Graviton5 deployment preparation

These are separate v2 artifacts. They do not modify or reuse the existing i-0b59c8057ba296bca AMD deployment in us-east-2. The separately authorized parent is now running; see current deployment evidence. No supplied command deletes files, uses rsync deletion, or terminates instances.

Hardware proof

crates/enclave/src/hardware.rs requires all of the following before returning VerifiedHardware:

Production Linux aarch64, with readable local online-CPU MIDR registers. Each register must identify Arm implementer 0x41, architecture 0xf, Neoverse V3 part 0xd84. Variant/revision may vary.
A fresh document directly from this process's NSM handle, with nonzero 48-byte PCR0/1/2/4. It binds the candidate parent ID through PCR4 = SHA384(48 zero bytes || ASCII(instance_id)).
A SigV4-authenticated DescribeInstances request sent by the enclave over certificate-verified TLS to the compiled endpoint ec2.us-west-2.amazonaws.com. The exact PCR4-bound instance must be c9g.4xlarge, running, arm64 and enclave-enabled. A signed but stale Instance Identity Document is not accepted.
Completion within 90 seconds by both the runtime deadline and fresh NSM time.

The credentials bridge serves short-lived instance-role credentials on vsock 8005 only to enclave CID 16. It is an untrusted transport, never the source of hardware facts. Its role needs only ec2:DescribeInstances in us-west-2. The bridge uses IMDSv2, ignores HTTP proxy environment variables and never logs credential material. HTTP, credential and XML sizes are capped before collection.

The caller must gate both serving and a signed READY claim on successful hardware verification. A graviton5_verified field printed by a host is not a proof. Live MIDR exposure and the complete code path still need validation on Nitro; if sysfs registers are unavailable the module refuses readiness.

Primary sources checked 2026-09-09:

Cost and allocation

AWS Pricing API, queried 2026-09-09: Linux/shared/OnDemand c9g.4xlarge in us-west-2 costs $0.69552/hour, approximately $16.69/day or $507.73 per 730-hour month. Price SKU WNWJJAR6U6FMDMPQ, effective 2026-09-01, publication 2026-09-09T00:46:05Z. This excludes EBS, public IPv4, network transfers and external solvers. The instance has 16 cores and 32 GiB. Bootstrap reserves 12 cores and 24 GiB for Nitro, leaving 4 cores and 8 GiB for the parent.

The prepared root disk is encrypted 100 GiB gp3 with automatic deletion disabled. Generation runs for roughly one day before production readiness; calibration must determine the actual measured iteration count first. A configuration with zero or development iterations must not be promoted to production.

Provision a separate parent

First create a dedicated EC2 instance role/profile using graviton5-role-trust.json and graviton5-instance-role.json. DescribeInstances requires Resource: "*"; the region condition narrows it. No KMS, S3 or writable EC2 permissions are needed by the enclave. A dedicated security group should allow SSH only from the operator and the eventual Cloudflare/origin ingress. Use a public subnet with internet routing so the parent can reach upstreams. Creating these resources and the new instance is a distinct coordinated action. The provisioning identity needs the relevant IAM role/profile creation actions, iam:PassRole, EC2 instance/network creation and read-only SSM AMI lookup.

With those concrete resources available, this command is read only in AWS:

python3 deploy/graviton5-prepare.py \
  --security-group sg-EXAMPLE --subnet subnet-EXAMPLE \
  --key-name attested-relay-graviton5 \
  --instance-profile attested-relay-graviton5 \
  --output /tmp/attested-relay-launch-UNIQUE

It validates architecture, Nitro support, AZ offering, SG/subnet VPC alignment, profile, key pair and ARM AMI; then produces exact RunInstances input plus the read-only evidence used. It refuses to overwrite its output directory. Review that JSON before the coordinated launch:

aws --region us-west-2 ec2 run-instances \
  --cli-input-json file:///tmp/attested-relay-launch-UNIQUE/run-instances.json

The request creates a distinct instance tagged attested-relay-graviton5; it never stops or resizes the AMD instance. Capacity errors should be handled by checking other supported AZs, not by changing the attested hardware requirement.

Build and run only the new image

Use a clean committed checkout on the ARM parent, without deleting remote files:

rsync -az --exclude target --exclude build/out --exclude build/out-graviton5 \
  ./ ec2-user@NEW-IP:attested-relay-source/

build/build-eif-graviton5.sh uses the pinned GNU ARM Rust image and pinned Nitro CLI 1.5.0. Native RandomX links into attested-relay-enclave; the final scratch image includes that binary and exactly its resolved ELF shared libraries, no shell or package manager. The build writes into a fresh timestamped folder and refuses existing paths. The entry point is /attested-relay-enclave, never the legacy drand executable.

Run the build twice from the same commit into separate fresh output paths and compare PCR0/1/2 and binary hashes. The build is a reproducibility mechanism, not evidence of reproducibility until those independent builds match.

Install graviton5-credential-bridge.py at /opt/attested-relay/graviton5-credential-bridge.py, install graviton5-credentials.service and start it before the v2 enclave. The parent host must also supply the existing outbound TCP/config/UDP services and new GET transport. Only once those services and reviewed measured config are ready:

nitro-cli run-enclave --eif-path /ABSOLUTE/PATH/attested-relay.eif \
  --cpu-count 12 --memory 24576 --enclave-cid 16 --enclave-name attested-relay-v2

No debug/console option is permitted in production. A deployment test must show verified hardware, delayed warm-up/readiness, nonce/PCR/inner-TLS binding, real GET forwarding through Cloudflare, record publication and independent solver recovery. It must reject wrong hardware, changed PCRs, replayed transport chunks, modified puzzle manifests and a client certificate mismatch.

Short-work diagnostic before production

graviton5-build-diagnostic.sh SOURCE_BUNDLE PARENT_COMMIT FRESH_OUTPUT_DIR creates a separate clean clone, changes only measured iterations = 8, and records a diagnostic commit, exact parent diff and explicit no-seven-day-claim provenance. It builds a genuine non-debug Nitro EIF. Do not edit the production checkout or present these diagnostic measurements as production measurements.

graviton5-install-release.sh ABSOLUTE_BUILD_OUTPUT UNIQUE_RELEASE_NAME installs immutable versioned artifacts and a loopback-only parent service using its bundled GNU runtime. Every release has a distinct artifact directory. Keep diagnostic-* and production directories separate so short-work puzzles cannot enter the production artifact index. The installer does not start an enclave.

After real attestation/GET/sealing/independent solving tests pass, stop only the identified diagnostic enclave, retain its files and evidence, switch the host service to the production release, and start the measured long-work EIF. No public ingress is needed for diagnostics: use an SSH local forward to port8080.