nvdc 0.2.1__tar.gz → 0.2.2__tar.gz

{nvdc-0.2.1 → nvdc-0.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: nvdc
-Version: 0.2.1
+Version: 0.2.2
 Summary: Bring your GPU onto the network: one command turns a GPU into a verifiable, OpenAI-compatible inference node.
 Author: NVDC
 License: Apache-2.0
@@ -150,6 +150,16 @@ Attestation is a first-class, pluggable component (`nvdc/attestation.py`):
 A coordinator can enforce policy with `--require-attested` to only route work to
 nodes whose attestation verifies.
 
+**Model identity** is attested separately from hardware. Every node publishes a
+content-addressed commitment of the artifact it serves (the Ollama manifest
+digest) and signs it into each work receipt (`nvdc-work-v2`). The coordinator
+independently checks the claim against `registry.ollama.ai` and surfaces a
+verdict (`verified` / `mismatch` / `unknown`) per node and per receipt;
+`--require-verified-models` restricts routing to verified artifacts. Without a
+TEE this cannot *prove* which bytes ran — what it guarantees is that a node
+claiming one model while serving another has signed a non-repudiable false
+statement that contradicts public ground truth.
+
 > Note: the DGX Spark / GB10 cannot produce hardware attestation (NVIDIA disabled
 > CC on this SKU). It serves inference fine; it just joins as an unattested node.
 

{nvdc-0.2.1 → nvdc-0.2.2}/README.md

@@ -128,6 +128,16 @@ Attestation is a first-class, pluggable component (`nvdc/attestation.py`):
 A coordinator can enforce policy with `--require-attested` to only route work to
 nodes whose attestation verifies.
 
+**Model identity** is attested separately from hardware. Every node publishes a
+content-addressed commitment of the artifact it serves (the Ollama manifest
+digest) and signs it into each work receipt (`nvdc-work-v2`). The coordinator
+independently checks the claim against `registry.ollama.ai` and surfaces a
+verdict (`verified` / `mismatch` / `unknown`) per node and per receipt;
+`--require-verified-models` restricts routing to verified artifacts. Without a
+TEE this cannot *prove* which bytes ran — what it guarantees is that a node
+claiming one model while serving another has signed a non-repudiable false
+statement that contradicts public ground truth.
+
 > Note: the DGX Spark / GB10 cannot produce hardware attestation (NVIDIA disabled
 > CC on this SKU). It serves inference fine; it just joins as an unattested node.
 

{nvdc-0.2.1 → nvdc-0.2.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "nvdc"
-version = "0.2.1"
+version = "0.2.2"
 description = "Bring your GPU onto the network: one command turns a GPU into a verifiable, OpenAI-compatible inference node."
 readme = "README.md"
 requires-python = ">=3.9"

{nvdc-0.2.1 → nvdc-0.2.2}/src/nvdc/__init__.py

@@ -1,3 +1,3 @@
 """nvdc: bring your GPU onto the network as a verifiable, OpenAI-compatible inference node."""
 
-__version__ = "0.2.1"
+__version__ = "0.2.2"

{nvdc-0.2.1 → nvdc-0.2.2}/src/nvdc/agent.py

@@ -21,6 +21,7 @@ from .gpu import detect_gpu, detect_gpus, detect_interconnect
 from .hardware import detect_hardware, machine_id as hw_machine_id
 from .inference import Backend, make_backend
 from .keys import Identity
+from .models import local_ollama_commit
 
 log = logging.getLogger("nvdc.agent")
 
@@ -87,6 +88,7 @@ class NodeAgent:
         self.cluster = cluster
         self.private = private
         self.auto_update = auto_update
+        self.model_commit = ""  # set at registration from the backend's store
         self.token = token
         self.require_attestation = require_attestation
         self.status_cb = status_cb
@@ -211,6 +213,17 @@ class NodeAgent:
             raise RuntimeError(
                 f"attestation required but not verified: {att.reason or att.mode}"
             )
+        # Model identity commitment: the content digest of the artifact this
+        # node will serve. Signed into every work receipt (nvdc-work-v2) and
+        # checked by the coordinator against the public registry.
+        if getattr(self.backend, "name", "") == "ollama":
+            self.model_commit = await local_ollama_commit(
+                self.model, getattr(self.backend, "base_url", "http://localhost:11434"))
+            if self.model_commit:
+                log.info("model commitment: %s -> %s", self.model, self.model_commit[:23] + "…")
+            else:
+                log.warning("could not derive a model commitment for '%s'; "
+                            "receipts will not carry a model identity", self.model)
         profile = protocol.NodeProfile(
             name=self.name,
             models=[self.model],
@@ -229,6 +242,7 @@ class NodeAgent:
             machine_id=self.machine_id,
             cluster=self.cluster,
             private=self.private,
+            model_commit=self.model_commit,
             agent_version=__version__,
         )
         await self._send(protocol.MSG_REGISTER, profile=protocol.node_profile_to_dict(profile))
@@ -324,7 +338,8 @@ class NodeAgent:
 
