spec: define composite CPU and GPU evidence for confidential inference receipts
Maintainers usually reply within 1 day
@imran-siddique is already working on this.
Since Sep 7, 2026.
Assessment
This issue has not been assessed yet.
Description
Problem
Confidential inference can involve two independent hardware trust chains: a confidential CPU or VM and a confidential GPU. A generic runtime measurement or a GPU example alone does not define how a verifier establishes that both reports belong to the same workload, channel, model execution, and evidence epoch.
The evidence format should support this composition without claiming that a valid receipt proves model quality, physical isolation beyond the admitted hardware threat model, or inference correctness.
Scope
Define a generic TRACE profile or composition rule for confidential-inference receipts. No customer, event, provider deployment, or proprietary service is in scope.
Acceptance criteria
- Represent distinct CPU and GPU evidence chains and their independent appraisal outcomes.
- Bind both chains to one freshness challenge, deployment identity, or attested channel key.
- Bind the workload measurement, model artifact digest, policy identity, and inference-session identifier.
- Represent attestation-gated key release and lease state by digest or linked receipt, without exposing keys or model weights.
- Distinguish verified, structurally present but unverified, missing, stale, mismatched, and contraindicated evidence.
- Define verifier behavior for CPU substitution, GPU substitution, transport-key substitution, and expired lease cases.
- State explicitly that hardware evidence does not prove model output correctness or defeat physical attacks outside the admitted threat model.
- Add one positive and isolated negative conformance vectors for each required binding.
Related work
Weight Custody Manifest issue #77 tracks a real contemporaneous CPU plus GPU sealed-key release. This issue concerns the portable TRACE representation and verifier semantics for the resulting composite execution evidence.
- Dominant language
- Python
- Stars
- 37
- Forks
- 33
- Avg merge
- 1d 4h
- Merged PRs (30d)
- 122
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from agentrust-io/trace-spec
-
Difficulty 5/5 Over a week Newbie friendliness 25/100
agentrust-io/trace-spec#593 · 1 comment ·
Maintainers usually reply within 1 day
-
bug needs-review:HIGH
Difficulty 5/5 Over a week Newbie friendliness 20/100
agentrust-io/trace-spec#591 · 4 comments ·
Maintainers usually reply within 1 day
-
prototype(manifest_requirements): resolve accepted_methods without duplicating bindings and reject unconfigured binding endpoints with ProfileErrorPossibly taken @drk-ram claimed this 1 day ago. Open
Difficulty 3/5 1-2 days Newbie friendliness 78/100
agentrust-io/trace-spec#580 ·
Maintainers usually reply within 1 day
-
feat(delegation): add parent_record_hash, verify_delegation_link, and verify_delegation_chain to agentrust_tracePossibly taken @drk-ram claimed this 1 day ago. Open
Difficulty 4/5 3-5 days Newbie friendliness 58/100
agentrust-io/trace-spec#581 ·
Maintainers usually reply within 1 day
-
revocation,trust-record-verify: implement es256 and es384 bundle verification and add EC revocation vectors (#448 items 1, 10)Possibly taken @drk-ram claimed this 1 day ago. Open
Difficulty 4/5 3-5 days Newbie friendliness 52/100
agentrust-io/trace-spec#584 ·
Maintainers usually reply within 1 day
All issues in agentrust-io/trace-spec
Similar issues
-
documentation
Difficulty 2/5 1-3 hours Newbie friendliness 67/100
Maintainers usually reply within 1 day
-
good first issue module-baseline needs triage ux
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
darnitdevorg/darnit#650 ·
Maintainers usually reply within 2 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
nyjc-computing/campus#938 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
nf-osi/nf-metadata-dictionary#1027 ·
Maintainers usually reply within 1 day
-
bug documentation
Difficulty 1/5 Under an hour Newbie friendliness 92/100
qatrackplus/qatrackplus#913 ·
Maintainers usually reply within 3 days