Keep current and rollback PCR0s in Research and SDK bundles

apps/maple-research/frontend/src/config/openSecretClientConfig.ts

@@ -3,54 +3,17 @@ import { openSecretPcrEnvironment } from "./openSecretPcrEnvironment";
 const DEFAULT_OPEN_SECRET_CLIENT_ID = "ba5a14b5-d915-47b1-b7b1-afda52bc5fc6";
 
 const PCR0_VALUES = [
-  // Approved 2026-09-14 (services/opensecret signed history)
-  "a0ef363874f70bd82af98d8e628bf7f128dfca1f9918e83af494cd17f5d4ff1a0c1b94b235941a6d20138d1152cbe5aa",
-  // Approved 2026-09-12 (services/opensecret signed history)
-  "3d2f90b4dac7316e5485e03f4cdf3f2f8ae79fde77442546475eac6c3037916ac54b8bdb26c85a73e9b778a9a5077638",
-  // Approved 2026-09-05 (services/opensecret signed history)
-  "a1c09f74133cbcc0e5034b9a8a5ed1a5a567d4922140d69534827b4473c7f385b989ce594e0b11f6b8ec971decb95608",
-  "ed9109c16f30a470cf0ea2251816789b4ffa510c990118323ce94a2364b9bf05bdb8777959cbac86f5cabc4852e0da71",
-  "4f2bcdf16c38842e1a45defd944d24ea58bb5bcb76491843223022acfe9eb6f1ff79b2cb9a6b2a9219daf9c7bf40fa37",
-  "b8ee4b511ef2c9c6ab3e5c0840c5df2218fbb4d9df88254ece7af9462677e55aa5a03838f3ae432d86ca1cb6f992eee7",
-  "33ffe5cae0f72cfe904bde8019ad98efa0ce5db2800f37c5d4149461023d1f70ea77e4f58ae1327ff46ed6a34045d6e2",
-  "a1398fa2946b6ed4b96a1a992ee668aef3661329690f87d44cad5b646ce33e3b16a55674b1d6d54d115a5520801b97d6",
-  "878dc4111e94722f3d33b202dc1368916af2eb486e74b3d94c9dfbcb3d981fa652827ea8e951ddfe06d1cefb482e431c",
-  "4e242871fecc14933c889908a6a7593de574c2655a47ffa163c5fd7ba41d063152ef441bd555ac7f8569eac4fd7cbc8b",
-  "095d38ba5c9c7ad1cfe5832d3dd8304b020392867aeef84f47e08b4305b867540b0ff5b2eb7d279de410e19ad937896e",
-  "72c9a1dc207d919196c78f845c0f5fd4b3b3a690e024a3dd599f160be04875fbe52983773909a9f1584105f7d5103538",
-  "a5ae21e211fa709dbced7fec7fff0eb86001174365a29271c07d7fb55fd9f37c7e2ddef1b01f39e977ca246277efeef2",
-  "2520e5067830a34fc457b6360358e3754d53ab855f4a05a81312f2a2ed0bf893c5ec43d1325972efbe3a8f2b79303734",
-  "a275a3877972c670c4f43e658cc9296838f79a96a26429877f74285c3a088d426583d3e2f6f99cfd96c70fdfa1475266",
-  "8de5541089649e9edb2cd96fafb90716aa298483447e459708e8840b1f82a557c9d9ff6ae1fd2461b04310e7d9400d7d",
-  "02a41da2df084fd1dee420d7717bef6dc0120f1d6a0b7fded3f4c7a539be4044b3061c71bc7156731db1fb66494097b0",
-  "d9638aebacf2bf15ef0ab7d394320a3aa5ebde9f0e8911d2d2a0b49a2792f3825e6f6ca56960a63e91857398125d8038",
-  "41786ecb8e012b910cd095ad5f8b5acefcaf80df3cf8e909499da45dd594c7c4c28302b5dde551d870555bd389a1e2c4"
+  // Approved 2026-10-11 (services/opensecret signed history)
+  "21d27bd19cdd02632485a6e8874753e42cf7f098f1335bb62a9c23e7f64da9100c02dba582da17ac68052fa6be16b7a9",
+  // Approved 2026-10-09 (services/opensecret signed history; rollback)
+  "643b3c293a4eac11ec14ab405d2405e46cb714263a12da6c62f485a0fa395cb3c3d5ef07b18d39a1f9715f25e7943b66"
 ];
 
