Reference
Status and error vocabulary
Every badge, status word, stage name and event kind the product uses, and a glossary of the terms behind them.
ReferenceFor users, developers, administrators
Verification tiers in the console chat
| Badge | Tier |
|---|---|
| Verified by this page | 1, the console page, self-reported |
| Independently verified by the extension | 2, the browser extension |
| Verify it yourself | 3, Gatekeeper on your machine |
Refusals: Evidence did not check out (tier 1), The extension refused this endpoint (tier 2). Waiting: Checking this endpoint, Asking the extension. Absent: No extension detected.
Evidence state of this router's own endpoints
Published, Stale, Not published. Facts about publication, never verdicts. A bundle reads as stale after the deployment's freshness window, 24 hours.
External endpoint status
| Value | Badge | Meaning |
|---|---|---|
VERIFIED_BY_THIS_ROUTER | Verified by this router | Evidence verified, measurement on the trust list, digest pinned, certificate pinned |
DENIED_BY_THIS_ROUTER | Denied by this router | The last check refused it; models out of /v1/models |
PENDING | Pending (Awaiting a verdict to users) | No verdict yet, or awaiting approval of a factor |
DISABLED | Disabled (Switched off to users) | Taken out of service by an operator; not a verdict |
External endpoint stages
The lastStage of a denial, or the factor a pending endpoint waits on:
| Stage | Meaning | Action |
|---|---|---|
digest-not-pinned | No digest is pinned yet; projects to PENDING | Pin this digest |
measurement-not-trusted | The cloud's measurement is not on the list | Add to trust list, if you trust that cloud |
digest-mismatch | A digest is pinned and the deployment now publishes another | Approve new digest, after reading the diff |
fetch, cert-chain, untrusted-root, jws, tls-fingerprint, policy | The Gatekeeper pipeline stages, below |
Timeline event kinds
Registered, Verified by this router, Denied by this router, Deployment digest changed, Deployment digest pinned, Measurement changed, Disabled, Key rotated.
Measurement anchor
registry-signed (Super Protocol's registry signed it) or operator-pinned (an administrator accepted it). Display state only; the trust list is what admits.
Gatekeeper denial stages
stage | What happened |
|---|---|
fetch | The endpoint did not serve a usable bundle |
cert-chain | Its chain is malformed, expired or does not chain up |
untrusted-root | The chain ends somewhere you never trusted, and the root could not prove it is a Super Swarm root |
jws | Bad signature, wrong payload, or a stale or future bundle |
tls-fingerprint | The signed certificate is not the one on this connection |
policy | Verified, but a policy said no; usually an unpinned digest |
Verdict words: ADMITTED, DENIED. Root anchors: trustedRoots, attested (registry), attested (operator-pinned).
API error codes
Invitation refusals
invite_required, invite_already_claimed, invite_expired_or_unknown (403, invite-only deployments); the public lookup answers only unavailable.
Glossary
| Term | Meaning |
|---|---|
| Attestation | A hardware-signed report of what a confidential VM is running, and the act of checking it |
| Bundle | The signed document at /.well-known/swarm-evidence: chain, signature over the snapshot, TLS fingerprint, issuedAt |
| Evidence digest | SHA-256 of the canonical deployment snapshot: images by digest plus configuration. Identifies one deployment |
| Measurement | The normalised launch measurement of a cloud's root certificate authority VM, 64 hex characters. Identifies a cloud's image, never a deployment |
| Pin | A digest you approved for an endpoint; the list is plural so a rollout can be approved in advance |
| Registry | Super Protocol's public directory of signed measurements for the images it builds; the signing key is pinned in Gatekeeper |
| Registry-signed | A measurement found in that registry |
| Operator-pinned | A measurement you accepted yourself with trust measurements add |
| Snapshot | The deployment's images and configuration, as rendered and attested |
| TEE | Trusted execution environment: AMD SEV-SNP, Intel TDX, NVIDIA Confidential Computing |
| Tier | Which of the three agents produced a verdict about this router |
| Trust list | The administrator's list of cloud measurements for external upstreams |
| Workspace | The unit that owns keys and a credit balance; every account gets a personal one |