Vault3D.

AI inside the attestation path.

Vault3D does not ask AI to decide whether a print is valid. It uses AI to surface context a human or policy engine should review before a signed artifact enters the audit trail.

What Vault3D actually signs.

The signed bundle is not a stamp on a file. It is a canonical-form CBOR payload covering everything you need to reconstruct what the printer was instructed to do and what context it was instructed in.

The HSM.

API surface.

The daemon exposes a small REST API on the local printer host. Bindings: Python, Go, Rust (feature parity).

# sign a bundle (slicer hands the daemon the canonical CBOR + context)
POST /v3/bundles
  body: { gcode_sha256, slicer_attest, firmware_sha256, ... }
  resp: { bundle_id, signature, signed_at, machine_counter }

# fetch an archived bundle (audit / dispute / regulator request)
GET  /v3/bundles/{bundle_id}
  resp: full CBOR bundle + signature + verifier hints

# verify a bundle (anyone with manifest access can call this; idempotent, no auth)
POST /v3/verify
  body: bundle CBOR + signature
  resp: { ok: bool, manifest_rev, printer_id, signed_at }

# printer posture (the live machine-readable record)
GET  /v3/posture
  resp: { firmware_sha256, hsm_state, manifest_rev, last_sign, mode }

Verification works offline against a hardcoded ceremony root pin. The /v3/verify endpoint will refuse to verify if the manifest is older than the configurable TTL — this is deliberate; you want the verification to fail loud rather than silently accept a stale revoked key.

Performance characteristics.

Numbers from production fleet measurement, rolling 28 days, n = 41 sites. The HSM signature is approximately 95 ms of the 183 ms p99 sign latency; we do not see latency reduction as a goal worth pursuing further — the HSM is intentionally the bottleneck.

Slicer integration.

Vault3D is slicer-agnostic but slicer-attested. We publish signed slicer-attestation manifests for the open-source slicers and have a published agreement with one closed-source slicer vendor.

When a slicer is not fully attested, the TwinCert record (if issued) carries this honestly. Customers who require a fully-attested slicer for regulatory reasons should select from the first four rows.

Archive and retention.

Signed bundles are committed to the customer's manifest — an append-only log with a signed Merkle root. The log lives in customer-controlled storage; we recommend Postgres for the index and S3-compatible object storage for the bundles themselves, but the schema is portable.

• Append-only. A bundle, once committed, is in the log forever. There is no delete operation.
• Merkle-rooted. The log's signed Merkle root is republished to the customer manifest weekly. Any modification to a past bundle would invalidate the root.
• Customer-controlled. The archive lives in your infrastructure. We do not have a copy; we have only the ceremony root that allows you to verify your archive.
• Retention. Customer policy. Aerospace customers typically retain 25 years; medical, 30 years; spare-parts OEMs, the product lifetime. The schema is forward-compatible across all version migrations we have shipped.

What a signed bundle looks like.

One real (anonymised) bundle envelope, decoded from CBOR to JSON for readability.

{
  "bundle_id":        "bd-2026-05-19T08:42:09Z-7a3f",
  "customer_id":      "cust-warwick-aero-2024",
  "printer_id":       "BAY-A4-PRINTER-07",
  "gcode_sha256":     "4b9c7a3f81e2 ... d871a07",
  "slicer_attest": {
    "slicer":           "prusa-slicer-2.7.4",
    "build_sha256":     "8e21f04c9a18 ... a48c213",
    "attest_key":       "sl-prusa-2026-04"
  },
  "firmware_sha256":  "2c8e1b7a04f3 ... 7f61c80",
  "sensor_envelope": {
    "chamber_temp_c":   { "min": 38.2, "max": 41.6, "mean": 39.7 },
    "humidity_pct":     { "min": 14.1, "max": 16.8, "mean": 15.3 },
    "o2_ppm":           { "min": 90, "max": 130, "mean": 108 }
  },
  "operator_binding": {
    "idp":              "customer-okta",
    "sub":              "j.whitfield@warwick-aero.example",
    "session_sig":      "...HSM-signed..."
  },
  "machine_counter":  41873,
  "twincert_ref":     "twc-2026-05-19-aa70",
  "signed_at":        "2026-05-19T08:42:09.183Z",
  "signature":        "...Ed25519 + Dilithium-3 shadow..."
}

Related advisories.

3DC-2026-05-A1 · CRYSTALS-Dilithium migration plan

Shadow signatures already cover Vault3D bundles; phase-1 hybrid co-signing scheduled 2026 Q4.

3DC-2025-11-A1 · Vault3D firmware update path

Dual-control firmware update procedure (RB-25), live on all production fleet since 2025-11.