 const PCR0_DEV_VALUES = [
-  // Approved 2026-09-14 (services/opensecret signed history)
-  "61d92c66684de563fbc4ce3ece9680966672a065a65dedfd1dcdab149b2d3d3d725ab853dae6dc251dbb3326ff7d1214",
-  // Approved 2026-09-12 (services/opensecret signed history)
-  "c5470ea9d2d8499a65fbb9bc936bd7a62a5ef90b54da1504535cb4384f303fb673369d64f1a43f17c8ed8d2a89f09949",
-  // Approved 2026-09-05 (services/opensecret signed history)
-  "831eb975dad0b3f3741612acc92f020c0467bd3ac967ddf925fa60eff9e02cf9239ec50c699715fbf9a35e3448e2a117",
-  "799600ba64a29e360b1651f4ced6c9ca5323094a45294551327b996062c3f21e6fef651e7e3d97ec8d25be87b9935b4f",
-  "2fd9d4f716fd28336d96bc1a20b18a727c2d18f292577ba99323acfc8fb08959428a123b7acff478994c4f961247a0c7",
-  "4292db2a90ce5ea6f6e2766e0238a328c81dc060a1f3175bced2e94a10e0490d3ff9125d774dafdff969ac661778e757",
-  "f58409ae1bc8600c887fef5cc4055149c88c94b41c2b3e268826af7b43a1cdbacffdb2c96bf5972120c6460ab83fe89e",
-  "6fcdb8086806a96c421c08eaf67cebf164aa898798b6f91b072c884773bc6ed64fe8f5af644fe35411195167b0e4a5f1",
-  "0042958bde1fdd1bcbd4085ec94456c49e7bc5d2c3368f6f34edd6f339193cb7b53929d299eaf6a220ed5b7691f8618a",
-  "583ac140e0454dd4766a07c147cb6d90d5430d6bc9c1571da19c781dea4027e1c434273caba584440180ca42c2db84d5",
-  "4451e47ddb4be8a63492e62bc400e69d924188040805c658334f708e8682d308af3feb16018e98a5589c345d28437a6b",
-  "5bc5a32791948dc7e315d01ec787307799bb6f70903d14c20dc47f19bb0ef3830eb3b2c5b04b7ae5b04717046b357a14",
-  "4243170eeb11d38cf9bbee48b754bccfe97385b4639051efe97cda50086784cd32009dcb89a0fb1098558f22dc55b4e6",
-  "be3de8fa74f42cc5165823da63aa283f1c8dfedb5e27e0bfa281c6dbd12d5b5bfd9bef591200175c44dbf0c504f5b0a5",
-  "ab7e90e1894f75fbd423f3d0027973b611beff7402bd224dcd0f162968fb9678f08c92970d16a444edc934aa6ecd7d62",
-  "8ba003e9d552d262cfd40a77eced199cfd0e776d1fd69d5ed6b7e6c6c92b91a0481e965247502f95a20478fe0a8f3de7",
-  "2e6e8f86a657f6daed8e699c0b74bf02d6c7d6414638b1032e6addd2bca7d208a0e8aa4961eb8e926c54dc58fd63d401",
-  "6b15f0571de13a6357e646bbe3772a8fe32fdd85b07ba97b3a6f95bdc43023dd9deb5710c26b75346de90157d9ecdd1f",
-  "2596e528703abda188de27b6995f8d3cc553502e4acbb4d06db1dc8239b428638447adff38ccce358ef9fe34c2e0bccc",
-  "e36d72989d89818b77ab1012cf875c46c0d7fb5389fd559b9ea0950231ae1cc17dd222e5d19a84363a27a3cd7f268de6"
+  // Approved 2026-10-11 (services/opensecret signed history)
+  "a95956c3fb9457e509be6d614ffefcddf98fe594f77bb6a56891fc1f5bdec41da2add13db22e0908363c8d0929c04def",
+  // Approved 2026-10-09 (services/opensecret signed history; rollback)
+  "e573a3ddc8a27f387e24cfb02a8fa594fe782674de6ee1fa9385126b9f8ec38f4a236e91c371bdd2b9444623c1c1cc34"
 ];
 
 export function openSecretClientConfig() {

sdk/rust/src/pcr.rs

@@ -28,35 +28,17 @@ pub const OFFICIAL_DEVELOPMENT_PCR_HISTORY_URL: &str =
     "https://raw.githubusercontent.com/MaplePrivacyLabs/Maple/master/services/opensecret/pcrDevHistory.json";
 
