Skip to content

SparkProof v0.2.0 — mandatory attestation & audit security hardening

Choose a tag to compare

View all tags
@ai-hpc ai-hpc released this 25 Jul 05:37
v0.2.0
8db8bcb
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security-hardening release from a whole-project audit (8 merged PRs, #40–#48). generator_version stays 0.3.0 (bundle format unchanged).

⚠️ Breaking — publish/release path

run_release_gate / sparkproof-publish-dataset now fail closed unless strict cryptographic attestation passes. Before publishing on v0.2.0:

  • install dcap-qvl, and
  • provision the SparkProof-enclave MRTD allow-list (SPARKPROOF_TDX_MRTD_ALLOWLIST env or policies/tdx_mrtd_allowlist.json).

Until then the gate rejects all bundles by design. The cheap offline sparkproof-verify / verify_bundle are unchanged — CPU-only verification still works.

Security

  • Mandatory attestation for production acceptance (SEC-1/2/3, SEC-TDX-1): strict gate requires an NVIDIA NRAS signature and an Intel-TDX-DCAP-verified quote bound to an allow-listed MRTD.
  • Verifier fails closed on malformed/adversarial bundles; row-count inflation (CORR-3) and absent NRAS measurement (SEC-8) rejected in strict mode.
  • Secret isolation: untrusted teacher/miner kernel code runs with os.environ scrubbed of API keys / wallet material (SEC-4).
  • Anti-cheat catches getattr / functools.partial / local-alias torch-fallback indirection (SEC-6).
  • request_sha256 relabeled integrity-only, not proof-of-call (SEC-5).

Robustness & correctness

  • Resume no longer drops transient gateway_error tasks; retryable HTTP is transient, not fatal (CORR-1/2).
  • Winner checkpointed before the completion marker; self-evolution survives a malformed parent kernel (PIPE-1/2).
  • Consistent Blackwell pass-rate floor (CORR-5); optimize_request_sha256 labeled by the actual winner (CORR-6).

Code quality

  • One canonical fenced-code extractor, shared teacher-leaf payload, extracted optimize pass — all behind byte-identical golden tests (QUAL-1/3/5).

Docs

  • docs/PIPELINE_REDESIGN.md (incremental datagen-factory redesign), docs/SECURITY_FINDINGS.md (findings + status).

354 tests pass, ruff clean. Full detail in CHANGELOG.md.

Known follow-ups (not in this release)

SEC-7 (timing-nonce restructure — needs a GPU node), SEC-6 nn-module instantiate-then-call, and the PIPE-3/4/5 concurrency/budget/resumable-prove phases.

Assets 2
Loading