Real Nitro diagnostic evidence, 2026-09-09

This is a deliberately short-work diagnostic, not a seven-day timelock. The complete source is production commit 474083ea74d0df069275da613e62a985d6960056 plus exactly the attached configuration patch: eight iterations per segment. The diagnostic commit is d47591a968a95515bf7cc30cfce4224dafc4c181. The measured epoch remains 86,400 seconds, seven segments, real RandomX v2, and the normal production hardware gate. It was launched without debug flags, using 12 CPUs and 24,576 MiB on the separate Graviton5 parent.

The real enclave passed CPU MIDR evidence, fresh NSM PCR4 parent binding, and live EC2 DescribeInstances verified over TLS inside the enclave. The SDK verified the AWS Nitro certificate chain and COSE signature, fresh nonce, pinned PCR0, actual inner-TLS peer SPKI, and signed hardware/policy fields. The signed policy reported ready, graviton5_verified=true, and instance_type=c9g.4xlarge.

An inner-TLS GET of https://example.com/ through the outer GET transport returned HTTP 200. The SDK ran through an SSH tunnel to the parent's loopback HTTP port, with insecure_local=True and allow_dev=False. Thus the diagnostic tests real Nitro authentication and GET transport but does not itself test a public Cloudflare route.

Copied public puzzle/attestation/record artifacts were authenticated locally, then the native Mac solver performed the seven sequential RandomX segments using light mode. Decryption of the XChaCha20-Poly1305 record recovered the exact 559-byte response body, SHA256 ff67a9d764d6a2367a187734e697f6a53217db9a21c101d410a113ca871a299d. The offline solver consumes only those copied files and an attestation-verified service key; it requires no AWS credentials or API. The original diagnostic artifacts and enclave build remain preserved separately from production.

The archived attestation authenticates evidence at its signed NSM timestamp; it is not a reusable proof of current liveness. The captured fresh verification was valid for its own nonce and TLS session. These artifacts contain only a public example.com request and response.