 const OFFICIAL_PRODUCTION_PCR0S: &[&str] = &[
-    // Approved 2026-09-14 (services/opensecret signed history)
-    "a0ef363874f70bd82af98d8e628bf7f128dfca1f9918e83af494cd17f5d4ff1a0c1b94b235941a6d20138d1152cbe5aa",
-    // Approved 2026-09-12 (services/opensecret signed history)
-    "3d2f90b4dac7316e5485e03f4cdf3f2f8ae79fde77442546475eac6c3037916ac54b8bdb26c85a73e9b778a9a5077638",
-    // Approved 2026-09-05 (services/opensecret signed history)
-    "a1c09f74133cbcc0e5034b9a8a5ed1a5a567d4922140d69534827b4473c7f385b989ce594e0b11f6b8ec971decb95608",
-    "eeddbb58f57c38894d6d5af5e575fbe791c5bf3bbcfb5df8da8cfcf0c2e1da1913108e6a762112444740b88c163d7f4b",
-    "74ed417f88cb0ca76c4a3d10f278bd010f1d3f95eafb254d4732511bb50e404507a4049b779c5230137e4091a5582271",
-    "9043fcab93b972d3c14ad2dc8fa78ca7ad374fc937c02435681772a003f7a72876bc4d578089b5c4cf3fe9b480f1aabb",
-    "52c3595b151d93d8b159c257301bfd5aa6f49210de0c55a6cd6df5ebeee44e4206cab950500f5d188f7fa14e6d900b75",
-    "91cb67311e910cce68cd5b7d0de77aa40610d87c6681439b44c46c3ff786ae643956ab2c812478a1da8745b259f07a45",
-    "859065ac81b81d3735130ba08b8af72a7256b603fefb74faabae25ed28cca6edcaa7c10ea32b5948d675c18a9b0f2b1d",
-    "acd82a7d3943e23e95a9dc3ce0b0107ea358d6287f9e3afa245622f7c7e3e0a66142a928b6efcc02f594a95366d3a99d",
+    // Approved 2026-10-11 (services/opensecret signed history)
+    "21d27bd19cdd02632485a6e8874753e42cf7f098f1335bb62a9c23e7f64da9100c02dba582da17ac68052fa6be16b7a9",
+    // Approved 2026-10-09 (services/opensecret signed history; rollback)
+    "643b3c293a4eac11ec14ab405d2405e46cb714263a12da6c62f485a0fa395cb3c3d5ef07b18d39a1f9715f25e7943b66",
 ];
 
 const OFFICIAL_DEVELOPMENT_PCR0S: &[&str] = &[
-    // Approved 2026-09-14 (services/opensecret signed history)
-    "61d92c66684de563fbc4ce3ece9680966672a065a65dedfd1dcdab149b2d3d3d725ab853dae6dc251dbb3326ff7d1214",
-    // Approved 2026-09-12 (services/opensecret signed history)
-    "c5470ea9d2d8499a65fbb9bc936bd7a62a5ef90b54da1504535cb4384f303fb673369d64f1a43f17c8ed8d2a89f09949",
-    // Approved 2026-09-05 (services/opensecret signed history)
-    "831eb975dad0b3f3741612acc92f020c0467bd3ac967ddf925fa60eff9e02cf9239ec50c699715fbf9a35e3448e2a117",
-    "62c0407056217a4c10764ed9045694c29fa93255d3cc04c2f989cdd9a1f8050c8b169714c71f1118ebce2fcc9951d1a9",
-    "cb95519905443f9f66f05f63c548b61ad1561a27fd5717b69285861aaea3c3063fe12a2571773b67fea3c6c11b4d8ec6",
-    "deb5895831b5e4286f5a2dcf5e9c27383821446f8df2b465f141d10743599be20ba3bb381ce063bf7139cc89f7f61d4c",
-    "70ba26c6af1ec3b57ce80e1adcc0ee96d70224d4c7a078f427895cdf68e1c30f09b5ac4c456588d872f3f21ff77c036b",
-    "669404ea71435b8f498b48db7816a5c2ab1d258b1a77685b11d84d15a73189504d79c4dee13a658de9f4a0cbfc39cfe8",
-    "a791bf92c25ffdfd372660e460a0e238c6778c090672df6509ae4bc065cf8668b6baac6b6a11d554af53ee0ff0172ad5",
-    "c4285443b87b9b12a6cea3bef1064ec060f652b235a297095975af8f134e5ed65f92d70d4616fdec80af9dff48bb9f35",
+    // Approved 2026-10-11 (services/opensecret signed history)
+    "a95956c3fb9457e509be6d614ffefcddf98fe594f77bb6a56891fc1f5bdec41da2add13db22e0908363c8d0929c04def",
+    // Approved 2026-10-09 (services/opensecret signed history; rollback)
+    "e573a3ddc8a27f387e24cfb02a8fa594fe782674de6ee1fa9385126b9f8ec38f4a236e91c371bdd2b9444623c1c1cc34",
 ];
 
