Public reference observatory

Route evidence and recent changes

Follow each client route from plaintext holder to reference policy and observed evidence. The dated adapter rows below describe checks performed by this repository; they are not full provider verdicts.

Published

Values or policy bytes available from a provider.

Accepted

Values a particular client or verifier permits.

Observed

Evidence returned on one route at a stated time.

These sets can differ during rollout or after retirement. A public file fetch proves publication, not signature validity, hardware state or request binding. How to read the evidence

Explore the reference history graph →
Observed workload changes, published reference sets, full values, and the evidence available to estimate change size.

Change timeline

429 recorded events · latest 20 shown

A new identity means newly observed by this sampling process. It does not establish a deployment date or authorize a new value.

Reviewed: needs evidence · aci-gateway/tee.redpill.ai

The tee.redpill.ai coverage_lost event compares a 2026-10-13 legacy adapter 'verified' row with a 2026-10-14 current 'not_checked' row. The newer verifier requires boot-measurement and request-path proof that the older result did not establish. Captured gateway quote, nonce, keyset, event-log and compose fields support several narrower bindings, but do not complete those missing checks. This is primarily an instrument-scope downgrade, not evidence that the provider changed to a compromised deployment. The three ACI hosts share one observed gateway workload; zero full-valid adapter results do not imply three compromised providers.

Confirmed immutable report/raw-evidence integrity, unchanged reported compose identity and the new explicit boot/request proof gap. The coverage event primarily corrects the instrument claim; it does not demonstrate a compromised deployment. The reported keyset change remains a separate unproven continuity question. Retain not_checked, do not expand accepted references, and verify boot measurements plus a bound backend request before a full-route claim.

Review and evidence ↗

2026-10-30T18:37

publication_changed publication/private-inference-browser-verifier

9d68c1e1d57d13a8dff8 → d6c7657ac48ad30048e2 (hash prefixes)

Event evidence ↗ Awaiting review

2026-10-30T18:37

publication_changed publication/private-inference-chat-main

cc74f71c0c7623e27b8c → 8b50bd1b31ddbdcf328e (hash prefixes)

Event evidence ↗ Awaiting review

2026-10-30T18:37

publication_changed publication/private-inference-chat-html

c515a6322b4b25e14a0e → 5b6f7d33eb93613ab1de (hash prefixes)

Event evidence ↗ Awaiting review

2026-10-30T18:37

catalog_changed publication/private-inference-catalog

fcef1b4eabb77cd20a20 → 0c3572a1e179d8eb5f8f (hash prefixes)

Event evidence ↗ Awaiting review

2026-10-30T18:37

publication_changed publication/confidential-ai-releases

bc59a4ab591df86a2396 → 93c5921df2f65fe3297f (hash prefixes)

Event evidence ↗ Awaiting review

2026-10-30T18:36

untrusted_identity_reported near-ai/zai-org/GLM-5.1-FP8 · compose_hash

a0e3c6f4f21a60ea3f5c96bc7ef319b03a184ca2049605399275fbcea74e8c5f → 5f7ebd85cf1f480a118f75dd10fd0cb277e4ddbb23845f1c20d8ea0f1e87efa6

Event evidence ↗ Awaiting review

2026-10-29T18:57

catalog_changed publication/private-inference-catalog

e4597e1f21738bd82f75 → fcef1b4eabb77cd20a20 (hash prefixes)

Event evidence ↗ Awaiting review

2026-10-29T18:57

publication_changed publication/confidential-ai-releases

5dc8e6bcf5c3410dadfb → bc59a4ab591df86a2396 (hash prefixes)

Event evidence ↗ Awaiting review

2026-10-29T18:57

publication_changed publication/privatemode-manifest

b47473de3d4246903490 → cb8fe2f3b8973b8d12f9 (hash prefixes)

Event evidence ↗ Awaiting review

2026-10-29T18:57

untrusted_identity_reported tinfoil/router · measurement

9134838da8aa4e1792566b2988820340356517c4db0c94261eb8154843e0357554ba72fcf185f950d9301fbede574c90 → e716274321b31eaf1301d3eddfbe477da1a69c6a8afeea9f8cd36b6546d94728ffb88b4eb11f0a4cc76e40e3b294b8a7

Event evidence ↗ Awaiting review

2026-10-29T18:57

untrusted_identity_reported tinfoil/router · bundle_digest

5233a27f1468f474d27c103e06c1a7a607e6a722ff4f9299ddf4e32fa87f201e → adc71cdb94b8762993777156f3290463f3a8ee2ea42665289a83d502cdf69d76

