Enclave execution: TEE for tamper-proof attestation (marketplace requirement)

[joelteply]

Summary

Phase 4 — run benchmark evaluation inside a Trusted Execution Environment. The ONLY tier that prevents input-output binding attacks. Required before real money flows.

Options

• AWS Nitro Enclaves (most accessible)
• Intel SGX (broad support)
• ARM TrustZone (mobile/embedded)

What enclave proves

• Code running inside is genuine and unmodified (hardware attestation)
• Results provably came from running those inputs through that code
• No cherry-picking, no model swap, no modified eval harness

Marketplace flow

1. Contract issues nonce
2. Forge runner executes inside TEE
3. TEE signs attestation with hardware-bound key
4. Contract verifies hardware attestation certificate
5. Payment released

Depends on

• Signed attestation working (Phase 2)
• Key registry (Phase 2)
• Grid operational with marketplace