Skip to content

Verified Compute R3-1: signed receipts with a verifier nonce (Ed25519) #7332

Closed
#7363
Closed
Verified Compute R3-1: signed receipts with a verifier nonce (Ed25519)#7332
#7363

Description

@gHashTag
gHashTag
opened on Oct 7, 2026

Epic: #6655 (Verified Compute), Round 3, item R3-1. Owner decision 2026-10-07 (translated): "sign the receipts -- that is Round 3".

Problem

t27c silicon writes .trinity/receipts/*.json (R2-1, #7044) and t27c run-record judges them (R2-4, #7130). Nothing on a receipt proves who wrote it: any JSON with the six fields of specs/verified/receipt.t27 is judged exactly like a real one, and a genuine PASS receipt can be replayed for a later run because the receipt carries no verifier-chosen nonce.

Competitor comparison (research 2026-10-07)

System What the receipt binds Authorship / freshness
Phala / NVIDIA CC (TEE) request hash + response hash + attested workload hardware-signed quote, fresh nonce per request
EigenAI model id, container digest, GPU type, driver, decoding params operator stake; challenge by re-execution
Gonka stored completion + top-k logprobs, model version on chain chain transaction from the host key
zkML (DeepProve, EZKL) the proof itself proof is unforgeable; ~1000-100000x overhead
t27 today device, full IDCODE, verdict, seal hash, seeds, toolchain none -- unsigned file, no nonce

Every serious competitor binds its receipt to an identity and most to a fresh challenge. t27's receipt has the stronger content (bit-exact integer verdict, toolchain matched to the seal, multi-placement agreement) and the weakest envelope.

Requirement

  1. Contract half (this issue's first PR, pure .t27): specs/verified/signed_receipt.t27 -- signature scheme (Ed25519, RFC 8032), the canonical signed message (domain line + fields in fixed order + nonce), the judgment order (unsigned -> key not registered -> bad signature -> nonce missing -> nonce not the challenge), the authentication levels (NONE / AUTHOR / FRESH), the key-location rule (private key never inside the repository; public keys under .trinity/keys/), and the honest ceiling: a host signature proves authorship and integrity, never that a given die computed the result.
  2. Tool half (foreign, owner-approved-foreign): t27c silicon signs every receipt when a key is configured (--nonce accepted), t27c receipt-key init creates the pair (private key outside the tree, public key committed), t27c run-record reports the run's authentication level next to its citability.

Out of scope (named next items)

  • R3-2: device-rooted identity -- read the 7-series 57-bit DNA_PORT live and bind it into the signed message (a host key cannot tell two dies apart; an IDCODE names the part, not the die).
  • R3-3: independence across boards/operators -- three seeds on one board catch place-and-route faults, not a dishonest operator.

Acceptance

  • contract spec on master: zig tests pass on the lab, hand mutants killed, sealed on the lab
  • tool half on master: signed receipt verifies, a one-byte edit fails, a receipt replayed against a new nonce is judged NOT FRESH, a key path inside the repo is refused
  • existing unsigned receipts (R2-5 capstone) stay citable and are reported at level NONE -- no retroactive claim

Activity

  1. gHashTag commented on Oct 7, 2026

    @gHashTag
    gHashTag
    on Oct 7, 2026
    OwnerAuthor

    Full verifiable-compute competitor comparison behind R3-1 (research 2026-10-07; star counts from the GitHub API that day; overhead figures are vendor claims unless marked).

    Verifiable / decentralized AI compute: competitor scan for t27 Verified Compute (2026-10-07)

    Scope: public sources only, read-only. Star counts are from the GitHub API on 2026-10-07. "Claimed" means the vendor's own number.

