Sovereign Tensor Container (STC) and Provenance (STP) Specifications
draft-somaratne-scitt-stc-stp-00

SCITT Working Group                                         C. Somaratne
Internet-Draft                                    Sovereign Stack Global
Intended status: Informational                            28 August 2026
Expires: 1 March 2027

  Sovereign Tensor Container (STC) and Provenance (STP) Specifications
                    draft-somaratne-scitt-stc-stp-00

Abstract

   This document defines the Sovereign Tensor Container (STC-1.0) and
   Sovereign Tensor Provenance (STP-1.0) specifications.  STC-1.0
   establishes a strict 64-byte physical memory alignment standard for
   binary machine learning tensor payloads to enable zero-copy Direct
   Memory Access (DMA).  STP-1.0 defines an embedded cryptographic
   provenance framework utilizing C2PA profiles, X.509 signature chains,
   and SCITT-compatible attestations to secure supply-chain integrity
   for distributed AI models.

Status of This Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at https://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on 1 March 2027.

Copyright Notice

   Copyright (c) 2026 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

Somaratne                 Expires 1 March 2027                  [Page 1]
Internet-Draft            STC and STP for SCITT              August 2026

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents (https://trustee.ietf.org/
   license-info) in effect on the date of publication of this document.
   Please review these documents carefully, as they describe your rights
   and restrictions with respect to this document.  Code Components
   extracted from this document must include Revised BSD License text as
   described in Section 4.e of the Trust Legal Provisions and are
   provided without warranty as described in the Revised BSD License.

Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
   2.  STC-1.0: Memory Alignment Architecture  . . . . . . . . . . .   2
   3.  STP-1.0: Cryptographic Provenance (TRUST Block) . . . . . . .   3
     3.1.  C2PA and X.509 Integration  . . . . . . . . . . . . . . .   3
     3.2.  SCITT Attestation . . . . . . . . . . . . . . . . . . . .   3
   4.  Security Considerations . . . . . . . . . . . . . . . . . . .   3
   5.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .   3
   6.  References  . . . . . . . . . . . . . . . . . . . . . . . . .   3
     6.1.  Normative References  . . . . . . . . . . . . . . . . . .   3
     6.2.  Informative References  . . . . . . . . . . . . . . . . .   4
   Author's Address  . . . . . . . . . . . . . . . . . . . . . . . .   4

1.  Introduction

   The proliferation of large neural networks has exposed severe
   fragmentation in model distribution and supply-chain security.
   Existing container formats rely on out-of-band metadata files and
   arbitrary-length headers, which force unaligned memory access during
   host-to-device transfers and break cryptographic provenance chains
   upon redistribution.

   This document proposes an architectural framework to secure the AI
   supply chain by embedding Supply Chain Integrity, Transparency, and
   Trust (SCITT) principles directly into the tensor payload container.
   The foundational architecture is published under Zenodo [STC-ZENODO].

2.  STC-1.0: Memory Alignment Architecture

   To achieve true zero-copy Unified DMA, STC-1.0 dictates a hermetic
   binary container utilizing strict 64-byte physical cache-line
   alignment.

   All metadata preceding the tensor payload MUST be dynamically padded.
   Runtimes MUST apply the following mathematical constraint to
   calculate the padding length (in bytes) before the payload initiates:

   padding = (64 - (length (mod 64))) (mod 64)

Somaratne                 Expires 1 March 2027                  [Page 2]
Internet-Draft            STC and STP for SCITT              August 2026

   This alignment ensures execution runtimes can mmap the artifact and
   dispatch it directly to the GPU without CPU byte-shifting.

3.  STP-1.0: Cryptographic Provenance (TRUST Block)

   The STP-1.0 specification defines a mandatory TRUST block within the
   STC header structure.  This block acts as a cryptographic execution
   gate for inference engines.

3.1.  C2PA and X.509 Integration

   The TRUST block MUST contain:

   1.  An AI-specific C2PA manifest [C2PA] detailing training data
       lineage and synthetic token ratios.

   2.  An X.509 certificate chain [RFC5280] binding the artifact to a
       verified developer identity.

   3.  An absolute SHA-256 payload hash of the aligned tensor bytes.

3.2.  SCITT Attestation

   By embedding these cryptographic claims natively, the STC artifact
   functions as a self-contained Statement for a SCITT Transparency
   Service.  Inference runtimes SHOULD verify the X.509 signatures and
   payload hash against a trusted SCITT ledger before allocating VRAM.

4.  Security Considerations

   Traditional ML checksums are easily spoofed during man-in-the-middle
   redistribution, leading to weight poisoning.  STP-1.0 mitigates this
   by mandating cryptographic signature verification at the engine
   level.  A compromised private key could allow an attacker to sign a
   poisoned model; therefore, short-lived certificates and Time-Stamp
   Protocol (TSP) [RFC3161] integration are strongly recommended.

5.  IANA Considerations

   This document requests the registration of a new media type,
   application/vnd.stc, to identify Sovereign Tensor Container
   artifacts.

6.  References

6.1.  Normative References

Somaratne                 Expires 1 March 2027                  [Page 3]
Internet-Draft            STC and STP for SCITT              August 2026

   [RFC5280]  Cooper, D., Santesson, S., Farrell, S., Boeyen, S.,
              Housley, R., and W. Polk, "Internet X.509 Public Key
              Infrastructure Certificate and Certificate Revocation List
              (CRL) Profile", RFC 5280, DOI 10.17487/RFC5280, May 2008,
              <https://www.rfc-editor.org/info/rfc5280>.

   [RFC3161]  Adams, C., Cain, P., Pinkas, D., and R. Zuccherato,
              "Internet X.509 Public Key Infrastructure Time-Stamp
              Protocol (TSP)", RFC 3161, DOI 10.17487/RFC3161, August
              2001, <https://www.rfc-editor.org/info/rfc3161>.

   [C2PA]     "C2PA Technical Specification", n.d.,
              <https://c2pa.org/specifications/specifications/1.3/specs/
              C2PA_Specification.html>.

6.2.  Informative References

   [STC-ZENODO]
              "Sovereign Tensor Architecture: A Unified Open Standard",
              n.d., <https://doi.org/10.5281/zenodo.22120344>.

Author's Address

   Chamara Somaratne
   Sovereign Stack Global
   Email: chamara@anthosa.com

Somaratne                 Expires 1 March 2027                  [Page 4]