Event evidence ↗ Awaiting review

2026-10-29T18:57

untrusted_identity_reported near-ai/zai-org/GLM-5.1-FP8 · image_digest

a6e5cc53a138833fc5c57e39420a477d69cc1f5b33e7a777b9df52c42dfe9e8b → d38e6d816454de5c93690ef46f8297fd5e57c6b8c4b5dfe984b7e1229aa6b790

Event evidence ↗ Awaiting review

2026-10-29T18:57

untrusted_identity_reported near-ai/zai-org/GLM-5.1-FP8 · compose_hash

56444a2f3f5a709d2067e0150cfe9442345fbde2dd0e1998e705485a029d3865 → f571e5dafe8f96baf116a271b4be9cba228b447dd6ebe502bbda81ede7bcc7ce

Event evidence ↗ Awaiting review

2026-10-28T18:51

catalog_changed publication/private-inference-catalog

7a15310cdd7fcfaa1263 → e4597e1f21738bd82f75 (hash prefixes)

Event evidence ↗ Awaiting review

2026-10-28T18:51

publication_changed publication/confidential-ai-releases

4c7d3b413dc8a5bb3ee1 → 5dc8e6bcf5c3410dadfb (hash prefixes)

Event evidence ↗ Awaiting review

2026-10-27T18:41

catalog_changed publication/private-inference-catalog

89990cd77646394ac562 → 7a15310cdd7fcfaa1263 (hash prefixes)

Event evidence ↗ Awaiting review

2026-10-27T18:41

publication_changed publication/confidential-ai-releases

cc241ccd0d6d396a5df6 → 4c7d3b413dc8a5bb3ee1 (hash prefixes)

Event evidence ↗ Awaiting review

2026-10-27T18:41

publication_changed publication/maple-legacy-pcrDevHistory.json

4da33a08bf1a1697cfde → 9444fb6e133e6626958c (hash prefixes)

Event evidence ↗ Awaiting review

2026-10-27T18:41

publication_changed publication/maple-canonical-pcrDevHistory.json

4da33a08bf1a1697cfde → 9444fb6e133e6626958c (hash prefixes)

Event evidence ↗ Awaiting review

2026-10-27T18:41

publication_changed publication/maple-legacy-pcrDev.json

cfc1b9b9999b073bee20 → df5ddc0708bc9f267a02 (hash prefixes)

Event evidence ↗ Awaiting review

Client routes and plaintext holders

19 routes · inventory reviewed 2026-10-13

A model or brand can have multiple routes. Each card names who can receive plaintext and what its client accepts.

ACI gateway: tee.redpill.ai

TLS to gateway · HTTPS

partial

Plaintext holders

ACI gateway enclave; selected backend after gateway forwarding

Client acceptance

Current adapter checks selected gateway fields; independent quote-to-statement and backend-session binding remain under repair.

2 reference inputs

gateway: TDX quote, compose and keyset · published at live attestation endpoint · accepted by repository adapter (observed adapter check)
backend: session evidence digest · published at gateway report · accepted by unverified in adapter (self reported)

1 adapter row matched: tee.redpill.ai — not checked

Open: Verify authenticated quote body binds reported keyset, nonce and compose payload; Verify backend session bundles

Next: Re-run negative binding tests and inspect live request route.

Sources: redpill.md ↗aci.py ↗

ACI gateway: inference.phala.com

TLS to gateway · HTTPS

partial

Plaintext holders

ACI gateway enclave; selected backend after gateway forwarding

Client acceptance

Hostname policy differs from the RedPill host; the shared gateway workload does not establish the selected backend.

2 reference inputs

gateway: TDX quote, compose and keyset · published at live attestation endpoint · accepted by repository adapter (observed adapter check)
backend: session evidence digest · published at gateway report · accepted by unverified in adapter (self reported)

1 adapter row matched: inference.phala.com — not checked

Open: Verify authenticated quote bindings and backend session bundles

Next: Trace one harmless request through the selected route.

Sources: phala.md ↗aci.py ↗

ACI gateway: api.redpill.ai

TLS to gateway · HTTPS

partial

Plaintext holders

ACI gateway enclave; potential non-TEE backend selected by policy

Client acceptance

This hostname's measured policy does not force TEE-only serving; a valid gateway quote cannot establish private backend execution.

1 reference input

gateway: TDX quote and measured domain policy · published at live attestation endpoint · accepted by repository adapter (observed adapter check)

1 adapter row matched: api.redpill.ai — adapter rejected

Open: Request-bound backend evidence absent

Next: Keep this hostname separate in route displays and test routing enforcement.

Sources: redpill.md ↗aci.py ↗

NEAR AI gateway, ordinary HTTPS

plain_gateway · HTTPS

partial

Plaintext holders

NEAR cloud-api gateway; selected model worker

Client acceptance

The adapter compares each requested model with its own anchor entry and records the authorization query's Base block number and hash. Chain authorization is operator policy, not independent client approval or request-path proof.

