TaifoonTAIFOON
HOSTING INTEGRATION SPEC · v2

Receipts,
not reproductions.

How an agent runtime attaches to the coordination layer: enclaved execution, decisions bound to content, and settlement on evidence. This version exists because v1 claimed things that are false. An adversarial review killed four claims outright and rebuilt three mechanisms. What follows is the design that survived, with the retractions listed in place rather than quietly dropped.

VERIFIED
11
against production
BUILDING
4
in progress
PROPOSED
3
designed
RETRACTED
5
withdrawn
TAGGING DISCIPLINE

Every claim carries a status

Verified means checked against production on the date shown. Building means in progress, with a date. Proposed means designed and not yet built. Retracted means claimed in v1 and withdrawn here. Where a measurement contradicts an earlier published figure, the measurement wins.

VERIFIEDBUILDINGPROPOSEDRETRACTED
§ 1

Determinism envelope

RETRACTED"Same tape, same seed, same fingerprint."

Why it fell: False for any LLM in the loop. GPU inference kernels are not batch-invariant: batch composition varies with concurrent load, so identical prompt, seed and temperature 0 still diverge. Replaced by the honest split: the harness is reproducible, and the model is recorded.

2026-08-17 review
VERIFIEDThe harness is deterministic: clock gating, data tape, dispatcher ordering, book simulator, queue position, fill and fee logic. Same tape in, same fills out.

Evidence: Cross-repo parity test on replay_pace_ms; 1,537 recorded sessions in the film bank.

2026-08-17
VERIFIEDEvery model call is captured into the tape at the moment it happens and never claimed to be regenerable. Replay replays the recording; it does not re-run the mind.

Evidence: Receipt v1 binds prompt_hash + output_hash per decision; taifoon-verify prints the non-reproducibility caveat on every PASS.

2026-08-17
§ 2

Receipt v1

VERIFIEDA receipt signed over the content, in order: prev_hash, seq, model/engine/driver digests, sampler, prompt and output hashes, policy hash. Semantics: "the enclave with these measurements asserts it emitted this output." It does not assert that the output is correct or reproducible.

Evidence: receipts/ in taifoon-hosting: record + chain rules, 11 tests (edited content, withheld entries, reordering, unanchored tail, RTMR3 mismatch). Issued for a delivery job and anchored: WORM stream receipts-v1, anchor tx 0xcfe97efc… on Base Sepolia, VERDICT PASS 4/4 admissible.

2026-08-17
VERIFIEDtaifoon-verify: a standalone CLI that returns pass/fail with zero Taifoon trust. Attestation is appraised against reference values the CALLER supplies.

Evidence: stdlib-only, no network call to Taifoon. Ships with the spec.

2026-08-17
§ 3

Attestation

BUILDINGAppraisal returns a TCB status and its collateral expires, so a green tick is a policy decision. It needs published reference values per image, an SVN floor, a collateral max-age, and a documented action per status.

Evidence: Verifier already reports STALE for a non-current TCB status rather than passing it. The published measurement policy and recovery runbook are not written yet.

2026-08-17
BUILDINGThe tenant compose hash, app identity and key provider are extended into RTMR3 so the workload is inside the measurement. Until then, "attested workload" means "attested host".

Evidence: Verifier enforces the distinction today: a quote without RTMR3 reports PARTIAL, meaning "proves a generic boot, not THIS workload". The extension itself needs the TEE lane.

2026-08-17
VERIFIEDTaifoon’s own compute hosts have no TEE. Hardware attestation is available only through the attested partner lane.

Evidence: Compute host is an Intel i5-13500 with an RTX 4000 Ada. It has no TDX, no SEV-SNP and no confidential-compute mode. Receipts issued on our metal report UNATTESTED, by construction.

2026-08-17
§ 4

The log

RETRACTED"Hash-chained and superroot-anchored means nobody, including us, can rewrite history."

Why it fell: Hash chaining protects anchored prefixes only. The unanchored tail is operator-controlled. Truncate, reorder or fork it and both versions stay consistent with the last anchored root. Withholding is undetectable.

2026-08-17 review
VERIFIEDCertificate-Transparency semantics over the log: signed tree heads, consistency proofs between heads, and inclusion proofs. A rewritten or truncated prefix cannot verify against a head anyone already holds.

Evidence: worm/merkle.py (RFC 6962) + /worm/{stream}/{sth,consistency,inclusion}. 7 tests incl. the equivocation and truncation attacks. Live: stream receipts-v1, consistency 2→4 VERIFIED and inclusion idx 1 VERIFIED, checked locally against the server’s own STH.

2026-08-17
PROPOSEDAt least two witnesses we do not operate cosign the tree heads, plus rollback protection via an external monotonic counter.

Evidence: The proof plumbing is live and witness-ready; the witnesses themselves are third parties and therefore a partnership step, not a commit.

VERIFIEDADMISSIBILITY: nothing after the last witnessed-and-anchored head is evidence for a dispute, a market resolution or a graduation gate.

Evidence: Enforced in taifoon-verify: entries past the anchored head report INADMISSIBLE, and a head with no anchoring transaction fails outright (a defect found and fixed in our own tooling on 2026-08-17).

