fuin 1.0.0__tar.gz

fuin-1.0.0/.gitignore

@@ -0,0 +1,14 @@
+.env
+.env.*
+.venv/
+__pycache__/
+*.pyc
+.pytest_cache/
+target/
+private/
+
+# TEE scorer build output
+tee/target/
+tee/dist/
+.fuin-cache/
+ask/dist/

fuin-1.0.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 fexx301
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

fuin-1.0.0/PKG-INFO

@@ -0,0 +1,223 @@
+Metadata-Version: 2.5
+Name: fuin
+Version: 1.0.0
+Summary: Sealed benchmark results with verifiable NEAR AI Cloud TEE signatures and a re-scorable audit sample
+Project-URL: Homepage, https://github.com/fexx301/fuin
+Project-URL: Repository, https://github.com/fexx301/fuin
+Project-URL: Documentation, https://github.com/fexx301/fuin#readme
+License-Expression: MIT
+License-File: LICENSE
+Requires-Python: >=3.13
+Requires-Dist: cryptography>=50.0.2
+Requires-Dist: dcap-qvl==0.7.0
+Requires-Dist: eth-account>=0.13
+Requires-Dist: pyyaml>=6.0.3
+Requires-Dist: requests>=2.32
+Requires-Dist: rfc8785==0.1.4
+Requires-Dist: sigstore>=4
+Description-Content-Type: text/markdown
+
+# Fūin
+
+Fūin (封印, pronounced *foo-een*) is Japanese for "seal": the test set is sealed on NEAR before any result is committed.
+
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/fexx301/fuin/main/assets/fuin-logo-dark.svg">
+  <img src="https://raw.githubusercontent.com/fexx301/fuin/main/assets/fuin-logo.svg" alt="Fūin logo" width="320">
+</picture>
+
+Fūin publishes a private benchmark result that a stranger can check **without an account and without the test set**. Every answer carries a signature from the model's attested TEE key on NEAR AI Cloud, the set and results are committed on NEAR, and every answer is scored inside a TEE on OutLayer. A round can also reveal a sample picked by a future NEAR block, or reveal nothing at all. In round 7 a TEE made every model call itself and recorded one answer per question and counted every retry (round 7 had one), so no owner could quietly re-ask and keep the best answer.
+
+Built at NEAR HACKATHON (Nov 1–14, 2026), tracks `privacy` and `open`.
+
+![The browser verifier refusing a real round-3 certificate whose revealed answer was edited after signing: REFUSED signature_text_mismatch](https://raw.githubusercontent.com/fexx301/fuin/main/assets/verify-refused.png)
+
+*The browser verifier on a real round-3 certificate after "Edit an answer": the checks pass until the revealed sample is re-scored, where the edited answer no longer matches what the model signed.*
+
+## The problem
+
+A benchmark owner has two bad options:
+
+- **Publish the test set.** It leaks into the next model's training data, and the benchmark stops measuring anything.
+- **Keep it private.** Then everyone has to take the owner's word for the scores: which model ran, whether answers were edited, and whether the grading was honest.
+
+Fūin is a third option. The owner keeps the questions private. Anyone can check that the published score came from real, unedited answers by a named model running in a TEE, committed before any sample was drawn, and scored correctly against the owner's sealed answer key, over every answer. Whether the questions are any good stays with the owner. Private eval sets are already in use: NEAR's Delta League, for example, ranks fine-tuned models on one ([Illia Polosukhin, Nov 6, 2026](https://x.com/ilblackdragon/status/2118591003368296561)). Fūin certifies models that NEAR AI Cloud serves in an attested TEE, so certifying fine-tuned submissions like those would need them served the same way.
+
+## How it works
+
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/fexx301/fuin/main/assets/fuin-flow-dark.svg">
+  <img src="https://raw.githubusercontent.com/fexx301/fuin/main/assets/fuin-flow.svg" alt="The six steps of a Fūin round: seal on NEAR, run (the model in a TEE signs each answer), commit on NEAR, close, check (a future block picks a sample, or a TEE scores every answer), verify (anyone gets VERIFIED, REFUSED or CAN'T CERTIFY)" width="940">
+</picture>
+
+**seal → run → commit → close → check → verify.**
+1. **Seal:** the owner seals a Merkle root over the salted questions, and a policy (request template, settings, scorer, audit size), on the NEAR registry.
+2. **Run:** each answer comes from NEAR AI Cloud, signed by the model's TEE key.
+3. **Commit:** the owner commits each run's root and total.
+4. **Close:** no more runs can join the round.
+5. **Check:** a future NEAR block picks a sample to reveal, or a TEE on OutLayer scores every answer.
+6. **Verify:** anyone rebuilds everything from the chain and the certificate, and gets one of three outcomes: **VERIFIED**; **REFUSED** with a reason code, when the evidence is wrong; or **CAN'T CERTIFY**, when evidence is missing or unsupported or a service didn't answer. An outage never decides a verdict.
+
+The rounds come in three kinds, each a trade-off:
+
+| | Sampled (`fuin seal`) | TEE-scored (`fuin seal --tee`) | Asked once (`fuin seal --ask`) |
+|---|---|---|---|
+| Questions revealed | a sample, picked by a future NEAR block | none | none |
+| Who calls the model | the owner | the owner | a TEE, once per question, after the seal |
+| How scores are checked | anyone re-scores the sample; a TEE re-scores every answer | a TEE re-scores every answer | the TEE scores each answer as it asks |
+| Can the owner re-ask a question and keep the best answer? | yes (a printed limit) | yes (a printed limit) | no: the TEE keeps one answer per question and counts any retry |
+| Models and token cap | all seven, 8,192 | all seven, 8,192 | fast models only, a smaller cap (DeepSeek-V4.1-Flash at 4,096) |
+| Rounds here | 1–3 | 4–6 | 7 |
+
+Every step in detail, with the deployment trace, the answer-key check and end-to-end encryption: [docs/HOW-IT-WORKS.md](https://github.com/fexx301/fuin/blob/main/docs/HOW-IT-WORKS.md).
+
+## Result: which NEAR AI Cloud model answers NEAR developer questions correctly?
+
+Seven rounds of private questions, each answer cited to a line of [near/docs](https://github.com/near/docs) at commit `e2d2ea17`. They produced 20 certificates covering 2,302 answers from seven models. Every model ran with reasoning on and temperature 0. Every committed score was computed over every answer inside a TEE:
+
+| Round | Kind | Questions | Committed score |
+|---|---|---|---|
+| 7 | asked once, end-to-end encrypted, 4,096 tokens | 37 | DeepSeek-V4.1-Flash **19** |
+| 6 | TEE-scored, end-to-end encrypted | 96 | DeepSeek-V4.1-Flash abliterated **40** · DeepSeek-V4.1-Flash **38** · GLM-5.3-flash **33** · Qwen3.6-35B-A3B **22** · Qwen3.8-27B **22** · Qwen3.8-27B abliterated **21** · Qwen3-VL-30B-A3B **11** |
+| 5 | TEE-scored, end-to-end encrypted | 96 | DeepSeek-V4.1-Flash **48** · GLM-5.3-flash **42** · Qwen3.8-27B **27** |
+| 4 | TEE-scored | 155 | DeepSeek-V4.1-Flash **84** · GLM-5.3-flash **64** · Qwen3.8-27B **39** |
+| 3 | sampled, 28 revealed | 300 | GLM-5.3-flash **122** · Qwen3.8-27B **77** |
+| 2 | sampled, 23 revealed | 60 | GLM-5.3-flash **32** · Qwen3.8-27B **17** |
