Proofs
Every security property is a live, externally verifiable proof — attestation, in-VRAM consumption, post-quantum key transport, and a transparent STARK audit stream.
Nothing here is asserted. Every property is a check you can run against real hardware, on the hardware itself, and a verdict you can read.
The live proofs
| Proof | What it demonstrates |
|---|---|
| Attestation gate | Refuses to release the key on non-attested or non-Confidential-Computing hardware. Fails closed. |
| Anti-replay | An attestation report captured for one challenge is rejected against a fresh one. The nonce is read from inside the GPU-signed body and compared in constant time — not from an adjacent struct field. |
| CC enforcement | No key is released unless Confidential Computing is active on the GPU. Fails closed. |
| In-VRAM inference | Weights are decrypted and consumed inside VRAM; only a small result leaves the device, never the plaintext. |
| Revocation | A revoked model can no longer derive its key. |
| PQ-hybrid migration | A key is migrated from classical to post-quantum-hybrid wrapping, plaintext never exposed. |
| Threshold derivation | A key is derived from a quorum's partials without the master secret ever being reassembled. |
Reading the verdicts
Each proof reports one of:
proven— the property was affirmatively demonstrated on this hardware.fail-closed— the gate correctly refused (for example, Confidential Computing is off). This is the security working, not a failure. The affirmative path simply needs CC-enabled hardware to show.failed— the gate misbehaved. A real problem.
On a stock GPU without Confidential Computing, scsa-vault attest and
scsa-vault cc-check read fail-closed — an attacker who strips CC gets denied. On a CC-enabled GPU (a
customer's own H100, a confidential cloud instance) they turn proven with a
hardware-signed report.
Why the proofs can't be faked
- The attestation report is signed by the GPU vendor's key, verified against an embedded root certificate. There is no forging a passing report without a real, CC-enabled GPU.
- The key is bound to the attested measurement, so a protected model cannot be moved to a different card.
- The audit proofs (below) are transparent — no trusted setup, no secret verification key, nothing to leak or forge.
These verdicts are produced by the gate on your own hardware. They are strong evidence about that machine, and they are not a substitute for independent external review, which has not yet been done. See the maturity table.
Post-quantum key transport
The sealed payload is symmetric (ChaCha20-Poly1305), which is already quantum-resistant. The exposed surface is key transport, and there SCSA layers X25519 + ML-KEM-768 (FIPS 203) — two independent mechanisms. Breaking one alone does not recover the key; you must break both classical and post-quantum. This is the CSfC "two independent layers" model, applied to confidential compute. A key migrates from classical to hybrid wrapping without ever being exposed in the process.
The audit stream (transparent STARK)
Every state transition can emit a transparent, post-quantum STARK proof that the transition is a correct link in a tamper-evident commitment chain. An external auditor verifies it from the proof bytes and public values alone — no state, no keys, no plaintext, no trusted setup.
zk-cli prove <statement> # generate the proof on the node
zk-cli verify <proof> # verify statelessly, from the proof bytes aloneThis is the upgrade from "trust us" to "check the proof": an auditor watching the stream can confirm each operation without ever touching the weights, the data, or the raw log. A proof can be bound to a specific policy and inference, so the stream attests what ran under which rules — not merely that a chain advanced.
Where the decision itself is the evidence
The proofs above tell you the hardware gate behaves. They do not, by themselves, tell a third party what was authorized and by whom. That is the Authority Fabric: every release is a signed decision envelope, committed to an append-only log before anything is released, and checkable offline by anyone with the bytes — after every service that produced it has been shut down.