Sovereign mode

For a bank, a regulator, or any workload where the answer to "who has access to the box" must be nobody but you, run in sovereign mode. The scsa CLI drives your GPU directly over SSH, with your own key. No control plane sits in the middle; no external party is ever authorized on the machine.

Set it up

scsa config set-gpu gpu01.internal 22 --key ~/.ssh/id_ed25519
scsa local deploy

set-gpu points the CLI straight at your GPU; local deploy builds the binaries (scsa-vault, scsa-infer, zk-cli) on your hardware from source bundled in the package — no control plane, no repo checkout, no external download. Only a CUDA 12.x driver is required (no nvcc). From here the CLI reads their verdicts over your SSH connection.

Run it

scsa local seal model.bin --out model.scsa   # seal a model to your GPU — ciphertext at rest
scsa local unseal model.scsa --out model.bin # unseal on the bound GPU
scsa local prove     # every proof, run directly on your GPU
scsa local attest    # attest your GPU
scsa local zk        # a STARK proof, generated on your GPU

local seal is the product itself, sovereign: your model is encrypted with a key derived from your GPU's identity and never leaves your machine. The .scsa is inert on any other hardware.

$ scsa local prove
running proofs directly on your gpu — nothing leaves your perimeter…
  FAIL-CLOSED  attest
  PROVEN       verify-replay
  FAIL-CLOSED  cc-check
  PROVEN       vram-proof
  PROVEN       pq-migrate
  PROVEN       threshold

  4 proven  2 fail-closed  — trust the math, not the operator

fail-closed on attest and cc-check means the GPU isn't in Confidential Computing mode — the gate correctly refuses rather than pretending. On a CC- enabled GPU those turn to proven. See Proofs.

Why this is the sovereign path

• No control plane. The command runs the binaries on your box and parses the result. There is no server to trust, meter, or compromise.
• Your key only. Nothing from the operator is authorized on the machine.
• Air-gap friendly. The binaries are self-contained and phone home to nothing; a sovereign deployment can run fully offline.

The strongest posture

Sovereign mode removes the operator from the loop. To also remove the need to trust any single machine or party — including your own operators — combine it with threshold custody, where the key is split so that no one holds enough to unseal alone. Security then rests entirely on the math: hardware-signed attestation plus threshold cryptography.