+| 1 | sampled, 23 revealed, 4,096 tokens | 60 | GLM-5.3-flash **25** · Qwen3.8-27B **17** |
+
+**What the scores show:**
+- Rounds 2–6 used 8,192 tokens.
+- DeepSeek-V4.1-Flash, in its base or abliterated version, leads rounds 4–6.
+- GLM-5.3-flash beats Qwen3.8-27B in all six rounds they share.
+- The rounds use different questions, so compare models within a round, not across rounds.
+
+**Answer keys:** in rounds 4–7, which reveal nothing, a TEE checked each answer key against the near/docs line it cites. 374 of 384 appear there, and 10 are flagged as unchecked.
+
+**More detail:**
+- [docs/RESULTS.md](https://github.com/fexx301/fuin/blob/main/docs/RESULTS.md): the full table (served builds, revealed breakdowns, cut-offs), what each round disclosed, and how disclosure shrinks as suites grow.
+- `evidence/*/README.md`: the transactions for every round.
+
+## For judges
+
+**Quick check (about 2 minutes once dependencies are installed; the first `uv sync` can take 10 minutes on a slow connection; needs [uv](https://docs.astral.sh/uv/) and network, no account or API key):**
+
+```sh
+git clone https://github.com/fexx301/fuin && cd fuin
+uv sync                                    # first run downloads the dependencies
+env -u NEARAI_API_KEY uv run fuin verify examples/cert-near-dev-96-r6-deepseek-v4.1-flash-1017.json   # about 1 minute: VERIFIED, every check printed
+uv run pytest -q                           # 5 seconds, offline: 157 passed
+uv run python scripts/check_fixtures.py examples/tampered/manifest.json   # optional, about 4 minutes: 39 ok lines
+```
+
+CAN'T CERTIFY with `evidence_unavailable` means a public service (NEAR's RPC, Intel or NVIDIA) didn't answer, not that the certificate is wrong: run the same command again.
+
+**Full review (optional):**
+- Run `scripts/review.sh` in the background. It takes about 30 minutes (allow 45).
+- It waits on Intel, NVIDIA, NEAR, OutLayer, GitHub and Docker Hub, and retries when a public service rate-limits it.
+- It exits 0 with `ALL CHECKS PASSED`.
+- `AGENTS.md` lists the exit codes, what not to run and where the evidence lives.
+
+Every claim maps to a command:
+
+| Claim | Check | Expected |
+|---|---|---|
+| A stranger can verify a result without an account or the test set | `env -u NEARAI_API_KEY uv run fuin verify examples/cert-near-dev-60-r1-qwen3.8-27b.json` | `VERIFIED`, 10 `[pass]` lines, exit 0 |
+| Each answer is signed by the model's TEE-attested key | same output, `signatures` and `attestation` lines | `60/60 provider_tee …`; `quote UpToDate, NRAS True` |
+| The served container and weights are traced to NEAR's public deployment repo | same output, `deployment trace` line | `… nearai/cvm-compose-files: model-sg-qwen38-27b-fp8-tp1-coloc …` |
+| The set and results were committed on NEAR, with the seal before the commit and the commit before the close | same output, `registry` line | `seal … < commit … < close …` |
+| The owner can't choose which items a committed round reveals | same output, `audit sample` line; fixture `changed-audit` | `first final block ≥ close+2`; `REFUSED audit_sample_mismatch` |
+| Tampering is refused with a specific reason | `uv run python scripts/check_fixtures.py examples/tampered/manifest.json` | 39 `ok` lines, exit 0 |
+| Round 3's totals were re-scored over every answer inside a TEE, not only the sample | `env -u NEARAI_API_KEY uv run fuin verify examples/cert-near-dev-300-r3-glm-5.3-flash.json` | `[pass] tee score: all 300 items rebuilt and re-scored inside an OutLayer TDX enclave … total 122/300 and both roots match` |
+| A round can reveal nothing and still be checked, with no answer predating its seal | `env -u NEARAI_API_KEY uv run fuin verify examples/cert-near-dev-155-r4-deepseek-v4.1-flash-1017.json` | `VERIFIED`; `[pass] reveals: none: a TEE-scored round reveals nothing …`; `[pass] tee score: all 155 items rebuilt and re-scored …: total 84/155 …`; fixtures `zero-reveal-unscored`, `zero-reveal-scorer-swapped` |
+| A zero-reveal round's answer keys appear in the docs line they cite (a string match, not a check that the key is the right answer) | `env -u NEARAI_API_KEY uv run fuin verify examples/cert-near-dev-96-r6-glm-5.3-flash.json` | `[pass] answer keys: 92/96 answer keys appear in their cited line of near/docs at e2d2ea17, checked inside an OutLayer TDX enclave …; 4 flagged, not checked …: items 14, 35, 46, 94`; fixtures `ground-other-round`, `ground-hidden-flag`, `ground-fork-commit`, `ground-unpinned-build` |
+| Each answer was asked once, by a TEE, not by the owner (no re-asking to keep the best answer) | `env -u NEARAI_API_KEY uv run fuin verify examples/cert-near-dev-37-r7-deepseek-v4.1-flash-1017.json` | `VERIFIED`; `[pass] asked once: all 37 answers asked once inside an OutLayer TDX enclave by asker dbbb286b744c… in ask.fuin.testnet/asker … 1 retried ask … every request rebuilt with the seal block's hash … equals the signed one, so every ask came after the seal … ask.fuin.testnet/asker was locked at the seal …`; fixtures `asked-unscored`, `asked-unchecked`, `asked-other-project`, `asked-total-edited`, `asked-check-edited`, `asked-hidden-retry` |
+| Questions and answers can stay end-to-end encrypted, so NEAR's gateway never sees them | `env -u NEARAI_API_KEY uv run fuin verify examples/cert-near-dev-96-r5-glm-5.3-flash.json` | `VERIFIED`; the policy line ends `fuin-request-v3 (end-to-end encrypted)`, and the limits print the end-to-end-encryption line; probe: `evidence/2026-11-05-e2ee-probe/` |
+| The TEE scorer that ran is this repository's code | `tee/build-docker.sh` (any host with Docker; about 1.5 minutes once the image is pulled) | prints `b301d22b…`, the current pin in `policy/tee-v2.json` (scorer v9: scores as v7, grounds answer keys, runs the asked-check); `ask/build-docker.sh aaa2083` prints `dbbb286b…`, the asker locked in `ask.fuin.testnet/asker`. The earlier accepted builds rebuild the same way from their recorded commits: v8 `bb0d9a5d…` (round 7's grounding, `39a2da3`), v7 `acd9286f…` (groundings of rounds 4–6, `58523c7`), v2 `dabae968…` (rounds 1–4, `6381ee9`), v3 `2614ddaa…` (round 5, `907aec0`), v4 `cd36c486…` (the v4 rehearsal, `54a5b6e`), v5 `86db8213…` (`170c488`), v6 `67c2292e…` (round 6, `6b0705c`) |
+| The registry's code can't be replaced (its seal and commit values are also checked against the owner's signed transactions) | `curl -s https://archival-rpc.testnet.fastnear.com -H 'Content-Type: application/json' -d '{"jsonrpc":"2.0","id":1,"method":"query","params":{"request_type":"view_access_key_list","finality":"final","account_id":"registry.fuin.testnet"}}'` | `"keys":[]` |
+
+## Try it (no account, no API key, no test set)
+
+You need uv and network access to these services:
+- Intel PCS;
+- NVIDIA NRAS;
+- an archival NEAR testnet RPC (FastNEAR's by default; set `FUIN_TESTNET_RPC` to pin another);
+- the NEAR AI model catalog;
+- raw.githubusercontent.com;
+- Docker Hub.
+
+One verification takes about 40 seconds.
+
