Vision: a retrofit kit to make any datacenter verifiable.

Assurance Node

The independent referee: evidence in, signed receipts out

CPU TEE : host attestation

Where are the chips located?

A round-trip-time proof anchors each server to the Assurance Node, a landmark inside the same facility whose own position is independently attested. Added delay can only make a device look farther away, never closer, so the proof bounds the server to the facility itself. The GPU's TEE key binds that session to one specific chip, and the silicon's physical fingerprint (how it throttles under load) adds a continuously measured signal against key transplant, still a research primitive. A Data Sovereignty Auditor checks each workload against its declared jurisdiction, and the result is issued as a Sovereignty Certificate, a W3C Verifiable Credential the relying party verifies itself.

Captured by · Assurance Node + CPU TEE + GPU TEE

"where": {
  "jurisdiction": "SE",
  "proof": "rtt-an-landmark",
  "witness": "an:sto-fac1",
  "corroborators": ["sto1", "osl1", "cph1"],
  "bound_m": 500,
  "certificate": "vc:sovcert:7b9…",
  "verified": true
}

Who is using the model?

Human identity-proofing and signed delegation chains establish who is acting, and each agent carries scoped credentials issued inside its TEE-backed harness. A formal policy language in the Assurance Node decides every interaction (permit or forbid, with annotations such as escalate or redact), and the AgentGateway enforces the verdict in the traffic path; the evaluation engine is formally verified upstream, our integration still in development. Identity comes in tiers, from self-asserted to hardware-bound, and escalations route to a human approver whose signed decision lands in the same receipt chain.

Captured by · SmartNIC + CPU TEE

"who": {
  "principal": "did:web:gov.se",
  "agent": "vap:analyst-07",
  "delegation": "verified",
  "policy": {
    "action": "invoke",
    "injection_risk": 0.04,
    "toxic_content": 0.11,
    "pii_count": 0,
    "decision": "permit"
  }
}

What model is running?

Each serving Confidential VM hashes the model at load time inside the GPU's trusted execution environment, and a formal policy cross-checks that hash against the lab-signed evaluation record, binding the running model to its evaluation without exposing the weights. The binding is spot-checked after deployment: every request commits an output digest, and an unpredictable sample is recomputed on reference hardware, a second root independent of the TEE. Bit-exact recompute is demonstrated under bounded assumptions and is being hardened for production.

Captured by · GPU TEE

"what": {
  "model": "Llama-3.1-8B-Instruct",
  "deploy_hash": "0x9f3c…a1",
  "eval_hash":   "0x9f3c…a1",
  "match": true,
  "safety_evals": {
    "wmdp_acc":           0.31,
    "harmbench_asr":      0.02,
    "strongreject_score": 0.04,
    "truthfulqa_acc":     0.71
  },
  "signed_by": "eval-lab (illustrative)"
}

How are the chips being used?

Every job declares itself first in a signed Verifiable Job Manifest; measurement then checks the declaration. A DC-SCM / BMC module meters power at the shunt while the GPU TEE reports utilisation counters: two independent signals for the same work, cross-checked continuously, where disagreement flags an anomaly. Traffic shape helps distinguish training from inference, and a passive optical tap hashes every flow (headers only) into an append-only commitment, so the accounting rests on everything that crossed the wire, not only what was declared. Hardware never enrolled stays out of scope, a boundary the architecture states rather than hides. Every reading is hardware-rooted and every receipt chained, so a counter cannot be silently reset nor a window backdated without detection.

Captured by · SmartNIC + DC-SCM / BMC + GPU TEE

"how": {
  "manifest": "vjm:sha256:9c41…",
  "declared_class": "inference",
  "measured_class": "inference",
  "device_class": "NVIDIA HGX H100 · CC-mode",
  "window": "2026-06-18T09:00Z / PT1H",
  "shunt_power_kw": 10.4,
  "utilization_pct": 93.4,
  "flops_per_s": "1.5e16",
  "energy_kwh": 10.4,
  "shadow_hardware": "none-detected",
  "attested": true
}

Collects signed claims (RFC 9334 Evidence) from software ClaimsAuditors, each in its own Confidential VM.

Evaluates a formal policy language per interaction (permit or forbid, with decision annotations) under evaluation semantics formally verified upstream. The proof covers the evaluator, not the policies written in it.

Issues chained AI Passport receipts: retroactive forgery is detectable; only receipts leave the facility.

Emits a chained heartbeat: signed, sequentially numbered receipts every few seconds, so a gap in the evidence is itself evidence, cryptographically detectable.

Bounds staleness: receipts carry freshness windows and are checked against revocation state before a relying party acts, so a compromised key or device is cut off at the next check rather than trusted forever.

Spot-checks by recompute: an unpredictable sample of committed requests is re-run on reference hardware, and the output digests must match. The check is intended to stand even if a TEE falls.

At the treaty-grade tier, the relying party can request a fresh SPDM attestation directly from hardware to spot-check.