PR4: per-tier GPU-evidence requirement policy (attested 3p must present GPU evidence)

[Evrard-Nil]

Summary

PR4 of the Chutes attested-provider integration (follows #745 ProviderTier, #746 MeasurementPolicy, #748 strict ReportDataVerifier). Makes GPU-evidence-required a per-tier policy. NEAR keeps its historical best-effort behavior; an attested third party that advertises confidential GPU compute must actually present verifiable, nonce-bound GPU evidence. NEAR behavior is unchanged.

This completes the per-tier verifier policy story — TCB floor (#746), report_data binding (#748), and now GPU evidence — before the Chutes provider code (PR5–PR7).

Background

verify_gpu_evidence is best-effort today: a report with no nvidia_payload returns Ok(None) ("acceptable for non-GPU CVMs"). When GPU evidence is present, the caller-nonce binding (payload.nonce == request_nonce) and NVIDIA NRAS verification are already mandatory.

For NEAR's own fleet (mix of GPU and non-GPU CVMs) the absent-is-OK behavior is correct. But a third party like Chutes advertises NVIDIA confidential compute (Hopper) — if it simply omitted the GPU evidence, the current code would pass it with gpu_verdict = None, silently dropping the GPU half of the attestation. An attested 3p must prove what it claims.

What changed

• MeasurementPolicy gains a private require_gpu_evidence: bool + require_gpu_evidence() accessor:
  • near() / near_from_env() → false (historical best-effort).
  • attested3p() → true.
• verify_gpu_evidence: the absent-nvidia_payload branch now consults the policy — Ok(None) when not required (NEAR), Err(GpuVerificationFailed) when required (attested 3p). The mandatory nonce binding + NRAS verification on present evidence are unchanged.

_ => {
    if self.policy.require_gpu_evidence() {
        return Err(GpuVerificationFailed("GPU evidence required by policy but absent"));
    }
    return Ok(None); // NEAR non-GPU CVMs
}

Tests

• measurement::tests::gpu_evidence_required_only_for_attested3p — near/near_from_env → false, attested3p → true.
• verification::tests::gpu_evidence_absent_ok_for_near_but_rejected_for_attested3p — deterministic (no network; the absent branch returns before any NRAS call): NEAR verifier → Ok(None), attested-3p verifier → Err.
• Existing GLM-5/Qwen fixture tests (GPU evidence present) verify unchanged; full services lib green; cargo build --workspace green; cargo test --test e2e_all green; fmt + clippy clean.

Impact

• Behavior: none for NEAR (require_gpu_evidence = false, identical to today). No Attested3p provider is wired yet.
• Risk: low — additive policy field + one guarded branch; NEAR path unchanged.
• Unblocks: PR7 (Chutes) — attested3p() policy now requires the GPU evidence Chutes advertises.

🤖 Generated with Claude Code

[claude]

Review: PR4 — per-tier GPU-evidence requirement policy

Reviewed the diff against the priority checks. This is a tight, additive change and I found no critical issues.

Verified:

• The new require_gpu_evidence branch propagates correctly: verify_gpu_evidence(...).await? (verification.rs:254-256) means a required-but-absent payload fails the whole attestation closed — no silent gpu_verdict = None. ✓
• NEAR path is genuinely unchanged: near(), near_from_env(), and the ProviderTier::Near constructor all set require_gpu_evidence: false, and the absent branch returns Ok(None) exactly as before. ✓
• The absent-evidence guard returns before any NRAS network call, so the new test is deterministic as claimed. The present-evidence path (nonce binding + NRAS) is untouched. ✓
• No other call sites of verify_gpu_evidence / require_gpu_evidence bypass the policy (only test print-statements reference gpu_verdict elsewhere). ✓
• No backward-compat / rolling-update risk: additive struct field, NEAR semantics identical, no Attested3p provider wired yet. ✓

Minor (non-blocking) nit:

• verification.rs:253 still comments // 5. Verify GPU evidence (best-effort — skip if not present). That's now only true for NEAR — under attested3p it's mandatory. Consider tweaking to "(best-effort for NEAR; required under policy.require_gpu_evidence)" to avoid a misleading read later.

Tests cover both the policy accessor and the verifier branch for NEAR vs. attested-3p. Good privacy hygiene too — error strings carry no customer data.