+1. **Verify a real certificate:** `env -u NEARAI_API_KEY uv run fuin verify examples/cert-near-dev-60-r1-qwen3.8-27b.json`.
+   - You see `VERIFIED` with ten passing checks: rows, commitments, policy, signatures, reveals, attestation, deployment trace, registry, audit sample and TEE score.
+   - It also prints the scope line, the warnings and the limits that apply.
+   - The other 19 certificates in `examples/` verify the same way.
+2. **Watch tampering get refused:** `uv run python scripts/check_fixtures.py examples/tampered/manifest.json` prints 39 `ok` lines.
+   - Each fixture is a real certificate with one change.
+   - 29 are REFUSED, 9 are CAN'T CERTIFY, and 1 tricky but valid one must stay VERIFIED.
+   - Each fixture and its expected verdict: [docs/REFUSALS.md](https://github.com/fexx301/fuin/blob/main/docs/REFUSALS.md).
+3. **Read an audit:** `uv run fuin show examples/cert-near-dev-60-r2-glm-5.3-flash.json --audit` prints each of the 23 revealed questions with its expected answer, docs source, what the model said and its score.
+4. **Run the tests:**
+   - `uv run pytest`: 157 offline tests.
+   - `cd contract && cargo test`: 15 tests.
+   - `cd tee && cargo test`: the TEE scorer against Python on 3,600 generated cases, plus signed synthetic rounds.
+5. **Try it in a browser:** open [fexx301.github.io/fuin](https://fexx301.github.io/fuin/), or `site/index.html` from the clone. The page verifies certificates in the browser and lets you tamper with one live. It runs every local check, the live NEAR and OutLayer checks, the Intel TDX quote and the deployment trace. NVIDIA's GPU verdict can't run in a browser, so a published certificate shows `fuin verify`'s recorded result for it, matched to its exact bytes, and an uploaded one gets PARTLY CHECKED.
+
+## NEAR tools used
+
+- **NEAR AI Cloud:**
+  - TEE-hosted open models through the gateway (`/v1/chat/completions` with `x-no-aliasing`);
+  - end-to-end encryption to the model's attested key (`X-Signing-Algo: ecdsa`, `X-Client-Pub-Key`, `X-Model-Pub-Key`);
+  - `provider_tee` response signatures (`/v1/signature`);
+  - model attestation reports (Intel TDX quote, NVIDIA GPU evidence, event log, compose-manager attestation);
+  - the public model catalog (`verifiable`, `attestationSupported`).
+- **NEAR testnet contract** [`registry.fuin.testnet`](https://testnet.nearblocks.io/address/registry.fuin.testnet) (Rust, near-sdk 5.30, built with cargo-near):
+  - methods: `seal`, `commit_run`, `close_round`, `get_benchmark`, `get_run`;
+  - records can't be overwritten, runs are numbered per model, and callers pay for their own storage;
+  - **the account has no access keys**, so its code (hash `HvqaWNNceCX7AMtsanPobAt5mkAE2MsZdP2BURA2cgef`) can't be replaced. The verifier checks this.
+- **OutLayer** (FastNEAR's verifiable off-chain compute on NEAR):
+  - `request_execution` on `outlayer.testnet` runs the TEE scorer in an Intel TDX enclave;
+  - an encryption key bound to the scorer's sha256 seals its private key;
+  - worker measurements are approved on `worker.outlayer.testnet`;
+  - the asker runs as the locked OutLayer project `ask.fuin.testnet/asker`, with sealed project storage and the owner's key stored as an OutLayer secret.
+- **FastFS** serves the TEE scorer binary from a NEAR testnet transaction.
+- **NEAR block hashes** serve as the audit seed and the seal-bound request nonce; reads go over JSON-RPC at `final` finality.
+- **near-cli-rs** signs the owner's transactions; keys stay in the OS keychain.
+
+## Use it
+
+```sh
+pip install fuin            # or: uv tool install fuin
+fuin verify cert.json       # VERIFIED, REFUSED or CAN'T CERTIFY, with every check printed
+```
+
+- **In CI:** a GitHub Action (`uses: fexx301/fuin@main`) fails the step unless every certificate is VERIFIED.
+- **Your own private round** (`fuin check`, `seal`, `run`, `commit`, `close`, `reveal`, `tee-score`, `ask`): see [docs/USE.md](https://github.com/fexx301/fuin/blob/main/docs/USE.md).
+- **A second person trying it:** [PILOT.md](https://github.com/fexx301/fuin/blob/main/PILOT.md) is a step-by-step kit. A fellow builder ran it unmodified on Windows 11 under WSL2.
+
+## Limits
+
+Every VERIFIED prints the limits that apply to its certificate. In short:
+
+- Scores are checked on the revealed sample, and on every answer through the TEE score. The TEE score trusts Intel TDX, OutLayer's worker approvals and its key service.
+- In a round that reveals nothing, only the owner can see the questions. Answer keys are checked only against the docs line they cite, which doesn't prove a key is the right answer.
+- In rounds 1–6 an owner could re-ask a sealed question and commit the best signed answer, and no certificate could show it. In round 7 a TEE asked each question itself and kept one answer; a retry (one in round 7) is counted, and a single draw per item could differ from the total by at most that count. This rests on OutLayer's storage not being rolled back.
+- Instances of a model can share a signing key, so a signature doesn't identify the serving instance. Accepted configurations are recorded from NEAR's attested reports, not rebuilt from source.
+- Verification is account-free but not offline: it needs the public services listed under [Try it](#try-it-no-account-no-api-key-no-test-set).
+
+The full list, word for word as printed: [docs/LIMITS.md](https://github.com/fexx301/fuin/blob/main/docs/LIMITS.md).
+
+## Repository
+
+| Path | What |
+|---|---|
+| `src/fuin/` | the `fuin` command: owner workflow and verifier ([map](https://github.com/fexx301/fuin/blob/main/docs/ARCHITECTURE.md)) |
+| `contract/` | the registry contract and its tests |
+| `tee/` | the TEE scorer (Rust, WASI P2) and its reproducible build `tee/build-docker.sh` |
+| `ask/` | the asker, run as the locked OutLayer project `ask.fuin.testnet/asker`; reproducible build `ask/build-docker.sh` |
+| `policy/` | what the verifier accepts: attestation policies, the pinned scorer and asker builds (`tee-v2.json`), sigstore's trust root |
+| `site/` | the browser verifier and results page (`verify.js` must agree with the Python verifier on every certificate and fixture) |
+| `examples/` | the 20 real certificates; `tampered/` fixtures and their manifest |
+| `evidence/` | dated command output, transactions and write-ups behind every claim |
+| `docs/` | [how it works](https://github.com/fexx301/fuin/blob/main/docs/HOW-IT-WORKS.md), [results](https://github.com/fexx301/fuin/blob/main/docs/RESULTS.md), [refusals](https://github.com/fexx301/fuin/blob/main/docs/REFUSALS.md), [limits](https://github.com/fexx301/fuin/blob/main/docs/LIMITS.md), [use](https://github.com/fexx301/fuin/blob/main/docs/USE.md), [architecture](https://github.com/fexx301/fuin/blob/main/docs/ARCHITECTURE.md), [costs and dependencies](https://github.com/fexx301/fuin/blob/main/docs/COSTS-AND-DEPENDENCIES.md) |
+
+Running and fixing it: [MAINTAINING.md](https://github.com/fexx301/fuin/blob/main/MAINTAINING.md). Changes: [CHANGELOG.md](https://github.com/fexx301/fuin/blob/main/CHANGELOG.md). MIT licence.