2 reference inputs

gateway: TDX compose hash · published at on-chain app authorization and live quote · accepted by repository adapter per observed hash at recorded Base block (observed adapter check)
worker: model compose hash · published at on-chain authorization and Hermes model mapping · accepted by repository adapter checks the requested model's own anchor entry; client policy remains separate (partially checked)

2 adapter rows matched: openai/gpt-oss-120b — unavailablezai-org/GLM-5.1-FP8 — adapter rejected

1 public source capture for this provider; publication only, last attempt 2026-10-26T19:19.

Open: Authenticate compose-manager actions and model identity through the quote/event chain; Bind selected backend and encryption or TLS key to the actual request

Next: Verify the remaining authenticated model and request chain with controlled mismatches.

Sources: near-ai.md ↗review.md ↗

NEAR AI gateway with application encryption

verified_e2ee · application E2EE over HTTPS

candidate route

Plaintext holders

client before encryption; selected model TEE for protected fields; gateway may read unencrypted metadata and fields

Client acceptance

Client must authorize the requested model and bind the attested key before encryption; protection covers only selected fields. Open response-key substitution issue #1061 limits reply confidentiality.

1 reference input

worker: TDX compose, GPU and key · published at live quote plus model authorization · accepted by specific E2EE client implementation (source inspected)

No matched request observation. This route has an inventory or source review only.

1 public source capture for this provider; publication only, last attempt 2026-10-26T19:19.

Open: End-to-end request trace and response-key fix

Next: Test a pinned client with a harmless request and altered route/key.

Sources: e2ee-chat-completions ↗1061 ↗

NEAR AI experimental direct model endpoint

direct · direct model HTTPS/E2EE

candidate route

Plaintext holders

client before encryption; model worker after decryption

Client acceptance

Bypassing the gateway does not itself verify the direct channel; this repository's lightclient does not complete an encrypted request.

1 reference input

worker: model quote, key and authorization · published at live model endpoint and on-chain authorization · accepted by experimental client implementation (unverified)

No matched request observation. This route has an inventory or source review only.

1 public source capture for this provider; publication only, last attempt 2026-10-26T19:19.

Open: Authenticated action hash and quote binding; encrypted completion

Next: Verify each detached-to-authenticated link and complete a request.

Sources: near_ai_lightclient.py ↗review.md ↗

Tinfoil router to model enclave

SDK or HTTPS · HPKE/TLS

partial

Plaintext holders

Tinfoil router enclave; selected model enclave

Client acceptance

Router's embedded repo pins and measured code can constrain worker admission; direct worker endpoints are currently unavailable for independent probes.

2 reference inputs

router: SEV-SNP measurement and Sigstore release · published at tagged GitHub release · accepted by repository adapter (observed adapter check)
worker: model enclave measurement · published at router trust configuration · accepted by router runtime re-attestation (source inspected)

1 adapter row matched: router — not checked

Open: Independent AMD chain validation and worker request observation

Next: Preserve router release identity and regain worker evidence.

Sources: tinfoil.md ↗tinfoil.py ↗

Venice E2EE via NEAR

Venice E2EE · application E2EE over HTTPS

partial

Plaintext holders

client before encryption; NEAR worker after decryption; Venice relay may read unencrypted fields

Client acceptance

Attestation reachability and selected-field encryption depend on the actual Venice client and model route.

1 reference input

near-worker: TDX quote and model key · published at Venice attestation endpoint · accepted by Venice client policy or repository adapter (partially checked)

2 adapter rows matched: e2ee-glm-5-1 — adapter acceptede2ee-qwen3-6-35b-a3b — adapter accepted

1 public source capture for this provider; publication only, last attempt 2026-10-26T19:19.

Open: Request-bound model and key proof

Next: Refresh catalog and independently verify a sampled E2EE request.

Sources: venice.md ↗

Venice E2EE via Phala

Venice E2EE · application E2EE over HTTPS

partial

Plaintext holders

client before encryption; Phala worker after decryption; Venice relay may read unencrypted fields

Client acceptance

Phala backend evidence must be evaluated separately from NEAR-backed Venice routes.

1 reference input

phala-worker: worker quote and model key · published at Venice attestation endpoint · accepted by Venice client policy or repository adapter (partially checked)

3 adapter rows matched: e2ee-gemma-4-31b — unavailablee2ee-gpt-oss-120b-p — adapter acceptede2ee-qwen3-6-35b-a3b-uncensored-p — adapter accepted

1 public source capture for this provider; publication only, last attempt 2026-10-26T19:19.

Open: Some endpoints return no evidence; request-bound model and key proof

Next: Refresh catalog and distinguish missing evidence from failed verification.

