Ryan MacArthur

Fine-tuning is usually treated like a cloud workflow: upload the examples, rent the accelerator, wait for the checkpoint, then trust that the training data was handled correctly. I wanted the opposite security shape: the model adapts where the data already lives.

This harness runs VibeThinker entirely in the browser on WebGPU. The base weights load once and stay frozen. All behaviour moves through compact LoRA adapters that hot-swap at runtime without reloading the base or dropping the KV cache.

The interesting part is not the demo. It is the boundary: examples, gradients, adapter weights, and inference all stay local. That is the pattern I keep building toward — useful ML with a security model you can explain without hand-waving.

Cloud security breaks when trust stops at "the provider says so." Nitro, SEV-SNP, and TDX each expose different quote formats, evidence devices, and signing roots, but the real question is the same everywhere: is this the reviewed code, running inside the hardware boundary it claims?

These four repos turn that into a product path. Source goes into an ephemeral TDX build, comes out as a vendor-rooted EAT receipt, binds the workload's TLS key to the quote, then gates agent privileges on that proof. The security story is deliberately boring: no receipt, no token.

1. unified-quote the receipt format

   One EAT-based receipt across AWS Nitro, AMD SEV-SNP, and Intel TDX, with each platform's evidence normalized against a pinned vendor root. One verifier contract for code identity, hardware identity, and policy decisions.

2. attestation-service receipts for any source

   Submit a source tarball; an ephemeral Intel TDX VM rebuilds it inside the boundary and returns a signed receipt. That makes the build host an untrusted courier instead of a root of trust.

3. attested-workload the workload in-TEE

   Serve the workload over attested TLS: the certificate's SPKI is bound into the quote, so the network channel carries the same identity as the enclave. The proof survives contact with real clients.

4. cvm-agent proof → privilege

   The enforcement layer: before an agent receives a GitHub, Stripe, or deploy token, the runtime checks the receipt. It turns attestation from a compliance artifact into an access control primitive.