Adversarial by default.

The sandboxing controls above confine where a model can run. The containment layer below constrains what a model can do — defending against the threat class where a model escapes its testing environment to manipulate other systems (e.g. the OpenAI ↔ Hugging Face incident). Every inference path — local WebGPU, mesh peer, and cloud — applies both controls inline; there is no path that bypasses them.

1. MeshInfer.AI ML team pulls model weights from upstream (HF, partner) and verifies source checksums.
2. Quantization pipeline is reproducible and signed. Build attestations stored via in-toto.
3. Final bundle signed with Ed25519 offline key (air-gapped HSM). Rotation quarterly. (V3 upgrade: dual-signed with SPHINCS⁺ — see §5.10)
4. Client SDK refuses any bundle not signed by an active, non-revoked key.
5. Revocation list distributed inline with every routing decision response.

The following pipeline is live in pqcPoIAttestation. Every inference task on the mesh passes through this flow.

The verification pipeline is live in the Coordinator backend. A configurable sample of mesh tasks is selected for verification, with elevated sampling for low-reputation nodes and BYOM models. Sampled tasks are re-executed under deterministic decoding conditions by an independent verifier, and the output hash is compared against the original submission. The hash is bound to the task identity and model, preventing replay and model-spoofing attacks. Mismatches trigger a third-verifier escalation, a reputation penalty for the minority node, and accumulated mismatches within a rolling window result in node degradation. All verification hashes are stored in an append-only, XMSS-compatible hash chain for compliance evidence.

All five PQC subsystems are live in the Coordinator backend. Classical primitives remain active for compatibility; each subsystem carries a documented upgrade path to its NIST-standardised PQC equivalent. "Harvest now, decrypt later" attacks are mitigated by the hybrid approach — an adversary must break both the classical and PQC primitive simultaneously.

  ✅ Phase 0 (Now):     Ed25519 signing live (pqcSigning)
                        ECDH-P256 + Kyber768 hybrid handshake live (pqcTLS)
                        Ed25519 + Kyber768 node identity certs live (pqcNodeIdentity)
                        SHA256-chain PoI attestation live (pqcPoIAttestation)
                        WOTS+ routing signatures live (pqcRoutingSignatures)

  🔄 Phase 1 (V2, 2026): Swap Kyber768 placeholder → noble-post-quantum ML-KEM WASM
                          Ed25519+Dilithium dual-sign on all bundles

  🔄 Phase 2 (V3, 2027): Dilithium-only node identity certs
                          SPHINCS+ full hypertree (replace WOTS+ leaves)
                          XMSS stateful hash-based PoI audit chain

  🔄 Phase 3 (GA, 2027): Classical-only paths deprecated
                          Full FIPS 203/204/205 certified operation

All hybrid signatures require an adversary to break both the classical and PQC primitive. No security regression is possible during the transition window.