    1. Competitors, one paragraph each

    Gonka (gonka.ai, gonka-ai/gonka 641 stars, pushed today). Verifies LLM inference plus "Proof of Compute" sprints. PoC v2 went live in v0.2.9 (about Feb 2026), and multi-model PoC came in v0.2.12 (2026-04-27). How: the executor stores the output tokens and top-k logprobs. A validator picked by PoC weight replays the "enforced tokens" through its own model and compares logprobs (CompareLogits). Only 1-10% of inferences are checked. Determinism: none, because a tolerance is used. The open PR #1448 (still open on 2026-09-24) adds a bit-exact replay of the sampling step only: a chain-bound SHA-256 seed and a 2^16 integer-weight pipeline. It does not recompute the forward pass, because "batch composition alone flips 0-8% of honest positions". Verdicts are honest/fraud/inconclusive. Receipt: a stored completion fixed by a hash, with the model pinned to hf_repo@hf_commit on chain. Slashing: 80% of weight must be backed by collateral; default slashes are 20% for INVALID and 10% for downtime, with SPRT downtime detection. Attestation: none. Live weaknesses: PR #1873 (a forged out-of-vocab token passed validation) and issue #1915 (a PoC "bait node" exploit, about 2026-10-05). Scale: about 14k H100-equivalents (Feb 2026). (docs, PR #1448, PR #1873, #1915, collateral)

    Gensyn: Verde + RepOps + Judge. Verifies ML training, fine-tuning and inference by refereed delegation. When two providers disagree, a two-level bisection game finds the first divergent operator, and the referee re-executes only that one operator. Determinism: RepOps fixes the reduction order in CUDA kernels to get bitwise reproducibility across GPUs. Claimed overhead: under 30% on large matmul, about 60% on Llama-3.1-1B (A100). Total cost is at least 2x because the work is replicated. Receipt: hash commitments over the computation graph. Security: sound if at least one provider is honest. Judge has been live since 2025-08-27. Mainnet (OP-stack L2) launched 2026-04-22 and $AI TGE was 2026-04-29. A third-party review (about Aug 2026) says Verde-secured training compute is not yet earning revenue. Attestation: none. (arXiv 2502.19405, blog, Judge)

    Prime Intellect: TOPLOC. Verifies that a provider used the right model, prompt and precision. How: a locality-sensitive hash over the top-k last-hidden-state values, encoded as a polynomial (258 B per 32 tokens). The verifier re-runs a prefill, which is claimed to be up to 100x faster than generation. Determinism: tolerant by design; it checks exponent and mantissa differences, so it is robust across GPUs, tensor-parallel layouts and kernels. TOPLOC v2 (SYNTHETIC-2) adds pipeline-parallel stage replay and sampling checks, and ejects the first faulty node. It was used for INTELLECT-2 rollouts. The INTELLECT-3 report (Dec 2025) does not mention TOPLOC. No slashing or TEE is published. toploc has 61 stars; prime-rl has 2.1k. (arXiv 2501.16007, SYNTHETIC-2, INTELLECT-3)

    Hyperbolic: PoSP. A game-theoretic sampled audit with a pure-strategy Nash equilibrium (arXiv 2405.00295 v3, 2025-05-31). Commitments are compared, and arbitration plus slashing follows a mismatch. Claimed: under 1% overhead, 100-1000x cheaper than zkML. Determinism: not addressed. Status: whether it runs in production is disputed in 2026 sources; Hyperbolic now mostly sells a GPU marketplace. (paper)

    Nous Psyche. Decentralized training over DisTrO with a Solana coordinator. Each client commits a SHA-256 of its results, witnesses report liveness in Bloom filters, and a verifier role duplicates work. Nous says practical verification is "an open problem" and accepts results "within an expected range". Hermes 4.3 was trained fully on Psyche (Dec 2025). No TEE and no ZK. Repos: nousnet 971 stars, DisTrO 1.06k. (docs, Nous)

    Bittensor. Validators score miners subjectively, and Yuma consensus is a stake-weighted, clipped aggregate of those scores. Commit-reveal v3 (drand time-lock) fights weight copying. Nothing checks that the computation itself was correct; Bittensor verifies agreement on quality. 129 subnets (Aug 2026). The opentensor/bittensor repo now redirects to RaoFoundation/bittensor and shows as archived (2026-07); I have not checked why. (weight copying)

    zkML. Determinism comes from fixed-point quantization inside the circuit. The proof is the receipt: succinct, publicly verifiable, and needing no trust in the hardware.

