Evidence bundle
You hit a TEE-hosted app. This page is the audit-ready report for what’s running there. It is built for two readers at the same time:
- A casual visitor who wants to confirm there’s a real bundle here, the kind a security person could take seriously, and forward the URL on if it matters to them.
- A reviewer or auditor who is actually going to read the source and check the artifacts.
The mechanical part — proving the code running on this CVM is the same code in the public GitHub repo — is resolved on this page, automatically, on load. The judgmental part — whether the code does what it claims — is the source-reading work below. You don’t have to do it; you can pass the URL to someone whose job it is.
Consumer verification
The Python verify() library runs Phala’s local DCAP/QVL verifier. Install its CLI before
using the library:
cargo install dcap-qvl-cli
It returns structured facts, including quote validity and measurements; the consumer still chooses its acceptance policy.
Reading: timelock at hermes-staging