Open-source tools for verifying AI compute agreements: checking that a datacenter serves only declared inference (AI 2040: Plan A), that a hardwired pause of frontier training would hold, and the open problems in the AI Security Forum RFDs.
Everything here is tested in simulation and in continuous integration. Nothing has been demonstrated on real hardware yet, and each repository says what it does not show.
Start here: plan-a-closure
Every joule, packet byte and byte of GPU memory on a node has to be explained by verified work, and whatever is left over bounds hidden compute. It maps all 79 Plan A requirements to code and tests, re-derives 114 of the numbers in the hardwired-pause paper, and carries the component repositories below.
If you have an H100 or H200, the most useful thing you could do is run its one-GPU pilot. It needs no meeting: one unattended command, about two hours, and the GPU is left as it was found.
git clone https://github.com/AnonRish/plan-a-closure && cd plan-a-closure
python3 -m venv .venv && . .venv/bin/activate
pip install -e ".[test,hw]"
sudo -E env PATH="$PATH" closure tier0 --confirm-hardware --gpu 0 --out runs/tier0Operator guide · Plan A coverage · Hardwired-pause re-derivation
Vendored into plan-a-closure and tested with it.
| Repository | What it does |
|---|---|
| aisecurity-rfds | Tested packages for 8 of the 42 AI Security Forum RFDs, each stating what it does not show |
| assurance-curves | Detection math for partial recomputation: assurance curves, detection time, false-alarm budgets |
| weight-diode | One-way transport for model weights, checked against a signed manifest, with no reverse path |
| covert-timing-warden | Timing covert channels on tapped inference clusters: detectors, capacity bounds, mitigation |
| tap-logger-rtl | Verilog SHA-256 hash-chain frame logger, checked in simulation against a Python reference |
| packet-forge | Adversarial TCP overlap corpus and normalising reassembler for testing network taps |
| fides | Packet-hashing inference-only verification tap, with TOPLOC and DiFR reference implementations |
| cuda-guard | Evidence classes, verdicts and a tamper-evident ledger for GPU-side verification |
| compute-ledger | Chip-stock accounting: declared against estimated compute, with uncertainty |
| continental-load-registry | Public registry of large-load grid interconnection requests, with a bound on residual compute (dashboard) |
| Repository | What it does |
|---|---|
| transparency-report-schema | A machine-checkable format for the transparency reports Plan A proposes |
| roadmap-calc | Calculators and consistency checks for the numbers in the AI 2040 Alignment Roadmap |
| incident-evidence-ledger | Signed, hash-chained, third-party-verifiable records of AI incidents |
| control-eval-sim | A simulator for AI-control protocols: monitoring, audit budgets, safety-usefulness frontiers |
| eval-distinguishability-audit | Tests whether evaluation prompts can be told apart from real usage |
Earlier Plan A work (ai-2040-plan-a-toolkit, ai-2040-verification, frontier-verify) is superseded by plan-a-closure and kept for reference.
Corrections, red-team results and hardware runs are all welcome: open an issue on the repository concerned, or email AnonRish@protonmail.com.