cloud: unified tenant verification contract — claim → artifact → endpoint → trust assumption

[JSONbored]

Context

The individual verification artifacts for hosted tenants now exist or are in flight, but no single documented contract says what a tenant can verify, via which artifact, under which trust assumption:

• The decision-ledger verify endpoint is public and working (the orb(trust): the 'public' decision-ledger verify endpoint requires an API token — 401 in prod, so the chain is verifiable by nobody #9120 fix landed).
• The ledger has an external anchor and verify returns the chain hash (the orb(trust): the decision ledger has no external anchor and verify returns no hash — wholesale re-chaining and tail truncation both pass clean #9122 fix landed).
• Decision records are published and digest-stable (the orb(trust): the decision record is never published — contributors get a 12-char prefix of a document no endpoint returns, and 51 preimages are already destroyed #9123 fix landed).
• Attested backtest replay (orb: run the backtest replay inside the CoCo runtime class and persist its attestation envelope #8537) and its verification docs path (docs+ui: extend verify-this-review with the attested-run verification path #8538) are open in this milestone.
• Per-tenant checksummed corpus export for private corpora is cloud: tenant-verifiable backtests for private corpora — per-tenant checksummed corpus export #8539.
• The live decision path is deliberately not attested — Research: the attested-evaluation epic covers offline backtests only — decide whether the LIVE decision path needs attestation, and in what order #9141 recorded that boundary and its revisit trigger; verify-this-review.mdx states it permanently.

A hosted customer evaluating LoopOver needs one page — and the engineering behind it needs one spec — answering: for each claim LoopOver makes, what artifact proves it, who can check it, and what is assumed.

Requirements

1. Produce a verification matrix covering, at minimum: gate-decision integrity (ledger + anchor), decision-record authenticity (digest + published record), published accuracy/guarantee numbers (corpus export + replay, per-tenant via cloud: tenant-verifiable backtests for private corpora — per-tenant checksummed corpus export #8539 for private corpora), attested backtest execution (orb: run the backtest replay inside the CoCo runtime class and persist its attestation envelope #8537/docs+ui: extend verify-this-review with the attested-run verification path #8538 envelope, once landed), and configuration/commitment scope (what the record's digests do and do not commit to).
2. Each row states: claim → artifact → endpoint/CLI → who can run it (anonymous / tenant / operator) → trust assumption (tamper-evident vs tamper-proof, per the honest framing in migrations/0180).
3. An explicit "not verifiable" section: live-gate execution (per Research: the attested-evaluation epic covers offline backtests only — decide whether the LIVE decision path needs attestation, and in what order #9141's recorded decision) and anything else knowingly out of scope, each with its revisit trigger.
4. The contract must distinguish self-host operators (verify everything locally) from hosted tenants (verify via public artifacts only) — the hosted column is the one this milestone exists for.

Deliverables

• A decision record on this issue resolving every numbered requirement.
• A docs page (extending or siblinging verify-this-review.mdx) publishing the matrix in tenant-facing language.
• Confirmed follow-up wiring: the ORB dashboard trust panel consumes this contract (that issue is blocked on this one).

Expected outcome

"What can I actually verify?" has one canonical answer, the same one the dashboards render and the docs publish — no scattered, drifting claims.

Out of scope

Building any new verification mechanism. This issue documents and contracts what exists; gaps it finds become their own issues.

References

Advances #8534. Relates to #8537, #8538, #8539, #9141, #8540.

[linear-code]

JSO-6346

[JSONbored]

Decision record — unified tenant verification contract

Resolving all four numbered requirements. Every endpoint, CLI, and trust assumption below is what ships today; anything not built is named as not-built rather than described as if it were.

---

1 & 2. The verification matrix

Each row: claim → artifact → endpoint/CLI → who can run it → trust assumption.