     def _sign_work(self, req_id, prompt_commit, tokens, response_commit, delivery) -> str:
         payload = keys.work_payload(req_id, self.model, prompt_commit, tokens,
-                                    response_commit, delivery)
+                                    response_commit, delivery,
+                                    model_commit=self.model_commit)
         return self.identity.sign(payload)
 
     async def _send(self, msg_type: str, **fields: Any):

{nvdc-0.2.1 → nvdc-0.2.2}/src/nvdc/cli.py

@@ -92,6 +92,7 @@ def cmd_coordinator(args: argparse.Namespace) -> int:
         require_payment=not args.no_payment,
         min_agent_version=args.min_agent_version
         or os.environ.get("NVDC_MIN_AGENT_VERSION", ""),
+        require_verified_models=args.require_verified_models or None,
     )
     print(f"nvdc coordinator on http://{args.host}:{args.port}")
     print(f"  OpenAI endpoint : http://{args.host}:{args.port}/v1/chat/completions")
@@ -199,6 +200,9 @@ def build_parser() -> argparse.ArgumentParser:
     c.add_argument("--min-agent-version", default="",
                    help="refuse agents older than this version at registration "
                         "(or NVDC_MIN_AGENT_VERSION); empty = no gate")
+    c.add_argument("--require-verified-models", action="store_true",
+                   help="only route to nodes whose claimed model digest matches "
+                        "the public registry (or NVDC_REQUIRE_VERIFIED_MODELS)")
     c.set_defaults(func=cmd_coordinator)
 
     a = sub.add_parser("app", help="launch the visual node client (web UI)")

{nvdc-0.2.1 → nvdc-0.2.2}/src/nvdc/coordinator.py

@@ -30,6 +30,7 @@ from fastapi.responses import JSONResponse, StreamingResponse
 from starlette.concurrency import run_in_threadpool
 
 from . import __version__, accounts, keys, payments, protocol
+from . import models as model_identity
 from .keys import Identity
 from .protocol import version_tuple
 from .storage import Account, Storage, make_storage, to_micro, to_usd
@@ -140,10 +141,14 @@ def _verify_node(r: Dict[str, Any]) -> bool:
     sig = r.get("node_sig", "")
     if not sig:
         return False
-    payload = keys.work_payload(
-        r.get("req_id", ""), r.get("model", ""), r.get("prompt_commit", ""),
-        r.get("tokens", 0), r.get("response_commit", ""), r.get("delivery", ""))
-    return keys.verify(r.get("miner_account", ""), payload, sig)
+    args = (r.get("req_id", ""), r.get("model", ""), r.get("prompt_commit", ""),
+            r.get("tokens", 0), r.get("response_commit", ""), r.get("delivery", ""))
+    account = r.get("node_account", "") or r.get("miner_account", "")
+    # v2 (signature covers the model artifact digest), then legacy v1.
+    if r.get("model_commit"):
+        if keys.verify(account, keys.work_payload(*args, model_commit=r["model_commit"]), sig):
+            return True
+    return keys.verify(account, keys.work_payload(*args), sig)
 
