x0ne Engine.
Confidential-only
inference engine.

What is done, what is next.

Written from the repository's FEATURES.toml. On a measured line the date is the first run on a real confidential VM that exercised the feature; on a tested line, the first proof.

Done, measured on hardware 47

• The VM is verified before each question14 October 2026A relay on your machine checks the VM's hardware proof before any question or key leaves your computer.
• The hardware proof is checked up to Intel's root14 October 2026The VM's proof chains to Intel's pinned root; the host's security level and signer are checked live, and refused on doubt.
• Intel's trusted module is identified14 October 2026The signer, attributes and version of Intel's TDX module are checked against Intel's published identities; an unknown module is refused.
• A fresh challenge from your machine14 October 2026Your machine draws the challenge the VM's proof must answer, so a recorded proof cannot be replayed.
• One hardware proof per connection14 October 2026Every encrypted connection carries its own hardware proof, bound to that connection; a stolen connection key yields nothing.
• One strict encryption setting, no shortcuts14 October 2026The channel offers two TLS 1.3 settings only, no session resumption and no early data: one connection, one proof.
• Each version pins its own boot measurements14 October 2026Each version embeds and pins its measurements file; a release with nothing to pin refuses to serve (87).
• The firmware must be one Google signed14 October 2026The VM's firmware measurement must appear in Google's signed list of endorsed firmware for that machine type.
• NVIDIA's verdict names the exact GPU14 October 2026Each GPU token from NVIDIA's attestation service is verified under the pinned chain and must name the serial of the local GPU.
• 5 Qwen3 models, pinned file by file14 October 2026The built-in catalog pins 5 Apache-2.0 Qwen3 models to one Hugging Face commit, with every file's size and SHA-256; safetensors only.
• Downloads resume, run in parallel, are hashed before install14 October 2026pull downloads files and 64 MiB ranges in parallel, resumes what is missing, hashes every file and installs atomically.
• One command runs the VM on Google Cloud14 October 2026x0ne-engine cloud creates the confidential VM, waits until it serves, chats, and always deletes the VM on exit or signal.
• A signed receipt with every answer17 October 2026Every answer carries a receipt signed inside the VM, binding the question and the answer; the relay verifies it.
• The boot log is replayed against a closed list17 October 2026The VM's boot log is replayed; every event of the measured boot must be on the image reference's closed lists.
• The price is announced before anything is billed17 October 2026Before creating the VM, up prints the spot price, Google's confidential computing surcharge and the run's cap, and waits for your yes.
• The GPU quota is checked before billing starts17 October 2026Before anything is billed, up reads the spot H100 quota and skips the zones that cannot hold the machine.
• A verified chat in your terminal17 October 2026x0ne-engine cloud run brings a model up and opens a chat; each answer says whether its receipt verified.
• Your usual tools, through the local endpoint17 October 2026The relay serves an OpenAI-compatible endpoint on your machine; Open WebUI and the openai Python client were run against it.
• Outside a confidential VM, the engine refuses to serve17 October 2026Off a TDX VM the engine stops (64) before any port opens; a release with nothing to pin stops too (87).
• Speed figures published, with their rows17 October 2026Decode speeds are published with every row, all of them from an H100 inside a confidential VM.
• The image reference is signed, checked before reading18 October 2026The relay checks the reference's detached signature by the pinned archive key before parsing it; otherwise it stops (99).
• Two pinned NVIDIA signing certificates18 October 2026NVIDIA's tokens are verified under two pinned intermediate certificates, one RSA and one P-384, each with its fixed algorithm.
• Large models served as published, in pieces18 October 2026Weight files are mapped read-only as published and checked against their index; qwen3 8b, 5 files, served by x0ne Core in a VM.
• The served model's fingerprint, recomputable by anyone18 October 2026The fingerprint of the served model is a SHA-256 over the checksums of config, tokenizer and weights; the VM recomputes it on load.
• The GPU must boot secure, with debugging off22 October 2026Each GPU token must report valid certificate chains, no revocation, secure boot on and debugging off.
• Streamed answers, receipt on the last chunk22 October 2026With stream on, the answer arrives as the model generates it, in the OpenAI format; the receipt rides the final chunk.
• The relay streams and rebuilds every event22 October 2026The local endpoint streams from the VM; every event is checked against an allow list and rebuilt before the receipt is verified.
• Clients retry only when told to22 October 2026A full queue answers 503 with a wait time; other relay errors say do not retry, so a standard OpenAI client generates once.
• Several clients at once, rehearsed on hardware22 October 2026A confidential VM served 49 requests from concurrent clients through the relay, 256 tokens in 3.70 to 3.75 s, for 0.66 USD.
• Revoked Intel certificates are refused25 October 2026The VM at start-up and your machine at each verdict read Intel's revocation list; a listed certificate is refused.
• Intel's root revocation list is read25 October 2026Intel's root revocation list is read; a certificate authority or signer listed on it is treated as revoked.
• A floor on the host's security level25 October 2026Transparent by default: the host is judged on Intel's standard data and its advisories are named; strict, on request, refuses an out-of-date host.
• A VM that never serves is deleted25 October 2026up reads the VM's console, prints why it refused and deletes a VM that never serves (97), instead of waiting.
• Your question is sealed on your machine28 October 2026The SDK, on your machine, verifies the VM, seals the question to the VM's key and checks the receipt. Prototype.
• Unpatched Intel flaws are named, or refused28 October 2026In transparent mode the relay names the host's unpatched Intel advisories in each verdict and receipt; strict mode refuses the host.
• The NVIDIA key comes from a file, never printed30 October 2026The VM reads the NVIDIA attestation key from a file, never prints it, and stops (103) when the service refuses it.
• No serving unless the GPU is in confidential mode30 October 2026The VM refuses to serve (74) unless the GPU reports production confidential computing mode with developer tools off.
• The receipt says what is not proven30 October 2026The receipt states four things it does not prove, the device that computed, the host's security level, the sampling settings and the seed.
• Sampling settings honoured, the sampler signed30 October 2026Temperature, top_p, seed and stop sequences are honoured; the receipt signs temperature, top_p and seed; tool calling answers 400, not supported yet.
• Answers constrained to a JSON schema30 October 2026A JSON schema in the request constrains the answer token by token; the receipt names the schema's SHA-256.
• The VM's key document carries the GPU verdict30 October 2026The VM's key document binds the session settings and carries NVIDIA's verdict on the GPU; your machine needs no round trip to NVIDIA.
• By default, the VM answers your address only30 October 2026By default the VM's cloud firewall admits your machine's public address alone on port 443, no longer the whole Internet.
• The whole boot is pinned, firmware included31 October 2026Your machine fetches the firmware Google signed for the VM and requires its 16 boot events, identical over 3 boots.
• Answers are padded in size and time31 October 2026Whole answers leave at a rounded size, 16 KiB at least, on 100 ms ticks; streams send frames of one size.
• Sealed answers streamed, VM to SDK, through the relay1 November 2026The SDK streams a sealed answer from the VM; the relay on your machine passes each frame on unopened. Measured on hardware once.
• Qwen3 runs on x0ne Core, our own GPU engine4 November 2026x0ne Core runs Qwen3 on the GPU with its own kernels, compiled ahead of time, and replays one CUDA graph per generated token.
• GPU inference inside the confidential VM4 November 2026x0ne Core serves the model on the GPU inside the confidential VM, through this Engine: a test run on an H100, not a release.

