Supply Chain

TEE inference turns the model runtime into part of the trusted computing base. A3S Power keeps the default developer path productive, but gives production TEE operators a smaller tee-minimal profile for security review.

Feature Profiles

Recommended TEE Profile

Use tee-minimal when the deployment target is AMD SEV-SNP or Intel TDX and the operator wants to avoid large inference dependency trees:

cargo build --release --no-default-features --features tee-minimal

This profile includes:

• picolm pure Rust GGUF layer-streaming inference.
• TEE detection and attestation paths for SEV-SNP, TDX, and simulation.
• Model SHA-256 integrity checks and attestation model binding.
• AES-256-GCM encrypted model loading, memory zeroing, and log redaction.
• RA-TLS transport through the tls feature.
• AF_VSOCK transport through the vsock feature for a3s-box MicroVM deployments.

It excludes:

• mistralrs / candle as the default broad-compatibility backend.
• llama-cpp-2 and the llama.cpp C++ inference engine.
• Hugging Face pull support unless hf is explicitly enabled.

TLS and HTTP crypto dependencies may still include native crypto build components such as ring or aws-lc-sys; tee-minimal removes native inference engines, not every native dependency in the full network stack.

Backend Audit Surface

The picolm path is split into small Rust modules under src/backend/picolm.rs, src/backend/gguf_stream.rs, and src/backend/picolm_ops/. It currently covers:

• GGUF v2/v3 parsing with zero-copy tensor slices and bounds checks.
• madvise(MADV_DONTNEED) page release after layer processing.
• Multi-head / GQA attention, SwiGLU / GeGLU feed-forward, RoPE, RMSNorm, and KV cache.
• Q4_K, Q5_K, Q6_K, Q8_0, Q4_0, F16, and F32 dequantization.
• Fused dequant+dot kernels, Rayon matmul, NEON and AVX2 optimized paths.
• JSON grammar-constrained output, tool-call parsing, and speculative decoding.

Run these checks from crates/power when auditing a release:

# Compare dependency surfaces.
cargo tree --no-default-features --features tee-minimal --edges no-dev | wc -l
cargo tree --edges no-dev | wc -l

# Review unsafe blocks in the layer-streaming inference path.
rg -n "unsafe" src/backend/picolm.rs src/backend/gguf_stream.rs src/backend/picolm_ops src/tee/encrypted_model.rs src/tee/epc.rs

# List native build scripts in the selected profile.
cargo tree --no-default-features --features tee-minimal --edges build

Encrypted Model Handling

Power has three encrypted model paths:

Audit Checklist

• Pin the exact Power version and feature profile.
• Reproduce the dependency tree for the release artifact.
• Review all unsafe blocks in the selected inference and TEE paths.
• Verify model hashes are configured before enabling tee_mode.
• Check that attestation report_data binds [nonce(32)][model_sha256(32)] for model-specific verification.
• Keep redact_logs = true and suppress_token_metrics = true for sensitive deployments.
• Prefer streaming_decrypt = true with picolm or in_memory_decrypt = true for other backends when plaintext disk writes are unacceptable.
• Validate RA-TLS clients extract and verify the custom attestation X.509 extension before sending prompts.