 
 def build_clusters(machines: List[Dict[str, Any]], live_ids: set) -> List[Dict[str, Any]]:
@@ -181,6 +186,11 @@ class Node:
         self.owner_account = profile.get("owner_account", "") or self.account_id
         self.machine_id = profile.get("machine_id", "") or self.id
         self.cluster = profile.get("cluster", "") or ""
+        # Model identity: the node's claimed artifact digest, and the verdict
+        # from checking that claim against the public registry at registration
+        # ("verified" | "mismatch" | "unknown").
+        self.model_commit = str(profile.get("model_commit", "") or "")
+        self.model_verdict = "unknown"
         self.draining = False
         self.pending: Dict[str, PendingRequest] = {}
         self._send_lock = asyncio.Lock()
@@ -255,6 +265,8 @@ class Node:
             "price_per_mtok": round(self.price_per_mtok, 6),
             "price_per_mtok_input": round(self.price_per_mtok_input, 6),
             "private": self.private,
+            "model_commit": self.model_commit,
+            "model_verdict": self.model_verdict,
             "attested": self.attested,
             "attestation_mode": self.attestation.get("mode", "none"),
             "agent_version": self.profile.get("agent_version", ""),
@@ -339,7 +351,8 @@ class Registry:
 
     def pick(self, model: str = "", models: Optional[List[str]] = None,
              require_attested: bool = False, pin: str = "", min_rating: int = 0,
-             max_price: Optional[float] = None, consumer: str = "") -> Optional[Node]:
+             max_price: Optional[float] = None, consumer: str = "",
+             require_verified: bool = False) -> Optional[Node]:
         def model_ok(n: Node) -> bool:
             if model:
                 return model in n.models
@@ -357,6 +370,8 @@ class Registry:
             # Private nodes serve only their owner (personal AI mode).
             and (not n.private or own(n))
             and (not require_attested or n.attested)
+            # Strict networks only route to registry-verified model artifacts.
+            and (not require_verified or n.model_verdict == "verified")
             and n.rating() >= min_rating
             # A max price never excludes your own node — it's free for you.
             and (max_price is None or own(n)
@@ -455,11 +470,18 @@ class Registry:
 
 def create_app(auth_token: str = "", require_attested: bool = False,
                require_payment: bool = True,
-               min_agent_version: Optional[str] = None) -> FastAPI:
+               min_agent_version: Optional[str] = None,
+               require_verified_models: Optional[bool] = None) -> FastAPI:
     # Minimum agent version allowed to JOIN the network (older agents are
     # refused at the door with a clear upgrade message). Empty = no gate.
     if min_agent_version is None:
         min_agent_version = os.environ.get("NVDC_MIN_AGENT_VERSION", "").strip()
+    # Strict model-identity policy: only route to nodes whose claimed model
+    # digest matches the public registry. Default off — verdicts are always
+    # computed and surfaced either way.
+    if require_verified_models is None:
+        require_verified_models = bool(
+            os.environ.get("NVDC_REQUIRE_VERIFIED_MODELS", "").strip())
     app = FastAPI(title="nvdc coordinator")
     # Allow browser clients (e.g. the Vercel static site) to read the network
     # and stream chat. Inference billing identifies accounts by header, not
@@ -489,6 +511,34 @@ def create_app(auth_token: str = "", require_attested: bool = False,
                 node.restore_stats(rec)
                 return
 
