From 9541e424cf39d4c9abac050c3fe3873d063405de Mon Sep 17 00:00:00 2001 From: Imran Siddique Date: Thu, 27 Aug 2026 09:45:04 -0700 Subject: [PATCH] fix(wcm): remove six dead links from the public launch page Every link from agentrust-io.com/wcm/ into the WCM repository 404s. The repository is private, and a launch page's entire audience is anonymous readers, so all six were broken for exactly the people the page is for: /blob/main/THREAT-MODEL.md "Full threat model" /issues/78 and /issues/79 the two disclosed open limitations /issues "Review open questions", for security researchers /actions the "574 tests passing" evidence claim /tree/main/conformance/vectors the "91 conformance vectors" claim This is the same trap agentrust-io/integrations#141 made a hard CONTRIBUTING rule about, arriving from the other direction: fourteen integration READMEs now point here as "specification and documentation", so a reader following one to find the spec landed on a page whose own links were dead. Each replacement is a real destination rather than a redirect of the problem: Vectors and test count now point at PyPI, and say why in a title attribute. Both are checkable from the published package, because the sdist ships tests/ and the conformance vectors. That is a stronger claim than a CI badge: a reader can reproduce the numbers instead of being shown a green tick. The two limitations lose their hyperlinks and keep their prose. The paragraph already states both in full; the disclosure was always the point and the link only ever pointed into a tracker nobody outside the org can open. "Full threat model" points at the on-page limits section, which is the public statement of the same thing. Security researchers get a mailto, matching the two personas that already use one. An issue tracker they cannot open is not a way in. The evidence strip had also drifted: pinned at a pre-0.27.0 commit, showing 0.26.0 and 574 tests. Now a952cb6, 0.27.0 and 599, with proof.json regenerated from that commit. launch-page.test.js gains the durable part. It previously asserted the issue LINKS were present, which is how these survived: the check enforced the dead link rather than the disclosure. It now asserts the limitation prose, and separately that no link into the private repository exists anywhere on the page. Verified it fails on a reintroduced link. Delete that check when the repository goes public (weight-custody-manifest#40). Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_014NL8o3PXq6kfs2SdmBv6ak --- wcm/index.html | 14 +++++++------- wcm/launch-page.test.js | 27 ++++++++++++++++++++++++++- wcm/proof.json | 8 ++++---- 3 files changed, 37 insertions(+), 12 deletions(-) diff --git a/wcm/index.html b/wcm/index.html index 22e8c80..6175aa1 100644 --- a/wcm/index.html +++ b/wcm/index.html @@ -75,12 +75,12 @@

Deploy closed model weights
without surrendering control

- 0.26.0Python SDK - 91Conformance vectors - 574Tests passing + 0.27.0Python SDK + 91Conformance vectors + 599Tests passing 3Hardware families exercised
-

Release evidence captured against WCM commit 4af6836. Claims link to their supporting artifact.

+

Release evidence captured against WCM commit a952cb6. Each claim is checkable from the published package: pip download --no-binary :all: weight-custody-manifest ships the tests and the conformance vectors.

@@ -251,8 +251,8 @@

Two guarantees, never blended

Placed the way a frontier lab grades it: WCM implements the confidential-computing measure that RAND recommends in Securing AI Model Weights. It holds across the OC1 to OC3 attacker range and, by its own concession, not against an OC4 or OC5 actor who owns the hardware. It is not a security level. A security level is a whole-organization posture, and assigning one to a single control misuses the unit.

-

Verification paths have been exercised against real silicon across AMD SEV-SNP, Intel TDX, and NVIDIA H100 in confidential computing mode. Two areas are deliberately not claimed yet, because they need evidence from the real protected runtime rather than a more persuasive simulation: protected-boundary hardware evidence for the memory fingerprint sweep, and production zeroization from the actual controller rather than unit tests.

-

RAND weight-security report ↗TEE.fail research ↗BadRAM research ↗Full threat model ↗

+

Verification paths have been exercised against real silicon across AMD SEV-SNP, Intel TDX, and NVIDIA H100 in confidential computing mode. Two areas are deliberately not claimed yet, because they need evidence from the real protected runtime rather than a more persuasive simulation: protected-boundary hardware evidence for the memory fingerprint sweep, and production zeroization from the actual controller rather than unit tests.

+

RAND weight-security report ↗TEE.fail research ↗BadRAM research ↗Guarantee scope and limits ↓

@@ -261,7 +261,7 @@

Four ways into the release

Model owners

Evaluate a closed-weight deployment and pressure-test the release policy against your actual threat model.

Evaluate a deployment →

Runtime and cloud teams

Add or review an attestation profile and prove what your protected boundary can support.

Follow the release →
-

Security researchers

Challenge the threat model, fixtures, hardware assumptions, and explicit non-goals.

Review open questions →
+

Standards contributors

Review the manifest, portable evidence, conformance levels, and interoperability boundaries.

Join the review →
diff --git a/wcm/launch-page.test.js b/wcm/launch-page.test.js index 409abf8..2e3a32b 100644 --- a/wcm/launch-page.test.js +++ b/wcm/launch-page.test.js @@ -21,7 +21,32 @@ for (const platform of proof.hardware_families) { assert.ok(!html.includes('None protect the builder'), 'avoid an unsupported novelty absolute'); assert.ok(!html.includes('Open core.'), 'launch copy must describe the open surface precisely'); assert.ok(html.includes('Sponsorship does not confer ownership or governance authority')); -assert.ok(html.includes('issues/78') && html.includes('issues/79')); +// The two open limitations must stay disclosed. This used to assert the issue +// links were present, which is how six dead links survived on a public page: the +// tracker is private, so every one of them 404s for the readers this page is +// for. The disclosure is what matters, not the hyperlink, so assert the prose. +assert.ok( + html.includes('protected-boundary hardware evidence for the memory fingerprint sweep'), + 'the memory-sweep limitation must stay disclosed' +); +assert.ok( + html.includes('production zeroization from the actual controller'), + 'the zeroization limitation must stay disclosed' +); + +// Nothing on a public page may link into the WCM repository while it is private. +// Every such link 404s for an anonymous reader, which is precisely the audience +// a launch page has. The same rule is enforced for integration READMEs in +// agentrust-io/integrations CONTRIBUTING.md; this is the check for the site. +// When the repository goes public (weight-custody-manifest#40), delete this. +const privateRepoLinks = [...html.matchAll( + /https:\/\/github\.com\/agentrust-io\/weight-custody-manifest[^"'\s]*/g +)].map((match) => match[0]); +assert.deepEqual( + privateRepoLinks, + [], + `these 404 for anonymous readers while the repo is private: ${privateRepoLinks.join(', ')}` +); assert.ok(html.includes('/wcm/og-launch.png')); const socialCard = fs.readFileSync(path.join(here, 'og-launch.png')); assert.ok(socialCard.length > 100_000); diff --git a/wcm/proof.json b/wcm/proof.json index 881fd72..520e303 100644 --- a/wcm/proof.json +++ b/wcm/proof.json @@ -1,9 +1,9 @@ { - "captured_at": "2026-08-23", - "wcm_commit": "4af6836ca11b0742f03d1ca421bec47d34d8fa32", - "sdk_version": "0.26.0", + "captured_at": "2026-08-27", + "wcm_commit": "a952cb6cfa40f483774738ef71df80f73317a737", + "sdk_version": "0.27.0", "conformance_vectors": 91, - "tests_passed": 574, + "tests_passed": 599, "hardware_families": [ "AMD SEV-SNP", "Intel TDX",