The proof matrix showcased the cloud path and left the air-gap path
undemonstrated. prove-gpu and prove-lpu both reach across a network to
silicon the prover does not own; there was no counterpart proving the
case the sandbox ladder was built for. Every component existed —
mmap-only GGUF loading with no network fetch path, deny-by-default
NetworkGrant, offline Ed25519 attestation, hardware energy counters —
and nothing assembled them.
prove_local runs a local engine against local weights with no network
grant, meters it on this host's own counters, and seals a cell.
It is the deliberate inverse of prove_inference. There the silicon
belongs to someone else, so energy is an honest token Estimator. Here
the silicon is ours — the one case where joules can actually be
measured — so device records pass through verbatim from PowerMeter
with whatever provenance the hardware honestly supports. The meter can
degrade; this does not re-tag it.
Three properties, each checked rather than asserted:
1. Weights are local. Opened from disk and streamed into a BLAKE3
bound into the proof, so the cell attests inference against these
bytes and not merely "a model". An unresolvable path is an error.
2. No egress was granted. The NetworkGrant default — empty outbound,
inbound false — is asserted before the engine is spawned.
3. Energy is this host's, measured across the engine's execution.
A non-zero engine exit refuses to seal: a proof for a run that failed
would attest to work that did not happen.
The engine is operator-supplied and driven as a subprocess, exactly as
prove_accelerator drives a GPU workload, so the sandbox standard takes
no dependency on any particular inference runtime.
Verified end to end on Apple Silicon against a real checkpoint:
Devstral-Small-2-24B-Instruct Q4_K_M, 13.35 GiB, generating from the
local GGUF at 17.4 tok/s warm — 92.68 J measured over the span via
IOReport energy-model counters (HwShunt, sudo-free), sealed to receipt
b3:ARwbWCm… with attestation and signature both verified.
SPEC §7.2 caught the first cut: the Apple meter reports CPU, GPU and
ANE together, and a hardcoded CPU-only DeviceIdentity list left the
NPU energy record unnamed. Identities are now derived from the
measurement rather than assumed — the standard enforcing its own
invariant against an incomplete implementation.
4 guard tests: absent weights, failed engine, weight-hash binding,
zero-egress posture.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
6e3238c8fe