+    # Registry ground truth for model digests, cached so registration doesn't
+    # hammer registry.ollama.ai (tags are mutable, hence the TTL refresh).
+    _model_digest_cache: Dict[str, tuple] = {}
+
+    async def expected_model_digest(model: str) -> str:
+        hit = _model_digest_cache.get(model)
+        if hit and time.time() - hit[1] < 6 * 3600:
+            return hit[0]
+        digest = await model_identity.fetch_registry_digest(model)
+        _model_digest_cache[model] = (digest, time.time())
+        return digest
+
+    async def _verify_node_model(node: Node) -> None:
+        """Check the node's claimed artifact digest against the registry."""
+        if not node.model_commit:
+            return  # no claim made -> verdict stays "unknown"
+        try:
+            expected = await expected_model_digest(node.model)
+        except Exception:
+            expected = ""
+        node.model_verdict = model_identity.model_verdict(node.model_commit, expected)
+        if node.model_verdict == "mismatch":
+            log.warning(
+                "model commitment MISMATCH: node '%s' claims %s for '%s' but the "
+                "registry says %s", node.profile.get("name"),
+                node.model_commit[:19] + "…", node.model,
+                (expected[:19] + "…") if expected else "?")
+
     # House node: a coordinator-hosted miner backed by the Cerebras API, so
     # the network always has at least one live node. Created only here from
     # the coordinator's own environment — the public node protocol has no way
@@ -543,6 +593,7 @@ def create_app(auth_token: str = "", require_attested: bool = False,
             node_id = uuid.uuid4().hex[:12]
             node = Node(node_id, ws, first.get("profile", {}))
             _rehydrate_stats(node)  # a reconnect is not a brand-new miner
+            await _verify_node_model(node)  # registry-anchored model identity
             registry.add(node)
             # Persist this machine under its owner so the account can list its
             # clusters/machines even after the node disconnects.
@@ -691,7 +742,8 @@ def create_app(auth_token: str = "", require_attested: bool = False,
         node = registry.pick(model, models=models_filter or None,
                              require_attested=require_attested, pin=pin,
                              min_rating=min_rating, max_price=max_price,
-                             consumer=consumer_id)
+                             consumer=consumer_id,
+                             require_verified=require_verified_models)
         if node is None:
             why = f"no available miner for model '{model or ','.join(models_filter)}'"
             if pin:
@@ -774,6 +826,7 @@ def create_app(auth_token: str = "", require_attested: bool = False,
             "max_price": round(max_price, 8) if max_price is not None else -1,
             "nonce": nonce, "auth_ts": auth_ts, "hold_u": hold_u,
             "price_in": price_in, "self_serve": self_serve,
+            "model_commit": node.model_commit, "model_verdict": node.model_verdict,
             "consumer_sig": consumer_sig, "consumer_sig_valid": consumer_sig_valid,
         }
         base_headers = {
@@ -801,13 +854,26 @@ def create_app(auth_token: str = "", require_attested: bool = False,
         # Refresh the persisted machine record so lifetime stats (TPS, rating
         # inputs, earnings) survive reconnects and coordinator restarts.
         ledger.record_machine(node.owner_account, node.machine_record())
-        # Verify the node's completion signature over what it delivered.
+        # Verify the node's completion signature over what it delivered. A
+        # node that registered a model commitment signs nvdc-work-v2 (the
+        # signature also covers the artifact digest); older agents sign v1.
+        # The v1 fallback keeps legacy receipts verifiable but records that
+        # the model identity was NOT covered by the signature.
         node_sig_valid = False
+        model_commit_signed = False
         if node_sig:
-            work = keys.work_payload(req_id, ctx["model"], ctx["prompt_commit"],
-                                     tokens, response_commit, delivery)
-            # The machine signs with its own key; earnings credit the owner.
-            node_sig_valid = keys.verify(ctx["node_account"], work, node_sig)
+            mc = ctx.get("model_commit", "")
+            if mc:
+                work2 = keys.work_payload(req_id, ctx["model"], ctx["prompt_commit"],
+                                          tokens, response_commit, delivery,
+                                          model_commit=mc)
+                # The machine signs with its own key; earnings credit the owner.
+                node_sig_valid = keys.verify(ctx["node_account"], work2, node_sig)
+                model_commit_signed = node_sig_valid
+            if not node_sig_valid:
+                work = keys.work_payload(req_id, ctx["model"], ctx["prompt_commit"],
+                                         tokens, response_commit, delivery)
+                node_sig_valid = keys.verify(ctx["node_account"], work, node_sig)
         receipt = ledger.settle(ctx["consumer_id"], ctx["miner_account"], cost, {
             "req_id": req_id, "model": ctx["model"], "req_model": ctx["req_model"],
             "miner_node": ctx["node_id"], "node_account": ctx["node_account"], "tokens": tokens,
@@ -815,6 +881,9 @@ def create_app(auth_token: str = "", require_attested: bool = False,
             "price_per_mtok": round(price, 6),
             "price_per_mtok_input": round(ctx["price_in"], 6),
             "self_serve": ctx["self_serve"],
+            "model_commit": ctx.get("model_commit", ""),
+            "model_commit_signed": model_commit_signed,
+            "model_verdict": ctx.get("model_verdict", "unknown"),
             "delivery": delivery,
             "attested": ctx["attested"], "prompt_commit": ctx["prompt_commit"],
             "response_commit": response_commit,

