spec: define composite CPU and GPU evidence for confidential inference receipts

[imran-siddique]

Problem

Confidential inference can involve two independent hardware trust chains: a confidential CPU or VM and a confidential GPU. A generic runtime measurement or a GPU example alone does not define how a verifier establishes that both reports belong to the same workload, channel, model execution, and evidence epoch.

The evidence format should support this composition without claiming that a valid receipt proves model quality, physical isolation beyond the admitted hardware threat model, or inference correctness.

Scope

Define a generic TRACE profile or composition rule for confidential-inference receipts. No customer, event, provider deployment, or proprietary service is in scope.

Acceptance criteria

• Represent distinct CPU and GPU evidence chains and their independent appraisal outcomes.
• Bind both chains to one freshness challenge, deployment identity, or attested channel key.
• Bind the workload measurement, model artifact digest, policy identity, and inference-session identifier.
• Represent attestation-gated key release and lease state by digest or linked receipt, without exposing keys or model weights.
• Distinguish verified, structurally present but unverified, missing, stale, mismatched, and contraindicated evidence.
• Define verifier behavior for CPU substitution, GPU substitution, transport-key substitution, and expired lease cases.
• State explicitly that hardware evidence does not prove model output correctness or defeat physical attacks outside the admitted threat model.
• Add one positive and isolated negative conformance vectors for each required binding.

Related work

Weight Custody Manifest issue #77 tracks a real contemporaneous CPU plus GPU sealed-key release. This issue concerns the portable TRACE representation and verifier semantics for the resulting composite execution evidence.