Enforce environment-scoped PCR0 trust in maple-proxy

.env.example

@@ -11,6 +11,10 @@ MAPLE_PORT=8080
 # Local: http://localhost:3000
 MAPLE_BACKEND_URL=https://enclave.trymaple.ai
 
+# PCR0 trust roots must match the selected backend environment.
+# Use development only with the development enclave; production is the default.
+MAPLE_PCR0_ENVIRONMENT=production
+
 # Authentication
 # Your Maple API key - get this from https://trymaple.ai
 MAPLE_API_KEY=your-maple-api-key-here

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "maple-proxy"
-version = "0.2.0"
+version = "0.3.0"
 edition = "2021"
 authors = ["OpenSecret"]
 description = "Lightweight OpenAI-compatible proxy server for Maple/OpenSecret TEE infrastructure"
@@ -29,7 +29,7 @@ path = "src/main.rs"
 
 [dependencies]
 # OpenSecret SDK
-opensecret = "3.4.0"
+opensecret = "3.6.0"
 
 # Web server
 axum = { version = "0.8.4", features = ["http2", "macros"] }

Dockerfile

@@ -54,6 +54,7 @@ USER maple
 ENV MAPLE_HOST=0.0.0.0 \
     MAPLE_PORT=8080 \
     MAPLE_BACKEND_URL=https://enclave.trymaple.ai \
+    MAPLE_PCR0_ENVIRONMENT=production \
     MAPLE_DEBUG=false \
     MAPLE_ENABLE_CORS=true \
     MAPLE_REQUEST_TIMEOUT_SECS=300 \

README.md

@@ -33,7 +33,7 @@ Add to your `Cargo.toml`:
 [dependencies]
 maple-proxy = { git = "https://github.com/opensecretcloud/maple-proxy" }
 # Or if published to crates.io:
-# maple-proxy = "0.2.0"
+# maple-proxy = "0.3.0"
 ```
 
 ## ⚙️ Configuration
@@ -45,6 +45,7 @@ Set environment variables or use command-line arguments:
 export MAPLE_HOST=127.0.0.1                    # Server host (default: 127.0.0.1)
 export MAPLE_PORT=8080                         # Server port (default: 8080)
 export MAPLE_BACKEND_URL=http://localhost:3000         # Maple backend URL (prod: https://enclave.trymaple.ai)
+export MAPLE_PCR0_ENVIRONMENT=production       # PCR0 trust roots: production (default) or development
 export MAPLE_API_KEY=your-maple-api-key        # Default API key (optional)
 export MAPLE_DEBUG=true                        # Enable debug logging
 export MAPLE_ENABLE_CORS=true                  # Enable CORS
@@ -55,6 +56,9 @@ export MAPLE_STREAM_IDLE_TIMEOUT_SECS=300      # Streaming idle timeout between
 Or use CLI arguments:
 ```bash
 cargo run -- --host 0.0.0.0 --port 8080 --backend-url https://enclave.trymaple.ai
+
+# Development enclaves must be selected explicitly
+cargo run -- --backend-url https://enclave.secretgpt.ai --pcr0-environment development
 ```
 
 ## 🛠️ Usage
@@ -119,7 +123,7 @@ curl http://localhost:8080/v1/embeddings \
 You can also embed Maple Proxy in your own Rust application:
 
 ```rust
-use maple_proxy::{Config, create_app};
+use maple_proxy::{Config, Pcr0Environment, create_app};
 use tokio::net::TcpListener;
 
 #[tokio::main]
@@ -133,6 +137,7 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
         8081,  // Custom port
         "https://enclave.trymaple.ai".to_string(),
     )
+    .with_pcr0_environment(Pcr0Environment::Production)
     .with_api_key("your-api-key-here".to_string())
     .with_debug(true)
     .with_cors(true);

docker-compose.yml

@@ -19,6 +19,7 @@ services:
 
       # Backend configuration (defaults to production)
       - MAPLE_BACKEND_URL=${MAPLE_BACKEND_URL:-https://enclave.trymaple.ai}
+      - MAPLE_PCR0_ENVIRONMENT=${MAPLE_PCR0_ENVIRONMENT:-production}
 
       # Authentication - Uncomment ONLY for private/internal deployments!
       # For public deployments: Keep this commented out - clients will pass their own API keys

examples/library_usage.rs

@@ -1,4 +1,4 @@
-use maple_proxy::{create_app, Config};
+use maple_proxy::{create_app, Config, Pcr0Environment};
 use tokio::net::TcpListener;
 
