This deployment serves the same models over an OpenAI-compatible API — point any OpenAI SDK at:

Streaming and non-streaming. Also GET /v1/models, GET /warmup?model=…. Model names match the picker. If the deployment config sets api_key, send it as Authorization: Bearer <key>. Requests run in the same enclave as this chat.

This app runs inside a hardware TEE — a measured confidential VM. TLS for this origin terminates inside the enclave, and its remote attestation binds that TLS key to a code measurement whose Sigstore provenance traces to the open-source EnclaveHost/enclave repo. Verified, it proves the code handling your prompts is exactly the published build — the operator can't see in.

The check runs client-side against the pinned repo: hardware quote → vendor root, Sigstore provenance, measurement match, TLS binding to this origin. Never take the gateway's word for it — only a check your own machine runs means anything. Programmatic: @tinfoilsh/verifier. Prompts and replies are processed only inside the enclave; chat history lives only in this browser.