fuin-1.0.0/README.md

@@ -0,0 +1,204 @@
+# Fūin
+
+Fūin (封印, pronounced *foo-een*) is Japanese for "seal": the test set is sealed on NEAR before any result is committed.
+
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/fexx301/fuin/main/assets/fuin-logo-dark.svg">
+  <img src="https://raw.githubusercontent.com/fexx301/fuin/main/assets/fuin-logo.svg" alt="Fūin logo" width="320">
+</picture>
+
+Fūin publishes a private benchmark result that a stranger can check **without an account and without the test set**. Every answer carries a signature from the model's attested TEE key on NEAR AI Cloud, the set and results are committed on NEAR, and every answer is scored inside a TEE on OutLayer. A round can also reveal a sample picked by a future NEAR block, or reveal nothing at all. In round 7 a TEE made every model call itself and recorded one answer per question and counted every retry (round 7 had one), so no owner could quietly re-ask and keep the best answer.
+
+Built at NEAR HACKATHON (Nov 1–14, 2026), tracks `privacy` and `open`.
+
+![The browser verifier refusing a real round-3 certificate whose revealed answer was edited after signing: REFUSED signature_text_mismatch](https://raw.githubusercontent.com/fexx301/fuin/main/assets/verify-refused.png)
+
+*The browser verifier on a real round-3 certificate after "Edit an answer": the checks pass until the revealed sample is re-scored, where the edited answer no longer matches what the model signed.*
+
+## The problem
+
+A benchmark owner has two bad options:
+
+- **Publish the test set.** It leaks into the next model's training data, and the benchmark stops measuring anything.
+- **Keep it private.** Then everyone has to take the owner's word for the scores: which model ran, whether answers were edited, and whether the grading was honest.
+
+Fūin is a third option. The owner keeps the questions private. Anyone can check that the published score came from real, unedited answers by a named model running in a TEE, committed before any sample was drawn, and scored correctly against the owner's sealed answer key, over every answer. Whether the questions are any good stays with the owner. Private eval sets are already in use: NEAR's Delta League, for example, ranks fine-tuned models on one ([Illia Polosukhin, Nov 6, 2026](https://x.com/ilblackdragon/status/2118591003368296561)). Fūin certifies models that NEAR AI Cloud serves in an attested TEE, so certifying fine-tuned submissions like those would need them served the same way.
+
+## How it works
+
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/fexx301/fuin/main/assets/fuin-flow-dark.svg">
+  <img src="https://raw.githubusercontent.com/fexx301/fuin/main/assets/fuin-flow.svg" alt="The six steps of a Fūin round: seal on NEAR, run (the model in a TEE signs each answer), commit on NEAR, close, check (a future block picks a sample, or a TEE scores every answer), verify (anyone gets VERIFIED, REFUSED or CAN'T CERTIFY)" width="940">
+</picture>
+
+**seal → run → commit → close → check → verify.**
+1. **Seal:** the owner seals a Merkle root over the salted questions, and a policy (request template, settings, scorer, audit size), on the NEAR registry.
+2. **Run:** each answer comes from NEAR AI Cloud, signed by the model's TEE key.
+3. **Commit:** the owner commits each run's root and total.
+4. **Close:** no more runs can join the round.
+5. **Check:** a future NEAR block picks a sample to reveal, or a TEE on OutLayer scores every answer.
+6. **Verify:** anyone rebuilds everything from the chain and the certificate, and gets one of three outcomes: **VERIFIED**; **REFUSED** with a reason code, when the evidence is wrong; or **CAN'T CERTIFY**, when evidence is missing or unsupported or a service didn't answer. An outage never decides a verdict.
+
+The rounds come in three kinds, each a trade-off:
+
+| | Sampled (`fuin seal`) | TEE-scored (`fuin seal --tee`) | Asked once (`fuin seal --ask`) |
+|---|---|---|---|
+| Questions revealed | a sample, picked by a future NEAR block | none | none |
+| Who calls the model | the owner | the owner | a TEE, once per question, after the seal |
+| How scores are checked | anyone re-scores the sample; a TEE re-scores every answer | a TEE re-scores every answer | the TEE scores each answer as it asks |
+| Can the owner re-ask a question and keep the best answer? | yes (a printed limit) | yes (a printed limit) | no: the TEE keeps one answer per question and counts any retry |
+| Models and token cap | all seven, 8,192 | all seven, 8,192 | fast models only, a smaller cap (DeepSeek-V4.1-Flash at 4,096) |
+| Rounds here | 1–3 | 4–6 | 7 |
+
+Every step in detail, with the deployment trace, the answer-key check and end-to-end encryption: [docs/HOW-IT-WORKS.md](https://github.com/fexx301/fuin/blob/main/docs/HOW-IT-WORKS.md).
+
+## Result: which NEAR AI Cloud model answers NEAR developer questions correctly?
+
+Seven rounds of private questions, each answer cited to a line of [near/docs](https://github.com/near/docs) at commit `e2d2ea17`. They produced 20 certificates covering 2,302 answers from seven models. Every model ran with reasoning on and temperature 0. Every committed score was computed over every answer inside a TEE:
+
+| Round | Kind | Questions | Committed score |
+|---|---|---|---|
+| 7 | asked once, end-to-end encrypted, 4,096 tokens | 37 | DeepSeek-V4.1-Flash **19** |
+| 6 | TEE-scored, end-to-end encrypted | 96 | DeepSeek-V4.1-Flash abliterated **40** · DeepSeek-V4.1-Flash **38** · GLM-5.3-flash **33** · Qwen3.6-35B-A3B **22** · Qwen3.8-27B **22** · Qwen3.8-27B abliterated **21** · Qwen3-VL-30B-A3B **11** |
+| 5 | TEE-scored, end-to-end encrypted | 96 | DeepSeek-V4.1-Flash **48** · GLM-5.3-flash **42** · Qwen3.8-27B **27** |
+| 4 | TEE-scored | 155 | DeepSeek-V4.1-Flash **84** · GLM-5.3-flash **64** · Qwen3.8-27B **39** |
+| 3 | sampled, 28 revealed | 300 | GLM-5.3-flash **122** · Qwen3.8-27B **77** |
+| 2 | sampled, 23 revealed | 60 | GLM-5.3-flash **32** · Qwen3.8-27B **17** |
+| 1 | sampled, 23 revealed, 4,096 tokens | 60 | GLM-5.3-flash **25** · Qwen3.8-27B **17** |
+
+**What the scores show:**
+- Rounds 2–6 used 8,192 tokens.
+- DeepSeek-V4.1-Flash, in its base or abliterated version, leads rounds 4–6.
+- GLM-5.3-flash beats Qwen3.8-27B in all six rounds they share.
+- The rounds use different questions, so compare models within a round, not across rounds.
+
+**Answer keys:** in rounds 4–7, which reveal nothing, a TEE checked each answer key against the near/docs line it cites. 374 of 384 appear there, and 10 are flagged as unchecked.
+
+**More detail:**
