Private model delivery demo

This repository is a minimal end-to-end blueprint for delivering an encrypted model to a Tinfoil CVM. The repository contains no model weights, encryption keys, vault secrets, or CVM artifacts.

The demo uses:

• modelwrap v0.2.1 to produce an encrypted, dm-verity-protected EMWP;
• a pinned SmolLM2 135M GGUF as a fast CPU inference workload;
• a digest-pinned llama.cpp server image;
• PRIVATE_MODEL_KEY as the boot-only model key secret; and
• dev-vault.tinfoil.sh as the attested secret provider.

The complete customer-vault deployment is in vault/. It pins the strict provider source and includes a hardened systemd unit. dev-vault/ is a separate, conspicuously unsafe protocol harness for locally built CVMs whose provenance cannot yet pass the real verifier.

Prepare the encrypted model

./scripts/prepare-model.sh

The script downloads and verifies the pinned public source model, generates a local 64-byte model key, and creates a verified EMWP. Its .private/ output is ignored by Git. For a real private model, replace the download with a local model directory while keeping the same Modelwrap flow.

To create a local external config for pre-release testing:

./scripts/render-external-config.sh

The generated file is mode 0600, ignored by Git, and must never be committed. It bypasses the provider only for local qualification before the CVM image has publishable provenance.

Launch with a local CVM build

Build shipping-image from the intended cvmimage commit in an isolated worktree, install the EMWP at the host model path shown by scripts/prepare-model.sh, and launch without publishing any CVM artifacts:

tinctl dev-launch /path/to/cvmimage/result \
  --config ./tinfoil-config.yml \
  --external-config ./.private/external-config.yml \
  --skip-manifest \
  --watch

The inference API is OpenAI-compatible at /v1/chat/completions. Remove --external-config after the CVM release exists and the attested provider is configured with the same PRIVATE_MODEL_KEY.

To reproduce the released qualification without changing measured inputs:

tinctl dev-launch \
  --repo tinfoilsh/demo-private-model-delivery \
  --tag v0.0.2 \
  --published-cvm \
  --external-config ./.private/v0111-strict/external-config.yml \
  --debug=false \
  --name private-model-v0111-strict \
  --domain private-model-v0111-strict.box3.tinfoil.sh \
  --watch

Do not replace --published-cvm with --cvm-version for this check: the latter intentionally rewrites the YAML and therefore changes its measured hash. Do not inject debug SSH keys because debug mode adds a measured toolbox and command-line flag. The qualification external config contains only the temporary self-signed certificate placeholder required by tinfoild#159; it does not contain PRIVATE_MODEL_KEY.

The provider must authorize the enclave workload repository, not this model identity or the provider repository. During local pre-release testing, tinctl dev-launch imports its base metadata from tinfoilsh/confidential-debug; after the demo has its own release provenance, configure the provider for tinfoilsh/demo-private-model-delivery.

Vault transport is always HTTPS, including local and air-gapped deployments. Use a private CA embedded as vault-ca in the measured configuration rather than plaintext HTTP; the host and network remain outside the CVM trust boundary.

Release boundary

Do not tag, upload, or release a locally built CVM image. A successful provider release requires authenticated CVM provenance generated by the approved cvmimage release workflow.

This configuration repository is public so ATC and freshness-witness can authenticate its release artifacts without cross-repository credentials. The model remains private: only encrypted EMWP bytes are placed on the host, while the key is released after fresh attestation.

See QUALIFICATION.md for the tested matrix and the final release boundary.