Trust & Attestation
How a requester reasons about which untrusted hosts to trust: identity + attestation tiers + reputation from signed receipts + verification. Every number here is from the real loopback-grid trust engine.
How the grid decides which untrusted machines to believe: a reputation built from signed receipts, hardware-attestation tiers, and checking that independent results agree (quorum + canary audits).
Impact: It can safely use strangers' computers — cheaters are caught (wrong fingerprint or a failed secret audit), lose reputation and staked money, and stop getting work.
Avg trust
0.70
over all workers
L2 hosts
4
attested TEE enclaves
Receipts
64
signed verdict trail
Correct rate
86%
55/64 verdicts
Flagged
2
providers caught + deselected
Trust score
A hard attestation gate multiplied by a clamped blend of soft, signed signals, plus an exploration bonus for under-observed hosts.
effective_trust = gate(level ≥ min_level) · clamp(α·R + β·age + γ·voucher + δ·stake − penalties) + exploration
α=0.7β=0.1γ=0.1δ=0.1The attestation level is a hard gate (boolean), not just another score input — fail it and effective_trust is 0 regardless of reputation.
min_trust = 0bootstrap_trust = 0.1half_life = 7.0d
Sample host
worked example · real termsmarsh-otterL2 · TEE
R — reputationConfident
recency-weighted correctness over 144 obs
0.95
× 0.7 = 0.666
ageFactor
observation history → maturity
1.00
× 0.1 = 0.100
voucherTrust
trust lent by peers (none here)
0.80
× 0.1 = 0.080
stakeFactor
log-scaled from 3400 TON staked
0.71
× 0.1 = 0.071
− penalty
recent faults / disputes
−0.000
+ explorationBonus
nudge to sample under-observed hosts
+0.000
- Attestation gate (hard)
- L2 ≥ L1 PASS
- soft (clamped blend)
- 0.917
- reputation (raw)
- 1.00
- effective trust = gate · soft + explore
- 0.917
Attestation tiers
hardware trust ladderL0 · anonAnonymous
3 hosts- Evidence
- Pinned node key
- Proves
- Identity continuity only — same key across sessions.
- Hardware
- Any laptop
L1 · TPMMeasured boot
2 hosts- Evidence
- TPM quote (PCRs) + signed event log
- Proves
- A known-good OS / agent image booted (no plaintext-RAM guarantee).
- Hardware
- Modern laptops w/ TPM 2.0
L2 · TEEConfidential TEE
4 hosts- Evidence
- HW attestation quote — Intel TDX / AMD SEV-SNP / AWS Nitro — verified vs. allowlisted enclave measurement
- Proves
- DuckDB runs in hardware-encrypted memory; the host root user cannot read plaintext.
- Hardware
- Confidential cloud VMs
Commodity laptops cap at L0/L1; a true “the operator can't read RAM” guarantee needs L2 confidential hardware.
Selection policy by data class
What a requester demands of candidate hosts before dispatching, per data class.
| Data class | min_level | min_trust | quorum | Notes |
|---|---|---|---|---|
| Public | L0 · anon | 0.70 | 2–3 | Moderate redundancy; cheapest pool, laptops welcome. |
| Internal | L1 · TPM | 0.85 | 3 | Scoped credentials mandatory; measured-boot floor. |
| Sensitive | L2 · TEE | allowlist | optional | Attested enclave or permissioned allowlist; hardware enforces confidentiality. |
Selection score & routing
Beyond the hard gates and trust above, eligible hosts are ranked by a composite selection score. Performance and capability terms are driven by counterparty-measured signals (never self-reported ETA), so a host genuinely faster / higher-throughput / proven to handle heavy work wins dispatch more often. Real economics.ranking weights:
quality
success · latency · throughput · completion
w = 0.60
stake (reliability-gated)
amplifies already-reliable hosts only
w = 0.30
price
cheaper bids rank higher
w = 0.25
latency
counterparty-MEASURED commit speed (anti-game)
w = 0.15
throughput
counterparty-MEASURED bytes/sec (anti-game)
w = 0.15
capability
proven ability to handle heavy work
w = 0.10
stake_reliability_floor = 0.50newcomer_trust_ceiling = 1.00The stake term is gated on verified-success rate, and brand-new identities are capped below the top ranks until they build real history — so neither stake nor a lucky streak can buy selection.
Verification
How an answer from an untrusted host is checked before it's trusted or paid. The hash and quorum panels below are the actual results computed during the run.
1Canonical BLAKE3 result hash
Order-independent per-row hashing + normalized numeric/NULL form, then BLAKE3. Re-hashing the same 3 columns × 3 rows in a shuffled row order yields the identical digest.
| region | orders | gmv |
|---|---|---|
| emea | 184233 | 2481002.5 |
| amer | 201980 | 3120550 |
| apac | 98120 | 1044980.75 |
- hash
- reordered hash
- order_independent
- true
2Commit-first
Workers send result_hash before streaming any rows. Committing the answer up front prevents a host from adapting its result to match peers it observes.