Sources: venice.md ↗

Chutes TEE model route

Chutes API · HTTPS and encrypted worker transport

partial

Plaintext holders

API-side processing according to selected protocol; worker process and model

Client acceptance

MRTD identifies the dstack base TD but does not measure serve.py or model weights; matching the golden set is a narrower fact than workload approval.

1 reference input

worker: TDX MRTD · published at provider golden set · accepted by repository adapter and audit ledger (observed adapter check)

6 adapter rows matched: DeepSeek-V3.2-TEE — not checkedGLM-5.1-TEE — not checkedGLM-5.2-TEE — not checkedKimi-K2.6-TEE — not checkedQwen3-32B-TEE — unavailablegemma-4-31B-TEE — not checked

1 public source capture for this provider; publication only, last attempt 2026-10-26T19:19.

Open: Serving code and model artifact outside measured registers

Next: Inventory all confidential catalog models and investigate any unpublished MRTD.

Sources: chutes.md ↗chutes_tee.json ↗

Private Inference standard routing

standard · OpenAI-compatible HTTPS

provider claim

Plaintext holders

Private Inference proxy; selected supplier

Client acceptance

Standard routing makes no TEE-private claim; its supplier may be 0G, CheaperInference or OpenRouter according to published product description.

No matched request observation. This route has an inventory or source review only.

4 public source captures for this provider; publication only, last attempt 2026-10-30T18:37.

Open: Request-specific supplier unknown

Next: Track separately from private beta; do not score as confidential execution.

Sources: how-it-works ↗privateinference.md ↗

Private Inference zero-data-retention routing

zdr · OpenAI-compatible HTTPS

provider claim

Plaintext holders

Private Inference proxy; selected supplier

Client acceptance

ZDR is a retention policy and does not encrypt prompts from the Private Inference proxy.

No matched request observation. This route has an inventory or source review only.

4 public source captures for this provider; publication only, last attempt 2026-10-30T18:37.

Open: Retention enforcement and selected supplier unverified

Next: Keep retention claim outside confidentiality score.

Sources: how-it-works ↗privateinference.md ↗

Private Inference private beta via NEAR

private beta browser · browser E2EE over HTTPS

candidate unverified

Plaintext holders

browser before encryption; NEAR model TEE; relay can expose reply through unbound response-key header

Client acceptance

Inspected browser checks quote self-consistency but does not compare compose or OS image to an approved baseline; response key remains relay-substitutable per NEAR issue #1061.

2 reference inputs

browser: deployed JS bundle · published at privateinference.gg/chat · accepted by web delivery (source inspected)
near-worker: TDX compose and OS image · published at attestation endpoint · accepted by browser self-consistency checks; no approved baseline seen (unapproved reference)

No matched request observation. This route has an inventory or source review only.

4 public source captures for this provider; publication only, last attempt 2026-10-30T18:37.

Open: Attestation endpoint returned 401 without key; No independent approved model-to-workload baseline; Response-key binding gap

Next: Obtain authorized test key, verify a fresh quote and harmless encrypted completion, and test wrong-model rejection.

Sources: privateinference.md ↗how-it-works ↗

Maple Research or proxy via Tinfoil

web/native/SDK/local proxy · Nitro session then Tinfoil backend

candidate unverified

Plaintext holders

browser or local proxy before encryption; Maple OpenSecret Nitro enclave; Tinfoil router and worker enclaves

Client acceptance

SDK embedded roots can continue to accept an old PCR0; mutable signed histories authorize PCR0 text only. Upstream Tinfoil must be established separately.

2 reference inputs

opensecret: Nitro PCR0 · published at canonical and legacy signed histories · accepted by embedded SDK roots plus history on miss (publication monitored)
tinfoil: router and model measurement · published at Tinfoil releases · accepted by OpenSecret Tinfoil SDK (source inspected)

No matched request observation. This route has an inventory or source review only.

11 public source captures for this provider; publication only, last attempt 2026-10-30T18:37.

Open: No live Nitro/session evidence; No independent EIF rebuild; No request-bound upstream worker evidence

Next: Pin shipped client and source release, capture a fresh Nitro handshake, then trace chosen Tinfoil route.

Sources: maple.md ↗proof ↗

Maple Research or proxy via Continuum/Privatemode

web/native/SDK/local proxy · Nitro session then loopback sidecar

candidate unverified

Plaintext holders

browser or local proxy before encryption; Maple OpenSecret Nitro enclave; Continuum sidecar in Nitro image; Privatemode worker

Client acceptance

Nitro PCR0 covers checked-in sidecar bytes if deployed EIF matches source, but no source-to-binary or onward Privatemode proof has been established.

