Skip to content

WITNESS_PROXY.md

Latest commit

 

History

History
65 lines (47 loc) · 2.66 KB

WITNESS_PROXY.md

File metadata and controls

65 lines (47 loc) · 2.66 KB
Raw

Witness-proxy / non-TEE degraded tier

This document states the go-live posture for non-TEE and witness-only scrape proofs against the relay challenge (VAL-HARDEN-014 / VAL-HARDEN-015).

Default (v1 / go-live): tier disabled

Architecture §2 deferred the witness-proxy tier. At go-live the default is:

  • CHALLENGE_WITNESS_PROXY_ENABLED=false (or unset)

  • the witness-proxy tier is absent from scoring config (GET /internal/v1/scoring/config)

  • any submission carrying no valid TEE attestation, or an explicit non-TEE / witness-only proof, is rejected with:

    {"authentic": false, "reason": "non_tee_unsupported", "reward_gate": "closed"}

  • the authenticity gate is closed: the hotkey's get_weights contribution for that unit is zero (never silently accepted or partially rewarded)

A bare SDK outside a TEE proves nothing. Enforcement is the validator checking an allowlisted enclave measurement inside a hardware quote (L1).

Optional enable path

Operators may enable the degraded tier with:

export CHALLENGE_WITNESS_PROXY_ENABLED=true
# optional, defaults shown:
export CHALLENGE_WITNESS_PROXY_WEIGHT=0.25      # must be < self-hosted (0.5)
export CHALLENGE_WITNESS_PROXY_AUDIT_RATE=0.25  # must be > self-hosted (0.10)

When enabled:

tier weight audit rate trust anchor
managed-cloud 1.0 ~2% TEE (managed CVM, no bus access)
self-hosted 0.5 ~10% TEE (self-hosted; TEE.fail residual)
witness-proxy 0.25 ~25% proxy operator + network path

An equivalent authentic+complete witness-proxy result therefore earns strictly less weight than a TEE result (managed-cloud or self-hosted) and is replay-audited at a strictly higher rate.

Weaker trust basis (required disclosure)

The witness-proxy / non-TEE degraded tier rests on the proxy operator and an un-hijacked network path, not the TEE anchor. It is strictly weaker than any hardware attestation. This design is cryptographically-anchored trust-but-audit, never "trustless," never an absolute authenticity claim, and never upgrades a witness-only path to TEE-grade trust.

Machine-readable surfaces for the same posture:

  • GET /internal/v1/scoring/config → witness_proxy, tiers, assertions
  • POST /internal/v1/scoring/witness-proxy → config / compare
  • Python: relay.scoring.witness_proxy (REASON_NON_TEE_UNSUPPORTED, WITNESS_PROXY_TRUST_BASIS, scoring_config_snapshot)

See also docs/THREAT_MODEL.md row "Non-TEE / witness-only submit".