3Quorum / redundant execution
Run on k hosts, require ≥ q matching hashes. The fastest agreeing host streams the data; the losers RESET their in-flight streams. Below is the real evaluate_quorum outcome over 4 committed hashes.
h(A)h(A)h(A')h(divergent)
- agreement / quorum
- 3 / 3
- reached
- true
4Canary auditing
Inject queries whose answer is already known. A worker that returns the wrong hash is marked Incorrect and slashed — exactly what happened to the flagged providers below.
5Source-data-drift verification
Redundant execution only proves agreement if every racer read the same source data. The requester pins an input snapshot (input_snapshot on the dispatch) and each worker returns an input_fingerprint; the quorum is fingerprint-aware, so results computed over a drifted, stale, or swapped source are partitioned out instead of contaminating the agreed hash.
Honest-limit note — quorum assumes an honest majority among the chosen k. That assumption is why it is combined with reputation, attestation gating, Sybil cost (stake), and canaries rather than used alone.
Receipts
Signed verdicts that feed reputation. Recency-weighted R = Σ wᵢ·correctᵢ / Σ wᵢ, wᵢ = decayᵗ · job_weight. Receipts are gossiped / DHT-stored independently, so hiding a bad receipt is caught (anti-omission ⇒ treat hidden as low trust).
| Job | Worker | Verdict | Fault | Latency | Verified | Sig | When |
|---|---|---|---|---|---|---|---|
| marsh-otter | Correct | — | 21ms | yes | ed25519:4c6faeb3…5f02 | 0s ago | |
| rust-shrike | Incorrect | provider | 21ms | yes | ed25519:bcd3b872…770b | 0s ago | |
| pine-marten | Correct | — | 62ms | yes | ed25519:518fd553…1207 | 0s ago | |
| amber-mole | Correct | — | 48ms | yes | ed25519:e2dee65e…670a | 0s ago | |
| tidal-fox | Correct | — | 31ms | yes | ed25519:eb9ba4be…3b0c | 0s ago | |
| harbor-vole | Correct | — | 22ms | yes | ed25519:bcdf3ffe…3003 | 0s ago | |
| slate-heron | Correct | — | 111ms | yes | ed25519:4e8aac75…d003 | 0s ago | |
| cobalt-stoat | Inconclusive | — | 0ms | yes | ed25519:a9f3be6f…8507 | 0s ago | |
| frost-owl | Correct | — | 14ms | yes | ed25519:1be67a16…970a | 0s ago | |
| marsh-otter | Correct | — | 19ms | yes | ed25519:0e31c0ff…4d0f | 0s ago | |
| harbor-vole | Correct | — | 23ms | yes | ed25519:2c3213df…bc03 | 0s ago | |
| tidal-fox | Correct | — | 31ms | yes | ed25519:7e93648e…d602 | 0s ago | |
| amber-mole | Correct | — | 46ms | yes | ed25519:bc9deba0…c309 | 0s ago | |
| pine-marten | Correct | — | 61ms | yes | ed25519:691f502a…4001 | 0s ago | |
| slate-heron | Correct | — | 112ms | yes | ed25519:f957ad2a…7402 | 0s ago | |
| cobalt-stoat | Inconclusive | — | 0ms | yes | ed25519:d8378fe3…9100 | 0s ago | |
| frost-owl | Correct | — | 13ms | yes | ed25519:1f30ea5b…6506 | 0s ago | |
| marsh-otter | Correct | — | 19ms | yes | ed25519:dc97cc72…3d0c | 0s ago | |
| harbor-vole | Correct | — | 23ms | yes | ed25519:fc040ffe…0006 | 0s ago | |
| tidal-fox | Correct | — | 31ms | yes | ed25519:382ad548…e603 | 0s ago | |
| amber-mole | Correct | — | 45ms | yes | ed25519:2af4103a…b804 | 0s ago | |
| pine-marten | Correct | — | 61ms | yes | ed25519:e41e7d67…be01 | 0s ago | |
| slate-heron | Correct | — | 110ms | yes | ed25519:c9d7f002…2b09 | 0s ago | |
| cobalt-stoat | Inconclusive | — | 0ms | yes | ed25519:16a40b14…f606 | 0s ago | |
| frost-owl | Correct | — | 13ms | yes | ed25519:06060188…4702 | 0s ago | |
| marsh-otter | Correct | — | 20ms | yes | ed25519:2cd2b51c…100b | 0s ago | |
| harbor-vole | Correct | — | 22ms | yes | ed25519:66137ae0…7406 | 0s ago | |
| tidal-fox | Correct | — | 31ms | yes | ed25519:67a5ddbc…7c00 | 0s ago | |
| amber-mole | Correct | — | 47ms | yes | ed25519:9cbb44d2…3303 | 0s ago | |
