Device attestation signing has no flag, loads dynamically, and needs a server-registered key.
Claude Code has new code to attach a device attestation to the analytics envelopes it sends, so an event can be tied to a real device and not just an account. The event body is canonicalized to a fixed JSON form, hashed and signed, and the signature travels with the event. Nothing in this build turns it on: there is no flag and no settings key, the signing module is loaded at runtime and the path is inert whenever that load fails, and even with the module present signing only happens if the account has a registered device key, which is decided server-side.
- The canonicalized body is hashed with sha256 and signed with ECDSA in
ieee-p1363form; the envelope carrieskid,signatureandjcs_lib. - Payload keys are normalised and stray lone-surrogate escapes are scrubbed before signing; the canonicalizer refuses values that have no JSON form and non-finite numbers rather than emitting them.
- Ids containing a NUL byte skip signing entirely.
- Skips are recorded under the feature name
client_event_signerwith a reason:no_device_key,load_failedfor a key that is present but unreadable, orbound_elsewherefor a key belonging to a different device. - A failed module load emits its own telemetry with a
module_load_failedcause plus diagnostic output reading[clientEventSigner] the signer module did not load:. - Any signing failure falls back to sending the plain unsigned payload, so telemetry is never blocked by this path.
- None of this code or these strings exist in v2.1.247.
anthropic.ccr.client_event.v1, [clientEventSigner] the signer module did not load:
Strings lifted out of the shipped bundle, so the claim above can be checked against them.