Trust has a sequence.
Attestation, encrypted execution, signed provenance and USDC settlement form a single confidential computing path.
CPU + GPU confidential compute
A confidential virtual machine hosts vLLM or Triton in a signed image. A key-release agent verifies attestation; the receipt signer records approved model and code measurements.
- Intel TDX / AMD SEV-SNP
- NVIDIA H100 / H200 / Blackwell roadmap
- Phala dstack with dual attestation (initial design)
- Versioned policies rather than static pinning
Approved measurements on Arc
AttestationVerifier checks receipt signatures against approved model and code tuples. ModelRegistry handles timelocked model approval. UsageMeter connects per-call accounting to settlement and mandate checks.
- AttestationVerifier
- ModelRegistry
- UsageMeter
- FeeVault and planned $ENCL contracts
Hash-only operational records
The gateway, attestation verifier, receipt anchorer, payment facilitator, model registry API and view-key service coordinate the lifecycle. Workers refresh attestation, synchronize policies, settle usage and index chain events.
The backend specification calls for Bun, Hono, tRPC, Drizzle/Postgres, Redis/BullMQ and viem. Plaintext prompt and response bodies are outside the intended operational database.
Attested models. Scoped audit access.
The E3 roadmap adds model listings, provider stakes, fee accounting, receipt exports and a compliance kit. Token mechanics and marketplace availability require their own implementation and launch disclosures.
No token sale, staking service or investment return is offered through this preview.
Scale the private boundary.
The final roadmap stage targets multi-GPU Blackwell clusters for larger models and fine-tuning inside the enclave. This is a planned expansion, not a statement of current deployed capacity.
Make the limits explicit.
TEE protection targets the host, cloud operator and co-tenants. Approved code inside the enclave is still trusted. Hardware vendors, attestation services, policy governance and chain availability remain dependencies.
Receipts prove provenance, not answer correctness. Confidential payment amounts do not make addresses invisible.