+- [docs/RESULTS.md](https://github.com/fexx301/fuin/blob/main/docs/RESULTS.md): the full table (served builds, revealed breakdowns, cut-offs), what each round disclosed, and how disclosure shrinks as suites grow.
+- `evidence/*/README.md`: the transactions for every round.
+
+## For judges
+
+**Quick check (about 2 minutes once dependencies are installed; the first `uv sync` can take 10 minutes on a slow connection; needs [uv](https://docs.astral.sh/uv/) and network, no account or API key):**
+
+```sh
+git clone https://github.com/fexx301/fuin && cd fuin
+uv sync                                    # first run downloads the dependencies
+env -u NEARAI_API_KEY uv run fuin verify examples/cert-near-dev-96-r6-deepseek-v4.1-flash-1017.json   # about 1 minute: VERIFIED, every check printed
+uv run pytest -q                           # 5 seconds, offline: 157 passed
+uv run python scripts/check_fixtures.py examples/tampered/manifest.json   # optional, about 4 minutes: 39 ok lines
+```
+
+CAN'T CERTIFY with `evidence_unavailable` means a public service (NEAR's RPC, Intel or NVIDIA) didn't answer, not that the certificate is wrong: run the same command again.
+
+**Full review (optional):**
+- Run `scripts/review.sh` in the background. It takes about 30 minutes (allow 45).
+- It waits on Intel, NVIDIA, NEAR, OutLayer, GitHub and Docker Hub, and retries when a public service rate-limits it.
+- It exits 0 with `ALL CHECKS PASSED`.
+- `AGENTS.md` lists the exit codes, what not to run and where the evidence lives.
+
+Every claim maps to a command:
+
+| Claim | Check | Expected |
+|---|---|---|
+| A stranger can verify a result without an account or the test set | `env -u NEARAI_API_KEY uv run fuin verify examples/cert-near-dev-60-r1-qwen3.8-27b.json` | `VERIFIED`, 10 `[pass]` lines, exit 0 |
+| Each answer is signed by the model's TEE-attested key | same output, `signatures` and `attestation` lines | `60/60 provider_tee …`; `quote UpToDate, NRAS True` |
+| The served container and weights are traced to NEAR's public deployment repo | same output, `deployment trace` line | `… nearai/cvm-compose-files: model-sg-qwen38-27b-fp8-tp1-coloc …` |
+| The set and results were committed on NEAR, with the seal before the commit and the commit before the close | same output, `registry` line | `seal … < commit … < close …` |
+| The owner can't choose which items a committed round reveals | same output, `audit sample` line; fixture `changed-audit` | `first final block ≥ close+2`; `REFUSED audit_sample_mismatch` |
+| Tampering is refused with a specific reason | `uv run python scripts/check_fixtures.py examples/tampered/manifest.json` | 39 `ok` lines, exit 0 |
+| Round 3's totals were re-scored over every answer inside a TEE, not only the sample | `env -u NEARAI_API_KEY uv run fuin verify examples/cert-near-dev-300-r3-glm-5.3-flash.json` | `[pass] tee score: all 300 items rebuilt and re-scored inside an OutLayer TDX enclave … total 122/300 and both roots match` |
+| A round can reveal nothing and still be checked, with no answer predating its seal | `env -u NEARAI_API_KEY uv run fuin verify examples/cert-near-dev-155-r4-deepseek-v4.1-flash-1017.json` | `VERIFIED`; `[pass] reveals: none: a TEE-scored round reveals nothing …`; `[pass] tee score: all 155 items rebuilt and re-scored …: total 84/155 …`; fixtures `zero-reveal-unscored`, `zero-reveal-scorer-swapped` |
+| A zero-reveal round's answer keys appear in the docs line they cite (a string match, not a check that the key is the right answer) | `env -u NEARAI_API_KEY uv run fuin verify examples/cert-near-dev-96-r6-glm-5.3-flash.json` | `[pass] answer keys: 92/96 answer keys appear in their cited line of near/docs at e2d2ea17, checked inside an OutLayer TDX enclave …; 4 flagged, not checked …: items 14, 35, 46, 94`; fixtures `ground-other-round`, `ground-hidden-flag`, `ground-fork-commit`, `ground-unpinned-build` |
+| Each answer was asked once, by a TEE, not by the owner (no re-asking to keep the best answer) | `env -u NEARAI_API_KEY uv run fuin verify examples/cert-near-dev-37-r7-deepseek-v4.1-flash-1017.json` | `VERIFIED`; `[pass] asked once: all 37 answers asked once inside an OutLayer TDX enclave by asker dbbb286b744c… in ask.fuin.testnet/asker … 1 retried ask … every request rebuilt with the seal block's hash … equals the signed one, so every ask came after the seal … ask.fuin.testnet/asker was locked at the seal …`; fixtures `asked-unscored`, `asked-unchecked`, `asked-other-project`, `asked-total-edited`, `asked-check-edited`, `asked-hidden-retry` |
+| Questions and answers can stay end-to-end encrypted, so NEAR's gateway never sees them | `env -u NEARAI_API_KEY uv run fuin verify examples/cert-near-dev-96-r5-glm-5.3-flash.json` | `VERIFIED`; the policy line ends `fuin-request-v3 (end-to-end encrypted)`, and the limits print the end-to-end-encryption line; probe: `evidence/2026-11-05-e2ee-probe/` |
+| The TEE scorer that ran is this repository's code | `tee/build-docker.sh` (any host with Docker; about 1.5 minutes once the image is pulled) | prints `b301d22b…`, the current pin in `policy/tee-v2.json` (scorer v9: scores as v7, grounds answer keys, runs the asked-check); `ask/build-docker.sh aaa2083` prints `dbbb286b…`, the asker locked in `ask.fuin.testnet/asker`. The earlier accepted builds rebuild the same way from their recorded commits: v8 `bb0d9a5d…` (round 7's grounding, `39a2da3`), v7 `acd9286f…` (groundings of rounds 4–6, `58523c7`), v2 `dabae968…` (rounds 1–4, `6381ee9`), v3 `2614ddaa…` (round 5, `907aec0`), v4 `cd36c486…` (the v4 rehearsal, `54a5b6e`), v5 `86db8213…` (`170c488`), v6 `67c2292e…` (round 6, `6b0705c`) |
+| The registry's code can't be replaced (its seal and commit values are also checked against the owner's signed transactions) | `curl -s https://archival-rpc.testnet.fastnear.com -H 'Content-Type: application/json' -d '{"jsonrpc":"2.0","id":1,"method":"query","params":{"request_type":"view_access_key_list","finality":"final","account_id":"registry.fuin.testnet"}}'` | `"keys":[]` |
+
+## Try it (no account, no API key, no test set)
+
+You need uv and network access to these services:
+- Intel PCS;
+- NVIDIA NRAS;
+- an archival NEAR testnet RPC (FastNEAR's by default; set `FUIN_TESTNET_RPC` to pin another);
+- the NEAR AI model catalog;
+- raw.githubusercontent.com;
+- Docker Hub.
+
+One verification takes about 40 seconds.
+
+1. **Verify a real certificate:** `env -u NEARAI_API_KEY uv run fuin verify examples/cert-near-dev-60-r1-qwen3.8-27b.json`.
+   - You see `VERIFIED` with ten passing checks: rows, commitments, policy, signatures, reveals, attestation, deployment trace, registry, audit sample and TEE score.
+   - It also prints the scope line, the warnings and the limits that apply.
