Status and roadmap

We would rather you read this page than discover it.

What runs today

• The app. A chat with an open-weights model served inside a trusted execution environment. The app talks to RedPill, Phala's confidential inference gateway, which runs in an Intel TDX enclave and speaks ACI (Attested Confidential Inference).
• Attestation checked in your browser. For every session the app sends a fresh 32-byte nonce, receives the gateway's TDX quote, and verifies it against Intel's root certificate with Phala's open-source verifier (@phala/aci-verifier and @phala/dcap-qvl). It also checks that the quote binds the gateway's keyset and your nonce, that the keyset has not expired, and that the running container configuration is the one measured into the quote.
• A signed receipt for every answer. The enclave signs an Ed25519 receipt over the hash of the exact request it received and the exact response it returned. The app checks the signature against the attested key and recomputes both hashes from the bytes it sent and read.
• Session receipts. Closing a session produces a hermetic/receipt/1 file: the attestation report, the hash of the conversation and every enclave receipt. No question and no answer go into it.
• A receipt verifier. Drop any receipt file and every check runs again in your tab.
• The registry, live on Robinhood Chain. HermeticRegistry is deployed at 0x2CaAA119B793dB6835D92BBE76B35C9A5e910d39 (6 October 2026, Foundry, 6 tests, fuzzed). It stores one record per receipt hash: who sealed it, when, and which attested keyset and report it refers to.

What does not exist yet

• Hermetic does not run its own enclaves. Today the operator is Phala. Bonded Hermetic operators and slashing are the roadmap below, not a live system.
• No SDK is published. The quickstart shows how to do the same checks with the libraries that exist today.
• The relay key. The app can forward requests with a protocol key so visitors can try it without an account. Until that key is set on this deployment, you bring your own RedPill key and the app calls the gateway directly from your tab.

Roadmap

1. Pinned releases. Publish the reviewed compose hashes of the gateway builds Hermetic accepts, so the app fails closed on any other build instead of reporting the measurement.
2. End-to-end encryption. Encrypt prompts to the attested E2EE key so that no relay, Hermetic's included, ever sees plaintext.
3. First Hermetic enclave. One TDX and H100 machine run by the team, serving sessions with the same receipts.
4. Bonded operators. Third parties bond $HERMETIC to serve sessions; invalid attestations are slashed.
5. Governance of accepted builds. Holders vote on which builds, models and policies count as Hermetic.