Sell inference without handing over your weights
A Solana registry and payment rail. Your weights stay encrypted on confidential GPUs until 3 of 5 verifiers attest the enclave; callers pay per call in USDC.
Release checks — break one
Data key in the enclave
Three of five verifiers attest every node
The node binds fresh keys and a recent slot hash into its TDX quote and GPU evidence. Verifiers check them against Intel and NVIDIA references, the operator’s registry entry and the runtime allowlist; three signatures make one record_attestation, valid for 24 hours.
- signatures
- 3 / 5
- status
- valid for 24 h
- tcb_status
- UpToDate
- method
- committee
- cost
- 49,314 CU · 1,056 bytes
The data key opens only inside the enclave
The model owner’s key broker checks the node’s evidence against the record on-chain, verifies it again, and wraps the data key to the enclave’s HPKE key (X25519 + ML-KEM-768). Only that VM can unwrap it; every release is logged.
- Attestation valid
- Platform registered
- GPUs registered
- Runtime allowed
- Operator eligible
- Evidence matches
- data key
- released · logged
Every call pays the lane vault in USDC
The node answers HTTP 402 with an exact price or an upto ceiling settled by a voucher the enclave signs. Payment goes to the lane vault for this model and node.
One distribute call pays everyone at once
Anyone can call distribute(lane): one all-or-nothing transaction pays the fee, the operator and up to 8 split recipients.
distribute to 8 recipients and the fee: 165,610 CU · 268 bytes
- lane vault
- 0.000000 USDC
- run
- 0 sample calls
- your calls
- 0.000000 USDC
- protocol fee · 5%0.005040
- model owner · 61%0.058414
- operator · 25%0.023940
- base model · 10%0.009576
- contributor 1 · 4%0.003830
Sample prices, fee and split, in USDC.
The protocol fee buys $SEALROOM and burns it
- supply
- 1,000,000,000, fixed
- launch
- 100% to one public launch on equal terms
- allocations
- none
- vesting
- none
- fee share
- all of it to buyback and burn
Operators post a USDC bond, and a ruling can slash it
The bond is locked for 30 days after unbonding and while any dispute is open. On evidence of leaked weights or attestation fraud, arbitration freezes the operator, revokes its attestations and slashes the bond to the claimant.
- operator
- bonded
- bond
- 100,000 USDC (sample)
- attestations
- valid
- withdrawal
- after 30-day unbond
One registry for owners, operators and callers
- create_model
- update_policy
- update_price
- propose_split
- apply_split
- open_dispute
- brings
- encrypted weights, a manifest hash, a key broker
- decides
- allowed runtimes, minimum tier and bond, operator allowlist, price, split
- receives
- its split share of every distribute
Apply as an operator or a model owner
Operators are admitted after vetting; model owners list encrypted models through the same program.
Operators
Bring confidential-mode H100 or H200 capacity in a certified datacenter.
- needs
- Intel TDX servers, CC-mode GPUs, a legal entity
- signs
- the Operator Agreement
- posts
- a USDC bond
Model owners
Sell a specialist model to buyers who keep their data, without shipping the weights.
- needs
- a model the pinned vLLM build serves
- runs
- its own key broker, which holds the data key
- sets
- policy, price and split