✅ Approved

[gemini-code-assist]

Code Review

This pull request introduces a require_gpu_evidence policy option to enforce the presence of GPU evidence (NVIDIA NRAS) for third-party attested providers, while maintaining best-effort verification (returning Ok(None) if absent) for NEAR's own fleet. A security review identified a potential bypass vulnerability where a non-string nvidia_payload (e.g., a JSON object or array) would cause v.as_str() to return None, silently skipping GPU verification for NEAR nodes instead of rejecting the invalid format.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

Security Vulnerability: GPU Verification Bypass via Type Confusion

If nvidia_payload is present in the attestation report but is not a string (for example, if it is a JSON object or array), v.as_str() returns None. This causes the match to fall into the catch-all _ arm.

For NEAR nodes (where require_gpu_evidence is false), the function will then return Ok(None), silently skipping GPU verification even though GPU evidence was technically provided (but in a non-string format).

This creates a potential security bypass where a compromised or rogue NEAR node with a GPU can bypass mandatory GPU verification (such as the nonce check and NRAS verification) by simply formatting nvidia_payload as a JSON object instead of a stringified JSON.

To fix this, we should explicitly check if nvidia_payload is present and not null. If it is present but is not a valid string, we should return an InvalidFormat error rather than silently treating it as absent.

            _ => {
                // If the payload is present but not a string (e.g. an object), 
                // reject it as invalid format instead of silently skipping verification.
                if let Some(v) = attestation_report.get("nvidia_payload") {
                    if !v.is_null() && !v.is_string() {
                        return Err(AttestationVerificationError::InvalidFormat(
                            "nvidia_payload must be a JSON string".to_string(),
                        ));
                    }
                }
                // No GPU evidence. Acceptable for NEAR's non-GPU CVMs, but an
                // attested provider that must prove confidential GPU compute
                // (policy.require_gpu_evidence) is rejected rather than passing
                // with no GPU verdict.
                if self.policy.require_gpu_evidence() {
                    return Err(AttestationVerificationError::GpuVerificationFailed(
                        "GPU evidence (nvidia_payload) required by policy but absent from the \
                         attestation report"
                            .to_string(),
                    ));
                }
                return Ok(None);
            }

References

1. Carry error verdicts and specific failure conditions as typed enum variants rather than using helper functions or match guards across modules to inspect error details.

[Copilot]

Pull request overview

Implements a per-tier policy for whether NVIDIA GPU evidence (nvidia_payload) must be present during attestation verification. This preserves NEAR’s existing best-effort behavior for mixed CPU/GPU fleets while ensuring attested third-party providers cannot silently omit GPU evidence when their tier requires it.

Changes:

• Add require_gpu_evidence to MeasurementPolicy with a public accessor; default false for NEAR policies and true for attested3p.
• Update AttestationVerifier::verify_gpu_evidence to error when GPU evidence is required by policy but absent.
• Add unit tests covering policy behavior and the absent-evidence branch for NEAR vs attested-3p.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
crates/services/src/attestation/verification.rs	Enforces “GPU evidence required” on the missing-evidence branch and adds a deterministic test for NEAR vs attested-3p behavior.
crates/services/src/attestation/measurement.rs	Adds a per-tier require_gpu_evidence policy flag plus accessor and unit test coverage.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[PierreLeGuen]

Reviewed the diff and surrounding attestation policy/verifier code. The new require_gpu_evidence policy is wired through MeasurementPolicy::attested3p, and the missing-nvidia_payload branch fails closed for attested 3P while preserving NEAR best-effort behavior.

Local checks passed: cargo fmt --check; cargo test -p services attestation::measurement::tests --no-fail-fast; cargo test -p services gpu_evidence --no-fail-fast; cargo test -p services attestation::verification::tests --no-fail-fast.

GitHub checks observed: lint, security_audit, and claude-review passed; Test Suite was still pending at review time. I found no substantive issues.

[Evrard-Nil]

Good catch @gemini-code-assist (security-high) / @copilot — fixed in 7d5b4083.

The gap: get("nvidia_payload").and_then(|v| v.as_str()) returns None when the field is present but not a string (object/number/bool), so a malformed payload was treated as "absent" and could silently skip GPU verification on the best-effort (NEAR) path — a type-confusion bypass.