+   - The other 19 certificates in `examples/` verify the same way.
+2. **Watch tampering get refused:** `uv run python scripts/check_fixtures.py examples/tampered/manifest.json` prints 39 `ok` lines.
+   - Each fixture is a real certificate with one change.
+   - 29 are REFUSED, 9 are CAN'T CERTIFY, and 1 tricky but valid one must stay VERIFIED.
+   - Each fixture and its expected verdict: [docs/REFUSALS.md](https://github.com/fexx301/fuin/blob/main/docs/REFUSALS.md).
+3. **Read an audit:** `uv run fuin show examples/cert-near-dev-60-r2-glm-5.3-flash.json --audit` prints each of the 23 revealed questions with its expected answer, docs source, what the model said and its score.
+4. **Run the tests:**
+   - `uv run pytest`: 157 offline tests.
+   - `cd contract && cargo test`: 15 tests.
+   - `cd tee && cargo test`: the TEE scorer against Python on 3,600 generated cases, plus signed synthetic rounds.
+5. **Try it in a browser:** open [fexx301.github.io/fuin](https://fexx301.github.io/fuin/), or `site/index.html` from the clone. The page verifies certificates in the browser and lets you tamper with one live. It runs every local check, the live NEAR and OutLayer checks, the Intel TDX quote and the deployment trace. NVIDIA's GPU verdict can't run in a browser, so a published certificate shows `fuin verify`'s recorded result for it, matched to its exact bytes, and an uploaded one gets PARTLY CHECKED.
+
+## NEAR tools used
+
+- **NEAR AI Cloud:**
+  - TEE-hosted open models through the gateway (`/v1/chat/completions` with `x-no-aliasing`);
+  - end-to-end encryption to the model's attested key (`X-Signing-Algo: ecdsa`, `X-Client-Pub-Key`, `X-Model-Pub-Key`);
+  - `provider_tee` response signatures (`/v1/signature`);
+  - model attestation reports (Intel TDX quote, NVIDIA GPU evidence, event log, compose-manager attestation);
+  - the public model catalog (`verifiable`, `attestationSupported`).
+- **NEAR testnet contract** [`registry.fuin.testnet`](https://testnet.nearblocks.io/address/registry.fuin.testnet) (Rust, near-sdk 5.30, built with cargo-near):
+  - methods: `seal`, `commit_run`, `close_round`, `get_benchmark`, `get_run`;
+  - records can't be overwritten, runs are numbered per model, and callers pay for their own storage;
+  - **the account has no access keys**, so its code (hash `HvqaWNNceCX7AMtsanPobAt5mkAE2MsZdP2BURA2cgef`) can't be replaced. The verifier checks this.
+- **OutLayer** (FastNEAR's verifiable off-chain compute on NEAR):
+  - `request_execution` on `outlayer.testnet` runs the TEE scorer in an Intel TDX enclave;
+  - an encryption key bound to the scorer's sha256 seals its private key;
+  - worker measurements are approved on `worker.outlayer.testnet`;
+  - the asker runs as the locked OutLayer project `ask.fuin.testnet/asker`, with sealed project storage and the owner's key stored as an OutLayer secret.
+- **FastFS** serves the TEE scorer binary from a NEAR testnet transaction.
+- **NEAR block hashes** serve as the audit seed and the seal-bound request nonce; reads go over JSON-RPC at `final` finality.
+- **near-cli-rs** signs the owner's transactions; keys stay in the OS keychain.
+
+## Use it
+
+```sh
+pip install fuin            # or: uv tool install fuin
+fuin verify cert.json       # VERIFIED, REFUSED or CAN'T CERTIFY, with every check printed
+```
+
+- **In CI:** a GitHub Action (`uses: fexx301/fuin@main`) fails the step unless every certificate is VERIFIED.
+- **Your own private round** (`fuin check`, `seal`, `run`, `commit`, `close`, `reveal`, `tee-score`, `ask`): see [docs/USE.md](https://github.com/fexx301/fuin/blob/main/docs/USE.md).
+- **A second person trying it:** [PILOT.md](https://github.com/fexx301/fuin/blob/main/PILOT.md) is a step-by-step kit. A fellow builder ran it unmodified on Windows 11 under WSL2.
+
+## Limits
+
+Every VERIFIED prints the limits that apply to its certificate. In short:
+
+- Scores are checked on the revealed sample, and on every answer through the TEE score. The TEE score trusts Intel TDX, OutLayer's worker approvals and its key service.
+- In a round that reveals nothing, only the owner can see the questions. Answer keys are checked only against the docs line they cite, which doesn't prove a key is the right answer.
+- In rounds 1–6 an owner could re-ask a sealed question and commit the best signed answer, and no certificate could show it. In round 7 a TEE asked each question itself and kept one answer; a retry (one in round 7) is counted, and a single draw per item could differ from the total by at most that count. This rests on OutLayer's storage not being rolled back.
+- Instances of a model can share a signing key, so a signature doesn't identify the serving instance. Accepted configurations are recorded from NEAR's attested reports, not rebuilt from source.
+- Verification is account-free but not offline: it needs the public services listed under [Try it](#try-it-no-account-no-api-key-no-test-set).
+
+The full list, word for word as printed: [docs/LIMITS.md](https://github.com/fexx301/fuin/blob/main/docs/LIMITS.md).
+
+## Repository
+
+| Path | What |
+|---|---|
+| `src/fuin/` | the `fuin` command: owner workflow and verifier ([map](https://github.com/fexx301/fuin/blob/main/docs/ARCHITECTURE.md)) |
+| `contract/` | the registry contract and its tests |
+| `tee/` | the TEE scorer (Rust, WASI P2) and its reproducible build `tee/build-docker.sh` |
+| `ask/` | the asker, run as the locked OutLayer project `ask.fuin.testnet/asker`; reproducible build `ask/build-docker.sh` |
+| `policy/` | what the verifier accepts: attestation policies, the pinned scorer and asker builds (`tee-v2.json`), sigstore's trust root |
+| `site/` | the browser verifier and results page (`verify.js` must agree with the Python verifier on every certificate and fixture) |
+| `examples/` | the 20 real certificates; `tampered/` fixtures and their manifest |
+| `evidence/` | dated command output, transactions and write-ups behind every claim |
+| `docs/` | [how it works](https://github.com/fexx301/fuin/blob/main/docs/HOW-IT-WORKS.md), [results](https://github.com/fexx301/fuin/blob/main/docs/RESULTS.md), [refusals](https://github.com/fexx301/fuin/blob/main/docs/REFUSALS.md), [limits](https://github.com/fexx301/fuin/blob/main/docs/LIMITS.md), [use](https://github.com/fexx301/fuin/blob/main/docs/USE.md), [architecture](https://github.com/fexx301/fuin/blob/main/docs/ARCHITECTURE.md), [costs and dependencies](https://github.com/fexx301/fuin/blob/main/docs/COSTS-AND-DEPENDENCIES.md) |
+
+Running and fixing it: [MAINTAINING.md](https://github.com/fexx301/fuin/blob/main/MAINTAINING.md). Changes: [CHANGELOG.md](https://github.com/fexx301/fuin/blob/main/CHANGELOG.md). MIT licence.