{nvdc-0.2.1 → nvdc-0.2.2}/src/nvdc/keys.py

@@ -44,13 +44,26 @@ def auth_payload(consumer: str, model: str, prompt_commit: str,
 
 
 def work_payload(req_id: str, model: str, prompt_commit: str, tokens: int,
-                 response_commit: str, delivery: str) -> Dict[str, Any]:
-    """What the NODE signs at the end: attestation of work delivered."""
-    return {
+                 response_commit: str, delivery: str,
+                 model_commit: str = "") -> Dict[str, Any]:
+    """What the NODE signs at the end: attestation of work delivered.
+
+    When the node knows the content digest of the artifact it served
+    (``model_commit``), the payload upgrades to v2 and the signature also
+    covers the model's identity — claiming one model while serving another
+    becomes a signed, non-repudiable false statement. With no commitment the
+    payload is byte-identical to v1, so existing nodes and receipts verify
+    unchanged.
+    """
+    payload = {
         "kind": "nvdc-work-v1", "req_id": req_id, "model": model,
         "prompt_commit": prompt_commit, "tokens": int(tokens),
         "response_commit": response_commit, "delivery": delivery,
     }
+    if model_commit:
+        payload["kind"] = "nvdc-work-v2"
+        payload["model_commit"] = model_commit
+    return payload
 
 
 def account_from_pubkey(pub: Ed25519PublicKey) -> str:

nvdc-0.2.2/src/nvdc/models.py

@@ -0,0 +1,100 @@
+"""Model identity: content-addressed commitments for served models.
+
+Hardware attestation says WHERE work ran; this module is about WHAT was run.
+Without a TEE we cannot cryptographically prove which bytes sat in GPU memory,
+so the goal is different and honest: every node publishes a content-addressed
+commitment (digest) of the artifact it serves, signs it into each work receipt
+(``nvdc-work-v2`` in keys.py), and the coordinator independently checks the
+claim against the same public registry nodes pull from. A node can still lie —
+but the lie is now a signed, non-repudiable statement that contradicts public
+ground truth, so it is detectable, attributable and punishable.
+
+Ollama's model store is already content-addressed: every model resolves to an
+OCI-style manifest whose sha256 digest uniquely identifies weights + config.
+``registry.ollama.ai`` serves those manifests publicly, which gives the
+coordinator an authoritative expected digest for every catalog tag.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import logging
+from typing import Any, Dict
+
+import httpx
+
+log = logging.getLogger("nvdc.models")
+
+OLLAMA_REGISTRY = "https://registry.ollama.ai"
+
+
+def _norm_digest(d: str) -> str:
+    d = str(d or "").strip()
+    if not d:
+        return ""
+    return d if d.startswith("sha256:") else "sha256:" + d
+
+
+def _pick_digest(tags_json: Dict[str, Any], model: str) -> str:
+    """Pull the digest of ``model`` out of an Ollama ``/api/tags`` response."""
+    want = model if ":" in model else model + ":latest"
+    for m in tags_json.get("models", []):
+        if m.get("name") == want or m.get("model") == want:
+            return _norm_digest(m.get("digest", ""))
+    return ""
+
+
+async def local_ollama_commit(model: str, ollama_url: str) -> str:
+    """The content digest of the locally installed model, or "" if unknown.
+
+    Reported by the same daemon that will execute the inference — i.e. the
+    runtime's own claim of identity, which the node then signs.
+    """
+    try:
+        async with httpx.AsyncClient(timeout=10) as c:
+            r = await c.get(f"{ollama_url.rstrip('/')}/api/tags")
+            r.raise_for_status()
+            return _pick_digest(r.json(), model)
+    except Exception as e:
+        log.debug("could not read local model digest for %s: %s", model, e)
+        return ""
+
+
+async def fetch_registry_digest(model: str) -> str:
+    """Authoritative digest for a library tag from registry.ollama.ai.
+
+    Returns "" when unavailable (custom/private models, network failure) —
+    callers must treat that as "unknown", never as a mismatch.
+    """
+    if "/" in model:  # only library/* tags have a public canonical digest
+        return ""
+    name, _, tag = model.partition(":")
+    if not name:
+        return ""
+    url = f"{OLLAMA_REGISTRY}/v2/library/{name}/manifests/{tag or 'latest'}"
+    headers = {"Accept": "application/vnd.docker.distribution.manifest.v2+json"}
+    try:
+        async with httpx.AsyncClient(timeout=8, follow_redirects=True) as c:
+            r = await c.get(url, headers=headers)
+            if r.status_code != 200:
+                return ""
+            dcd = r.headers.get("docker-content-digest", "")
+            if dcd:
+                return _norm_digest(dcd)
+            # OCI content addressing: the digest IS the sha256 of the bytes.
+            return "sha256:" + hashlib.sha256(r.content).hexdigest()
+    except Exception as e:
+        log.debug("registry digest fetch failed for %s: %s", model, e)
+        return ""
+
+
+def model_verdict(claimed: str, expected: str) -> str:
+    """Compare a node's claimed digest with registry ground truth.
+
+    'unknown' whenever either side is missing — absence of evidence is not a
+    mismatch. 'mismatch' only when both digests exist and differ.
+    """
+    claimed, expected = _norm_digest(claimed), _norm_digest(expected)
+    if not claimed or not expected:
+        return "unknown"
+    return "verified" if claimed == expected else "mismatch"

