Every claim carries a status
Real — verified against production on the date shown. Building — in progress, dated. Proposed — designed, not built. Retracted — claimed in v1, withdrawn here. Where a measurement contradicts an earlier published figure, the measurement wins.
Determinism envelope
Why it fell: False for any LLM in the loop. GPU inference kernels are not batch-invariant: batch composition varies with concurrent load, so identical prompt, seed and temperature 0 still diverge. Replaced by the honest split — the harness is reproducible, the model is recorded.
Evidence: Cross-repo parity test on replay_pace_ms; 1,537 recorded sessions in the film bank.
Evidence: Receipt v1 binds prompt_hash + output_hash per decision; taifoon-verify prints the non-reproducibility caveat on every PASS.
Receipt v1
Evidence: receipts/ in taifoon-hosting: record + chain rules, 11 tests (edited content, withheld entries, reordering, unanchored tail, RTMR3 mismatch). Issued for a real delivery job and anchored: WORM stream receipts-v1, anchor tx 0xcfe97efc… on Base Sepolia, VERDICT PASS 4/4 admissible.
Evidence: stdlib-only, no network call to Taifoon. Ships with the spec.
Attestation
Evidence: Verifier already reports STALE for a non-current TCB status rather than passing it. The published measurement policy and recovery runbook are not written yet.
Evidence: Verifier enforces the distinction today: a quote without RTMR3 reports PARTIAL — "proves a generic boot, not THIS workload". The extension itself needs the TEE lane.
Evidence: Compute host is an Intel i5-13500 with an RTX 4000 Ada — no TDX, no SEV-SNP, no confidential-compute mode. Receipts issued on our metal report UNATTESTED, by construction.
The log
Why it fell: Hash chaining protects anchored prefixes only. The unanchored tail is operator-controlled — truncate, reorder or fork it and both versions stay consistent with the last anchored root. Withholding is undetectable.
Evidence: worm/merkle.py (RFC 6962) + /worm/{stream}/{sth,consistency,inclusion}. 7 tests incl. the equivocation and truncation attacks. Live: stream receipts-v1, consistency 2→4 VERIFIED and inclusion idx 1 VERIFIED, checked locally against the server’s own STH.
Evidence: The proof plumbing is live and witness-ready; the witnesses themselves are third parties and therefore a partnership step, not a commit.
Evidence: Enforced in taifoon-verify: entries past the anchored head report INADMISSIBLE, and a head with no anchoring transaction fails outright (a defect found and fixed in our own tooling on 2026-08-17).
Binding to the root
Evidence: Schema, harness and consumer guard shipped (data/provable-window.json, 61 chains). First run measured 0/61: the public API exposes only the superroot, so every record is measured_at:null / eligible_for_market_emission:false. Publishing a guessed retention depth would be exactly the editorial choice the rule forbids.
Evidence: 61 chains in the live root; 2.19M leaves at time of writing.
Graduation
Evidence: Enforced in the control plane. Live check: evidence without a horizon 412s; declaring 64 candidates raises the bar to 99.5% and 412s at 96%.
Evidence: A transition without preRegistration is refused with 412.
Evidence: A perfect gate-1 screen cannot buy a deploy; parity outside tolerance 412s.
Evidence: Today a drift halt stops the workload and revokes signing, and REPORTS that this is incomplete: the venue exposes no mass-cancel route, so resting orders and open positions survive. The caveat is returned by the API and sealed into the audit log rather than hidden.
Evidence: 2-of-3 threshold signing is POC-proven (FROST); production key migration is an owner-gated decision, and the jurisdictional posture needs a named legal path.
Evidence classes
Evidence: Gated behind the provable-window data (§5) and a named legal path. Nothing market-shaped is live.
Mechanism
Why it fell: A challenge ticket is a bounty with a mandatory entry fee. Worse, the bribery inversion: raising q makes buying the challenger’s silence cheaper as a fraction of the loot. Replaced by a bond floor independent of q, a burn on every slash, and canary-measured detection.
Why it fell: Wash-tradeable: mint a YES+NO pair, cross the YES between your own wallets, merge back — cost is one rake, output is an "objective" reputation. Reputation is computed from settled outcomes weighted by notional and counterparty disjointness instead.
Why it fell: True asymptotically, false through bootstrap: thin books need a market maker, and first-collector bounties at ~zero fee flow are equity subsidy. No token emissions remains a real commitment; "no subsidy" was not.
The limits, stated in place
Infrastructure claims are easy to write and hard to check. These are the ones we refuse to make, so a partner can hold us to the ones we do.
- ✗That an LLM’s decisions are reproducible.
- ✗That a hardware quote says anything about a specific inference.
- ✗That unanchored log entries are evidence.
- ✗That absence of a fault proof is proof of no fault.
- ✗That a market price is a track record.
- ✗That an insurance book is solvent against a correlated multi-chain outage without a purchased catastrophe layer.
- ✗That geo-gating is a legal strategy — event contracts and insurance-in-substance both need a named path.
The tool, not the assurance
taifoon-verify takes a receipt bundle and returns pass/fail with zero Taifoon trust: it checks the chain, the signatures, the attestation against reference values YOU supply, and the admissibility rule that makes an unanchored tail worthless as evidence.
taifoon-verify bundle.json --reference '{"rtmr3":"<your golden value>"}'
1. CHAIN PASS
2. SIGNATURE UNATTESTED ← our own metal has no TEE; it says so
3. ATTESTATION NONE
4. ADMISSIBILITY PASS ← 4/4 admissible against an on-chain anchor
VERDICT: PASS — the chain is intact and unaltered since commitment.
This does NOT claim the model would decide the same way twice,
nor that any output is correct.Source: receipts/ in the hosting repo — stdlib only, no network call to us. The sequencing that follows it, in dependency order: RTMR3 measurement policy → witnessed log with external cosigners → per-chain provable-window data → canary-measured detection → proof-settled classes only → real stakes, gated on a named legal path.