Neutrality · how SiBIL stays neutral
Nobody can edit the number
The provider installs the agent. It does not pick the tests, run the scoring, or sign the report. The rules are the same for every box, and anyone can check the result without asking us.
- providerinstalls the agent
- agentruns the signed suite, signs the raw bundle
- backendverifies, scores, countersigns
- anyonechecks the signature
What the provider controls, and what it does not
- Which servers it enrols
- The hardware in each box
- Whether to share a report
- Fixing a flag, then running again
- The scorethe backend computes it
- The formula and the rulessame for every box
- The test suiteversioned, TUF-signed
- When spot checks runrandom times
- Which flags showeach one is in the signed report
- The signatureone changed byte breaks it
Same rules for every box
One formula. One set of balance rules. NVIDIA and AMD tools build from one source, and no rule checks who made the card.
| P | performance against a reference |
| B | balance: the parts fit together |
| min | the weaker one sets the score |
- B1PCIe linktrained width and speed
- B2Link bandwidthmeasured host-to-GPU copy
- B4FeedCPU-fed rate vs on-GPU rate
- B5CPU per GPUcores that feed each card
- B6Host memoryhost RAM vs GPU memory
- B10Power limitset limit vs SKU
| rule | B4 feed |
| measured | 0.662 of on-GPU |
| threshold | 0.85 |
Check us, don’t trust us
The public keys are online. Every report page checks its own signature in your browser. A one-file script does the same check offline.
The node signs the raw bundle. The backend verifies it, scores it and countersigns. The report names the key that signed it.
- $ python3 verify.py report.json <key>
- ✓ OK: run r-539393fadbabca97 score 767 signed by key 67c7762dc90ca121
- # change one byte in the report
- ✕ FAIL: the report was changed (payload_sha256)
- GPU returns tile sumsCPU checks them
- nonce ties run to scheduleno reuse
- replayed or edited bundleno score
What we do not prove yet
A trust page that hides its gaps is not one. Here is where the proof stops today.
- Tier 1 · file keylive
- Tier 2 · TPM-backed keyplanned, not built
- Tier 3 · TPM quoteplanned, not built
- Proves: nobody changed the report after it was signed.
- Proves: the score comes from the measurements the agent sent, with the named score model.
- Not yet: which physical machine ran the test. With a file key, a person with root on the server can send changed measurements.
- Provisional: some server CPUs have no reference yet. Those scores show as “provisional”, with no grade.
See a real signed report
An H200 server, measured with a spot check. Open it and the signature check runs in your browser.