    • Lagrange DeepProve (3.35k stars; open-sourced 2026-06-03). GPT-2 at 512 tokens: 7.6 min to prove, 1.3 s to verify, 10.7 MiB proof, about 1.1 tok/s. It is at about 99.6% cosine similarity to the float model at 12-bit. The product page lists Llama-3 8B/70B proofs without saying what hardware was used.
    • EZKL (1.23k stars; last push 2026-02). Halo2. nanoGPT-1M takes about 966 s to prove.
    • zkVMs (RISC Zero 2.2k stars, SP1 1.74k). A 3.4M-parameter MLP takes about 41 s to prove. General-purpose provers are about 25-370x slower than specialized ones.
    • Modulus Labs was acquired by Tools for Humanity in Dec 2024 and is no longer an independent vendor.
    • The overall overhead is 10^3-10^5x versus native inference.

    (DeepProve, ZKTorch, Proof of Tech)

    TEE (H100/B200 confidential computing).

    • Phala. An Intel TDX quote plus an NVIDIA CC report checked by NRAS. Each response gets a receipt (x-receipt-id, then /v1/aci/receipts/{id}) that binds the request and response hashes to the attested workload keyset. A fresh nonce prevents replay. Overhead is under 5% by Phala's own figure, but independent studies measure 20-30% latency and up to 70% throughput loss when models are swapped. Dstack has 555 stars.
    • Nillion nilAI. AMD SEV-SNP signed responses. The Blacklight decentralized attestation-challenge layer has been live since Feb 2026.
    • Atoma. Built nvrust for GPU attestation, but atoma-node now returns 404 on GitHub, so its status is unknown.
    • What TEEs prove: which code ran on genuine hardware, not that the output is correct, and the trust anchor is Intel, AMD or NVIDIA.

    (Phala verify, arXiv 2505.16501, nilAI)

    EigenAI (EigenCloud): the closest competitor to t27's thesis. Bit-exact GPU inference: 100% reproducible over 10k runs on a single GPU SKU, 0% across A100 and H100, claimed overhead about 1.8%. It uses llama.cpp, custom fixed-order kernels and pinned drivers. Results are posted encrypted to EigenDA; any verifier can re-execute in a challenge window, and a byte mismatch slashes restaked ETH. The request carries the model id, container digest, GPU architecture tag, driver/toolkit version, decoding policy and prompt commitment. Disputes are re-run in a TEE. Mainnet alpha launched about Jan 2026. (arXiv 2602.00182, blog)

    Ritual. Infernet is a set of oracles. The Symphony chain's "execute once, verify many" model has a staked executor return a TEE attestation and/or a ZK proof, and validators verify that proof instead of re-executing. Its docs say parts of Symphony are not yet released. (docs)

    Academic work on determinism.

    • DiFR (arXiv 2511.20621). Seed-synchronized token divergence. It detects 4-bit quantization with AUC above 0.999 within 300 tokens, with zero provider cost.
    • "Bit-Exact AI Inference Verification Without Performance Tradeoffs" (arXiv 2606.00279, ICML 2026 TAIGR best paper). GPU inference is deterministic unless atomics are used, and float rounding can serve as a configuration fingerprint.
    • Hawkeye (arXiv 2603.20421). Reproduces GPU-level non-determinism.
    • "Verifying international agreements on AI" (arXiv 2507.15916). Recommends integer inference for exactly t27's reason.
    • FPGA side. Bitstream remote attestation, including a PQC/blockchain variant (arXiv 2506.21073); BYOTee; "Integer Intelligence: Training to FPGA" (Electronics 2026).
    • Gap in the literature: I found no system that combines an attested FPGA bitstream, deterministic integer inference and economic settlement.