fuin-1.0.0/evidence/2026-11-03-fixtures/README.md

@@ -0,0 +1,9 @@
+# Tamper fixtures
+
+`scripts/make_fixtures.py` writes one isolated mutation per file plus `examples/tampered/manifest.json`; `scripts/check_fixtures.py` verifies each in a fresh process and compares with the manifest. `check-output.txt` is the recorded run.
+
+**answer-hint** is a real round, not an edit: `scripts/make_hint_fixture.py` seals a 1-item fixture benchmark (a question outside every hidden suite), has the owner append the answer to the prompt, gets the model's signature on that hinted request, and commits it honestly on chain. Every check passes except the request rebuild → REFUSED `request_policy_mismatch`. Round: `fixture-answer-hint-2`.
+
+`fixture-answer-hint-1` (sealed, committed and closed on testnet, Nov 3) is an **unpublished** fixture round: its question turned out to be one of the hidden 60, so its certificate was deleted before any commit. The chain holds only its hashes.
+
+The first fixture set (12 mutations of the thin-path certificate; `check-output.txt`, all 12 matching) was removed with that certificate, because it carried the same reused facts. The fixtures are rebuilt from the 60-item round's Qwen certificate, whose reveals are that round's own audited sample.

fuin-1.0.0/evidence/2026-11-03-fresh-clone-rehearsal/README.md

@@ -0,0 +1,17 @@
+# Fresh-clone rehearsal, 2026-11-03
+
+`git clone https://github.com/fexx301/fuin` into an empty directory (at commit `c995dc3`), then `./scripts/review.sh` with `NEARAI_API_KEY` unset. Result: **ALL CHECKS PASSED** in 243 s on the builder's Mac (uv and Rust already installed):
+
+- both `examples/cert-near-dev-60-r1-*.json` VERIFIED;
+- 14/14 tamper fixtures with their expected verdicts;
+- 33 Python tests and 15 contract tests passed.
+
+**Not yet shown:** a fresh AI-agent session (Claude Code or Codex) given only the README, and a machine without uv or Rust preinstalled.
+
+## Re-run, 2026-11-04 (after the review fixes and round 2)
+
+Fresh clone at `9d68c4c`, `./scripts/review.sh` with no API key: **ALL CHECKS PASSED** in 234 s. All 4 certificates (2 models × 2 rounds) VERIFIED; 14/14 fixtures with their expected verdicts; 55 Python tests (including 21 offline hostile-input and outage tests) and 15 contract tests passed.
+
+## Re-run, 2026-11-04 (interactive page and in-browser verifier)
+
+Fresh clone at `8b2d232`, `./scripts/review.sh` with no API key: **ALL CHECKS PASSED** in 311 s on Node 24. Steps: 4 certificates VERIFIED; 14/14 fixtures; 55 Python and 15 contract tests; and the in-browser verifier (`site/verify.js`, run under Node) matching the CLI on all 20 cases. Those cases cover the 4 real certificates, 13 tamper and outage cases (including a forged TDX quote, an edited app_compose and an unapproved configuration that must not hide registry tampering) and scorer parity on all 92 revealed answers.

fuin-1.0.0/evidence/2026-11-03-provenance-probe/README.md

@@ -0,0 +1,20 @@
+# Image-provenance probe, 2026-11-03 (timebox 2 h; took about 1 h)
+
+**Question:** the accepted `compose_hash` pins NEAR's compose-manager launcher, not the model containers. Can a stranger tie a signed answer to the container and weights that actually served it?
+
+**Finding: the deployment can be traced; the container's build provenance is not checked.**
+
+1. Each model report carries `compose_manager_attestation`: a second TDX quote whose report data is `sha256(canonical action log) ‖ client nonce`. The log is canonical JSON (sorted keys, compact), as defined by `canonicalize_actions` in the public [nearai/compose-manager](https://github.com/nearai/compose-manager) `src/main.rs`. `fuin` recomputes the hash, checks the nonce, verifies the quote, and requires the same MRCONFIGID and RTMR3 as the model's own quote (same CVM).
+2. The measured `app_compose` pins `GITHUB_REPO=https://github.com/nearai/cvm-compose-files` as a literal, not an overridable variable. Each `compose_up` in the log names a tag, a commit, a compose file and the file's sha256.
+3. `fuin` replays the log to find which services are up, fetches each compose file at its logged commit from the public repo, checks the sha256, and reads every service that declares `--served-model-name <model>`.
+
+Result on the `near-dev-60-r1` certificates (every file's sha256 matched):
+
+| Model | Serving service(s) | Tag / file | Weights |
+|---|---|---|---|
+| Qwen/Qwen3.8-27B | `model-sg-qwen38-27b-fp8-tp1-coloc` | v0.0.539 `prod/small-models.yaml` | `Qwen/Qwen3.8-27B-FP8` rev `017b9c7a…` |
+| z-ai/glm-5.3-flash | `model-sg-glm53-w4afp8-tp2-r1`…`r4` | v0.0.521 `prod/GLM-5.3-Flash-SGL-TP2x4-W4AFP8-*.yaml` | `graphistry/GLM-5.3-Flash-W4AFP8` snapshot `99f1fa70…` |
+
+So the scores describe NEAR's deployed **quantized** weights (FP8; a W4AFP8 build), not the full-precision checkpoints that public benchmark tables usually report.
+
+**Not covered:** the images' build provenance (cosign/SLSA attestations named in NEAR's compose README). Checking it needs tooling outside this verifier, so it stays a printed limit, and the trace does not gate the verdict (the spec gates only on verified image provenance). Contradictory trace evidence (hash, nonce, quote or file mismatch) is REFUSED `attestation_invalid` (fixture `edited-deployment-log`); an unavailable trace is a warning.

fuin-1.0.0/evidence/2026-11-03-round-near-dev-60-r1/README.md

@@ -0,0 +1,23 @@
+# Round `near-dev-60-r1`, 2026-11-03
+
+60 hidden NEAR-developer questions, each answer cited to a line of near/docs at commit e2d2ea17 (checked by `scripts/check_suite_sources.py`, 60/60). The suite is not in this repo; only the audited sample is revealed. Models: Qwen/Qwen3.8-27B and z-ai/glm-5.3-flash, both with `max_tokens` 4096, temperature 0, reasoning on (GLM cannot turn it off). Scorer `fuin-scorer-v2` (strict: the answer must be the number or term alone). Owner `fuin.testnet`; registry `registry.fuin.testnet` (locked: 0 access keys).
+
+| Step | Transaction | Height |
+|---|---|---|
+| seal (n=60, D=6, k=23) | [GyvMjM5JvGKCaJR4PHdpTSp9shBFhWFNJ7z7Xr2tAaTF](https://testnet.nearblocks.io/txns/GyvMjM5JvGKCaJR4PHdpTSp9shBFhWFNJ7z7Xr2tAaTF) | 276079270 |
+| commit_run Qwen3.8-27B, run 0: **17/60** | [9UTrvDF5hGPkNK8gVaGUEFV8wkUtcRYPzmtvvietrLYS](https://testnet.nearblocks.io/txns/9UTrvDF5hGPkNK8gVaGUEFV8wkUtcRYPzmtvvietrLYS) | 276088479 |
+| commit_run glm-5.3-flash, run 0: **25/60** | [Dn2wWnsX2aAyXKZvu12LDXScEV5EMToxYQ2k2AMggZxL](https://testnet.nearblocks.io/txns/Dn2wWnsX2aAyXKZvu12LDXScEV5EMToxYQ2k2AMggZxL) | 276088494 |
+| close_round | [6vqe9Q8q3u4WDrhhQwPRB4taPp4k8iKL1zB9sHiWS8GL](https://testnet.nearblocks.io/txns/6vqe9Q8q3u4WDrhhQwPRB4taPp4k8iKL1zB9sHiWS8GL) | 276088507 |
+
+Seed block 276088509 (first final block ≥ close+2). Both certificates reveal the same 23 items.
+
+| Model | Committed score | Answers cut off at the 4096-token cap (scored 0) | Owner-reported retries |
+|---|---|---|---|
+| Qwen3.8-27B | 17/60 | 17 | 1 |
+| glm-5.3-flash | 25/60 | 21 | 1 |
+
+Read the scores with the cap counts: a cut-off answer scores 0 whatever the model knew. The cap was sealed before the run and applies to both models.
+
+**Disclosure:** 23 items are revealed by the audit. One more unrevealed item (index 17) cites the same docs line as revealed items 16 and 18, and its answer follows from theirs, so it is counted as disclosed: **24 disclosed, 36 hidden**. The thin-path questions, whose facts recur in this suite, are withheld from the repo (see `../2026-11-03-thin-path/`).
+
+`verify-output.txt`: `env -u NEARAI_API_KEY uv run fuin verify …` on both certificates → VERIFIED, exit 0.

