ynniv on Nostr: < over wn > @Steller Deer how do we know whether operandi --confidential is actually ...

< over wn > @Steller Deer how do we know whether operandi --confidential is actually doing attested inference?

⏺ Short answer: the --confidential flag by itself proves nothing — it's a session claim. What makes it attested is a chain of three hard gates, and you confirm it by checking the gates, not the flag.

The chain (all in `operandi/src/ppq.lisp` + `llm.lisp`):

1. The flag is a claim, enforced at startup. --confidential sets llm:*confidential*; require-confidential! (bin/operandi.lisp:264) exits 2 unless the backend is :ppq, and set-backend-ppq! refuses any model that isn't private/* (llm.lisp:561). So --confidential --openrouter … or a typo'd model dies before a byte leaves — no silent downgrade.

2. The transport is the sealer. Confidential mode installs *sealed-post* (llm.lisp:580); %llm-post/post-chat route every request through it, and if *confidential* is set with no sealer it errors rather than POST plaintext (llm.lisp:353). The engine's blocking and streaming paths both go through llm:post-chat (engine.lisp:913, 1023), so the body is EHBP-sealed.

3. The sealer verifies attestation before sealing. verify-attested-key (ppq.lisp:174) fetches /attestation + /.well-known/hpke-keys, verifies the AMD SEV-SNP bundle against the pinned ARK via cl-sev-snp, and requires the HPKE key to equal report_data[32:64]. Any failure is a hard ppq-error — no fallback. Then the response must carry Ehbp-Response-Nonce (ppq.lisp:296); its absence means the peer didn't decrypt our frame, and the answer is refused.

How to actually check it — I just ran it live:

────
(operandi.ppq:attestation-status :force t)
=> OK T, "ppq confidential: inference.tinfoil.sh verified,
HPKE key b92b915ff41ef5d7, measurement 5a2f5576ff6b2850"
────

and the underlying checks all pass:

────
snp report chain/signature/binding T
report_data binds enclaveCert SPKI T
DSSE signature by Fulcio leaf T
statement snp_measurement == report measurement T
statement subject == bundle digest T
────

with hpke == report_data[32:64] confirmed equalp T. That is the evidence: the key we seal to is bound into a report signed by a chain rooted at the pinned AMD ARK, and the report's report_data[0:32] binds the enclave's TLS cert.

What it does and doesn't prove. It proves the peer holding the HPKE key is the measured Tinfoil enclave (Path A), and that our prompt went out as ciphertext only that enclave could open. It does not prove which model weights ran — the measurement is the enclave image, and there's no independent PCR0 reproducibility (that caveat applies to Path B, PPQ's own Nitro enclave, which --confidential refuses anyway).

One gap worth flagging: there is no user-facing command that prints this. The TUI banner's "ppq confidential" (tui.lisp:1289) is derived purely from llm:*confidential* — a label, not evidence — and there's no /attest slash-command. To know, you currently have to call operandi.ppq:attestation-status from the image. Adding a /attest command that runs it would make the claim checkable from inside a session.
27 iter · 0.000¢, 806468 prompt (763904 cached)/11990 completion tok, 27 calls

--

notably, accounting seems broken (0.000¢)