    2. Comparison table

    System What is checked Mechanism Bit-exact? Receipt/proof Overhead (claimed) Slashing HW attestation Status 2026
    Gonka LLM inference, PoC 1-10% logprob replay, tolerance sampling only (PR open) hashed completion + top-k logprobs ~1-10% yes, collateral 20%/10% no mainnet, ~14k H100e
    Gensyn Verde train/infer dispute bisection to one op yes (RepOps, GPU) graph hash commits >=2x replication, +30-60% kernels yes (protocol) no mainnet Apr 2026; training not live
    TOPLOC model/precision identity LSH of activations, prefill no (tolerant) 258 B / 32 tok validation up to 100x cheaper node ejection no used in INTELLECT-2
    PoSP any output sampled audit, Nash no commitments <1% yes no production unclear
    Psyche training dup work, witnesses no (range) SHA-256 commits, Bloom dup cost planned no Hermes 4.3 trained
    Bittensor quality score stake-weighted consensus n/a weight vectors n/a dereg/emission no 129 subnets
    EigenAI LLM inference optimistic re-exec, byte equality yes, same GPU SKU request w/ container+driver+arch ~1.8% yes, restaked ETH TEE for disputes mainnet alpha
    DeepProve/EZKL/zkVM inference SNARK yes (fixed-point) succinct proof 10^3-10^5x n/a no DeepProve OSS Jun 2026
    Phala/Nillion code identity TDX/SEV + NVIDIA CC no signed quote + per-response receipt 5-30% no/varies yes (vendor root) production
    Ritual inference TEE and/or ZK via ZK attestation/proof varies PoS yes (TEE) partial
    t27 VC ternary circuit result sealed spec + >=3 P&R placements on XC7A200T yes (integer RTL) 6-field receipt incl. built_by 3x+ runs, FPGA specs only IDCODE only bench, single device

    3. Gaps, phrased as candidate requirements (ranked)

    1. The receipt must be cryptographically bound to the device. A JTAG IDCODE names a part type, not a chip, and the tool writes the receipt, so anyone could type one. To fix this, read the 7-series 57-bit DNA_PORT on the fabric. The bitstream would then sign {DNA, seal hash, input hash, output hash, verifier nonce}, or HMAC it with an eFUSE/BBRAM key. This is uncertain: 7-series has no built-in attestation key, so the signing logic would have to be our own RTL.
    2. A verifier-chosen nonce and an input/output digest in every receipt. Phala and NRAS use a fresh nonce, and Phala binds the request and response hashes. As far as I can tell, receipt.t27's six fields contain neither, so an old PASS receipt can be replayed. (payout.t27 does have a spent-nonce set for billing.)
    3. Independent placements must also mean independent operators and boards. Three seeds on one board run by one owner rule out place-and-route accidents, not a dishonest operator. Gensyn and EigenAI assume at least one honest party among different parties. Require at least 2 distinct DNA values or operators for "citable".
    4. Enforced settlement, not just vocabulary. Gonka, Gensyn, EigenAI and PoSP slash real collateral on chain. t27's payout words should be wired to a ledger, even a minimal append-only one.
    5. Localize disagreements (as in Verde). When placements disagree, report the first divergent stage or cycle, using ILA/readback or a scan chain, instead of only rejecting the run.
    6. A sampled audit rate with stated probabilities. Gonka checks 1-10% and PoSP uses a Nash-calibrated rate. State what fraction of jobs is re-run, and the detection probability that buys.
    7. Scale and workload. Competitors verify 8B-235B-parameter LLMs. t27 currently verifies one 32-wide ternary cell on the board. Publish a throughput and cost-per-verified-op figure.
    8. Confidentiality. TEE competitors hide prompts and weights; t27 has no privacy story. Lower priority unless customers ask for it.
    9. Third-party verifiability without hardware. zkML lets anyone check a receipt in about 1 s. A t27 reader needs the seal files and trusts the tool. Publish signed receipts plus an independent verifier.