#	Claim	Artifact	Endpoint / CLI	Who can run it	Trust assumption
1	Gate-decision integrity — the decision sequence was not silently reordered, deleted, or rewritten	Hash-chained ledger (row_hash = sha256(prev_hash ‖ canonical fields), genesis = 64 zeros)	GET /v1/public/decision-ledger/verify?afterSeq=&limit= → { ok, checked, nextAfterSeq, tipSeq, tipHash, totalCount, break? }; 409 on a break	Anonymous (unauthenticated by design)	Tamper-EVIDENT, not tamper-proof. Detects gaps, predecessor/row-hash mismatches, short tails, content mismatches, missing records. Does not detect the operator deleting the chain wholesale and re-chaining from genesis — that needs an external anchor, which is not built (buildLedgerAnchorPayload exists and is called from nowhere).
2	Decision-record authenticity — this specific verdict is the document its digest names	DecisionRecord (schemaVersion 4) + recordDigest = sha256(canonicalJson(record))	GET /v1/public/decision-records/:owner/:repo/:pull → { record, recordDigest }; full 64-hex digests also printed in the PR's "Decision record" section	Anonymous	Digest is independently recomputable — canonicalization is deterministic (sorted keys, no whitespace). Assumes the ledger row for that record has not been re-chained (row 1's limit). Supersessions are visible history (:rev<N> ids), never silent overwrites.
3	Published accuracy numbers — the fairness report's precision figures are real computations over real, replayable history	Checksummed corpus manifest (checksum = sha256 over key-sorted cases) + public scoring code in @loopover/engine	GET /v1/public/stats (rulePrecision block); re-derive via scripts/backtest-corpus-export.ts → verify checksum → re-run scoreBacktest	Anonymous for public repos; tenant-only for private corpora — and per-tenant export is #8539, still open	Requires the corpus be publishable. Closes T1 (corpus tampering) and T2 (numbers not from published code) per #8136. Does not close T3 (is the ground-truth override history itself honest).
4	Attested backtest execution — the replay ran unmodified inside genuine SEV-SNP hardware	AttestationEnvelope (measurement, reportData, runId, base64 report)	npx tsx scripts/verify-attested-run.ts --envelope … --expected … — fully offline; exit 0 = verified, 1–8 = one failure class each, 9 = usage/IO	Anonymous, with zero contact with LoopOver	Trusts AMD's root certificate only. Not yet reachable in production: software is merged (#9211/#9212/#9214/#9213) but no SNP hardware is deployed, so no production envelope exists yet (#8535–#8537). Proves computation, never data provenance.
5	Configuration & commitment scope — what the verdict's digests actually pin	configDigest (resolved gateCheckPolicy), settingsDigest (raw effective settings), promptDigest (the actual sent system prompt), modelIds	Same record endpoint as row 2	Anonymous reads the digests; only the operator/tenant can reproduce their preimages (settings are not public)	Digests commit to the configuration and prompt text in force at decision time — a changed policy or prompt yields a different digest. They do not commit to model behavior: identical modelIds + promptDigest can still yield different completions, since inference is not deterministic. A digest match means "same inputs," never "same output."

---

3. Explicitly NOT verifiable

Each with its revisit trigger, stated so the boundary is legible rather than discovered.

• Live gate execution. The merge/close calls acting on a real PR are not attested and, per the recorded decision in Research: the attested-evaluation epic covers offline backtests only — decide whether the LIVE decision path needs attestation, and in what order #9141, are not planned to be. A network-reachable attestation service in the live request path trades a real availability guarantee for a proof the deterministic stage already gives more cheaply through replay. Revisit trigger: a hosted tenant requires attested live decisions contractually — not merely prefers them. This is standing design, not a gap awaiting hardware.
• Ground-truth honesty (T3, Research: is TEE hardware attestation necessary, or does a reproducible-backtest checksum approach cover the real threat? #8136). Labels are human-override events recorded on maintainer infrastructure. No artifact in this matrix closes this — including attestation. Closing it needs provenance at event-capture time (receipts verifiable by the humans whose overrides they record). Revisit trigger: a tenant disputes recorded override history in a way reproducibility cannot settle.
• Wholesale ledger replacement. Row 1's limit. Revisit trigger: external anchoring ships (signed checkpoints, transparency log, or on-chain commitment) — tracked, not built.
• Private-corpus reproduction by third parties. A hosted tenant's history cannot be published for anonymous re-runs. Revisit trigger: cloud: tenant-verifiable backtests for private corpora — per-tenant checksummed corpus export #8539 lands, giving the tenant (not the public) a checksummed export.
• Model behavior. Row 5's limit — no artifact makes a non-deterministic model reproducible.

---

4. Self-host operator vs hosted tenant

	Self-host operator	Hosted tenant
Verifies	Everything locally — own Postgres, own corpus export, own ledger, no dependency on our uptime	Public artifacts only: rows 1, 2, 3 (public repos), 5
Corpus access	Direct (--pg "$DATABASE_URL")	Blocked on #8539 for private repos
Trust surface	Trusts their own infrastructure — they are the operator	Trusts LoopOver's operator honesty exactly to the degree row 1's tamper-evident limit allows
The honest asymmetry	Genuinely closes T1/T2 for themselves	Cannot close T3, and cannot close wholesale re-chaining until anchoring exists

The hosted-tenant column is the one this milestone exists for, and it is the weaker of the two — stating that plainly is the point of the contract.

---

Deliverables status

• ✅ This decision record.
• ⏳ Docs page publishing the matrix in tenant-facing language — sibling to verify-this-review.mdx (which stays the how-to walkthrough; this is the what-can-I-check contract).
• ➡️ Follow-up wiring confirmed: the ORB dashboard trust panel consumes this matrix as its single source, so dashboard, docs, and contract cannot drift apart.

Gaps this contract surfaces (each becomes its own issue, per the issue's own out-of-scope rule)

1. No external ledger anchor — buildLedgerAnchorPayload is written but unused; row 1 stays tamper-evident until it ships.
2. No artifact signing — the only signing in src/ is an operator-managed HMAC allowlist for federated bundles, unsuitable for an open verifier audience.
3. No production attestation — row 4's verification path is complete in software and unreachable in practice until SNP hardware lands.