attestation: update verdict status to CRITICAL for non-Verified boot + ship proof

Updated the tee_integrity_verdict status: any boot state that is not Google-
Verified (SelfSigned/yellow, Unverified/orange, Failed/red) is now CRITICAL
(previously MEDIUM for self-signed, HIGH for unverified) and no longer earns
MEETS_DEVICE_INTEGRITY. A custom-signed or unverified boot is the unavoidable
footprint of a modified OS (custom kernel / ROM / KernelSU) => most probably
rooted.

The finding now carries hardware-attested proof of why: verified_boot_key_sha256
(the boot-signing key, which is not Google's on a modified device) plus an
os_modified_proof message tailored per boot state.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: iamjosephmj

deviceintelligence/src/main/kotlin/io/ssemaj/deviceintelligence/internal/IntegrityVerdict.kt

@@ -120,13 +120,19 @@ internal fun deriveIntegrityVerdict(
         firstFailure = "software_attestation"
     }
 
+    // Only a Google-VERIFIED (green) boot is a genuine OS. SELF_SIGNED (yellow)
+    // means the boot image is signed with a NON-Google (custom) AVB key — the
+    // unavoidable footprint of a relocked-with-own-key boot, i.e. a custom
+    // kernel / KernelSU / custom ROM. It is bootloader-"locked" but not stock,
+    // so it is most probably rooted and must NOT pass device integrity. Treat
+    // yellow like unverified (orange): not genuine -> CRITICAL severity below.
     val isGenuineOs = isHardware &&
-        (parsed.verifiedBootState == VerifiedBootState.VERIFIED ||
-            parsed.verifiedBootState == VerifiedBootState.SELF_SIGNED)
+        parsed.verifiedBootState == VerifiedBootState.VERIFIED
     if (isGenuineOs) {
         tiers += DeviceTier.MEETS_DEVICE_INTEGRITY
     } else if (isHardware && firstFailure == null) {
         firstFailure = when (parsed.verifiedBootState) {
+            VerifiedBootState.SELF_SIGNED -> "boot_self_signed"
             VerifiedBootState.UNVERIFIED, null -> "boot_unverified"
             VerifiedBootState.FAILED -> "boot_failed"
             else -> "boot_unrecognized"
@@ -161,7 +167,9 @@ internal fun deriveIntegrityVerdict(
         // means there is no hardware-backed evidence at all.
         !isHardware -> Severity.CRITICAL
         app == AppRecognition.UNRECOGNIZED_VERSION -> Severity.CRITICAL
-        !isGenuineOs -> Severity.HIGH
+        // Not a Google-VERIFIED boot (yellow/self-signed, orange/unverified, or
+        // red/failed) => the boot chain was modified => most probably rooted.
+        !isGenuineOs -> Severity.CRITICAL
         !isStrong -> Severity.MEDIUM
         else -> Severity.LOW
     }

deviceintelligence/src/main/kotlin/io/ssemaj/deviceintelligence/internal/KeyAttestationDetector.kt

@@ -475,24 +475,63 @@ internal object KeyAttestationDetector : Detector {
         verdict: IntegrityVerdict,
         pkg: String,
     ): Finding {
-        val details = LinkedHashMap<String, String>(8)
+        val details = LinkedHashMap<String, String>(10)
         details["device_recognition"] = verdict.deviceRecognition
             .joinToString(",") { it.wire }
         details["app_recognition"] = verdict.appRecognition.wire
-        details["bootloader_locked"] = (c.parsed?.deviceLocked?.toString() ?: "unknown")
+        val locked = c.parsed?.deviceLocked
+        details["bootloader_locked"] = locked?.toString() ?: "unknown"
         details["verified_boot_state"] = c.parsed?.verifiedBootState?.wire ?: "Unknown"
+        // The hardware-attested hash of the key that signed the running boot
+        // image. On stock it chains to Google's AVB key; any other value is
+        // proof the boot partition was re-signed with a custom key.
+        val bootKeyHash = c.parsed?.verifiedBootKey?.let { sha256Hex(it) }
+        bootKeyHash?.let { details["verified_boot_key_sha256"] = it }
         details["verdict_authoritative"] = "false"
         verdict.reason?.let { details["reason"] = it }
 
+        // Attach the concrete, hardware-attested proof of *why* the OS is
+        // considered modified (when the boot state says so).
+        val proof = osModifiedProof(c.parsed?.verifiedBootState, locked, bootKeyHash)
+        proof?.let { details["os_modified_proof"] = it }
+
         return Finding(
             kind = "tee_integrity_verdict",
             severity = verdict.severity,
             subject = pkg,
-            message = "TEE evidence indicates degraded device or app integrity (advisory; verify chain server-side)",
+            message = proof
+                ?: "TEE evidence indicates degraded device or app integrity (advisory; verify chain server-side)",
             details = details,
         )
     }
 
+    /**
+     * Hardware-attested proof of *why* the OS is considered modified, derived
+     * from the Verified Boot state in the attestation cert. Returns null for a
+     * Google-VERIFIED (green) boot — there is nothing to prove. These fields
+     * come from the secure element's RootOfTrust and cannot be forged on-device.
+     */
+    private fun osModifiedProof(
+        state: VerifiedBootState?,
+        locked: Boolean?,
+        bootKeyHash: String?,
+    ): String? = when (state) {
+        VerifiedBootState.SELF_SIGNED ->
+            "OS MODIFIED (hardware-attested): the running boot image is signed by a NON-Google " +
+                "(custom) AVB key [verifiedBootKey=${bootKeyHash ?: "?"}], verifiedBootState=SelfSigned. " +
+                "A stock device chains to Google's key; a custom key is the unavoidable footprint of a " +
+                "flashed + relocked boot (custom kernel / ROM / KernelSU). Bootloader-locked but not stock " +
+                "=> most probably rooted."
+        VerifiedBootState.UNVERIFIED ->
+            "OS MODIFIED (hardware-attested): bootloader is UNLOCKED (verifiedBootState=Unverified, " +
+                "deviceLocked=${locked ?: "?"}) — boot is not verified and can be arbitrarily replaced " +
+                "=> most probably rooted."
+        VerifiedBootState.FAILED ->
+            "OS MODIFIED (hardware-attested): boot verification FAILED (verifiedBootState=Failed) — the " +
+                "boot image does not match its expected signature. OS modified or corrupted."
+        else -> null
+    }
+
     // ---- AttestationReport construction -----------------------------------
 
     /**