{"schema":"mycolo.signoff.inspect.v0","contract":{"id":"mycolo.signoff.v0","not":["certificate","certified","verified hardware","lab","UL","NIST"],"summary":"MyColo does not certify hardware. We ask YOUR agent (or you) to sign a receipt on YOUR machine. The MyColo agent is the requester, not the signer.","rules":["Key stays on your box (~/.config/mycolo/ed25519.seed, mode 0600). It never uploads.","A valid sign-off means: this key observed this readout + this file.","It does not mean MyColo, NVIDIA, or a lab checked the tok/s.","signed ≠ measured. Measured is a locked bench — not shipped yet.","Use --signer-kind agent --signer-label <your-agent>. That is the customer agent, not ours."]},"does":["Read GPU / VRAM / CPU / RAM / OS via collect (nvidia-smi or sysfs).","Build a v0 bundle. Drop os_name from the hash. Drop signoffs from the hash.","SHA-256 the canonical JSON → content_sha256.","Ed25519-sign ONLY the utf-8 bytes of that hex digest.","Append {public_key_hex, signature_hex, signer_kind, signer_label, statement=hardware-receipt-v0}.","Keep the seed at ~/.config/mycolo/ed25519.seed (mode 0600). Never upload it."],"does_not":["Open a network socket. sign / verify / keygen / collect have no HTTP.","Read hostname, MAC, serial, username, or home path.","Put os_name in the hardware fingerprint.","Certify tok/s. signed ≠ measured.","Run a model or download weights.","Send the seed, the raw key, or the full desk dump anywhere."],"signed_message":"utf-8 bytes of content_sha256 (64 hex chars). Not the JSON, not the GPU string, not a MyColo token.","key_path":"~/.config/mycolo/ed25519.seed","statement":"hardware-receipt-v0","sources":[{"path":"measure/receipt.py","sha256":"8ca9c44f4161a63c616912ce56ebce0475c31dc5910cb1056dc1a0c84c2e9387","bytes":5158},{"path":"measure/collect.py","sha256":"0402bde2347f8c49d3cc66269087864b1d0699df3efbd5041c0f6c2d5e2de852","bytes":3872}],"import_audit":{"ok":true,"files":{"measure/receipt.py":{"imports":["__future__","datetime","hashlib","json","nacl","nacl.exceptions","nacl.signing","os","pathlib","schema","schema.models"],"extra":[],"banned":[]},"measure/collect.py":{"imports":["__future__","json","pathlib","platform","schema","schema.models","shutil","subprocess"],"extra":[],"banned":[]}}},"note":"Compare this blob to `mycolo-measure inspect` on your box. If sha256(receipt.py) differs, do not sign. MyColo asks; your agent signs."}