{nvdc-0.2.1 → nvdc-0.2.2}/src/nvdc/protocol.py

@@ -95,6 +95,7 @@ class NodeProfile:
     machine_id: str = ""         # stable per-machine id (survives reconnects)
     cluster: str = ""            # optional cluster label grouping machines
     private: bool = False        # personal mode: serve only the owner account
+    model_commit: str = ""       # content digest of the served model artifact
     agent_version: str = ""
     node_id: Optional[str] = None
 

{nvdc-0.2.1 → nvdc-0.2.2}/src/nvdc.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: nvdc
-Version: 0.2.1
+Version: 0.2.2
 Summary: Bring your GPU onto the network: one command turns a GPU into a verifiable, OpenAI-compatible inference node.
 Author: NVDC
 License: Apache-2.0
@@ -150,6 +150,16 @@ Attestation is a first-class, pluggable component (`nvdc/attestation.py`):
 A coordinator can enforce policy with `--require-attested` to only route work to
 nodes whose attestation verifies.
 
+**Model identity** is attested separately from hardware. Every node publishes a
+content-addressed commitment of the artifact it serves (the Ollama manifest
+digest) and signs it into each work receipt (`nvdc-work-v2`). The coordinator
+independently checks the claim against `registry.ollama.ai` and surfaces a
+verdict (`verified` / `mismatch` / `unknown`) per node and per receipt;
+`--require-verified-models` restricts routing to verified artifacts. Without a
+TEE this cannot *prove* which bytes ran — what it guarantees is that a node
+claiming one model while serving another has signed a non-repudiable false
+statement that contradicts public ground truth.
+
 > Note: the DGX Spark / GB10 cannot produce hardware attestation (NVIDIA disabled
 > CC on this SKU). It serves inference fine; it just joins as an unattested node.
 

{nvdc-0.2.1 → nvdc-0.2.2}/src/nvdc.egg-info/SOURCES.txt

@@ -14,6 +14,7 @@ src/nvdc/hardware.py
 src/nvdc/house.py
 src/nvdc/inference.py
 src/nvdc/keys.py
+src/nvdc/models.py
 src/nvdc/payments.py
 src/nvdc/protocol.py
 src/nvdc/runtime.py
@@ -30,6 +31,7 @@ src/nvdc/web/index.html
 tests/test_accounts_auth.py
 tests/test_coordinator_security.py
 tests/test_house_node.py
+tests/test_model_attestation.py
 tests/test_persistence.py
 tests/test_self_serve.py
 tests/test_self_update.py