3 reference inputs

opensecret: Nitro PCR0 · published at canonical and legacy signed histories · accepted by embedded SDK roots plus history on miss (publication monitored)
continuum-sidecar: binary in measured Nitro rootfs · published at Maple source tree · accepted by Nitro PCR0 transitively (source inspected)
privatemode-worker: Privatemode manifest · published at CDN manifest · accepted by sidecar policy not yet inspected (unknown)

No matched request observation. This route has an inventory or source review only.

11 public source captures for this provider; publication only, last attempt 2026-10-30T18:37.

Open: No live Nitro/session evidence; Sidecar policy and upstream key exchange uninspected; No independent EIF rebuild

Next: Inspect sidecar source/build provenance and verify its onward Privatemode request.

Sources: maple.md ↗

Privatemode proxy with automatic manifest

proxy auto-update · local proxy to attested backend

candidate unverified

Plaintext holders

local proxy; Coordinator and secret service where key material is handled; selected model worker

Client acceptance

Default proxy can auto-adopt the latest provider manifest; a successful retry means agreement with current provider publication, not an independently pinned policy.

1 reference input

worker: SNP/TDX policies and GPU/model roots · published at CDN manifest · accepted by proxy fetches latest and retries after validation failure (publication monitored)

No matched request observation. This route has an inventory or source review only.

1 public source capture for this provider; publication only, last attempt 2026-10-30T18:37.

Open: No live key exchange/completion; Manifest policy values not independently reproduced; Coordinator and secret-service admission unverified

Next: Pin exact manifest, inspect all policies and test update/failure behavior.

Sources: landscape.md ↗ ↗

Privatemode proxy with pinned manifest

proxy pinned · local proxy to attested backend

candidate unverified

Plaintext holders

local proxy; Coordinator and secret service where key material is handled; selected model worker

Client acceptance

Locally pinned manifest may reject provider updates until operator review; actual fail-closed behavior requires a controlled request test.

1 reference input

worker: SNP/TDX policies and GPU/model roots · published at locally pinned CDN manifest copy · accepted by proxy --manifest-path (publication monitored)

No matched request observation. This route has an inventory or source review only.

1 public source capture for this provider; publication only, last attempt 2026-10-30T18:37.

Open: No pinned-client request test; Policy reproduction and key distribution unverified

Next: Test old/new manifest and mutated quote before sending a harmless prompt.

Sources: landscape.md ↗ ↗

Privatemode proxyless API

proxyless · HTTPS

candidate unverified

Plaintext holders

Privatemode service front door and backend according to deployed route

Client acceptance

Documentation says this path currently lacks client-side attestation; it needs a separate verdict from local proxy modes.

1 reference input

service: provider internal attestation policy · published at trust documentation · accepted by provider on caller's behalf (provider claim)

No matched request observation. This route has an inventory or source review only.

1 public source capture for this provider; publication only, last attempt 2026-10-30T18:37.

Open: No client-visible verified recipient or key binding

Next: Document actual TLS termination and provider-side checks before scoring.

Sources: ↗

Confidential AI Inference API

HTTPS API / TEErminator · TLS at c8s TEE then protected mesh

candidate unverified

Plaintext holders

tls-lb TEE; gateway; SGLang router and workers; operator access paths described in threat model

Client acceptance

Read-only allowlist and release capture does not verify Sigstore, hardware quote, exact TLS session, GPU evidence or request route. Public threat model documents operator/control-plane access paths.

2 reference inputs

tls-lb: TDX MRTD/RTMR, TLS cert and nonce · published at attestation endpoint and signed release · accepted by TEErminator with operator-reviewed pins (publication monitored)
worker: c8s allowlist and workload receipts · published at allowlist endpoint and signed release · accepted by client verifier policy (publication monitored)

No matched request observation. This route has an inventory or source review only.

3 public source captures for this provider; publication only, last attempt 2026-10-30T18:37.

Open: No cryptographic live proof; Operator key and unencrypted control-plane disk concerns; No request-bound worker/model proof

Next: Match live attestation to signed release and allowlist; test pinned TEErminator against same TLS session.

Sources: landscape.md ↗threat-model.md ↗

Public reference captures

Read-only HTTP captures preserve exact bytes and hashes. Every row here has no signature or quote verification. A fetch error keeps the last successful hash for continuity.

chutes

1 fetched · 0 errors

confidential-ai

3 fetched · 0 errors

maple

11 fetched · 0 errors

near-ai

1 fetched · 0 errors

private-inference

4 fetched · 0 errors

privatemode

1 fetched · 0 errors

venice

1 fetched · 0 errors

Maple canonical ↔ legacy: pcrDev.json match · pcrDevHistory.json match · pcrProd.json match · pcrProdHistory.json match. Byte agreement at this vantage does not validate signatures or live PCRs.