2026-08-17
§ 5

Binding to the root

BUILDINGThe per-chain provable window (retention depth, tip lag, finality type) is published as machine-readable data, with dispute windows derived programmatically rather than chosen editorially.

Evidence: Schema, harness and consumer guard shipped (data/provable-window.json, 61 chains). First run measured 0/61: the public API exposes only the superroot, so every record is measured_at:null / eligible_for_market_emission:false. Publishing a guessed retention depth would be exactly the editorial choice the rule forbids.

2026-08-17
VERIFIEDThe superroot recomputes every 10 seconds and supports third-party recomputation against chain state.

Evidence: 61 chains in the live root; 2.19M leaves at time of writing.

2026-08-17
§ 6

Graduation

VERIFIEDGate 1 is a screen, not a measurement: it reports the divergence horizon (steps until trajectories separate), logs how many candidates were evaluated, and corrects the threshold for that multiplicity.

Evidence: Enforced in the control plane. Live check: evidence without a horizon 412s; declaring 64 candidates raises the bar to 99.5% and 412s at 96%.

2026-08-17
VERIFIEDGate 2 requires a pre-registration: a named statistic, a named window and a threshold declared before the run. "Stationary" is not a measurement.

Evidence: A transition without preRegistration is refused with 412.

2026-08-17
VERIFIEDGate 4 (shadow parity) is the binding gate: prospective, out-of-sample, with a defined tracking-error tolerance over M sessions.

Evidence: A perfect gate-1 screen cannot buy a deploy; parity outside tolerance 412s.

2026-08-17
BUILDINGDe-graduation terminates at the venue, not the signer: mass-cancel plus flatten-only, cancel-on-disconnect armed, with a published p99 for detect → policy → exchange-ack.

Evidence: Today a drift halt stops the workload and revokes signing, and REPORTS that this is incomplete: the venue exposes no mass-cancel route, so resting orders and open positions survive. The caveat is returned by the API and sealed into the audit log rather than hidden.

2026-08-17
PROPOSEDA service that holds the key and the policy engine is a custodian: either the tenant holds a share (2-of-2), or we call it a hosted custodial signer under policy and name the jurisdictional posture.

Evidence: 2-of-3 threshold signing is POC-proven (FROST); production key migration is an owner-gated decision, and the jurisdictional posture needs a named legal path.

§ 7

Evidence classes

PROPOSEDOnly proof-settled market classes ship first; every market carries its evidence type, and negative claims become bonded staking rather than markets.

Evidence: Gated behind the provable-window data (§5) and a named legal path. Nothing market-shaped is live.

§ 8

Mechanism

RETRACTED"SLIP challenge tickets are a market for q, so detection approaches certainty and honest bonds collapse twentyfold."

Why it fell: A challenge ticket is a bounty with a mandatory entry fee. Worse, the bribery inversion: raising q makes buying the challenger’s silence cheaper as a fraction of the loot. Replaced by a bond floor independent of q, a burn on every slash, and canary-measured detection.

2026-08-17 review
RETRACTED"A provider whose jobs trade at 95¢ YES has a public track record."

Why it fell: Wash-tradeable: mint a YES+NO pair, cross the YES between your own wallets, and merge back. The cost is one rake and the output is an "objective" reputation. Reputation is computed from settled outcomes weighted by notional and counterparty disjointness instead.

2026-08-17 review
RETRACTED"Zero emissions" as a present-tense claim.

Why it fell: True asymptotically, false through bootstrap: thin books need a market maker, and first-collector bounties at ~zero fee flow are equity subsidy. No token emissions remains a commitment; "no subsidy" was not.

2026-08-17 review
WHAT WE DO NOT CLAIM

The limits, stated in place

Infrastructure claims are easy to write and hard to check. These are the ones we refuse to make, so a partner can hold us to the ones we do.

  • ✗That an LLM’s decisions are reproducible.
  • ✗That a hardware quote says anything about a specific inference.
  • ✗That unanchored log entries are evidence.
  • ✗That absence of a fault proof is proof of no fault.
  • ✗That a market price is a track record.
  • ✗That an insurance book is solvent against a correlated multi-chain outage without a purchased catastrophe layer.
  • ✗That geo-gating is a legal strategy. Event contracts and insurance-in-substance both need a named path.
VERIFY IT YOURSELF

The tool, not the assurance

taifoon-verify takes a receipt bundle and returns pass/fail with zero Taifoon trust: it checks the chain, the signatures, the attestation against reference values YOU supply, and the admissibility rule that makes an unanchored tail worthless as evidence.

taifoon-verify bundle.json --reference '{"rtmr3":"<your golden value>"}'

1. CHAIN         PASS
2. SIGNATURE     UNATTESTED   ← our own metal has no TEE; it says so
3. ATTESTATION   NONE
4. ADMISSIBILITY PASS         ← 4/4 admissible against an on-chain anchor

VERDICT: PASS — the chain is intact and unaltered since commitment.
         This does NOT claim the model would decide the same way twice,
         nor that any output is correct.

Source: receipts/ in the hosting repo. It uses the stdlib only and makes no network call to us. The sequencing that follows it, in dependency order: RTMR3 measurement policy, then a witnessed log with external cosigners, then per-chain provable-window data, then canary-measured detection, then proof-settled classes only, and last funded stakes, gated on a named legal path.