fuin-1.0.0/evidence/2026-11-03-testnet-deploy/README.md

@@ -0,0 +1,23 @@
+# Registry deployment, NEAR testnet, 2026-11-03
+
+| Step | Transaction |
+|---|---|
+| Create `fuin.testnet` (faucet) | [CnEzSoNsYVQkQk5bKK2Xk5Ye2sAuDSzEQFK8s5FCYGSh](https://testnet.nearblocks.io/txns/CnEzSoNsYVQkQk5bKK2Xk5Ye2sAuDSzEQFK8s5FCYGSh) |
+| Create `registry.fuin.testnet` (3 NEAR) | [6fUy8zfnfWxHxxLkNVBbr4hYWEZL2aFSgy699CFhftoh](https://testnet.nearblocks.io/txns/6fUy8zfnfWxHxxLkNVBbr4hYWEZL2aFSgy699CFhftoh) |
+| Deploy `contract/` + `new()` | [FJGqyUNVYpecHBrKgWdPyJLHvVrS3fH9VqZhQvRuiw7w](https://testnet.nearblocks.io/txns/FJGqyUNVYpecHBrKgWdPyJLHvVrS3fH9VqZhQvRuiw7w) |
+
+- Build: `cd contract && cargo near build non-reproducible-wasm` (cargo-near 0.22.0, rustc 1.95.0) → `fuin_registry.wasm`, sha256 `cbf03d1cf90160c803da8f30b5f08e27270c7ca46a25a3d43c2a9a2a2f89b1b9`.
+- On-chain `code_hash` (base58 sha256): `Ej6EQ3yyVPL9xNLdvpZJaJWUYnyrx6T7Gw67kwTkH8BA` — matches the local build.
+- Access keys: one full-access key is **still held** on `registry.fuin.testnet`, so the code can still be replaced. It is deleted before the first real sealed run; until then, records here are not append-only guaranteed.
+
+## Redeploy, 2026-11-03: storage paid by callers
+
+Before this change anyone could call `seal` repeatedly and the registry paid the storage from its own balance; an owner could append runs without limit. Now `seal`, `commit_run` and `close_round` are payable: each call pays for the bytes it adds (`env::storage_byte_cost`), excess is refunded, and a benchmark holds at most 32 runs. The stored layout is unchanged, so the existing round reads as before.
+
+- Redeploy (same account, no init): [A5pqvHDFJL5AtX6nQogeyhnfePJdZn6JULLyHT8NWEqb](https://testnet.nearblocks.io/txns/A5pqvHDFJL5AtX6nQogeyhnfePJdZn6JULLyHT8NWEqb). wasm sha256 `fb85b35fa74cce30800098ff3ee1660e29e4eafb52a755203a49136027bb99ac`; on-chain `code_hash` `HvqaWNNceCX7AMtsanPobAt5mkAE2MsZdP2BURA2cgef` matches the local build. The verifier now pins this hash.
+- On-chain check: `seal` with 0 NEAR attached → `Smart contract panicked: attach at least 2740000000000000000000 yoctoNEAR to pay for 274 bytes of storage`. With 0.05 NEAR attached → sealed (`storage-check-1`, [8Dco3LWZotocaUd4xmXQ8fkPhSCZELPCr4pjssa3Uyrt](https://testnet.nearblocks.io/txns/8Dco3LWZotocaUd4xmXQ8fkPhSCZELPCr4pjssa3Uyrt)); the caller spent ≈0.003 NEAR including gas, and the rest was refunded. `storage-check-1` is a test record, not a benchmark.
+- The thin-path round (`near-dev-thin-1`) was sealed under the previous code. Its certificate was re-revealed so its registry field carries the new pinned hash; the seed, sample and reveals are unchanged (a one-line diff), and it still verifies. That this was possible is the disclosed consequence of the full-access key still being held.
+
+## Registry locked, 2026-11-03
+
+At the user's go-ahead, the only full-access key on `registry.fuin.testnet` was deleted: [BSzPeYQaLQeuyqBD1P1KZR1EVB8Kc57RRUQphVFchep7](https://testnet.nearblocks.io/txns/BSzPeYQaLQeuyqBD1P1KZR1EVB8Kc57RRUQphVFchep7). `view_access_key_list` now returns 0 keys, so the code (hash `HvqaWNNceCX7AMtsanPobAt5mkAE2MsZdP2BURA2cgef`) can no longer be replaced and the contract has no admin or upgrade methods. Records written from here on are append-only. The verifier checks the key count and warns if a registry still has a key. The thin-path round was sealed before the lock; its history is as disclosed above.

fuin-1.0.0/evidence/2026-11-03-thin-path/README.md

@@ -0,0 +1,13 @@
+# Thin path, 2026-11-03 (one model, 5 items, all revealed)
+
+Suite: 5 NEAR-developer questions, answers pinned to near/docs commit e2d2ea17. **The questions, the certificate and the fixtures built from it are withheld from this repo** (removed from its history on Nov 3): the same facts were reused in the hidden 60-item round `near-dev-60-r1`, so publishing them would disclose hidden items. The transactions and verify output below contain no question text. Owner `fuin.testnet`, registry `registry.fuin.testnet`.
+
+| Step | Transaction | Execution height |
+|---|---|---|
+| seal | [5tUABH68SfnZrYgtVVd53TmQSY9QmWm6of5GsuYF336B](https://testnet.nearblocks.io/txns/5tUABH68SfnZrYgtVVd53TmQSY9QmWm6of5GsuYF336B) | 276073537 |
+| commit_run (Qwen/Qwen3.8-27B, run 0, 2/5) | [3mF17GaExqBrhDLkAt1vJBgM3Z2DfUQemfzgRw7R8BbR](https://testnet.nearblocks.io/txns/3mF17GaExqBrhDLkAt1vJBgM3Z2DfUQemfzgRw7R8BbR) | 276073620 |
+| close_round | [8e1QCYLDRgFqdf3xDkrvzr3vhqB6Lv5AcJRrAG8F7ZX4](https://testnet.nearblocks.io/txns/8e1QCYLDRgFqdf3xDkrvzr3vhqB6Lv5AcJRrAG8F7ZX4) | 276073646 |
+
+Seed block 276073648. `env -u NEARAI_API_KEY uv run fuin verify …` output, recorded before the certificate was withheld: `verify-output.txt` (real cert VERIFIED; an edited-answer copy REFUSED `signature_text_mismatch`).
+
+Not shown by this run: keeping part of the set hidden (all 5 revealed), a second model, the other refusal fixtures. The registry's full-access key was still held at the time, so its code could have been replaced.