 /// OpenSecret deployment environment whose PCR0 trust roots should be used.
@@ -483,6 +465,21 @@ mod tests {
             .is_err());
     }
 
+    #[tokio::test]
+    async fn older_approvals_require_history_rather_than_bundled_trust() {
+        let production = Pcr0TrustPolicy::official().without_remote_history();
+        let development =
+            Pcr0TrustPolicy::official_for(Pcr0Environment::Development).without_remote_history();
+        assert!(production
+            .verify_pcr0(&pcr_bytes("eeddbb58f57c38894d6d5af5e575fbe791c5bf3bbcfb5df8da8cfcf0c2e1da1913108e6a762112444740b88c163d7f4b"))
+            .await
+            .is_err());
+        assert!(development
+            .verify_pcr0(&pcr_bytes("62c0407056217a4c10764ed9045694c29fa93255d3cc04c2f989cdd9a1f8050c8b169714c71f1118ebce2fcc9951d1a9"))
+            .await
+            .is_err());
+    }
+
     #[tokio::test]
     async fn all_zero_pcr0_is_never_trusted() {
         assert!(Pcr0TrustPolicy::from_static_allowlist([ALL_ZERO_PCR0]).is_err());

sdk/src/lib/pcr.ts

@@ -2,38 +2,20 @@
  * Valid PCR0 values for production environments
  */
 const DEFAULT_PCR0_VALUES = [
-  // Approved 2026-09-14 (services/opensecret signed history)
-  "a0ef363874f70bd82af98d8e628bf7f128dfca1f9918e83af494cd17f5d4ff1a0c1b94b235941a6d20138d1152cbe5aa",
-  // Approved 2026-09-12 (services/opensecret signed history)
-  "3d2f90b4dac7316e5485e03f4cdf3f2f8ae79fde77442546475eac6c3037916ac54b8bdb26c85a73e9b778a9a5077638",
-  // Approved 2026-09-05 (services/opensecret signed history)
-  "a1c09f74133cbcc0e5034b9a8a5ed1a5a567d4922140d69534827b4473c7f385b989ce594e0b11f6b8ec971decb95608",
-  "eeddbb58f57c38894d6d5af5e575fbe791c5bf3bbcfb5df8da8cfcf0c2e1da1913108e6a762112444740b88c163d7f4b",
-  "74ed417f88cb0ca76c4a3d10f278bd010f1d3f95eafb254d4732511bb50e404507a4049b779c5230137e4091a5582271",
-  "9043fcab93b972d3c14ad2dc8fa78ca7ad374fc937c02435681772a003f7a72876bc4d578089b5c4cf3fe9b480f1aabb",
-  "52c3595b151d93d8b159c257301bfd5aa6f49210de0c55a6cd6df5ebeee44e4206cab950500f5d188f7fa14e6d900b75",
-  "91cb67311e910cce68cd5b7d0de77aa40610d87c6681439b44c46c3ff786ae643956ab2c812478a1da8745b259f07a45",
-  "859065ac81b81d3735130ba08b8af72a7256b603fefb74faabae25ed28cca6edcaa7c10ea32b5948d675c18a9b0f2b1d",
-  "acd82a7d3943e23e95a9dc3ce0b0107ea358d6287f9e3afa245622f7c7e3e0a66142a928b6efcc02f594a95366d3a99d"
+  // Approved 2026-10-11 (services/opensecret signed history)
+  "21d27bd19cdd02632485a6e8874753e42cf7f098f1335bb62a9c23e7f64da9100c02dba582da17ac68052fa6be16b7a9",
+  // Approved 2026-10-09 (services/opensecret signed history; rollback)
+  "643b3c293a4eac11ec14ab405d2405e46cb714263a12da6c62f485a0fa395cb3c3d5ef07b18d39a1f9715f25e7943b66"
 ];
 
