Skip to content

Commit 138248f

Browse files
imran-siddiqueclaude
imran-siddique
and
claude
committed
feat: add Weight Custody Manifest landing page
Adds /wcm/, following the existing apex subfolder pattern used by /telemetry/ and /quickstart/. Uses the shared design-system.css at the current ?v=10 with no page-level CSS and no second token set. The WCM repository is private while the specification is in development, so this page deliberately links nowhere near it. It points at the public reference SDK on PyPI and at the public demos and examples repositories, which are what somebody can actually use today. It states that the repository will be open sourced without committing to a date. Carries the honest guarantee scope verbatim in substance: cryptographic custody against software and remote adversaries, accountability grade and explicitly not cryptographic custody against an operator who owns the hardware, and placement by RAND OC tier rather than as a security level. Also registers the page in sitemap.xml. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CNKLKU2URREZxCsKZBdsnb
1 parent 215dab2 commit 138248f

2 files changed

Lines changed: 244 additions & 0 deletions

File tree

‎sitemap.xml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,12 @@
3030
<changefreq>monthly</changefreq>
3131
<priority>0.9</priority>
3232
</url>
33+
<url>
34+
<loc>https://agentrust-io.com/wcm/</loc>
35+
<lastmod>2026-08-23</lastmod>
36+
<changefreq>monthly</changefreq>
37+
<priority>0.9</priority>
38+
</url>
3339
<url>
3440
<loc>https://agentrust-io.com/extensions/ca2a/v0.1/</loc>
3541
<lastmod>2026-08-19</lastmod>

‎wcm/index.html‎

Lines changed: 238 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,238 @@
1+
<!DOCTYPE html>
2+
<html lang="en">
3+
<head>
4+
<meta charset="UTF-8">
5+
<meta name="viewport" content="width=device-width, initial-scale=1.0">
6+
<title>Weight Custody Manifest | AgenTrust</title>
7+
<meta name="description" content="An open protocol for protecting model weights deployed into a customer's own or sovereign infrastructure. Signed manifest, attestation-gated key release, renewable lease with wipe on lapse, and derivative lineage. Reference SDK available on PyPI while the specification is in development.">
8+
<link rel="canonical" href="https://agentrust-io.com/wcm/">
9+
<meta name="robots" content="index, follow">
10+
11+
<!-- Open Graph -->
12+
<meta property="og:type" content="website">
13+
<meta property="og:site_name" content="AgenTrust">
14+
<meta property="og:title" content="Weight Custody Manifest">
15+
<meta property="og:description" content="When you ship a model into infrastructure you do not control, the party at risk flips. WCM is the open protocol for that direction.">
16+
<meta property="og:url" content="https://agentrust-io.com/wcm/">
17+
<meta property="og:locale" content="en_US">
18+
<meta property="og:image" content="https://agentrust-io.com/og.png">
19+
<meta property="og:image:width" content="1200">
20+
<meta property="og:image:height" content="630">
21+
<meta property="og:image:alt" content="AgenTrust: open standards for AI agent governance">
22+
23+
<!-- Twitter -->
24+
<meta name="twitter:card" content="summary_large_image">
25+
<meta name="twitter:title" content="Weight Custody Manifest">
26+
<meta name="twitter:description" content="An open protocol for releasing model weights into infrastructure you do not control, with evidence of what happened.">
27+
<meta name="twitter:image" content="https://agentrust-io.com/og.png">
28+
29+
<!-- Icons -->
30+
<link rel="icon" href="/favicon.ico" sizes="any">
31+
<link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png">
32+
<link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
33+
<link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
34+
35+
<!-- Structured data -->
36+
<script type="application/ld+json">
37+
{
38+
"@context": "https://schema.org",
39+
"@type": "SoftwareSourceCode",
40+
"name": "Weight Custody Manifest",
41+
"description": "An open specification and reference SDK for protecting model weights deployed into customer-controlled or sovereign infrastructure: signed manifest, attestation-gated key release, runtime custody with wipe on lapse, derivative lineage, and portable conformance vectors.",
42+
"url": "https://agentrust-io.com/wcm/",
43+
"programmingLanguage": ["Python"],
44+
"publisher": { "@id": "https://agentrust-io.com/#organization" }
45+
}
46+
</script>
47+
48+
<link rel="stylesheet" href="/design-system.css?v=10">
49+
</head>
50+
<body class="at-page">
51+
52+
<header class="site-header">
53+
<a class="wordmark" href="/">agentrust<span>.io</span></a>
54+
<nav>
55+
<a href="#flip">The flip</a>
56+
<a href="#protocol">Protocol</a>
57+
<a href="#try">Try it</a>
58+
<a href="#limits">Limits</a>
59+
<a class="cta" href="https://pypi.org/project/weight-custody-manifest/">Reference SDK</a>
60+
</nav>
61+
</header>
62+
63+
<div class="hero"><div class="wrap">
64+
<span class="eyebrow">Release · Attest · Revoke</span>
65+
<h1>Weight custody for models you deploy<br>into infrastructure you do not control</h1>
66+
<p class="sub">Every model-weight protection tool protects the customer from the model. None protect the builder from the customer. WCM is the open protocol for that direction: a signed manifest, attestation-gated key release, a renewable lease that wipes on lapse, and a chain of custody for derivatives.</p>
67+
<div><span class="status">Specification in active development · Reference SDK on PyPI · Open source soon</span></div>
68+
</div></div>
69+
70+
<main>
71+
72+
<section id="flip">
73+
<span class="label">The problem</span>
74+
<h2>The threat model flips when the model leaves your data center</h2>
75+
<p>Weight-protection tooling assumes the builder is trusted and the customer is the party at risk. Deploy a frontier model into a customer's own infrastructure, a sovereign cloud, or an air-gapped facility and that reverses. Now it is the builder whose weights sit on hardware someone else owns and someone else operates.</p>
76+
<p>WCM answers one question: <strong>can a model builder release encrypted weights only to an approved workload, keep that approval short-lived, and retain evidence of what happened?</strong> The answer is yes for the reference protocol and the software checks, with one boundary stated plainly rather than buried, which you will find further down this page.</p>
77+
</section>
78+
79+
<section id="protocol">
80+
<span class="label">How it works</span>
81+
<h2>Six steps, no plaintext key on the wire</h2>
82+
<div class="steps">
83+
84+
<div class="step">
85+
<div class="step-num">1</div>
86+
<div class="step-body">
87+
<h3>The builder signs a manifest</h3>
88+
<p>Encrypted weights, plus a signed manifest naming the exact weight and approved-workload measurements.</p>
89+
</div>
90+
</div>
91+
92+
<div class="step">
93+
<div class="step-num">2</div>
94+
<div class="step-body">
95+
<h3>The workload asks for a challenge</h3>
96+
<p>A protected workload requests a fresh, single-use challenge from the key broker.</p>
97+
</div>
98+
</div>
99+
100+
<div class="step">
101+
<div class="step-num">3</div>
102+
<div class="step-body">
103+
<h3>Attestation binds the request</h3>
104+
<p>CPU attestation, and GPU attestation where required, binds that challenge, the workload measurement, and an ephemeral transport key to the current launch.</p>
105+
</div>
106+
</div>
107+
108+
<div class="step">
109+
<div class="step-num">4</div>
110+
<div class="step-body">
111+
<h3>The broker checks independently</h3>
112+
<p>Manifest policy, certificate chain, signatures, revocation state, measurements, freshness, and channel binding. Every check, every time.</p>
113+
</div>
114+
</div>
115+
116+
<div class="step">
117+
<div class="step-num">5</div>
118+
<div class="step-body">
119+
<h3>The key is sealed, not sent</h3>
120+
<p>Only if every required check passes, the broker seals the model key to the attested transport key. It never transmits plaintext key material.</p>
121+
</div>
122+
</div>
123+
124+
<div class="step">
125+
<div class="step-num">6</div>
126+
<div class="step-body">
127+
<h3>Authorization expires</h3>
128+
<p>The runtime periodically renews. A lapse means stop serving and wipe the in-memory key. Resuming requires a new successful attestation and release.</p>
129+
</div>
130+
</div>
131+
132+
</div>
133+
</section>
134+
135+
<section id="try">
136+
<span class="label">Try it</span>
137+
<h2>The reference SDK is already installable</h2>
138+
<p>The specification is still in development, but the Python reference implementation is published and you can exercise the whole protocol locally against synthetic evidence today. We would rather have your feedback now, while the design can still change, than after it is frozen.</p>
139+
140+
<div class="steps">
141+
142+
<div class="step">
143+
<div class="step-num">1</div>
144+
<div class="step-body">
145+
<h3>Install from PyPI</h3>
146+
<div class="code">
147+
<div class="code-head"><span class="code-label">Terminal</span><button class="copy">COPY</button></div>
148+
<pre>python -m pip install weight-custody-manifest</pre>
149+
</div>
150+
</div>
151+
</div>
152+
153+
<div class="step">
154+
<div class="step-num">2</div>
155+
<div class="step-body">
156+
<h3>Run the portable conformance suite</h3>
157+
<p class="hint">Language-neutral vectors across four conformance levels, exercising every reportable error code. The runner prints its own remaining limits on every run, so a pass is never read as more than it is.</p>
158+
<div class="code">
159+
<div class="code-head"><span class="code-label">Terminal</span><button class="copy">COPY</button></div>
160+
<pre>wcm conformance</pre>
161+
</div>
162+
</div>
163+
</div>
164+
165+
<div class="step">
166+
<div class="step-num">3</div>
167+
<div class="step-body">
168+
<h3>Walk through the runnable demos</h3>
169+
<p class="hint">The public demos repository covers weight custody, closed-weight release, derivative lineage, and sovereign threshold release. No special hardware required; they run in software-only development mode.</p>
170+
<div class="code">
171+
<div class="code-head"><span class="code-label">Terminal</span><button class="copy">COPY</button></div>
172+
<pre>git clone https://github.com/agentrust-io/demos
173+
cd demos
174+
pip install -r requirements.txt
175+
python demo.py 6</pre>
176+
</div>
177+
</div>
178+
</div>
179+
180+
</div>
181+
182+
<div style="margin-top:2.25rem;">
183+
<a class="button" href="https://pypi.org/project/weight-custody-manifest/">Reference SDK on PyPI</a>
184+
<a class="button secondary" href="https://github.com/agentrust-io/demos">Runnable demos</a>
185+
<a class="button secondary" href="https://github.com/agentrust-io/examples">Integration examples</a>
186+
</div>
187+
</section>
188+
189+
<section id="limits">
190+
<span class="label">Honest scope</span>
191+
<h2>Two guarantees, never blended</h2>
192+
<p>The dishonest version of this page would say the weights are physically impossible to extract. They are not, and the specification says so. WCM names two separate guarantees and does not let them run together.</p>
193+
194+
<table style="margin-top:2.25rem;">
195+
<tr><th>Against</th><th>What you get</th></tr>
196+
<tr><td><strong>Software and remote adversaries</strong><br>Host OS, remote attacker, an operator with software access</td><td><strong>Cryptographic custody.</strong> One caveat: a malicious hypervisor can extract keys through ciphertext side channels unless AMD SEV-SNP ciphertext hiding is enabled, so that is required for the claim to hold against a hypervisor-privileged operator.</td></tr>
197+
<tr><td><strong>An operator who physically owns the hardware</strong></td><td><strong>Accountability grade, not cryptographic custody.</strong> Current confidential-computing silicon is defeated by cheap, published memory-bus attacks that extract keys and forge attestation. What WCM offers at this tier is cost, detection, containment, legal recourse, and a mandatory physical-hardening tier.</td></tr>
198+
</table>
199+
200+
<div class="callout"><p><strong>Placed the way a frontier lab grades it:</strong> WCM implements the confidential-computing measure that RAND recommends in <em>Securing AI Model Weights</em>. It holds across the OC1 to OC3 attacker range and, by its own concession, not against an OC4 or OC5 actor who owns the hardware. It is not a security level. A security level is a whole-organization posture, and assigning one to a single control misuses the unit.</p></div>
201+
202+
<p style="margin-top:2rem;">Verification paths have been exercised against real silicon across AMD SEV-SNP, Intel TDX, and NVIDIA H100 in confidential computing mode. Two areas are deliberately not claimed yet, because they need evidence from the real protected runtime rather than a more persuasive simulation: protected-boundary hardware evidence for the memory fingerprint sweep, and production zeroization from the actual controller rather than unit tests. Both are tracked in the open.</p>
203+
</section>
204+
205+
<section id="status">
206+
<span class="label">Status</span>
207+
<h2>What is available now, and what is coming</h2>
208+
<p>The repository is in active development and will be open sourced soon. When it opens it publishes the full specification, the threat model, the limitations document, the manifest JSON Schema, the Python reference SDK, the portable conformance vectors, and a reproducibly built reference key-release-service image.</p>
209+
<p>The reference SDK is already on PyPI, and the demos and integration examples above are public today, so you can evaluate the protocol before the specification lands. This is deliberate: the design decisions we most want argued with are cheaper to change now.</p>
210+
<div class="callout"><p><strong>Open core.</strong> What opens is the protocol layer: the specification, the threat model, and the reference key-release service. The operated custody service and the enclave implementation are separate and are not part of it.</p></div>
211+
<div style="margin-top:2.25rem;">
212+
<a class="button" href="https://pypi.org/project/weight-custody-manifest/">Install the SDK</a>
213+
<a class="button secondary" href="https://github.com/agentrust-io">Follow the org on GitHub</a>
214+
</div>
215+
</section>
216+
217+
</main>
218+
219+
<footer class="site-footer"><div class="wrap">
220+
<div class="foot-in">
221+
<div class="foot-brand">
222+
<a class="wordmark" href="/">AgenTrust</a>
223+
<div class="tagline">Open standards for AI agent governance</div>
224+
</div>
225+
<div class="foot-links">
226+
<a href="/">Home</a>
227+
<a href="/quickstart/">Quickstart</a>
228+
<a href="/demos/">Demos</a>
229+
<a href="https://github.com/agentrust-io">GitHub</a>
230+
</div>
231+
</div>
232+
<div class="foot-legal">© 2026 AgenTrust Contributors · agentrust-io.com</div>
233+
</div></footer>
234+
235+
<script src="/supernav.js"></script>
236+
<script src="/page.js"></script>
237+
</body>
238+
</html>

0 commit comments

Comments
 (0)