Inspect 22 captured sources and hashes

Source	State	Observed	SHA-256 / last success
maple-canonical-pcrProd.json	observed	2026-10-30T18:37	54b9c74fab6ac617c192f8bfbc3f88f0f51e0657b1895127cd784fc200de6702 raw bytes
maple-legacy-pcrProd.json	observed	2026-10-30T18:37	54b9c74fab6ac617c192f8bfbc3f88f0f51e0657b1895127cd784fc200de6702 raw bytes
maple-canonical-pcrProdHistory.json	observed	2026-10-30T18:37	1ebfe7a7ddd6ad28a07baff2272121120e4a9e12006241c7d8417a631ca5c7e9 raw bytes
maple-legacy-pcrProdHistory.json	observed	2026-10-30T18:37	1ebfe7a7ddd6ad28a07baff2272121120e4a9e12006241c7d8417a631ca5c7e9 raw bytes
maple-canonical-pcrDev.json	observed	2026-10-30T18:37	df5ddc0708bc9f267a0211d7ceb4bb1aa8313a8f966060fe89b0302cd87b1579 raw bytes
maple-legacy-pcrDev.json	observed	2026-10-30T18:37	df5ddc0708bc9f267a0211d7ceb4bb1aa8313a8f966060fe89b0302cd87b1579 raw bytes
maple-canonical-pcrDevHistory.json	observed	2026-10-30T18:37	9444fb6e133e6626958c646ab1930db56895cc60db03fab61f42f063febdab90 raw bytes
maple-legacy-pcrDevHistory.json	observed	2026-10-30T18:37	9444fb6e133e6626958c646ab1930db56895cc60db03fab61f42f063febdab90 raw bytes
maple-typescript-pcr-policy	observed	2026-10-30T18:37	f001d931e588c0c9b072be4b03b5b54adc94c8f82443b1bc616f7c7c87cb65fb raw bytes
maple-rust-pcr-policy	observed	2026-10-30T18:37	03f9d8fd5dd944506a90ece4e2bb620a65a8406ed307b063d1456a3245931cd6 raw bytes
maple-research-client-config	observed	2026-10-30T18:37	aa5a9c519a419e6bd8cdd6b4224d225004c4264e562090d219c17443c2a49e03 raw bytes
privatemode-manifest	observed	2026-10-30T18:37	cb8fe2f3b8973b8d12f99c3340d4102c642e6be40e26c2a9070e1a630e420bab raw bytes
confidential-ai-allowlist	observed	2026-10-30T18:37	8de45cdb8f1242d714bb0de35b2f4aceb7eba93b3537219cb20fa029d10eb58d raw bytes
confidential-ai-releases	observed	2026-10-30T18:37	93c5921df2f65fe3297fde77c021271f7ae371269d11b9ee943b058bcac9f4ac raw bytes
confidential-ai-observed-release	observed	2026-10-30T18:37	afccfe9ec2817527af7a69d668dac1ad9f1d10f8f524d1d66084cf1612c4b2d6 raw bytes
private-inference-catalog	observed	2026-10-30T18:37	0c3572a1e179d8eb5f8fb2a2e7b424a21df63f40f8abbdad21d79afc76670d63 raw bytes
private-inference-chat-html	observed	2026-10-30T18:37	5b6f7d33eb93613ab1de013c7cff1a6cd00fe58c04a195ca37f1e5048fb2fc10 raw bytes
private-inference-chat-main	observed	2026-10-30T18:37	8b50bd1b31ddbdcf328e2c4a2ff7e96a64d545ea0ea3fead3140b4689ab213a2 raw bytes
private-inference-browser-verifier	observed	2026-10-30T18:37	d6c7657ac48ad30048e22e4b3414fdb287605f70368bbd6a705dca2822f7bd67 raw bytes
near-ai-models	observed	2026-10-26T19:19	7ee44efcb4fd505487efa1ba328a40f7cc1872480e0e493ed0f66e201c531d34 raw bytes
chutes-models	observed	2026-10-26T19:19	30f7007d805ab38dcedf54fbfb4805793191ab63ebabf0036db4ecfed226727b raw bytes
venice-models	observed	2026-10-26T19:19	aef830252f6335d0e8646cf2dc8e81e7f4273a11c33fa8128e130c016a329e33 raw bytes

Current adapter observations

An adapter pass means its scoped code accepted a response. Unavailable evidence, an incomplete check and a checked rejection are different outcomes. See each route card for plaintext and policy gaps.

