Trust model and limits

Hermetic is built on trusted execution environments. That is a hardware trust assumption, not a mathematical proof, and this page states the assumption in full.

What the app proves today

When the attestation panel says Verified, your browser has checked that:

a genuine Intel TDX machine produced the quote, chained to Intel's root, with its platform TCB status reported;
the quote binds the gateway's keyset and the nonce your tab just generated, so it is fresh and not replayed;
the container configuration running in the enclave is the one measured into the quote, and it points to public source (Dstack-TEE/private-ai-gateway);
every answer was signed by the attested key, over the exact bytes you sent and received.

It does not prove, today:

That the build is one Hermetic reviewed. The measurement is reported, not yet pinned to a list of accepted releases.
What happens upstream in full. The gateway is an aggregator: it runs in TDX without a GPU and forwards each request to a model served in a GPU TEE that it verifies itself. The receipt says which upstream served you and cites the session the gateway checked; your browser checks that citation's integrity, not the upstream's own hardware evidence.
Who the TLS peer was, from your browser. A browser cannot read certificates, so the TLS key shown is the one the Hermetic relay observed.
That a relay never saw your prompt. With the protocol relay, the Hermetic server forwards plaintext and stores nothing; with your own key, nothing passes through Hermetic. End-to-end encryption to the enclave key is on the roadmap.
Anything about operators or bonds. Today the operator is Phala. Bonded operators and slashing are not live.

What you trust

The hardware vendors' roots of trust. Intel for TDX quotes, NVIDIA for the GPU attestation. If either root key is compromised, attestations can be forged.
The isolation of the silicon. That memory encryption and the boundaries of the enclave hold against the host. Enclaves have had published side-channel attacks in the past; vendors patch them through microcode and firmware updates, and the registry only accepts builds measured on patched platforms.
The measured code. The receipt proves which build ran. Whether that build is correct is a question of the code itself, which is why every build in the registry must be reproducible from public source.

What you do not trust

The operator. It runs the machine but cannot read enclave memory, cannot forge a quote and cannot load a build that is not in the registry without the receipt showing it.
Hermetic. The team has no key that opens a session. It cannot read inputs or outputs.
The chain. Robinhood Chain only stores hashes. It orders and timestamps receipts; it holds nothing secret.

What Hermetic does not protect against

What the agent sends where the policy allows. If the policy allows egress to a host, data can reach that host. Read the policy before you trust a receipt.
What the model says. An attested session can still produce a wrong answer. Hermetic attests the environment, not the quality of the output.
Physical attacks by a determined operator with lab equipment against the chip. Bonds and slashing raise the cost; they do not make it impossible.
Metadata. Session timing and size are visible to the operator. The receipt does not reveal them publicly, but the operator sees traffic.

Why not zero-knowledge?

Proving a 70-billion-parameter model's inference in zero knowledge is not practical today at the speed agents need. Enclaves give a strong guarantee now, at native speed. The receipt format is versioned so that proof systems can be added to it as they become practical.