Verify that the hosted API runs the published open-source workload.

Checking this page rather than believing it

These files are static so that reading them costs the serving enclaves nothing. The attestation endpoints above are the authority, and they are there for when you want to check a plane deliberately — not on every page view.

Every published file carries a .bundle signed with cosign keyless. The signature binds the file to the GitHub Actions identity that produced it and records it in the Sigstore transparency log, so the timing and the immutability come from a third party rather than from us. Verify one without trusting this page:

cosign verify-blob \
  --bundle aws-release.json.bundle \
  --certificate-identity https://github.com/Lore-Hex/quill-cloud-proxy/.github/workflows/publish-trust-aws.yml@refs/heads/main \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  aws-release.json

Pin the exact identity, not a pattern. Each plane is signed by its own workflow file, and the workflow path is embedded in the certificate, so those are three cryptographically distinct signers. A regex over the repository would accept any workflow here and hand every plane the same authority — which is precisely the property this arrangement exists to avoid. Each record names its own identity in its transparency block, so the record tells you what to pin even if you are reading it from an email months from now.

A signature proves authorship, not recency. To confirm you have the newest record rather than an older one replayed at you, search the transparency log for that identity; the log is append-only, so a newer entry cannot be hidden from you. The bundle carries a Signed Entry Timestamp but no inclusion proof, so confirming log membership means querying Rekor rather than trusting the bundle alone.

What the image digest does not cover. Confidential Space allows a launch to override an allowlisted set of environment variables at a fixed image digest, and that allowlist includes QUILL_API_HOST, QUILL_TLS_MODE, TR_CONTROL_PLANE_BASE_URL and the ACME settings. So the digest pins the code, not every parameter the code was started with. We are telling you because a verifier who discovers it themselves is entitled to wonder what else went unmentioned. The AWS plane bakes its equivalents into the image, where they are covered by PCR0; the Azure plane pins them in the CCE policy, which is what hostdata measures.

And the log cannot tell you whether a measurement is still what is running. A deployment unchanged for months should carry a months-old signature, so age is not drift. Only comparing a published record against a live attestation distinguishes the two — which is what our own twice-daily check does, and what you can do yourself with the endpoints above.

The whole verifier runs from a URL, with no clone and no install:

uv run https://raw.githubusercontent.com/Lore-Hex/quill-cloud-proxy/main/tools/verify-attestation.py --help

Machine-readable release

{
  "accepted_image_digests": [
    "sha256:9e095bf5809b0ac6694e6a059b4253faee74beec8dd40165f1535d275073ff48"
  ],
  "accepted_image_references": [
    "us-central1-docker.pkg.dev/quill-cloud-proxy/quill/enclave-multi:gcp-release-a2e9659"
  ],
  "api_base_url": "https://api.trustedrouter.com/v1",
  "attestation_audience": "quill-cloud",
  "attestation_issuer": "https://confidentialcomputing.googleapis.com",
  "commit": "a2e9659",
  "compliance": {
    "hipaa_readiness": "https://trustedrouter.com/legal/hipaa-readiness",
    "hipaa_status": "readiness_documentation_prepared_baa_required_for_phi",
    "legal_packet": "https://trustedrouter.com/legal",
    "procurement_json": "https://trustedrouter.com/legal/procurement.json",
    "soc2_readiness": "https://trustedrouter.com/legal/soc2-readiness",
    "soc2_status": "readiness_documentation_prepared_report_pending",
    "subprocessors": "https://trustedrouter.com/legal/subprocessors"
  },
  "data_policy": {
    "client_telemetry_content_free": true,
    "client_telemetry_disclosure": "https://trustedrouter.com/docs/telemetry",
    "control_plane_prompt_access": false,
    "prompt_output_storage": false
  },
  "image_digest": "sha256:9e095bf5809b0ac6694e6a059b4253faee74beec8dd40165f1535d275073ff48",
  "image_reference": "us-central1-docker.pkg.dev/quill-cloud-proxy/quill/enclave-multi:gcp-release-a2e9659",
  "platform": "gcp-confidential-space",
  "receipts": {
    "accepted_specs": [
      "inference-receipt/1"
    ],
    "algorithms": [
      "EdDSA"
    ],
    "delivery": {
      "non_streaming": "x-inference-receipt response header (compact JWS)",
      "streaming": "final chat.completion.chunk inference_receipt (flattened JWS)"
    },
    "documentation": "https://trustedrouter.com/docs/receipts",
    "key_commitment": "attestation",
    "key_log": "https://trustedrouter.com/.well-known/inference-receipt-keys",
    "spec": "inference-receipt/1"
  },
  "release_state": "current",
  "released_by": "github-actions:deploy-enclave-gcp",
  "source_commit": "a2e9659",
  "source_repo": "https://github.com/Lore-Hex/quill-cloud-proxy",
  "source_repositories": {
    "attested_gateway": "https://github.com/Lore-Hex/quill-cloud-proxy",
    "cloud_infra": "https://github.com/Lore-Hex/quill-cloud-infra",
    "control_plane": "https://github.com/Lore-Hex/quill-router",
    "javascript_sdk": "https://github.com/Lore-Hex/trusted-router-js",
    "python_sdk": "https://github.com/Lore-Hex/trusted-router-py",
    "quill": "https://github.com/Lore-Hex/quill"
  },
  "tls": {
    "hostname": "api.trustedrouter.com",
    "mode": "acme-inside-confidential-space"
  }
}