Target	Outcome	Reason / checked at	Checks
aci-gateway/api.redpill.ai	Adapter rejected	unspecified 2026-10-30T18:36:56Z	8 checked fields × TEE route enforced— Backend check✓ Catalog nonempty— Catalog serving— Client nonce— Reproduced build✓ Compose binding— Gateway review— GPU evidence— Hardware signature— HPKE key— Address binding— Release measurement✓ Fresh nonce✓ OS archive metadata— Production OS— Release provenance✓ Key binding— Runtime config— Serving code✓ Session digest listing✓ TDX appraisal— TLS key pin
aci-gateway/inference.phala.com	Not checked	verification_incomplete 2026-10-30T18:36:55Z	8 checked fields ✓ TEE route enforced— Backend check✓ Catalog nonempty— Catalog serving— Client nonce— Reproduced build✓ Compose binding— Gateway review— GPU evidence— Hardware signature— HPKE key— Address binding— Release measurement✓ Fresh nonce✓ OS archive metadata— Production OS— Release provenance✓ Key binding— Runtime config— Serving code✓ Session digest listing✓ TDX appraisal— TLS key pin
aci-gateway/tee.redpill.ai	Not checked	verification_incomplete 2026-10-30T18:36:56Z	8 checked fields ✓ TEE route enforced— Backend check✓ Catalog nonempty— Catalog serving— Client nonce— Reproduced build✓ Compose binding— Gateway review— GPU evidence— Hardware signature— HPKE key— Address binding— Release measurement✓ Fresh nonce✓ OS archive metadata— Production OS— Release provenance✓ Key binding— Runtime config— Serving code✓ Session digest listing✓ TDX appraisal— TLS key pin
chutes/DeepSeek-V3.2-TEE	Not checked	verification_incomplete 2026-10-30T18:37:11Z	4 checked fields — TEE route enforced— Backend check— Catalog nonempty— Catalog serving— Client nonce— Reproduced build— Compose binding— Gateway review— GPU evidence— Hardware signature— HPKE key— Address binding— Release measurement✓ Fresh nonce— OS archive metadata— Production OS— Release provenance✓ Key binding— Runtime config× Serving code— Session digest listing✓ TDX appraisal— TLS key pin
chutes/GLM-5.1-TEE	Not checked	verification_incomplete 2026-10-30T18:37:11Z	4 checked fields — TEE route enforced— Backend check— Catalog nonempty— Catalog serving— Client nonce— Reproduced build— Compose binding— Gateway review— GPU evidence— Hardware signature— HPKE key— Address binding— Release measurement✓ Fresh nonce— OS archive metadata— Production OS— Release provenance✓ Key binding— Runtime config× Serving code— Session digest listing✓ TDX appraisal— TLS key pin
chutes/GLM-5.2-TEE	Not checked	verification_incomplete 2026-10-30T18:37:12Z	4 checked fields — TEE route enforced— Backend check— Catalog nonempty— Catalog serving— Client nonce— Reproduced build— Compose binding— Gateway review— GPU evidence— Hardware signature— HPKE key— Address binding— Release measurement✓ Fresh nonce— OS archive metadata— Production OS— Release provenance✓ Key binding— Runtime config× Serving code— Session digest listing✓ TDX appraisal— TLS key pin
chutes/Kimi-K2.6-TEE	Not checked	verification_incomplete 2026-10-30T18:37:16Z	4 checked fields — TEE route enforced— Backend check— Catalog nonempty— Catalog serving— Client nonce— Reproduced build— Compose binding— Gateway review— GPU evidence— Hardware signature— HPKE key— Address binding— Release measurement✓ Fresh nonce— OS archive metadata— Production OS— Release provenance✓ Key binding— Runtime config× Serving code— Session digest listing✓ TDX appraisal— TLS key pin
chutes/Qwen3-32B-TEE	Unavailable	RuntimeError: HTTP 404 on /e2e/instances/ac059e33-eb27-541c-b9a9-24b214036475: {"detail":"Chute not found"} 2026-10-30T18:37:07Z	0 checked fields — TEE route enforced— Backend check— Catalog nonempty— Catalog serving— Client nonce— Reproduced build— Compose binding— Gateway review— GPU evidence— Hardware signature— HPKE key— Address binding— Release measurement— Fresh nonce— OS archive metadata— Production OS— Release provenance— Key binding— Runtime config— Serving code— Session digest listing— TDX appraisal— TLS key pin
chutes/gemma-4-31B-TEE	Not checked	verification_incomplete 2026-10-30T18:37:10Z	4 checked fields — TEE route enforced— Backend check— Catalog nonempty— Catalog serving— Client nonce— Reproduced build— Compose binding— Gateway review— GPU evidence— Hardware signature— HPKE key— Address binding— Release measurement✓ Fresh nonce— OS archive metadata— Production OS— Release provenance✓ Key binding— Runtime config× Serving code— Session digest listing✓ TDX appraisal— TLS key pin
