L2 · DEVICE AGENT · FREE

One command, and the machine speaks for itself / device-signed identity

A device keypair is generated on the machine, telemetry is signed locally, and the server only writes a record after the signature verifies. The private key never leaves the host. No account, no API key, no cost.

Devices signed

real hosts (demo excluded)

Hosts claimable

1,239

already priced in the ledger

Claimed

devices with a host bridge

Why this page exists: the L2 layer has been specified since v0.1 but shipped zero real devices — not because nobody wanted it, but because there was no command anyone could actually run. This page is that command, plus the honest disclosure of what it does and does not prove.

Run it

bash

# 1) download (single file, zero dependencies, Node 16+)
curl -sO https://cvin.org/cvin_attest_agent.js

# 2) see what it would send (nothing uploaded)
node cvin_attest_agent.js --dry-run

# 3) attest (L2) and claim your marketplace host id in one go
node cvin_attest_agent.js --link vast.ai:513108 --operator "your-company"

# 4) keep it fresh: re-sign hourly (identity goes stale after 30 days)
node cvin_attest_agent.js --watch 60

Only nvidia-smi is read — the agent does not touch your workloads, does not open a port, and does not phone home anywhere except the endpoint you point it at.

What it proves, what it does not

Proves	① The CVIN you claim matches a hash of this GPU's serial/UUID (the serial itself never leaves the host); ② every later telemetry record is signed by the same device key and only written after verification; ③ if you claim a host id, the server cross-checks the model against the public listings that host already has.
Does not prove	It does not prove the card was never swapped (swapping means a new CVIN), does not prove the operator is telling the truth (only that the same key keeps speaking), and does not prove legal ownership — we have no marketplace account access and do not pretend otherwise.
Key handling	Written to `~/.cvin/device-*.pem` with mode 0600 on first run and reused afterwards. Losing it means a new CVIN (the old history stays, but cannot be re-signed). Rotating a bound key is rejected by design — that is the anti-key-swap rule.

Telemetry fields (whitelist)

Only these fields are accepted and stored. Anything else is dropped before the signature is checked — so what you signed is exactly what a third party can recompute from the ledger.

Field	Source
hours_power_on	agent flag --hours (if your stack tracks it)
ecc_errors	nvidia-smi
ecc_uncorrectable	nvidia-smi
temp_c	nvidia-smi
power_w	nvidia-smi
sm_count	read from the driver
mem_total_mb	nvidia-smi
driver_version	nvidia-smi
uuid	never stored in clear (hashed)
pcie_bdf	nvidia-smi
utilization_pct	nvidia-smi

FAQ

8 cards in one box — 8 CVINs?	Yes. The identity is per card (per GPU UUID), and all 8 can claim the same host id. The host-level price then applies to the box; the report shows the division explicitly.
No GPU on this box	Then it is not a GPU asset — the agent exits with code 2 and tells you so instead of registering a fake identity.
AMD / Ascend / other vendors	The CVIN spec covers them (mfr token in the ID), the agent currently reads nvidia-smi only. Mail hi@cvin.org with model + serial and we will encode it with the same rule.
Card replaced / machine rebuilt	Card swap = new serial hash = new CVIN (keep the old one; the alias table links them). Reinstalling the OS is fine as long as you keep ~/.cvin.
Does it cost anything at the other end?	No. Writing never costs anything — declare, attest and bind are free forever. We charge for decision documents, not for evidence collection.

Claim your host id Identity levels Download the agent