Measured, not asserted

Verifier

The advantage is not that grading happens in a sandbox; plenty of things run in sandboxes. It is that the provider cannot influence the grader, and that this is demonstrable rather than asserted.

Pinned environment

Contracts pin this image by digest. A tag would let the graded environment drift after funding.

verifier image

us-central1-docker.pkg.dev/quick-catcher-470218-b0/mergegate/verifier@sha256:2e81501ef459f2a520c0ac08c5fd51962af2290c666d2374681e9619cc015b0a

execution environment

gen2 (gVisor)

resources

2 vCPU / 4Gi

timeout

600s

egress

deny-tcp-egress; dns-resolution-available

network

mergegate-sealed / mergegate-sealed-uc1

service account

none, no cloud identity in the sandbox

writable paths

/workspace

retries

0, a retried evaluation is a second evaluation

How a submission is graded

Steps 2 and 5 are deliberately redundant. The guard already rejects grader-path edits, so the purge should never find anything, but a defense that depends on one check being correct fails when that check is wrong.

1

Materialize the pinned base tree

git archive emits tree contents only, so .git never exists to leak a reference solution.
2

Guard every touched path

A protected- or grader-path violation is a hard reject and the pinned commands never run.
3

Apply the provider diff

Allowed source paths only, as explicit file changes, never a shell patch of attacker-controlled input.
4

Quarantine provider test hooks

src/conftest.py sits inside an allowed path and pytest would still execute it. Allowed to write is not allowed to grade.
5

Purge grader paths, inject the buyer's bundle

The graded bytes are the buyer's, whatever the provider submitted.
6

Run only the pinned commands

argv vectors with no shell, in a rebuilt environment with no inherited secrets.
7

Install the runtime grader guard

An audit hook loaded outside the workspace stops provider code reading the graded tests. Blocking edits was not enough: code that reads them can answer from them without implementing anything.
8

Hash the tree and bind the result

tree_hash and submission_sha go into the receipt, so payment is for that exact artifact.

Probe exit code

Default Cloud Run

→

Sealed VPC

Each bit of the exit code is one destination. The change from 21 to 17 is the whole measurement: the same probe, run twice, against two configurations.

Network posture: measured

A probe executed inside a real Cloud Run Job, encoding each result as a bit of its exit code. Cloud Run surfaced neither stdout nor stderr, so the exit code was the only channel; a loopback control bit was included so a broken probe reports itself instead of masquerading as a passing guarantee.

Destination	Default Cloud Run	Sealed VPC
loopback (control)	reachable	reachable
1.1.1.1:443	reachable	blocked
142.250.72.46:443	blocked	blocked
93.184.216.34:80	blocked	blocked
DNS resolution	reachable	reachable

The first configuration reached the public internet. Cloud Run grants egress by default. An earlier version of this system asserted default-deny while the deployed job could reach Cloudflare, and because the manifest writes that field into a signed receipt, it would have signed a false statement. The claim is now deny-tcp-egress; dns-resolution-available. DNS still resolves and is disclosed as a residual signalling channel rather than rounded up.

Anti-gaming defenses

Each attack below is executed against a real repository with a real pytest process and asserted to fail. Mocking the runner would prove nothing; the grade has to actually be computed.

P1.1

A conftest.py hook that forces every outcome to pass

Quarantined before the run and recorded as a tamper signal, not silently fixed up.

P1.1

A sitecustomize.py that executes before any test is imported

Same quarantine: hooks the provider introduced or modified anywhere are removed.

P1.1b

Reading the graded tests at run time and answering from them

A submission that implemented nothing passed this way before the guard existed. Grader reads from provider source now raise.

P1.2

Reading the reference solution out of .git history

History never reaches the workspace, so there is nothing to read.

P1.3

Rewriting the graded tests

Rejected outright; the buyer's bundle also overwrites them regardless.

P1.3

Correct code that also disables the deploy gate

Rejected before any command runs; passing tests cannot rescue a path violation.

P0.4

Force-pushing a new head SHA after a PASS

A new SHA supersedes the previous artifact and invalidates its verification.

Scope: a run proves whether the submission satisfied the buyer's pinned contract. It does not assess code quality, security, or mergeworthiness.