 #[tokio::main]
@@ -12,6 +12,7 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
         8081, // Custom port
         "https://enclave.trymaple.ai".to_string(),
     )
+    .with_pcr0_environment(Pcr0Environment::Production)
     .with_api_key("your-api-key-here".to_string())
     .with_debug(true)
     .with_cors(true);

flake.nix

@@ -41,9 +41,6 @@
           clang
           libclang
 
-          # TypeScript / OpenClaw plugin
-          nodejs_22
-
           # Useful tools
           jq
           just

justfile

@@ -163,6 +163,7 @@ env:
     @echo "MAPLE_HOST: ${MAPLE_HOST:-127.0.0.1}"
     @echo "MAPLE_PORT: ${MAPLE_PORT:-8080}"
     @echo "MAPLE_BACKEND_URL: ${MAPLE_BACKEND_URL:-https://enclave.trymaple.ai}"
+    @echo "MAPLE_PCR0_ENVIRONMENT: ${MAPLE_PCR0_ENVIRONMENT:-production}"
     @echo "MAPLE_API_KEY: ${MAPLE_API_KEY:-[not set]}"
     @echo "MAPLE_DEBUG: ${MAPLE_DEBUG:-false}"
     @echo "MAPLE_ENABLE_CORS: ${MAPLE_ENABLE_CORS:-false}"
@@ -182,6 +183,7 @@ docker-run:
         -p ${MAPLE_PORT:-8080}:8080 \
         -e MAPLE_API_KEY=${MAPLE_API_KEY} \
         -e MAPLE_BACKEND_URL=${MAPLE_BACKEND_URL:-https://enclave.trymaple.ai} \
+        -e MAPLE_PCR0_ENVIRONMENT=${MAPLE_PCR0_ENVIRONMENT:-production} \
         -e MAPLE_DEBUG=${MAPLE_DEBUG:-false} \
         -e MAPLE_ENABLE_CORS=${MAPLE_ENABLE_CORS:-true} \
         -e MAPLE_REQUEST_TIMEOUT_SECS=${MAPLE_REQUEST_TIMEOUT_SECS:-300} \
@@ -196,6 +198,7 @@ docker-run-detached:
         -p ${MAPLE_PORT:-8080}:8080 \
         -e MAPLE_API_KEY=${MAPLE_API_KEY} \
         -e MAPLE_BACKEND_URL=${MAPLE_BACKEND_URL:-https://enclave.trymaple.ai} \
+        -e MAPLE_PCR0_ENVIRONMENT=${MAPLE_PCR0_ENVIRONMENT:-production} \
         -e MAPLE_DEBUG=${MAPLE_DEBUG:-false} \
         -e MAPLE_ENABLE_CORS=${MAPLE_ENABLE_CORS:-true} \
         -e MAPLE_REQUEST_TIMEOUT_SECS=${MAPLE_REQUEST_TIMEOUT_SECS:-300} \
@@ -263,50 +266,5 @@ ghcr-pull tag="latest":
     @{{container}} pull ghcr.io/opensecretcloud/maple-proxy:{{tag}}
     @echo "✅ Pulled ghcr.io/opensecretcloud/maple-proxy:{{tag}}"
 
-# === OpenClaw Plugin ===
-
-# Install plugin dependencies
-plugin-install:
-    @echo "📦 Installing plugin dependencies..."
-    @cd openclaw-plugin && npm install
-    @echo "✅ Plugin dependencies installed"
-
-# Build plugin (TypeScript -> JS)
-plugin-build:
-    @echo "🔨 Building OpenClaw plugin..."
-    @cd openclaw-plugin && npm run build
-    @echo "✅ Plugin built"
-
-# Lint plugin
-plugin-lint:
-    @echo "🔍 Linting plugin..."
-    @cd openclaw-plugin && npm run lint
-    @echo "✅ Plugin linted"
-
-# Test plugin
-plugin-test:
-    @echo "🧪 Testing plugin..."
-    @cd openclaw-plugin && npm test
-    @echo "✅ Plugin tests passed"
-
-# Check all (Rust + plugin)
-check-all: check plugin-lint plugin-test
-    @echo "✅ All checks passed (Rust + Plugin)"
-
-# Link plugin locally for OpenClaw development
-plugin-link:
-    @echo "🔗 Linking plugin to OpenClaw extensions..."
-    @openclaw plugins install -l ./openclaw-plugin
-    @echo "✅ Plugin linked"
-
-# Pack plugin for npm publishing
-plugin-pack:
-    @echo "📦 Packing plugin for npm..."
-    @cd openclaw-plugin && npm pack
-    @echo "✅ Plugin packed"
-
-# Publish plugin to npm
-plugin-publish:
-    @echo "🚀 Publishing plugin to npm..."
-    @cd openclaw-plugin && npm publish --access public
-    @echo "✅ Plugin published"
+# Compatibility alias for the complete repository check.
+check-all: check