Epic: attested evaluation on the hosted bare-metal execution plane

[JSONbored]

Problem

The backtest/calibration system's trust story is complete for today's product and deliberately incomplete for the hosted one. #8136 concluded: reproducibility (checksummed corpus via scripts/backtest-corpus-export.ts, public scoring code in @loopover/engine, pinned head/base SHAs persisted with every run) fully covers corpus-tamper and faked-score threats for publishable corpora. Hosted ORB reviewing private customer repos breaks exactly that property — a private corpus cannot be published for third-party re-runs, and that is the one case where attested execution buys real trust (#8137's survey). #8137 also settled the path: no viable TEE exists on the interim Cloudflare deployment (Workers are V8 isolates; Containers have no confidential-compute mode), but the hosted product's end-state execution plane is dedicated bare metal on the k3s + Kata stack (#7180's isolation-tier decision), and Kata 3.x is the base of the Confidential Containers (CoCo) project — hardware-attested confidential VMs (AMD SEV-SNP) as an additional runtime class on the same stack. The one already-recorded actionable (#8137): SNP-capable hardware is a hard purchase criterion.

This epic tracks the full build-out from that recorded decision to a working attested-evaluation capability. At origin/main there is zero TEE/attestation code anywhere in the repo (verified 2026-07-24); apps/loopover-ui/content/docs/verify-this-review.mdx currently names the trusted-execution boundary an explicit non-goal — that passage flips when this epic's verification-surface sub-issue lands.

Sequencing (sub-issues; the dependency graph is the schedule)

1. Hardware — procure + enable SEV-SNP on the hosted bare-metal fleet.
2. Runtime class — CoCo on the k3s/Kata stack (QEMU/cloud-hypervisor class beside the Firecracker sandbox classes — Firecracker has no SNP support; this is a configuration split, not a stack replacement).
3. Envelope (contributor-eligible) — a pure attestation-evidence schema + structural validator in packages/loopover-engine/src/calibration/, so the persisted run record has a typed seam before any infrastructure exists.
4. Attested runner — execute the existing backtest replay inside the confidential runtime class and persist the envelope with the run's audit event.
5. Verification surface — extend /docs/verify-this-review with the attested-run path.
6. Private-corpus bridge — tenant-verifiable backtests via per-tenant corpus export (works before attestation; reproducibility for the affected party).
7. T3 research — override-event provenance receipts (attestation proves computation, not data provenance; Research: is TEE hardware attestation necessary, or does a reproducible-backtest checksum approach cover the real threat? #8136's residual gap), demand-triggered.

Deliverables

None at the epic level — every deliverable lives in a sub-issue. The epic closes when every sub-issue does.

Links & Resources

• Research: is TEE hardware attestation necessary, or does a reproducible-backtest checksum approach cover the real threat? #8136 (threat model: reproducibility vs attestation), Research: survey viable TEE/confidential-compute options on Cloudflare Workers/Containers #8137 (viability survey + SEV-SNP path), Provisioning core: create/destroy a tenant's Container + Postgres DB #7180 (k3s/Kata isolation-tier decision), Epic: verifiable pre-merge backtest for ORB/AMS deterministic rules #8082 (the closed backtest foundation)
• Epic: ORB Cloud Readiness #4877 (ORB Cloud Readiness — hosted tenancy is this epic's demand trigger; blocked-by)
• src/services/threshold-backtest-run.ts (persistThresholdBacktestRuns — where the envelope attaches), scripts/backtest-corpus-export.ts, apps/loopover-ui/content/docs/verify-this-review.mdx

Boundaries

• Nothing in this epic changes what any live gate rule does; the advisory-first discipline of Epic: verifiable pre-merge backtest for ORB/AMS deterministic rules #8082/Decide + implement whether a REGRESSED backtest verdict should ever gate a merge (Phase 2) #8105 continues unchanged.
• The interim Cloudflare deployment is untouched — this epic builds the bare-metal plane's capability, it does not migrate tenants (migration is Cloud Readiness scope).
• No reward/scoring/trust-score changes. No secrets, hostnames, or hardware inventory details in any public issue text or commit.

maintainer-only — epic; work the sub-issues, not this shell.

[linear-code]

JSO-5903