Protected issuance: public roots and log

Ledger sa-prod-p0, epoch 1. Updated 1 November 2026. This page is a second, separate channel for the root key fingerprint: it is served by our API, not by the storage bucket that holds the material.

Root key fingerprint

SHA-256 of roots.json

4a4bb1cd912237c7746a7c8c093a1847043a061dbd3be10376679f4d145b199c

Download roots.json from the public bucket and compare its SHA-256 with the value above before trusting anything signed under these roots. If they differ, stop and contact us.

First measured issuance

Operation sa-prod-b2-0001, 31 October 2026, log entry 20

6,721 mWh of GPU energy, claim_kind: measured, claim_type: tee_attested. A real training run on an NVIDIA H100, on our own workload: the signed NVML counter difference across 754 samples, in a 76-second window that includes the preparation before training. Recipient checks: 6 of 6 passed.

You can check it yourself: the digest of the signed claim is in log entry 20. The steps are in the recipient guide.

Public material

What	Where
Recipient guide: what a protected package proves and what it does not, and the verification spec	recipient-guide-v2.md (first version)
Root keys (6, Cloud KMS HSM, ECDSA P-256)	roots.json
Root-signed statements: witness key, policy, client, gate image list v3	statements-seq6.json (up to seq 5)
Ledger identity, witness signing key, policy and image list in force	ledger-seq6.json (up to seq 5)
Minimal verifier written only from the published spec	verify_spec_minimal.py
Checksums of the files above, by publication	SHA256SUMS-v2.txt, SHA256SUMS-seq6.txt, SHA256SUMS.txt
Witness log (public copy, one object per entry)	log/sa-prod-p0/1/
Retention evidence of the origin log	origin-bucket-locked.json

Both the origin log and the public bucket have a locked 10-year retention policy: Google Cloud Storage refuses to delete or overwrite these objects before about 30 October 2036, whoever asks, Serial Alice included, for as long as the service enforces it and the account stays in good standing.

What this does and does not prove

A protected package shows that a gate whose Intel TDX measurement is on the root-signed image list, appraised under the policy in force (DCAP and Intel Trust Authority), issued the claim, and that a separate witness operated by Serial Alice recorded it in an append-only, signed log.

Each claim states its own kind. operator_declared means declared by the operator. measured with tee_attested means the gate accepted evidence from a sealed collector, and components says what was measured.
A measured figure comes from the GPU's own energy counter, signed by the collector; it is not a separate physical meter. It does not cover a kernel exploit or root inside the guest after boot.
The witness is separate from the gate but operated by Serial Alice; it is not independent.
The keys are Cloud KMS HSM keys. This is not a FIPS 140-3 claim.
The first packages (sa-prod-pilot-*) are an internal pilot with test values. sa-prod-b2-0001 is a real measurement on our own workload, not a customer claim, issued by a gate in the United States.

Questions, the reference verifier, or a fresh signed revocation status: contact us.