nvdc-0.2.2/tests/test_model_attestation.py

@@ -0,0 +1,195 @@
+"""Model identity: signed commitments, registry verdicts, routing policy."""
+
+import hashlib
+import json
+
+import pytest
+from starlette.testclient import TestClient
+
+from nvdc import keys, models, protocol
+from nvdc.coordinator import Node, Registry, create_app
+from nvdc.models import _pick_digest, model_verdict
+
+DIG = "sha256:" + "a" * 64
+OTHER = "sha256:" + "b" * 64
+
+
+# ---- pure pieces -------------------------------------------------------------
+def test_work_payload_v1_is_byte_identical_without_commitment():
+    p = keys.work_payload("r1", "m1", "pc", 5, "rc", "complete")
+    assert p == {"kind": "nvdc-work-v1", "req_id": "r1", "model": "m1",
+                 "prompt_commit": "pc", "tokens": 5, "response_commit": "rc",
+                 "delivery": "complete"}
+
+
+def test_work_payload_v2_signature_covers_model_identity(identity):
+    v2 = keys.work_payload("r1", "m1", "pc", 5, "rc", "complete", model_commit=DIG)
+    assert v2["kind"] == "nvdc-work-v2" and v2["model_commit"] == DIG
+    sig = identity.sign(v2)
+    assert keys.verify(identity.account_id, v2, sig)
+    # The same signature must NOT verify a payload claiming a different model.
+    forged = keys.work_payload("r1", "m1", "pc", 5, "rc", "complete", model_commit=OTHER)
+    assert not keys.verify(identity.account_id, forged, sig)
+    # ...nor strip the commitment and pass as v1.
+    v1 = keys.work_payload("r1", "m1", "pc", 5, "rc", "complete")
+    assert not keys.verify(identity.account_id, v1, sig)
+
+
+def test_verdict_logic():
+    assert model_verdict("", DIG) == "unknown"      # no claim
+    assert model_verdict(DIG, "") == "unknown"      # no ground truth
+    assert model_verdict(DIG, DIG) == "verified"
+    assert model_verdict("a" * 64, DIG) == "verified"   # prefix normalization
+    assert model_verdict(DIG, OTHER) == "mismatch"
+
+
+def test_pick_digest_from_ollama_tags():
+    tags = {"models": [
+        {"name": "llama3.1:8b", "digest": "a" * 64},
+        {"name": "mistral:latest", "digest": "sha256:" + "c" * 64},
+    ]}
+    assert _pick_digest(tags, "llama3.1:8b") == DIG
+    assert _pick_digest(tags, "mistral") == "sha256:" + "c" * 64
+    assert _pick_digest(tags, "missing:1b") == ""
+
+
+# ---- registration verdicts ---------------------------------------------------
+def _register(client, commit, model="llama3.1:8b"):
+    ws = client.websocket_connect("/node/ws")
+    ws.__enter__()
+    ws.send_text(protocol.encode(protocol.MSG_REGISTER, profile={
+        "name": "gpu", "account_id": "nvdc_machinekey",
+        "owner_account": "nvdc_owner", "machine_id": "m1",
+        "models": [model], "price_per_mtok": 1.0,
+        "model_commit": commit, "agent_version": "0.2.2",
+        "attestation": {"verified": False}}))
+    ack = json.loads(ws.receive_text())
+    return ws, ack
+
+
+@pytest.mark.parametrize("claimed,expected,verdict", [
+    (DIG, DIG, "verified"),
+    (OTHER, DIG, "mismatch"),
+    ("", DIG, "unknown"),       # legacy agent: no claim, never penalized
+])
+def test_registration_checks_claim_against_registry(monkeypatch, claimed, expected, verdict):
+    async def fake_registry(model):
+        return expected
+    monkeypatch.setattr(models, "fetch_registry_digest", fake_registry)
+    app = create_app(require_payment=False)
+    client = TestClient(app)
+    ws, ack = _register(client, claimed)
+    node = app.state.registry.nodes[ack["node_id"]]
+    assert node.model_verdict == verdict
+    d = node.to_dict()
+    assert d["model_verdict"] == verdict and d["model_commit"] == claimed
+    ws.__exit__(None, None, None)
+
+
+def test_registry_unreachable_is_unknown_not_mismatch(monkeypatch):
+    async def broken(model):
+        raise RuntimeError("registry down")
+    monkeypatch.setattr(models, "fetch_registry_digest", broken)
+    app = create_app(require_payment=False)
+    ws, ack = _register(TestClient(app), DIG)
+    assert app.state.registry.nodes[ack["node_id"]].model_verdict == "unknown"
+    ws.__exit__(None, None, None)
+
+
+# ---- routing policy ----------------------------------------------------------
+def _node(verdict, node_id="n1"):
+    n = Node(node_id, None, {"name": node_id, "models": ["m1"],
+                             "price_per_mtok": 1.0})
+    n.model_verdict = verdict
+    return n
+
+
