Bootstrap without circular trust

Bootstrap may rely on a cloud instance identity document, hardware-backed evidence, an orchestrator's authenticated state, or a securely delivered join credential. Each mechanism has a verifier and a scope: which node, account, environment, or lifetime does it establish? A signed platform statement is useful only if the issuer validates the expected platform authority and binds the statement to the intended request context. Replaying old evidence or accepting another account's evidence can otherwise cross the desired boundary.

The node's agent also needs to identify the issuer or server it contacts. Distributing a trusted root or using a documented authenticated bootstrap profile is part of this design, not a detail to disable when a connection fails. Trust-on-first-use changes the threat model and requires explicit acceptance criteria. Keep bootstrap credentials narrow and retire them after use when the selected protocol permits; a long-lived universal join secret can turn one node's compromise into broad enrollment power.

A node agent may authenticate to an issuer, while local workloads request credentials through a workload endpoint. The agent must determine which calling process or container is asking and match trusted selectors to registration policy. Merely reaching a Unix socket or local address does not mean every caller should receive the node's broadest identity. Socket exposure, namespace boundaries, process attributes, and orchestrator metadata all participate in the caller-identification assumptions.

Avoid treating user-supplied labels or environment variables as authoritative evidence without an independent trusted binding. A workload can often choose its own request fields. The issuer or agent needs evidence from a platform boundary whose integrity it actually trusts. A compromised node may falsify or access much more than an ordinary container; state that risk rather than promising that workload identity eliminates host trust. Isolate and monitor bootstrap privileges separately from normal service permissions.

Test enrollment from an allowed node and a disallowed account or namespace, then replay expired or mismatched evidence. Observe issuer decisions and the exact identity delivered without logging reusable secrets. Exercise agent restarts and lost server connectivity: a node should not silently receive an unrestricted fallback identity. Record bootstrap dependencies so a root rotation or platform API outage can be diagnosed without turning off verification to restore apparent connectivity.

The reliability lab is an availability analogy only. Reset and set both n=5, k=2, predict three up and a majority of three, then inspect; Reset and re-set n=5, k=3 to predict two up. These counts are not a trust quorum or attestation mechanism, and the lab does not validate evidence. Use the comparison to state that enough reachable issuer replicas do not establish authentic bootstrap or correct enrollment; those properties require the authority and registration checks described above.