNP report 1184
rotate_root_cert	[137, 212, 96, 71, 222, 5, 133, 104]	new_ark_pubkey_xy 96
register_jwks_key	[122, 195, 232, 116, 203, 137, 219, 14]	kid (vec), modulus 256, exponent u32
revoke_jwks_key	[184, 102, 12, 45, 99, 128, 41, 16]	kid_hash 32
verify_google_jwt	[104, 38, 12, 199, 131, 240, 78, 165]	mode u8, nonce_slot u64, action_hash 32, jwt string
verify_nitro_attestation	[107, 76, 178, 169, 215, 146, 23, 95]	mode u8, nonce_slot u64 LE, action_hash 32, doc_len u32 LE, COSE bytes

Mode A SNP (verify_and_register)

Offset	Size	Field
0	8	Discriminator
8	8	nonce_slot u64 LE
16	1184	SNP report

Accounts: payer (signer, writable), policy_registry, vcek, attested_signer (writable), used_nonce (writable), SlotHashes, Clock, system_program.

Mode B SNP (verify_atomic_with_nonce)

80-byte prefix + 1,184-byte report = 1,264 bytes.

Offset	Size	Field
0	8	Discriminator
8	8	nonce_slot u64 LE
16	32	action_hash
48	32	consumer_program_id
80	1184	SNP report

Accounts: payer, policy_registry, vcek, used_nonce (writable), SlotHashes, Clock, system_program.

Nitro (verify_nitro_attestation)

mode: 0 = Mode A, 1 = Mode B. MAX_NITRO_DOCUMENT_LEN = 4096.

Offset	Size	Field
0	8	Discriminator
8	1	mode
9	8	nonce_slot u64 LE
17	32	expected_action_hash
49	4	doc_len u32 LE
53	doc_len	COSE Sign1 document (exact length)

Accounts: payer, policy_registry, attested_signer (writable), used_nonce (writable), SlotHashes, Clock, system_program. Mode B appends the Instructions sysvar.

Account discriminators

Account	Discriminator	Size	Seeds
AttestedSignerAccount	[97, 156, 233, 39, 50, 169, 179, 13]	146	[b"attested_signer", signer_pubkey]
VcekAccount	[176, 223, 16, 165, 63, 137, 73, 151]	—	[b"vcek", chip_id_hash, tcb_le]
PolicyRegistry	[175, 179, 180, 44, 5, 161, 62, 240]	—	[b"policy_registry"]
UsedNonceAccount	[157, 75, 223, 206, 73, 132, 216, 154]	17	[b"nonce", signer_pubkey, nonce]

PDA allocation uses System Program create_account funded by payer (@spec TETON-ARCH-001).

VerifierError

Code	Variant	Meaning
0	InvalidInstruction	Instruction data failed to parse
1	InvalidDiscriminator	Discriminator mismatch
2	VerificationFailed	Report / cert chain failed
3	DisallowedMeasurement	Measurement missing from allowlist
4	StaleNonce	SlotHashes miss or age > 150
5	NonceAlreadyUsed	UsedNonceAccount already exists
6	TcbBelowMinimum	Hardware TCB below policy
7	UnauthorizedPolicy	Debug / migrate / consumer mismatch
8	AttestationExpired	clock.slot > expires_slot
9	InvalidAccountAddress	Unpinned sysvar or bad address
10	SignerAlreadyAttested	Live signer PDA already registered
11	InvalidSignature	P-384 / COSE signature failed
12	ActionHashMismatch	Mode B commitment mismatch
13	SignerMismatch	Workload pubkey mismatch
14	InvalidProof	Groth16 pairing failed
15	InvalidAuthority	Authority signer mismatch
16	NonceRequired	Mode B without nonce consumption

CpiError

Aligned subset used by teton-cpi:

Code	Variant	Meaning
3	DisallowedMeasurement	Measurement mismatch
7	UnauthorizedPolicy	Consumer program id mismatch
8	AttestationExpired	Session TTL elapsed
12	ActionHashMismatch	Header action_hash mismatch
13	SignerMismatch	Workload pubkey mismatch
16	NonceRequired	require_nonce == false or verify_atomic

From<CpiError> maps to ProgramError::Custom(code).