 /**
  * Valid PCR0 values for development environments
  */
 const DEFAULT_PCR0_VALUES_DEV = [
-  // Approved 2026-09-14 (services/opensecret signed history)
-  "61d92c66684de563fbc4ce3ece9680966672a065a65dedfd1dcdab149b2d3d3d725ab853dae6dc251dbb3326ff7d1214",
-  // Approved 2026-09-12 (services/opensecret signed history)
-  "c5470ea9d2d8499a65fbb9bc936bd7a62a5ef90b54da1504535cb4384f303fb673369d64f1a43f17c8ed8d2a89f09949",
-  // Approved 2026-09-05 (services/opensecret signed history)
-  "831eb975dad0b3f3741612acc92f020c0467bd3ac967ddf925fa60eff9e02cf9239ec50c699715fbf9a35e3448e2a117",
-  "62c0407056217a4c10764ed9045694c29fa93255d3cc04c2f989cdd9a1f8050c8b169714c71f1118ebce2fcc9951d1a9",
-  "cb95519905443f9f66f05f63c548b61ad1561a27fd5717b69285861aaea3c3063fe12a2571773b67fea3c6c11b4d8ec6",
-  "deb5895831b5e4286f5a2dcf5e9c27383821446f8df2b465f141d10743599be20ba3bb381ce063bf7139cc89f7f61d4c",
-  "70ba26c6af1ec3b57ce80e1adcc0ee96d70224d4c7a078f427895cdf68e1c30f09b5ac4c456588d872f3f21ff77c036b",
-  "669404ea71435b8f498b48db7816a5c2ab1d258b1a77685b11d84d15a73189504d79c4dee13a658de9f4a0cbfc39cfe8",
-  "a791bf92c25ffdfd372660e460a0e238c6778c090672df6509ae4bc065cf8668b6baac6b6a11d554af53ee0ff0172ad5",
-  "c4285443b87b9b12a6cea3bef1064ec060f652b235a297095975af8f134e5ed65f92d70d4616fdec80af9dff48bb9f35"
+  // Approved 2026-10-11 (services/opensecret signed history)
+  "a95956c3fb9457e509be6d614ffefcddf98fe594f77bb6a56891fc1f5bdec41da2add13db22e0908363c8d0929c04def",
+  // Approved 2026-10-09 (services/opensecret signed history; rollback)
+  "e573a3ddc8a27f387e24cfb02a8fa594fe782674de6ee1fa9385126b9f8ec38f4a236e91c371bdd2b9444623c1c1cc34"
 ];
 
 /**

sdk/src/lib/test/integration/liveAttestation.test.ts

@@ -19,7 +19,7 @@ afterEach(() => {
 });
 
 test.skipIf(!runLive)(
-  "hosted enclave establishes a session only after signed-history PCR0 validation",
+  "hosted enclave establishes a session only after environment-scoped PCR0 validation",
   async () => {
     const requests: string[] = [];
     globalThis.fetch = async (input, init) => {
@@ -41,13 +41,19 @@ test.skipIf(!runLive)(
 
     expect(attestationIndex).toBeGreaterThanOrEqual(0);
     expect(prodHistoryIndex).toBe(-1);
-    expect(devHistoryIndex).toBeGreaterThan(attestationIndex);
-    expect(keyExchangeIndex).toBeGreaterThan(devHistoryIndex);
+    // A current bundled root needs no history fetch; future approved images
+    // still fetch and verify their signed development history before exchange.
+    if (devHistoryIndex >= 0) {
+      expect(devHistoryIndex).toBeGreaterThan(attestationIndex);
+      expect(keyExchangeIndex).toBeGreaterThan(devHistoryIndex);
+    } else {
+      expect(keyExchangeIndex).toBeGreaterThan(attestationIndex);
+    }
   }
 );
 
 test.skipIf(!runLive)(
-  "hosted enclave cannot reach key exchange when its PCR0 policy is deliberately unknown",
+  "hosted development enclave cannot reach key exchange under production bundled trust",
   async () => {
     const requests: string[] = [];
     globalThis.fetch = async (input, init) => {
@@ -57,7 +63,7 @@ test.skipIf(!runLive)(
 
     await expect(
       getAttestation(true, liveApiUrl, {
-        environment: "development",
+        environment: "production",
         remoteAttestation: false
       })
     ).rejects.toThrow(/PCR0/i);

sdk/src/lib/test/integration/pcr.test.ts

@@ -26,9 +26,9 @@ global.sessionStorage = storageMock();
 