    4. Where t27 is genuinely ahead (with caveats)

    • Exact determinism by construction. Integer ternary RTL has no float reduction order to pin. EigenAI and RepOps get bit-exactness only with custom kernels, a single SKU and pinned drivers, and Gonka cannot replay its forward pass at all (0-8% honest flips). Caveat: EigenAI's roughly 2% claim weakens this as a selling point for GPU users. The edge is "exact across any board of the same part, regardless of driver". Testing that claim needs two boards and different builds.
    • Multi-placement agreement on hardware. No competitor varies the physical implementation (place-and-route seed) and requires the same verdict. This catches toolchain and timing faults that re-running the same binary cannot. I found no prior art. Caveat: it does not defend against a malicious operator (gap 3).
    • Toolchain identity in the receipt, matched to the seal. EigenAI records container, driver and GPU arch; Gonka pins hf_commit. Nobody I found requires the producer of the verified artifact to equal the receipt's producer, or seals spec, generated code and toolchain together. Caveat: this is a provenance property, not a cryptographic one, until receipts are signed.
    • A precise failure and payout vocabulary. corrupt_not_charged and unverifiable_not_charged mirror Gonka's "inconclusive, never fraud" lesson, and are more explicit than it. Caveat: none of it is enforced on chain yet.
    • Uncertain or unverified in this scan: whether PoSP runs in production; Atoma's status; Lagrange's Llama proof hardware; why the Bittensor repo shows as archived.
  2. gHashTag
    added 4 commits that reference this issue on Oct 7, 2026

    verified: signed receipts with a verifier nonce -- the R3-1 contract …

    e436d84

    verified: t27c signs receipts and run-record judges their level -- R3…

    8730f9e

    t27c: resolve .. under a missing directory before the inside-repo che…

    0742384

    verified: t27c signs receipts and run-record judges their level -- R3…

    f8ad9e7
  3. gHashTag
    closed this as completedin #7363on Oct 7, 2026
  4. gHashTag
    added 2 commits that reference this issue on Oct 7, 2026

    verified: the signed message, hex and key-id shape live in signed_rec…

    7364ef5

    seal: re-seal TriSha256 after the FIPS 180-4 rewrite (Refs #7332)

    0c96ab3

  5. gHashTag commented on Oct 7, 2026

    @gHashTag
    gHashTag
    on Oct 7, 2026
    OwnerAuthor

    Progress, 2026-10-07 09:30Z: moving R3-1 logic from hand Rust into .t27.

  6. gHashTag
    added 6 commits that reference this issue on Oct 7, 2026

    gen-rust: byte parameters only in a file that slices (Refs #7332)

    13958bb

    seals: gen_hash_rust for the 119 specs whose Rust output the slice fi…

    d3c442f

    seals: gen_hash_rust for the 8 specs whose Rust output the keyword fi…

    03e2d31

    seals: gen_hash_rust for the 26 specs whose Rust output the repeat fi…

    0100ee3

    verified: t27c runs receipt decisions, message and hex generated from…

    68fb928

    verified: SHA-512 (FIPS 180-4) as a t27 spec, step toward dropping ed…

    285694e

  7. 1 remaining item

  8. gHashTag
    added 15 commits that reference this issue on Oct 7, 2026

    specs: sha256 computes SHA-256 -- FIPS 180-4 sigmas, wrapping sums (R…

    5c2889a

    verified: Ed25519 (RFC 8032) as a t27 spec, on the SHA-512 spec (Refs #…

    5170356

    gen-rust: escape reserved keywords and the callee name at a call (Refs …

    fe629b0

    seals: gen_hash_rust for the 8 specs whose Rust output the keyword fi…

    87010bd

    gen-rust: escape reserved keywords and the callee name at a call (Refs …

    d4f9a4b

    seals: gen_hash_rust for the 8 specs whose Rust output the keyword fi…

    7c0b0e3

    gen-rust: lower the array repeat [v] ** n to [v; n] (Refs #7332)

    fcf0c19

    seals: gen_hash_rust for the 36 seals whose Rust output the repeat fi…

    6e46ddb

    gen-rust: lower the array repeat [v] ** n to [v; n] (Refs #7332) (#7468)

    7959d8b

    seals: gen_hash_rust for the 123 seals whose Rust output the slice fi…

    5722c89

    gen-rust: slices, byte-slice parameters, and &mut for pointer paramet…

    4921130

    verified: receipts sign and verify with the .t27 crypto, not ed25519-…

    32ed28f

    t27c hashes with specs/tri/crypto/sha256.t27, and build.rs drops sha2…

    2bb6308

    verified: corpus receipts sign with the .t27 ed25519 too (Refs #7332)

    9673af0

    verified: t27c signs, verifies and hashes with the .t27 crypto; ed255…

    cb9df57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions