diff --git a/wcm/index.html b/wcm/index.html index 22e8c80..6175aa1 100644 --- a/wcm/index.html +++ b/wcm/index.html @@ -75,12 +75,12 @@

Deploy closed model weights
without surrendering control

- 0.26.0Python SDK - 91Conformance vectors - 574Tests passing + 0.27.0Python SDK + 91Conformance vectors + 599Tests passing 3Hardware families exercised
-

Release evidence captured against WCM commit 4af6836. Claims link to their supporting artifact.

+

Release evidence captured against WCM commit a952cb6. Each claim is checkable from the published package: pip download --no-binary :all: weight-custody-manifest ships the tests and the conformance vectors.

@@ -251,8 +251,8 @@

Two guarantees, never blended

Placed the way a frontier lab grades it: WCM implements the confidential-computing measure that RAND recommends in Securing AI Model Weights. It holds across the OC1 to OC3 attacker range and, by its own concession, not against an OC4 or OC5 actor who owns the hardware. It is not a security level. A security level is a whole-organization posture, and assigning one to a single control misuses the unit.

-

Verification paths have been exercised against real silicon across AMD SEV-SNP, Intel TDX, and NVIDIA H100 in confidential computing mode. Two areas are deliberately not claimed yet, because they need evidence from the real protected runtime rather than a more persuasive simulation: protected-boundary hardware evidence for the memory fingerprint sweep, and production zeroization from the actual controller rather than unit tests.

-

RAND weight-security report ↗TEE.fail research ↗BadRAM research ↗Full threat model ↗

+

Verification paths have been exercised against real silicon across AMD SEV-SNP, Intel TDX, and NVIDIA H100 in confidential computing mode. Two areas are deliberately not claimed yet, because they need evidence from the real protected runtime rather than a more persuasive simulation: protected-boundary hardware evidence for the memory fingerprint sweep, and production zeroization from the actual controller rather than unit tests.

+

RAND weight-security report ↗TEE.fail research ↗BadRAM research ↗Guarantee scope and limits ↓

@@ -261,7 +261,7 @@

Four ways into the release

Model owners

Evaluate a closed-weight deployment and pressure-test the release policy against your actual threat model.

Evaluate a deployment →

Runtime and cloud teams

Add or review an attestation profile and prove what your protected boundary can support.

Follow the release →
-

Security researchers

Challenge the threat model, fixtures, hardware assumptions, and explicit non-goals.

Review open questions →
+

Standards contributors

Review the manifest, portable evidence, conformance levels, and interoperability boundaries.

Join the review →
diff --git a/wcm/launch-page.test.js b/wcm/launch-page.test.js index 409abf8..2e3a32b 100644 --- a/wcm/launch-page.test.js +++ b/wcm/launch-page.test.js @@ -21,7 +21,32 @@ for (const platform of proof.hardware_families) { assert.ok(!html.includes('None protect the builder'), 'avoid an unsupported novelty absolute'); assert.ok(!html.includes('Open core.'), 'launch copy must describe the open surface precisely'); assert.ok(html.includes('Sponsorship does not confer ownership or governance authority')); -assert.ok(html.includes('issues/78') && html.includes('issues/79')); +// The two open limitations must stay disclosed. This used to assert the issue +// links were present, which is how six dead links survived on a public page: the +// tracker is private, so every one of them 404s for the readers this page is +// for. The disclosure is what matters, not the hyperlink, so assert the prose. +assert.ok( + html.includes('protected-boundary hardware evidence for the memory fingerprint sweep'), + 'the memory-sweep limitation must stay disclosed' +); +assert.ok( + html.includes('production zeroization from the actual controller'), + 'the zeroization limitation must stay disclosed' +); + +// Nothing on a public page may link into the WCM repository while it is private. +// Every such link 404s for an anonymous reader, which is precisely the audience +// a launch page has. The same rule is enforced for integration READMEs in +// agentrust-io/integrations CONTRIBUTING.md; this is the check for the site. +// When the repository goes public (weight-custody-manifest#40), delete this. +const privateRepoLinks = [...html.matchAll( + /https:\/\/github\.com\/agentrust-io\/weight-custody-manifest[^"'\s]*/g +)].map((match) => match[0]); +assert.deepEqual( + privateRepoLinks, + [], + `these 404 for anonymous readers while the repo is private: ${privateRepoLinks.join(', ')}` +); assert.ok(html.includes('/wcm/og-launch.png')); const socialCard = fs.readFileSync(path.join(here, 'og-launch.png')); assert.ok(socialCard.length > 100_000); diff --git a/wcm/proof.json b/wcm/proof.json index 881fd72..520e303 100644 --- a/wcm/proof.json +++ b/wcm/proof.json @@ -1,9 +1,9 @@ { - "captured_at": "2026-08-23", - "wcm_commit": "4af6836ca11b0742f03d1ca421bec47d34d8fa32", - "sdk_version": "0.26.0", + "captured_at": "2026-08-27", + "wcm_commit": "a952cb6cfa40f483774738ef71df80f73317a737", + "sdk_version": "0.27.0", "conformance_vectors": 91, - "tests_passed": 574, + "tests_passed": 599, "hardware_families": [ "AMD SEV-SNP", "Intel TDX",