 // Sample PCR0 values for testing
 const VALID_PCR0_PROD =
-  "eeddbb58f57c38894d6d5af5e575fbe791c5bf3bbcfb5df8da8cfcf0c2e1da1913108e6a762112444740b88c163d7f4b";
+  "21d27bd19cdd02632485a6e8874753e42cf7f098f1335bb62a9c23e7f64da9100c02dba582da17ac68052fa6be16b7a9";
 const VALID_PCR0_DEV =
-  "62c0407056217a4c10764ed9045694c29fa93255d3cc04c2f989cdd9a1f8050c8b169714c71f1118ebce2fcc9951d1a9";
+  "a95956c3fb9457e509be6d614ffefcddf98fe594f77bb6a56891fc1f5bdec41da2add13db22e0908363c8d0929c04def";
 const CUSTOM_PCR0 = "11".repeat(48);
 const CUSTOM_PCR0_DEV = "22".repeat(48);
 
@@ -116,6 +116,61 @@ test("development rejects production PCR0 values", async () => {
   expect(result.isMatch).toBe(false);
 });
 
+test("current and rollback approvals remain trusted without history only in their environment", async () => {
+  const approvals = [
+    {
+      environment: "production",
+      pcr0s: [
+        "21d27bd19cdd02632485a6e8874753e42cf7f098f1335bb62a9c23e7f64da9100c02dba582da17ac68052fa6be16b7a9",
+        "643b3c293a4eac11ec14ab405d2405e46cb714263a12da6c62f485a0fa395cb3c3d5ef07b18d39a1f9715f25e7943b66"
+      ]
+    },
+    {
+      environment: "development",
+      pcr0s: [
+        "a95956c3fb9457e509be6d614ffefcddf98fe594f77bb6a56891fc1f5bdec41da2add13db22e0908363c8d0929c04def",
+        "e573a3ddc8a27f387e24cfb02a8fa594fe782674de6ee1fa9385126b9f8ec38f4a236e91c371bdd2b9444623c1c1cc34"
+      ]
+    }
+  ] as const;
+
+  for (const { environment, pcr0s } of approvals) {
+    for (const pcr0 of pcr0s) {
+      expect(
+        (await validatePcr0Hash(pcr0, { environment, remoteAttestation: false })).isMatch
+      ).toBe(true);
+      const oppositeEnvironment = environment === "production" ? "development" : "production";
+      expect(
+        (
+          await validatePcr0Hash(pcr0, {
+            environment: oppositeEnvironment,
+            remoteAttestation: false
+          })
+        ).isMatch
+      ).toBe(false);
+    }
+  }
+});
+
+test("older approvals require signed history rather than bundled trust", async () => {
+  expect(
+    (
+      await validatePcr0Hash(
+        "eeddbb58f57c38894d6d5af5e575fbe791c5bf3bbcfb5df8da8cfcf0c2e1da1913108e6a762112444740b88c163d7f4b",
+        { remoteAttestation: false }
+      )
+    ).isMatch
+  ).toBe(false);
+  expect(
+    (
+      await validatePcr0Hash(
+        "62c0407056217a4c10764ed9045694c29fa93255d3cc04c2f989cdd9a1f8050c8b169714c71f1118ebce2fcc9951d1a9",
+        { environment: "development", remoteAttestation: false }
+      )
+    ).isMatch
+  ).toBe(false);
+});
+
 test("validates custom PCR0 values", async () => {
   const config: PcrConfig = {
     pcr0Values: [CUSTOM_PCR0]
@@ -179,6 +234,9 @@ test("rejects unknown PCR0 values when remote attestation is disabled", async ()
   };
   const result = await validatePcr0Hash(VERIFIED_PCR0, config);
   expect(result.isMatch).toBe(false);
+  expect(
+    (await validatePcr0Hash(VERIFIED_PCR0, { ...config, environment: "development" })).isMatch
+  ).toBe(false);
 });
 
 test("validates PCR0 from only the selected production history by default", async () => {