# Compute9 NVIDIA Inventory v0.1.0

Experimental Linux CLI for one owner-authorized, read-only NVIDIA inventory query. The parser, signature checks and rejection paths have software tests; this release has NOT been validated on real GPU hardware. No GPU workload, benchmark, scheduling, idle-capacity proof or supplier certification is implemented.

## Reproduce without hardware

Use Node.js >=22. Download all three files into the same directory:

- https://gpu9d.com/downloads/compute9-nvidia-inventory.cjs
- https://gpu9d.com/downloads/compute9-preflight.cjs
- https://gpu9d.com/downloads/compute9-evidence.cjs

Check SHA-256 and dependencies at https://gpu9d.com/downloads/manifest.json. Same-origin hashes detect differences, not independently authenticated releases.

    node compute9-nvidia-inventory.cjs demo

The built-in H100 row is synthetic. The output says input_mode:simulation, queried_at:null, hardware_query_performed:false and capacity_publishable:false. It must never be imported as a real resource offer or hardware test result.

## Authorized local collection

Only the resource operator may run collection after independently establishing owner authority, explicit monitoring permission, an approved zero-cost test scope and a current local mapping of the permitted resource to its NVIDIA device index. A valid signature is not proof of ownership or legal authority.

    node compute9-nvidia-inventory.cjs collect --owner-authorized --consent-file consent.json --plan-file plan.json --binding-file binding.json --trusted-key-file owner-public.pem --machine-ref UUID

The owner confirmation flag alone is insufficient. Both the existing signed consent/plan and a separate signed binding must validate against the independently obtained public key before the driver command runs. The plan action must be read_gpu_metrics; synthetic_gpu_test grants are rejected. Only gpu_class, gpu_count and vram_total_mib may be selected for output, subject to the signed publication whitelist. At least one field is required. No uploads or network calls occur.

The binding links an opaque resource_id, opaque machine_ref UUID, a single device_index (0–63) and validity window. It is signed by the same pinned Ed25519 key over UTF-8 `GPU9D/Compute9 NVIDIA binding v0.1`, one newline, then the canonical binding object. See:

- https://gpu9d.com/schemas/compute9-nvidia-binding-v0.1.schema.json
- https://gpu9d.com/schemas/compute9-nvidia-inventory-v0.1.schema.json
- https://gpu9d.com/compute9-preflight.md

Device indices are local and can change after reboot or driver changes. The operator must recheck/reissue the mapping on the authorized machine before collection. The supplied machine_ref is an operator-controlled reference, NOT hardware attestation. No UUID/serial/PCI address, IP, hostname, process list, commands, prompts, datasets, weights or outputs are queried or published.

## Fixed vendor query and limits

On supported Linux hosts the CLI invokes only /usr/bin/nvidia-smi, without a shell or a user-selected executable, with fixed query columns name,memory.total and CSV/no-header/no-units output, restricted to the signed device index. It uses a minimal environment, a 2 KiB output cap and at most five seconds, further bounded by the plan duration. Child-process errors do not echo vendor stderr or private input. Unknown models, multiple device rows, extra columns and invalid/unknown memory values fail closed.

The implementation follows NVIDIA's documented selective-query, --id and CSV options: https://docs.nvidia.com/deploy/nvidia-smi/index.html . Only the small model-name vocabulary in the source is supported; other GPUs require an explicit parser update. NVML/DCGM integration and AMD support remain future work. Read-only driver queries may initialize a driver or wake hardware; operator approval still matters.

This CLI only constrains its own query duration/output. It does not monitor or enforce active-workload utilization, VRAM or power budgets, and does not implement a GPU stress test. An application using the exported asynchronous function cannot change the checked grant/mapping/publication fields mid-query: the inputs are snapshotted before validation. Expired grants or a backward clock invalidate the returned result.

## Trust limits

Queried inventory is a local observation, not independently verified performance. Outputs explicitly mark resource ownership, physical machine binding and independent measurement as unverified. No replay/revocation service, trusted clock, ongoing monitoring, signed inventory result or full evidence-chain linkage is provided. File signatures and hashes do not prove telemetry truth or complete history. The generic evidence tool remains a separate simulation/integrity tool. No C2/C3/C4 grade is conferred.

Neither reading inventory nor finding low utilization creates usable spare capacity. Actual provider permission and a separately approved availability window are needed before any connection or active test. Production capacity stays empty until those facts are established. Platform services are free; this does not promise free GPUs or authorize paid use.