| pine-marten | Correct | — | 60ms | yes | ed25519:f1855b17…f205 | 0s ago | |
| slate-heron | Correct | — | 112ms | yes | ed25519:8af04929…a401 | 0s ago | |
| cobalt-stoat | Inconclusive | — | 0ms | yes | ed25519:e9406855…d506 | 0s ago | |
| frost-owl | Correct | — | 14ms | yes | ed25519:fbd42d28…8b0e | 0s ago | |
| marsh-otter | Correct | — | 18ms | yes | ed25519:5bf63899…2f0c | 0s ago | |
| harbor-vole | Correct | — | 23ms | yes | ed25519:80110eba…9003 | 0s ago | |
| tidal-fox | Correct | — | 32ms | yes | ed25519:041eb851…0006 | 0s ago | |
| amber-mole | Correct | — | 46ms | yes | ed25519:e88719cd…5900 | 0s ago | |
| pine-marten | Correct | — | 61ms | yes | ed25519:e960c36f…3f07 | 0s ago | |
| slate-heron | Correct | — | 111ms | yes | ed25519:39e158a3…2e03 | 0s ago | |
| cobalt-stoat | Inconclusive | — | 0ms | yes | ed25519:36f9d4ca…9900 | 0s ago | |
| frost-owl | Correct | — | 15ms | yes | ed25519:a2cac458…da05 | 0s ago | |
| marsh-otter | Correct | — | 19ms | yes | ed25519:37b519af…e405 | 0s ago | |
| harbor-vole | Correct | — | 23ms | yes | ed25519:a3a0a886…040e | 0s ago | |
| tidal-fox | Correct | — | 32ms | yes | ed25519:55576ca2…6d07 | 0s ago | |
| amber-mole | Correct | — | 45ms | yes | ed25519:0b19eabd…5a00 | 0s ago | |
| pine-marten | Correct | — | 61ms | yes | ed25519:ff277b8f…ab01 | 0s ago | |
| slate-heron | Correct | — | 112ms | yes | ed25519:1ac497d3…690e | 0s ago | |
| cobalt-stoat | Inconclusive | — | 0ms | yes | ed25519:c0f1840a…3f0d | 0s ago | |
| frost-owl | Correct | — | 14ms | yes | ed25519:f42bc37a…3a0d | 0s ago | |
| marsh-otter | Correct | — | 19ms | yes | ed25519:ad774885…d909 | 0s ago | |
| harbor-vole | Correct | — | 23ms | yes | ed25519:70e8abe1…6b0c | 0s ago | |
| tidal-fox | Correct | — | 31ms | yes | ed25519:abf11296…e10a | 0s ago | |
| amber-mole | Correct | — | 47ms | yes | ed25519:715e79e8…1109 | 0s ago | |
| pine-marten | Correct | — | 60ms | yes | ed25519:59cd702e…cc00 | 0s ago | |
| slate-heron | Correct | — | 112ms | yes | ed25519:030a77ca…aa00 | 0s ago | |
| cobalt-stoat | Inconclusive | — | 0ms | yes | ed25519:92f33af0…940a | 0s ago | |
| frost-owl | Correct | — | 14ms | yes | ed25519:e04ea517…f80e | 0s ago | |
| marsh-otter | Correct | — | 20ms | yes | ed25519:66700978…dc0d | 0s ago | |
| harbor-vole | Correct | — | 24ms | yes | ed25519:600047f2…d207 | 0s ago | |
| tidal-fox | Correct | — | 31ms | yes | ed25519:9af873d4…d30f | 0s ago | |
| amber-mole | Correct | — | 46ms | yes | ed25519:53436c9c…2a07 | 0s ago | |
| pine-marten | Correct | — | 61ms | yes | ed25519:8c45ab2f…6a0c | 0s ago | |
| slate-heron | Correct | — | 111ms | yes | ed25519:4000f1be…9408 | 0s ago | |
| cobalt-stoat | Inconclusive | — | 0ms | yes | ed25519:07a900fa…460c | 0s ago |
Flagged providers · caught by verification
Real nodes the trust engine penalized this run. They returned a divergent hash (Incorrect) or never committed (Timeout), were verified against the quorum, and the engine drove their reputation and trust to ~0 — so the scheduler stops selecting them.
| Worker | Attestation | Behavior | correct / faults | reputation | trust |
|---|---|---|---|---|---|
| rust-shrike | L0 · anon | cheat | 0/1 | 0.00 | 0.00 |
| cobalt-stoat | L0 · anon | fail | 0/0 | — | 0.07 |
There is no central authority here — each node independently verifies a verdict against the committed hashes and decides on its own whether to down-weight or drop a peer.
Trust terms — radar (plotly)
The real soft-score inputs for the top worker vs. a penalized node — the trust engine's actual per-term values.
loading plot…
Verified-result latency (plotly histogram)
Commit-first latency across every Correct receipt this run.
loading plot…