+def test_strict_mode_routes_only_to_verified():
+    reg = Registry()
+    reg.add(_node("mismatch", "bad"))
+    reg.add(_node("unknown", "meh"))
+    assert reg.pick("m1", require_verified=True) is None
+    ok = _node("verified", "good")
+    reg.add(ok)
+    assert reg.pick("m1", require_verified=True) is ok
+    # Default policy: verdicts are informational, everyone routable.
+    assert reg.pick("m1") is not None
+
+
+# ---- receipts ----------------------------------------------------------------
+class _SigningNode(Node):
+    """In-process node that signs its work like a real v2 agent."""
+
+    def __init__(self, identity, commit):
+        super().__init__("s1", None, {
+            "name": "signer", "account_id": identity.account_id,
+            "owner_account": "nvdc_sowner", "machine_id": "sm1",
+            "models": ["m1"], "price_per_mtok": 1.0, "model_commit": commit,
+            "attestation": {"verified": False}})
+        self._identity = identity
+        self.model_verdict = "verified"
+
+    async def send(self, msg_type, **fields):
+        if msg_type != protocol.MSG_INFER:
+            return
+        req_id, body = fields["id"], fields["body"]
+        pc = hashlib.sha256(json.dumps(body.get("messages", []),
+                                       sort_keys=True).encode()).hexdigest()
+        rc = hashlib.sha256(b"ok").hexdigest()
+        sig = self._identity.sign(keys.work_payload(
+            req_id, "m1", pc, 7, rc, "complete", model_commit=self.model_commit))
+        self.pending[req_id].queue.put_nowait({
+            "t": protocol.MSG_RESULT, "id": req_id,
+            "body": {"choices": [{"message": {"role": "assistant", "content": "ok"}}],
+                     "usage": {"prompt_tokens": 3, "completion_tokens": 7}},
+            "tokens": 7, "prompt_tokens": 3, "response_commit": rc, "sig": sig})
+
+
+def test_receipt_carries_signed_model_commitment(identity):
+    app = create_app(require_payment=False)
+    app.state.registry.add(_SigningNode(identity, DIG))
+    client = TestClient(app)
+    r = client.post("/v1/chat/completions",
+                    headers={"X-NVDC-Account": "nvdc_consumer"},
+                    json={"model": "m1", "messages": [{"role": "user", "content": "hi"}]})
+    assert r.status_code == 200
+    receipt = app.state.ledger.recent(1)[0]
+    assert receipt["model_commit"] == DIG
+    assert receipt["model_commit_signed"] is True
+    assert receipt["node_sig_valid"] is True
+    assert receipt["model_verdict"] == "verified"
+    # /api/verify independently re-verifies the v2 node signature.
+    verdict = client.post("/api/verify", json=receipt).json()
+    assert verdict["node"] is True
+
+
+def test_legacy_v1_nodes_still_verify_but_commitment_unsigned(identity):
+    class _LegacyNode(_SigningNode):
+        def __init__(self, ident):
+            super().__init__(ident, commit="")   # pre-0.2.2: no commitment
+
+        async def send(self, msg_type, **fields):
+            if msg_type != protocol.MSG_INFER:
+                return
+            req_id, body = fields["id"], fields["body"]
+            pc = hashlib.sha256(json.dumps(body.get("messages", []),
+                                           sort_keys=True).encode()).hexdigest()
+            rc = hashlib.sha256(b"ok").hexdigest()
+            sig = self._identity.sign(keys.work_payload(req_id, "m1", pc, 7, rc, "complete"))
+            self.pending[req_id].queue.put_nowait({
+                "t": protocol.MSG_RESULT, "id": req_id,
+                "body": {"choices": [{"message": {"role": "assistant", "content": "ok"}}],
+                         "usage": {"prompt_tokens": 3, "completion_tokens": 7}},
+                "tokens": 7, "prompt_tokens": 3, "response_commit": rc, "sig": sig})
+
+    app = create_app(require_payment=False)
+    app.state.registry.add(_LegacyNode(identity))
+    client = TestClient(app)
+    r = client.post("/v1/chat/completions",
+                    headers={"X-NVDC-Account": "nvdc_consumer"},
+                    json={"model": "m1", "messages": [{"role": "user", "content": "hi"}]})
+    assert r.status_code == 200
+    receipt = app.state.ledger.recent(1)[0]
+    assert receipt["node_sig_valid"] is True          # legacy sigs still verify
+    assert receipt["model_commit_signed"] is False    # but identity not covered
+    assert receipt["model_commit"] == ""