near-ai/openai/gpt-oss-120b	Unavailable	HTTP 400: {"error":{"message":"Model 'openai/gpt-oss-120b' not found. It's not a valid model name or alias.","type":"invalid_request_error","param":"model","code":null}} 2026-10-30T18:36:57Z	0 checked fields — TEE route enforced— Backend check— Catalog nonempty— Catalog serving— Client nonce— Reproduced build— Compose binding— Gateway review— GPU evidence— Hardware signature— HPKE key— Address binding— Release measurement— Fresh nonce— OS archive metadata— Production OS— Release provenance— Key binding— Runtime config— Serving code— Session digest listing— TDX appraisal— TLS key pin
near-ai/zai-org/GLM-5.1-FP8	Adapter rejected	unspecified 2026-10-30T18:36:59Z	7 checked fields — TEE route enforced— Backend check— Catalog nonempty— Catalog serving— Client nonce— Reproduced build× Compose binding× Gateway review✓ GPU evidence— Hardware signature— HPKE key✓ Address binding— Release measurement✓ Fresh nonce— OS archive metadata— Production OS— Release provenance✓ Key binding— Runtime config— Serving code— Session digest listing✓ TDX appraisal— TLS key pin
tinfoil/router	Not checked	AMD SNP report signature and VCEK chain not verified 2026-10-30T18:37:00Z	6 checked fields — TEE route enforced— Backend check— Catalog nonempty— Catalog serving× Client nonce— Reproduced build— Compose binding— Gateway review— GPU evidence— Hardware signature✓ HPKE key— Address binding✓ Release measurement— Fresh nonce— OS archive metadata— Production OS✓ Release provenance— Key binding× Runtime config— Serving code— Session digest listing— TDX appraisal✓ TLS key pin
venice/e2ee-gemma-4-31b	Unavailable	no TEE attestation available for this model (404) 2026-10-30T18:37:03Z	0 checked fields — TEE route enforced— Backend check— Catalog nonempty— Catalog serving— Client nonce— Reproduced build— Compose binding— Gateway review— GPU evidence— Hardware signature— HPKE key— Address binding— Release measurement— Fresh nonce— OS archive metadata— Production OS— Release provenance— Key binding— Runtime config— Serving code— Session digest listing— TDX appraisal— TLS key pin
venice/e2ee-glm-5-1	Adapter accepted	adapter_accepted 2026-10-30T18:37:02Z	5 checked fields — TEE route enforced× Backend check— Catalog nonempty— Catalog serving— Client nonce— Reproduced build— Compose binding— Gateway review— GPU evidence— Hardware signature— HPKE key✓ Address binding— Release measurement✓ Fresh nonce— OS archive metadata— Production OS— Release provenance✓ Key binding— Runtime config— Serving code— Session digest listing✓ TDX appraisal— TLS key pin
venice/e2ee-gpt-oss-120b-p	Adapter accepted	adapter_accepted 2026-10-30T18:37:04Z	5 checked fields — TEE route enforced× Backend check— Catalog nonempty— Catalog serving— Client nonce— Reproduced build— Compose binding— Gateway review— GPU evidence— Hardware signature— HPKE key✓ Address binding— Release measurement✓ Fresh nonce— OS archive metadata— Production OS— Release provenance✓ Key binding— Runtime config— Serving code— Session digest listing✓ TDX appraisal— TLS key pin
venice/e2ee-qwen3-6-35b-a3b	Adapter accepted	adapter_accepted 2026-10-30T18:37:03Z	7 checked fields — TEE route enforced× Backend check— Catalog nonempty— Catalog serving— Client nonce— Reproduced build✓ Compose binding— Gateway review✓ GPU evidence— Hardware signature— HPKE key✓ Address binding— Release measurement✓ Fresh nonce— OS archive metadata— Production OS— Release provenance✓ Key binding— Runtime config— Serving code— Session digest listing✓ TDX appraisal— TLS key pin
venice/e2ee-qwen3-6-35b-a3b-uncensored-p	Adapter accepted	adapter_accepted 2026-10-30T18:37:06Z	6 checked fields — TEE route enforced× Backend check— Catalog nonempty— Catalog serving— Client nonce— Reproduced build— Compose binding— Gateway review✓ GPU evidence— Hardware signature— HPKE key✓ Address binding— Release measurement✓ Fresh nonce— OS archive metadata— Production OS— Release provenance✓ Key binding— Runtime config— Serving code— Session digest listing✓ TDX appraisal— TLS key pin

Sampling and audit limits

3695 historical provider/model observations over 188 sampled dates. Error-string buckets include 863 transport-classified rows and 396 invalid rows with no recorded reason. These correlated samples do not estimate a provider failure rate or detector sensitivity.

Newly observed identities are first sightings, not confirmed deployments. Inspect sampled identity cadence and gaps. Published references, accepted policy, and same-request proof remain separate evidence.