Built in the open, clean-room.

The shape of it

A consumer calls an OpenAI-compatible API over TLS. The coordinator (Go) authenticates the key, meters usage, and picks a provider by capability, trust tier, load, and thermal/battery headroom. It generates a fresh X25519 keypair per job, seals the request to the provider’s static key, and relays sealed token chunks back — decrypting only at the relay boundary, never persisting plaintext.

The provider core (Rust, portable) runs on macOS, Linux, Windows, and Android. It embeds llama.cpp, pulls models from a signed registry (per-file SHA-256, Ed25519 manifest signature), verifies them before advertising, and streams sealed tokens. On Android it’s a foreground service with a policy engine and JNI bindings to the same core.

Encryption envelope

• Consumer → coordinator: TLS (optionally NaCl-sealed to a published coordinator key).
• Coordinator → provider: mandatory crypto_box (X25519 + XSalsa20-Poly1305) with a fresh ephemeral keypair per job.
• Provider → coordinator: chunks sealed back to that ephemeral public key.
• No component writes prompt or response content to disk or logs. A CI check enforces it.

Trust tiers

• community — signed binary + network crypto. No owner-resistance claim.
• device_attested — a hardware-backed key in Android StrongBox / a TEE / a TPM, plus verified boot, with its attestation chain verified to the platform vendor’s root.
• confidential — CPU TEE + confidential GPU with remote attestation; the per-job key is released only after both verify. On the roadmap.

Android hardware attestation

The app generates an EC P-256 key in StrongBox (or the TEE) with an attestation challenge and signs the provider’s X25519 identity with it. The coordinator verifies the certificate chain to Google’s hardware-attestation root, checks the key-attestation extension (security level, verified boot state, bootloader lock), and checks the binding signature and its freshness. Only then is the node device_attested.

License

Apache 2.0 — permissive, with an explicit patent grant. Use it commercially, fork it, embed it. We only ask that you keep the notices.

Run it yourself

git clone function(){throw Error("Attempted to call REPO() from the server but REPO is on the client. It's not possible to invoke a client function from the server, it can only be rendered as a Component or passed to props of a Client Component.")}
cd shared-compute
make dev        # coordinator + a local provider
make e2e        # encrypted round-trip test