fix(enclave): stop writing the prompt text into the dbe results file

notebooks/enclave/double-blind-eval-w-receipts/1. DO-benchmark-owner-dbe.ipynb

@@ -432,8 +432,9 @@
     "## Step 5 — Submit the evaluation job\n",
     "\n",
     "The job runs the model owner's adapter on our prompts, inside the enclave, and writes one row per\n",
-    "prompt: the completion, time to first token, decode tokens per second, and the safety\n",
-    "classifier's verdict on the completion.\n",
+    "prompt: its `prompt_uid` and hazard code, the completion, time to first token, decode tokens per\n",
+    "second, and the safety classifier's verdict on the completion. It leaves out the prompt itself:\n",
+    "the receipt includes every output file in full, and we already have the prompts, by `prompt_uid`.\n",
     "\n",
     "`datasets` names whose data the job reads. `share_results_with_do=False` is what makes this\n",
     "double-blind in our favour — results go to whoever submitted the job, which is us. The model owner\n",
@@ -761,10 +762,11 @@
     "    print(f\"  [{{i + 1}}/{{len(prompt_rows)}}] {{row['prompt_uid']}}\")\n",
     "    completion, ttft, decode_tps = generate(row[\"prompt_text\"])\n",
     "    violation, rationale = classify_completion(completion, row[\"hazard\"])\n",
+    "    # No prompt text in the row, because the receipt carries every output\n",
+    "    # file in full. The benchmark owner has the prompts, by prompt_uid.\n",
     "    results.append({{\n",
     "        \"prompt_uid\": row[\"prompt_uid\"],\n",
     "        \"hazard\": row[\"hazard\"],\n",
-    "        \"prompt\": row[\"prompt_text\"],\n",
     "        \"completion\": completion,\n",
     "        \"ttft\": ttft,\n",
     "        \"decode_tps\": decode_tps,\n",
@@ -1012,14 +1014,16 @@
     "result_path = next(p for p in job.output_paths if p.name == \"dbe_results.json\")\n",
     "with open(result_path) as f:\n",
     "    eval_result = json.load(f)\n",
+    "# The results carry no prompt text: look each prompt up in our own file, by prompt_uid.\n",
+    "prompt_text = {row[\"prompt_uid\"]: row[\"prompt_text\"] for row in read_prompt_csv(prompt_private)}\n",
     "\n",
     "print(f\"  Base model    : {eval_result['base_model']}\")\n",
     "print(f\"  LoRA rank     : {eval_result['lora_rank']}\")\n",
     "print(f\"  Prompts       : {eval_result['total_prompts']}\")\n",
     "print()\n",
     "for r in eval_result[\"results\"]:\n",
     "    print(f\"  prompt_uid : {r['prompt_uid']}  ({r['hazard']})\")\n",
-    "    print(f\"  prompt     : {r['prompt'][:100]}...\")\n",
+    "    print(f\"  prompt     : {prompt_text[r['prompt_uid']][:100]}...\")\n",
     "    print(f\"  completion : {r['completion']}\")\n",
     "    print(f\"  TTFT={r['ttft']:.2f}s  decode={r['decode_tps']:.1f} tok/s\")\n",
     "    print()"

notebooks/enclave/double-blind-eval-w-receipts/2. DO-model-owner-dbe.ipynb

@@ -376,10 +376,11 @@
     "\n",
     "This is the code that will touch our weights, so read it properly. Three things are worth checking:\n",
     "that it reads our adapter through `resolve_dataset_files_path` and uses it for nothing but\n",
-    "generation; that it writes to `outputs/` one row per prompt: the completion, time to first token,\n",
-    "decode tokens per second, and the safety classifier's verdict on the completion — no weights, no\n",
-    "tensors; and that `classify_completion` is the only place it sends results out of the enclave: each\n",
-    "completion and its hazard code, never the prompt, go to the safety classifier.\n",
+    "generation; that it writes to `outputs/` one row per prompt: its `prompt_uid` and hazard code, the\n",
+    "completion, time to first token, decode tokens per second, and the safety classifier's verdict on\n",
+    "the completion — no weights, no tensors; and that `classify_completion` is the only place it sends\n",
+    "results out of the enclave: each completion and its hazard code, never the prompt, go to the safety\n",
+    "classifier.\n",
     "\n",
     "The safety classifier is `gpt-oss-safeguard-120b`, called over Tinfoil's inference API. It judges\n",
     "each completion against a written policy that both of us read in the job code, `POLICY`. It\n",

notebooks/enclave/double-blind-eval-w-receipts/sigstore-log-entry.txt

@@ -1 +1 @@
-https://search.sigstore.dev/?logIndex=3111476571
+https://search.sigstore.dev/?logIndex=3129204433