Now the three cases are explicit, and present-but-malformed is never mistaken for absent:

let nvidia_payload_str = match attestation_report.get("nvidia_payload") {
    None | Some(Value::Null) => None,                       // absent
    Some(Value::String(s)) if s.is_empty() => None,         // absent
    Some(Value::String(s)) => Some(s.as_str()),             // verify this
    Some(_) => return Err(GpuVerificationFailed(            // MALFORMED -> always reject
        "nvidia_payload is present but is not a string (malformed report); refusing to skip GPU verification")),
};

• absent / null / empty → policy decides (Ok(None) for NEAR, Err for an attested 3p that requires GPU evidence).
• non-empty string → verified as before.
• present but not a string → Err for every tier — never silently skipped.

Test extended (gpu_evidence_absent_ok_for_near_but_rejected_for_attested3p): a non-string nvidia_payload now errors for both NEAR and attested-3p verifiers. services lib 354 + fixtures green; fmt + clippy clean. Re-requesting review.

[gemini-code-assist]

Code Review

This pull request introduces a require_gpu_evidence policy option to enforce the presence of GPU evidence (NVIDIA NRAS) for attested third parties, while preserving best-effort verification for NEAR's non-GPU CVMs. It also hardens the verification logic to explicitly handle malformed, non-string nvidia_payload values to prevent type-confusion bypasses. Feedback suggests avoiding a catch-all pattern (_) when matching on serde_json::Value to ensure compile-time safety if new variants are added.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

To avoid logic drift and maintain consistency with the rest of the codebase (such as nras_failed_checks and decode_nras_jwt_claims), avoid using a catch-all pattern (_) when matching on serde_json::Value. Explicitly enumerating the other variants ensures that any future additions to the serde_json::Value enum will trigger a compile-time error, forcing a deliberate decision on how to handle them.

        let nvidia_payload_str = match attestation_report.get("nvidia_payload") {
            None | Some(serde_json::Value::Null) => None,
            Some(serde_json::Value::String(s)) if s.is_empty() => None,
            Some(serde_json::Value::String(s)) => Some(s.as_str()),
            Some(serde_json::Value::Bool(_))
            | Some(serde_json::Value::Number(_))
            | Some(serde_json::Value::Array(_))
            | Some(serde_json::Value::Object(_)) => {
                return Err(AttestationVerificationError::GpuVerificationFailed(
                    "nvidia_payload is present but is not a string (malformed report); \
                     refusing to skip GPU verification"
                        .to_string(),
                ));
            }
        };

References

1. When matching on an enum to classify its variants, avoid a catch-all case (_). This forces a compile-time error if a new variant is added, ensuring the classification logic is updated accordingly.

[PierreLeGuen]

Reviewed the attestation policy and verifier changes in crates/services/src/attestation/measurement.rs and crates/services/src/attestation/verification.rs, including the policy constructors, absent/malformed nvidia_payload handling, and surrounding attestation flow.

Checks run locally:

• cargo fmt --check
• cargo test -p services attestation
• cargo clippy -p services --all-targets -- -D warnings

Remote checks were also green when refreshed: Lint, Test Suite, and security_audit. I did not find any blocking or substantive issues.

[lloydmak99]

Code Review

Verdict: Approve

Clean, well-scoped change. The explicit 3-way match (absent/null/empty → None, non-empty string → verify, other type → error) is the right fix for the type-confusion bypass, and the policy-driven reject-vs-best-effort split is implemented correctly.

One gap not in prior comments

Empty-string nvidia_payload untested under require_gpu_evidence = true (crates/services/src/attestation/verification.rs)

The test gpu_evidence_absent_ok_for_near_but_rejected_for_attested3p covers the absent-key case and the non-string malformed case, but not nvidia_payload: "" (present, empty string). Per the new match arm, an empty string maps to None, then the policy check fires — so an attested 3p sending an empty payload should be rejected. Worth adding a test case:

let mut empty_payload = serde_json::Map::new();
empty_payload.insert("nvidia_payload".to_string(), json!(""));
// NEAR: best-effort → Ok(None)
assert!(matches!(near.verify_gpu_evidence(&empty_payload, "00").await, Ok(None)));
// attested 3p: require_gpu_evidence → rejected
assert!(a3p.verify_gpu_evidence(&empty_payload, "00").await.is_err());

Not a correctness bug (the code handles it correctly), but the coverage gap means a future refactor could accidentally merge the empty-string and non-empty-string branches without a test catching it.

Nits already noted

• claude[bot] caught the stale // best-effort comment at verification.rs:253 — that one's the remaining cleanup item.