Goal: a retrofit kit that aims to make a datacenter verifiable.

Assurance Node

The independent referee: evidence in, signed receipts out

CPU TEE : host attestation

Is this workload running in the declared jurisdiction?

A round-trip-time location proof anchors each server to the Assurance Node itself, a landmark inside the same facility, whose own position is independently attested and corroborated by external witness nodes. Because the witness sits metres away, the honest round-trip is already at the physical floor: added delay can only make a device look farther away, never closer, so the proof bounds the server to the facility itself rather than to a radius of kilometres. The proof locates a cryptographic session; the GPU's TEE key binds that session to one specific chip, and the silicon's physical fingerprint (how it throttles under load) adds a signal against key transplant, an active research primitive rather than a settled guarantee. Measured continuously rather than once at enrolment: it is the variance signature, not the mean, that betrays a moved device. A Data Sovereignty Auditor checks every workload against its declared jurisdiction, and the Assurance Node issues the result as a Sovereignty Certificate, a W3C Verifiable Credential the relying party verifies itself.

Captured by · Assurance Node + CPU TEE + GPU TEE

"where": {
  "jurisdiction": "SE",
  "proof": "rtt-an-landmark",
  "witness": "an:sto-fac1",
  "corroborators": ["sto1", "osl1", "cph1"],
  "bound_m": 500,
  "certificate": "vc:sovcert:7b9…",
  "verified": true
}

Who (and which agent) is using this compute, and did it stay in scope?

Human identity-proofing and signed agent-delegation chains establish the principal, and each agent carries its own scoped credentials issued inside its TEE-backed harness. The SmartNIC scores traffic for content governance while a formal policy language in the Assurance Node (its evaluation engine formally verified upstream, our integration in development) decides every interaction permit / forbid, annotating deny, warn, escalate, redact, shadow, or log, and the AgentGateway enforces the verdict in the traffic path. Identity comes in tiers (self-asserted, KYC-verified, hardware-bound), and scope is part of the answer: the gateway's per-interaction question is whether the agent stayed inside its delegation. Escalate verdicts route to a human approver, whose signed decision lands in the same receipt chain.

Captured by · SmartNIC + CPU TEE

"who": {
  "principal": "did:web:gov.se",
  "agent": "vap:analyst-07",
  "delegation": "verified",
  "policy": {
    "action": "invoke",
    "injection_risk": 0.04,
    "toxic_content": 0.11,
    "pii_count": 0,
    "decision": "permit"
  }
}

Is the deployed model the one that was evaluated, and is it safe?

Each serving Confidential VM (Intel TDX or AMD SEV-SNP) hashes the model at load time inside the GPU's trusted execution environment. A formal policy verifies the lab-signed (model hash, evaluation result) attestation and cross-checks it against the deploy-time hash, binding the running model to its evaluation without ever exposing the weights. Evaluation runs standard, widely-used safety benchmarks. The binding is also spot-checked after deployment: every request commits an output digest to the receipt chain, and an unpredictably sampled fraction is recomputed on reference hardware, a second root, independent of the TEE, confirming the served model matches the evaluated one on the sampled requests. Bit-exact recompute is demonstrated under bounded assumptions and is being hardened for production.

Captured by · GPU TEE

"what": {
  "model": "Llama-3.1-8B-Instruct",
  "deploy_hash": "0x9f3c…a1",
  "eval_hash":   "0x9f3c…a1",
  "match": true,
  "safety_evals": {
    "wmdp_acc":           0.31,
    "harmbench_asr":      0.02,
    "strongreject_score": 0.04,
    "truthfulqa_acc":     0.71
  },
  "signed_by": "eval-lab (illustrative)"
}

How much compute, of what class, was actually used?

Every job declares itself first: a signed Verifiable Job Manifest, submitted through the SmartNIC, states what will run and in which class; measurement then checks the declaration. A DC-SCM / BMC module meters power at the shunt while the GPU TEE reports utilisation counters, two independent signals for the same work, cross-checked continuously as tamper-evidence; disagreement flags an anomaly rather than metering exact FLOP/s. Traffic shape on the SmartNIC helps distinguish training from inference; undeclared draw inside the metered facility is flagged; NVSwitch counters (device-reported) track the east–west traffic inside the GPU fabric, and a passive optical tap on fabric I/O hashes every flow at line rate (headers only) into an append-only commitment, so the accounting rests on everything that crossed the wire, not only what was declared. Hardware never enrolled in the regime stays out of scope, a boundary the architecture states rather than hides. Every reading is hardware-rooted and tamper-evident, and the receipts are chained, so a counter cannot be silently reset nor a window backdated without detection.

Captured by · SmartNIC + DC-SCM / BMC + GPU TEE

"how": {
  "manifest": "vjm:sha256:9c41…",
  "declared_class": "inference",
  "measured_class": "inference",
  "device_class": "NVIDIA HGX H100 · CC-mode",
  "window": "2026-06-18T09:00Z / PT1H",
  "shunt_power_kw": 10.4,
  "utilization_pct": 93.4,
  "flops_per_s": "1.5e16",
  "energy_kwh": 10.4,
  "shadow_hardware": "none-detected",
  "attested": true
}

Collects signed claims (RFC 9334 Evidence) from software ClaimsAuditors, each in its own Confidential VM.

Evaluates a formal policy language per interaction (permit or forbid, with decision annotations) under evaluation semantics formally verified upstream. The proof covers the evaluator, not the policies written in it.

Issues chained AI Passport receipts: retroactive forgery is detectable; only receipts leave the facility.

Emits a chained heartbeat: signed, sequentially numbered receipts every few seconds, so a gap in the evidence is itself evidence, cryptographically detectable.

Bounds staleness: receipts carry freshness windows and are checked against revocation state before a relying party acts, so a compromised key or device is cut off at the next check rather than trusted forever.

Spot-checks by recompute: an unpredictable sample of committed requests is re-run on reference hardware, and the output digests must match. The check is intended to stand even if a TEE falls.

At the treaty-grade tier, the relying party can request a fresh SPDM attestation directly from hardware to spot-check.