#Verification

Attestation is useful only when the party relying on an answer controls the acceptance policy. Power therefore separates evidence production from evidence acceptance.

model bytes + runtime policy
             |
             v
canonical claims digest + fresh nonce
             |
             v
CPU TEE report + optional GPU evidence
             |
             v
request, effective prompt, and output receipt
             |
             v
independent client verifier accepts or rejects

#What the receipt binds

A response receipt can commit to:

• the exact model artifact identity;
• the runtime and effective policy;
• input, effective-prompt, decoding, tool, output, and response digests;
• the selected accelerator or exact fallback path;
• fused-batch or heterogeneous device-mesh evidence;
• the CPU TEE report and optional GPU confidential-computing claims.

Fields that cannot be derived honestly remain absent. For example, opaque multimodal renderer paths do not fabricate an effective-prompt digest.

#Build the strict verifier

cargo build --release --bin a3s-power-verify --features hw-verify

Without hw-verify, strict signature verification fails closed. The explicit --allow-offline bypass exists for fixtures and offline inspection, not production acceptance.

#Verify a running service

a3s-power-verify \
  --url https://power.example.com \
  --model your-model \
  --nonce <fresh-client-nonce-hex> \
  --model-hash <64-character-artifact-sha256> \
  --expected-measurement <96-character-launch-measurement-hex>

The verifier - not the server operator - chooses the accepted launch measurement, artifact hash, runtime policy, GPU evidence, and receipt fields.

#Hardware evidence

Power caches fetched AMD KDS certificate material in memory for one hour by default. Operators can tune that cache, but a network or certificate failure remains production-blocking unless an explicit reviewed offline certificate design exists. Intel TDX requires a later reviewed DCAP Quote/QVL path.

#Configure strict policy

tee_mode = true
tee_policy_mode = "strict"
redact_logs = true

expected_measurement "sev-snp" {
  digest = "<96-character measurement hex>"
}

model_hash "your-model" {
  digest = "sha256:<64-character artifact digest>"
}

Strict policy rejects simulated reports. CPU TEE placement also does not make GPU offload confidential; a GPU path needs verified gpu-confidential claims.

#Production-blocking failures

• Missing hardware-verification support in a strict verifier build.
• Missing or malformed launch-measurement and artifact pins.
• Missing raw report bytes in saved evidence.
• Vendor certificate retrieval, parsing, or signature failures.
• Stale nonces or mismatched model, policy, input, output, or device digests.
• Simulated or tee_type=none reports on a strict path.

Read Hardware Verifier Operations for certificate services, cache behavior, saved evidence, and failure policy.