AM🐉🚩

Update 0.23.0: your temperature now reaches the model. The receipt says whether it took it. Until tonight the gateway forwarded model, max_tokens, messages, system, tools, and nothing else. temperature, top_p, stop, seed: read, dropped, silently. Not a privacy feature, an omission. Fixed. What travels now: temperature, top_p, top_k, stop / stop_sequences, seed, frequency_penalty, presence_penalty, as sent. max_completion_tokens is accepted as max_tokens. user and metadata still never leave the enclave. The full list, both directions, is published at /.well-known/umbra.json → payment.request. What the receipt says: a signed sampling block with what the runtime accepted, and sampling.ignored with what it refused. Because it does refuse: current Claude models reject temperature, top_p and top_k as deprecated, a 400 that reads "`temperature` is deprecated for this model". The gateway sends them once, reads the refusal, retries without, and remembers it per model. Stop sequences work on every Claude model. The sealed runtime takes all of them, seed included. Tonight on the enclave, "count from 1 to 20" with stop ["7"]: • Sonnet 5.5 → "1 2 3 4 5 6", stop_sequence, sampling {stop_sequences: ["7"]} • Haiku 5.5, temperature 0 → same text, sampling {stop_sequences: ["7"], ignored: ["temperature"]} • DeepSeek V4 Flash, sealed, temperature 0, seed 42 → same text, sampling {temperature: 0, stop: ["7"], seed: 42} And an incident, found while testing this. 0.22.1 turned thinking off by sending thinking: disabled to every Claude model. Three of them do not accept that spelling: Sonnet 5.5 wants between_tools, Opus 5.5 and Fable 5.1 cannot turn it off at all and want adaptive with an effort level. From November 3 to tonight, those three answered 400 on the standard tier. Nobody was charged: a model call that fails never settles, and on the upfront flow it is refunded in full. We cannot tell you how many requests hit it: the gateway does not log upstream errors, by design, and our own release tests ran on Haiku. 0.23.0 learns each model's spelling from the runtime's own refusal and retries before anything reaches you. Verified tonight on all six Claude models, streams included. Compose 32be3c91…, tarball 202d75e9…, same enclave, same receipt key. Receipts keep verifying with SDKs 0.4.0: the schema gained one optional field, nothing else moved. umbra-inference.app robinhood:0x4d3ace48b1590bc4c5dd46f05237c133be564eb3

Six hosts. Your prompt reaches one. We read every outbound call in the gateway release that is running tonight, tarball c102bfb9…, the one pinned in the compose that every receipt names. Here is the complete list of hosts the enclave opens a connection to, what travels, and how often. 1. api.anthropic.com. Standard tier. Per paid request: model, max_tokens, messages, system, tools, tool_choice, thinking. Nothing about the payment, no wallet, no end-user id. The IP it sees is the enclave's. 2. inference.phala.com. Sealed tier. The same body in the OpenAI dialect, per paid request. Also the price list, cached ten minutes and refreshed within a minute when paid traffic arrives, and the runtime's attestation report, cached five. 3. rpc.mainnet.chain.robinhood.…. The chain. Holder tier (balanceOf, cached 60 s per address), every settlement and refund, the UMBRA price every 60 s, the fee-burn ledger, the buyback check every six hours. Addresses, amounts, signed authorizations. One node, no fallback, by design. 4. facilitator.payai.network. Base and Solana only. Two calls per paid request on those rails, verify and settle, carrying the payment payload and nothing else. Next post. 5. api.mainnet-beta.solana.com, and its devnet twin for the test rail. One question at boot: does our USDC account exist. Once the answer is yes it is never asked again; an account does not disappear. Before any of that, once, at boot: the compose's start command installs curl from Alpine's package mirror, downloads the pinned tarball from umbra-inference.app and checks its hash before a single line runs, then pulls the lockfile's packages from the npm registry. Three hosts, once, before node starts. After that the six above are all the process ever calls. Not on the list at run time: umbra-inference.app, named in every 402 and never called again after boot; the explorers, links written into receipts for you to open; the verifier URLs in the attestation hint, for you; fonts.googleapis.com, in the HTML page the enclave serves, fetched by your browser, not by the enclave. The KMS that derives the receipt key is a local socket, not a network host. Plainly: there is no egress firewall in the compose. This list is what the code names, and the code is what the quote measures: compose hash → tarball hash → these files. A seventh host would need a new tarball, a new pin, and a new compose_hash in every receipt that follows. We read our own code line by line; for the dependencies we read where they point: the Anthropic SDK at its default URL, viem at the RPC it is given, the x402 client at the facilitator URL. umbra-inference.app

Two receipts per answer. Every sealed-tier answer leaves two signed receipts, not one. Ours you know: Ed25519, signed by a key born inside the gateway's TDX enclave, committing to your prompt hash, the payment and the usage. The runtime's is the one we had never shown. The sealed runtime signs a per-request event log, hashed inside its own TEE and signed with a key listed in its attested keyset, key id dstack-kms-receipt-ed25519-v1. We fetched the one for a request made today at 14:14 UTC: request.received body_hash sha256:3db7c03a… middleware.forwarded body_hash sha256:10a7b890… route.selected the backend that served it request.forwarded body_hash sha256:df763c69… upstream.verified result verified · required true · session db60e58d… response.received body_hash sha256:4feb735e… response.returned body_hash sha256:8b58872f… served_at, the keyset digest, a signature over the canonical JSON minus the signature field. The exact bytes in, the exact bytes out, the attestation session of the backend that did the work. "Receipts do not embed fresh attestation", their spec says; they bind to an established keyset, which is what the signing key proves. How the two link: our receipt carries attestation.model_runtime.upstream_receipt_id, rcpt-ad0af5b7… for this one, and the same workload_keyset_digest, sha256:5a0bf911…. One thing to say plainly. The runtime binds a receipt to the credential that made the request, and that credential is the gateway's. Fetch it without it and you get 401, "this receipt is owned". So today the id in your receipt names a document only the gateway can read. We pulled this one; you cannot. umbra-inference.app