How to read the observatory

The homepage uses six route assessment axes, separate from raw adapter results. Read the versioned assessment rubric and dated source findings →

The unit of analysis is a client, model and request route. A brand can have several plaintext paths and different client policies. The route cards name the client mode, processes that may receive plaintext, published values, client acceptance and missing evidence.

Three distinct sets

Published

A provider serves a manifest, allowlist, release or reference history. Our capture retains exact bytes, origin, time and hash. Publication does not authenticate the file or prove deployment.

Accepted

An identified client policy permits a value. A built-in root, automatically refreshed manifest and locally pinned file have different authorities and rollback behavior.

Observed

A particular probe or request received evidence at one time. The check must bind authenticated measurement, recipient key, requested model and actual plaintext path before it supports a route verdict.

A mismatch may reflect a legitimate rollout, stale client, rejected update or attack. The change event requests review; it does not authorize a value. Reviewer decisions belong in separate signed or witnessed records.

What the current labels mean

Adapter accepted: The adapter accepted its scoped checks; this is not a full route verdict.
Adapter rejected: The adapter checked evidence and rejected it.
Not checked: Complete verification is unavailable; individual checks may have passed. Consult the stated missing proof.
Unsupported: The adapter cannot check this evidence surface.
Unavailable: Evidence or endpoint was unavailable; this is not a cryptographic rejection.
Stale: The latest evidence is too old for the stated freshness policy.
Not applicable: This check does not apply to this route.

A green adapter field is a result from that adapter's limited implementation. It is not an independent hardware, release or end-to-end request proof unless its verifier actually performed those checks. A missing credential is “not checked”; an HTTP failure is “unavailable”; a checked contradiction is “rejected.” Legacy snapshots may have only a boolean and narrower error context.

Reference capture and continuity

The publication probe makes bounded read-only HTTPS requests. Raw bodies are stored by SHA-256 and a derived latest index points to the last attempt and last success separately. Mirror comparison is byte agreement only. Changes in a public catalog's model or tier routing are distinct from volatile price text. The weekly model inventory is separate from the daily sentinel sample. Immutable events include route, old/new values, provenance and timestamp; no event is a deployment claim.

Reproduce the public baseline with python -m probes.references --catalogs. No key is required for the reference sources. Catalog endpoints may accept an existing API key through environment variables; credentials are never written into observations.

Sampled identity cadence

Daily probes can first see an existing fleet member. A value seen again can mean load balancing, rollback, recovery or sampling error. The table reports only observation windows; it does not estimate true rollout speed or fleet size.

Target	Source type	Samples	Distinct identities	Newly seen transitions	Observed days per new identity
aci-gateway/api.redpill.ai	control-plane	69	17	16	4.6
aci-gateway/inference.phala.com	control-plane	69	17	16	4.6
aci-gateway/tee.redpill.ai	control-plane	69	17	16	4.6
chutes/DeepSeek-V3.2-TEE	instance-sampled	125	2	1	134.0
chutes/GLM-5-TEE	instance-sampled	43	2	1	43.0
chutes/GLM-5.1-TEE	instance-sampled	65	1	0	—
chutes/GLM-5.2-TEE	instance-sampled	64	1	0	—
chutes/Kimi-K2.6-TEE	instance-sampled	124	2	1	134.0
chutes/Qwen3-32B-TEE	instance-sampled	119	2	1	129.0
chutes/gemma-4-31B-TEE	instance-sampled	122	2	1	134.0
near-ai/Qwen/Qwen3-30B-A3B-Instruct-2507	control-plane	32	10	9	3.4
near-ai/openai/gpt-oss-120b	control-plane	99	20	19	5.3
near-ai/zai-org/GLM-5-FP8	control-plane	31	10	9	3.4
near-ai/zai-org/GLM-5.1-FP8	control-plane	160	31	30	5.5
redpill/phala/gpt-oss-20b	control-plane	33	1	0	—
redpill/phala/qwen-2.5-7b-instruct	control-plane	34	1	0	—
tinfoil/gemma4-31b	control-plane	87	7	6	14.5
tinfoil/gpt-oss-120b	control-plane	82	2	1	82.0
tinfoil/llama3-3-70b	control-plane	93	3	2	46.5
tinfoil/router	control-plane	183	52	51	3.7

Current adapter check names

These field names help locate implementation and negative tests. Different architectures expose different checks, so a count of green cells is not a cross-provider privacy score.

Fresh nonce nonce_bound

TDX appraisal tdx_verified

Key binding report_data_binds_key

GPU evidence gpu_attested

Address binding key_derives_to_address

Compose binding compose_hash_committed

Production OS prod_os_image

Serving code serving_code_attested

Backend check backend_attested

Gateway review gateway_reference_audited

Catalog serving catalog_serves

Session digest listing sessions_publish_evidence_digests

Catalog nonempty catalog_nonempty

OS archive metadata os_image_archive_declares_production

Reproduced build code_measurement_reproducible

Release provenance release_provenance_verified

Release measurement measurement_matches_release

Hardware signature hardware_signature_verified

TLS key pin tls_pubkey_pinned

HPKE key hpke_pubkey_attested

Client nonce client_nonce_supported

Runtime config runtime_config_fully_attested

TEE route enforced attested_serving_enforced

Read the review and limitations for the source-level concerns that motivated this structure, including quote binding, model-scoped policy, reply-key substitution and operator access paths.