Trust boundary
Verify that the hosted API runs the published open-source workload.
api.trustedrouter.com is the prompt path. Public TLS terminates inside the measured GCP Confidential Space workload. The TrustedRouter control plane does not serve production inference routes and does not receive prompt or output bodies.
Clients can fetch the live attestation, verify issuer/audience/digest, and compare the measured image digest with the release data published here.
Client Verification
- OKFetch
https://api.trustedrouter.com/attestationover normal public TLS. - OKVerify the JWT issuer is
https://confidentialcomputing.googleapis.com. - OKVerify the audience is
quill-cloud. - OKCompare the attested image digest with this page.
- OKCheck the TLS certificate fingerprint is bound into the attestation nonce.
Published Files
DNS Requirement
api.trustedrouter.com must remain DNS-only or TCP-passthrough. TLS termination by a CDN would break the hosted-code trust claim because the prompt path certificate key must remain inside the measured workload.
GCP · Confidential Space
Compare image_digest against the digest in a live attestation JWT from the issuer above, checking its audience is quill-cloud. The certificate fingerprint is bound into the attestation nonce, so the connection you are on is the connection that was attested.
AWS · Nitro Enclaves
No measurement published for this plane yet. Do not treat its absence as a measurement of zero — verify against a live attestation before sending sensitive data.
This plane serves a certificate generated inside the enclave rather than one from a public CA. Its fingerprint and the TLS exporter value are bound into the attestation, so the connection you are on is the connection that was attested. Verify with --attested-cert-only; chain validation is replaced by that binding, not dropped.
Azure · Confidential Containers
No measurement published for this plane yet. Do not treat its absence as a measurement of zero — verify against a live attestation before sending sensitive data.
Compare hostdata against x-ms-sevsnpvm-hostdata in a live MAA token. Each serving region runs its own MAA instance, so accept any issuer listed above.
Why the three measurements look different
Each platform measures the artifact its own hardware can attest to, so there is no single number to compare across all three. GCP measures the container image; AWS measures the enclave image file into PCR0; Azure measures the policy that constrains what the container is allowed to be. A verifier checks one plane at a time, against that plane's own record.
Measurements published here are a set, not a single value. During a rollout the released key is deliberately bound to both the outgoing and incoming measurement so the old enclave keeps serving while the new one starts. A verifier pinned to exactly one value would fail during precisely that window, which is why each record carries the full accepted set alongside the value expected to be serving.
No Prompt Logs
Ordinary synchronous and streaming prompt/output storage is disabled. The opt-in Batch API uses separately documented encrypted retention. Generation content endpoint returns a compatible content_not_stored response.
Hosted Open Source
Control plane, billing, keys, compatibility routes, dashboard, and trust page.
Attested prompt gateway, release digest, and Confidential Space verification path.
Cloud deployment scripts, measured workload bringup, and trust publication flow.
Open-source Quill client, device, bootstrap, and attestation-facing code.
Python SDK repository for attestation-aware client helpers.
JavaScript SDK repository for browser and Node integrations.
Public provider conformance suite for validating the attested gateway translator contract.
Fail Closed
If attestation, billing authorization, or the gateway contract is unavailable, the prompt path should fail rather than silently downgrade to a non-attested route.
Machine-readable release
{
"accepted_image_digests": [
"sha256:7a3206965c4d537c2a42360db0ab51899ab00e283f1fbdf8e888b4b5c4d287f3"
],
"accepted_image_references": [
"us-central1-docker.pkg.dev/quill-cloud-proxy/quill/enclave-multi:gcp-release-ddf0c3e"
],
"api_base_url": "https://api.trustedrouter.com/v1",
"api_base_urls": [
"https://api.trustedrouter.com/v1",
"https://api.allyrouter.com/v1",
"https://api.uptimerouter.com/v1"
],
"attestation_audience": "quill-cloud",
"attestation_issuer": "https://confidentialcomputing.googleapis.com",
"data_policy": {
"control_plane_prompt_access": false,
"prompt_output_storage": false
},
"image_digest": "sha256:7a3206965c4d537c2a42360db0ab51899ab00e283f1fbdf8e888b4b5c4d287f3",
"image_reference": "us-central1-docker.pkg.dev/quill-cloud-proxy/quill/enclave-multi:gcp-release-ddf0c3e",
"platform": "gcp-confidential-space",
"release_metadata_status": "live",
"release_state": "current",
"source_commit": "ddf0c3e",
"source_repo": "https://github.com/Lore-Hex/quill-cloud-proxy",
"source_repositories": {
"attested_gateway": "https://github.com/Lore-Hex/quill-cloud-proxy",
"cloud_infra": "https://github.com/Lore-Hex/quill-cloud-infra",
"control_plane": "https://github.com/Lore-Hex/quill-router",
"javascript_sdk": "https://github.com/Lore-Hex/trusted-router-js",
"provider_check": "https://github.com/Lore-Hex/trustedrouter-provider-check",
"python_sdk": "https://github.com/Lore-Hex/trusted-router-py",
"quill": "https://github.com/Lore-Hex/quill"
},
"tls": {
"hostname": "api.trustedrouter.com",
"hostnames": [
"api.trustedrouter.com",
"api.allyrouter.com",
"api.uptimerouter.com"
],
"mode": "acme-inside-confidential-space"
}
}