Models
Qwen3.5 122B runs in an H200 GPU enclave on Phala. The three smaller models run on Nosana nodes outside the enclave, and their GPU host can read inference text. SDK attestation verification is not built.
Solrouter's open-weight routes do not call OpenAI, Anthropic, or Google model APIs.
Nosana models run outside the enclave; their GPU host can read prompt and reply text.
The qwen3.5:122b model runs in an H200 TEE, but the SDK does not verify its TEE
key, so strict E2E is unavailable through the proxy.
Available models
| Model | Id | Best for | Where it runs |
|---|---|---|---|
| Qwen3.5 122B | qwen3.5:122b | Flagship. Hardest questions, long context | H200 GPU enclave on Phala. The host cannot read your prompt |
| GPT-OSS 20B | gpt-oss:20b | General questions, research, summaries | Nosana node. The operator can read the prompt during a request |
| Qwen 3.8 27B | qwen3.8:27b | Uncensored. Topics other models refuse | Nosana node. Same limit |
| Qwen3 Coder 30B | qwen3-coder:30b | Coding. Review, refactors, explaining code | Nosana node. Same limit |
- Context: Qwen3.5 122B serves a 128K window; the Nosana models serve 8K (
NOSANA_CONTEXT_LENGTH, 8,192 tokens). Prompt, history, and reply share it. - Max output is enforced inside the enclave (
TEE_MAX_OUTPUT_TOKENS, 4,096 tokens). A request that asks for more is clamped. A request that sets no limit gets 2,048. - The REST API also accepts the ids with a
nosana:prefix, for examplenosana:gpt-oss:20b.
8K in and 4K out is fine for questions, a diff, or a file. It is not enough for a whole repository.
Strict E2E model route
qwen3.5:122b runs on an H200 confidential-computing GPU enclave hosted on Phala. The SDK can encrypt to this route, but it does not verify the TDX quote. The local proxy therefore rejects --mode e2e with HTTP 503 e2e_model_unavailable. Private mode is separate: it uses the Nosana proxy route, whose GPU host can read inference text.
Choosing a model
- In the chat app, pick the model in the composer.
- In the MCP server, pass
modeltoencrypted_chat:gpt-oss-20b(the default), or a backend id such asnosana:qwen3-coder:30b. - In the SDK, pass
modeltoclient.chat(). The default isgpt-oss-20b.
const res = await client.chat('Review this function for bugs', {
model: 'gpt-oss-20b',
});The SDK's TypeScript type still lists an older id, qwen3-8b. That model is retired and is not served. Use gpt-oss-20b. To reach the other two models from the SDK, pass the backend id with a cast, for example model: 'nosana:qwen3-coder:30b' as any.
How the models run
A sealed request goes from your device to the Intel TDX enclave on Phala. For the three Nosana-hosted models, the enclave decrypts it and sends the plaintext prompt to the Nosana node over HTTPS. That node runs outside the enclave and can read the prompt and reply. The enclave encrypts the reply to your key. The Solrouter backend does not see prompt plaintext.
Qwen3.5 122B runs in vLLM inside an NVIDIA H200 GPU enclave on Phala (confidential-computing mode, image pinned by digest in the attested compose). Only the TDX enclave holds the key to call it. The three smaller models each run as their own job on a Nosana GPU node, one node per model.
Where the prompt is readable
On Qwen3.5 122B, nowhere outside the enclaves: the GPU host sees only encrypted memory. On the Nosana-hosted models the GPU node runs outside any enclave, so the prompt and the reply are in plaintext in that node's memory while the model works. Solrouter rents the node and does not control its hardware. The request is not linked to your identity on the node. Solrouter's backend never sees the plaintext on either path. See What is private here.
Node warm-up
A node that has sat idle can answer the first request with "Nosana GPU node is warming up". The error is retryable. Wait a moment and send the request again.
Agent reasoning
The three ways a request runs through POST /agent, the guided-reasoning path, and the skill graph that shapes the answer.
Verify the enclave
Check that the key your prompts are sealed to is bound into the enclave's live Intel TDX quote, then check the Solana receipt for one sealed call.