Solrouter
How it works

The TEE request flow

What happens to one encrypted request, hop by hop, with the exact payload at each step.

This page follows one client.chat() call through the SDK, the Solrouter backend, the Intel TDX enclave, the Nosana GPU node, and back. Use the step list to walk the map. Each step names its payload and source file.

Select a node to see what it holds and what it sees.

Step 1 of 10: Fetch the enclave key
GET /tee/public-key -> {publicKey, publicKeySha256, algorithm, teeType}. Cached per process.

In words

  1. GET /tee/public-key returns {publicKey, publicKeySha256, algorithm, teeType}. The SDK caches it for the life of the process.
  2. The SDK makes an ephemeral X25519 keypair and derives the shared secret with the enclave key.
  3. RescueCipher encrypts the prompt in packed-31 form. The bundle is {ciphertext, nonce, publicKey, version: '2.0-packed31'}.
  4. POST /tee/process with a Bearer key. What leaves the machine: the ciphertext bundle plus, in plaintext, the API key, model id, chatId, and the optional systemPrompt, useRAG, ragCollection, useLiveSearch.
  5. The backend forwards {encryptedPrompt, model, privacyAttestationId} unchanged.
  6. The CVM derives the shared secret with its X25519 private key and decrypts.
  7. The CVM calls the configured Nosana endpoint at /v1/chat/completions with the plaintext prompt. HTTPS per the documented node URL, not re-verified.
  8. The CVM encrypts the reply to your key, signs the SOLR-ATTEST-v2 tuple, and requests a tappd quote with report_data = sha256(x25519 || ed25519).
  9. The backend commits the compressed receipt and returns {success, encryptedResponse, attestation, encryptionProof, requestId, metadata, backendRole: 'BLIND_RELAY', onchainAttestation, privacyProof}.
  10. The SDK decrypts encryptedResponse with the session private key.

The short picture

In words

  • Your device encrypts. The backend relays ciphertext. The enclave decrypts. The Nosana node runs the model in plaintext. The reply returns encrypted.

Key custody

  • Your device: an ephemeral X25519 private key per session. Never sent.
  • Solrouter backend: no key on this path.
  • Enclave: an X25519 sealing key and an ed25519 signing key, generated at boot and never exported.
  • Nosana node: no key. It receives plaintext from the enclave.

What is a TEE?

A TEE is a sealed part of a computer that the cloud operator cannot look into, and this page explains what that means for your prompt.

Encryption

Solrouter encrypts prompts on your device with Arcium RescueCipher and X25519 key exchange. Only an Intel TDX enclave can decrypt them. Solrouter's backend never sees plaintext.

On this page

The short pictureKey custody