Done, tested 27

• 1,355 tests, 92.58 % line coverage, in a local CI22 August 2026cargo test -p x0ne-infer passes 1,355 tests; make ci adds every feature, strict lints and licence and advisory checks; 92.58 % line coverage.
• Weights sealed, opened only after the key release18 September 2026x0ne-infer seal encrypts the weights; a known-answer test fixes the format, and the key lease is bounded in time.
• A VM in debug mode is refused23 September 2026A hardware proof whose debug flag is set is refused by the VM, by your machine and by the structural verifier.
• No secret on the command line or environment11 October 2026No command prints the value of an unknown argument; a key typed in place of a file name is refused without being printed.
• Proofs and connections are bounded13 October 2026One hardware proof at a time, a bounded queue, 429 or 503 with a wait time beyond; 256 handshakes at most, 10 s each.
• Keys live in protected memory13 October 2026The engine cannot be dumped; session and connection keys live in protected or locked memory, zeroed before release.
• The release ships the verified path only13 October 2026The release archive ships the client of the verified path only: the command line, the cloud tool and the relay.
• The Debian package builds the same twice13 October 2026make deb builds the package offline with the same SHA-256 from two containers; a host build and a VM build matched.
• The context fits the GPU memory left16 October 2026On a GPU the model's whole context must fit beside its weights, or it is not loaded; a longer prompt gets a 413.
• The GPU proof is bound to each connection22 October 2026With CPU and GPU attestation, every connection carries NVIDIA tokens over a challenge derived from that connection.
• AMD confidential VMs: the verifier, on your machine22 October 2026Your machine can verify an AMD SEV-SNP report up to AMD's pinned roots (Milan, Genoa, Turin), with floors on the firmware.
• The image reference must be in a public log22 October 2026The relay requires a transparency-log proof for the image reference; a forked, stale or unreachable log is refused.
• 16 promises we never make, held by a test22 October 2026A test forbids 16 claims this project does not make, in the README, the docs, the pages and the messages.
• A floor on the firmware version23 October 2026An image reference may set a minimum firmware version; an older firmware Google once signed is refused.
• NVIDIA's overall verdict must name each GPU token23 October 2026The overall NVIDIA token must carry exactly one SHA-256 per GPU token sent, no more, no less.
• The host's security level is re-read every hour23 October 2026Every hour the VM and the relay re-read Intel's security data; a verdict against the host stops the answers.
• The SDK replays a real hardware proof offline23 October 2026A test accepts the real Google Cloud proof of 2026-10-18 with its boot log and endorsement, and refuses each one-bit change.
• A sealed request cannot be replayed23 October 2026The VM refuses a sealed request replayed within its window.
• Nothing is logged on the answer paths23 October 2026A test forbids logging on the answer paths; errors cite at most 64 bytes; a crash leaves as a padded error.
• A model owner's key, released to verified VMs only24 October 2026The relay releases the owner's model key, encrypted to a key the VM proved; the VM then unseals the weights.
• A relay that sees who asks, not whatprototype 24 October 2026A prototype of a shared service where a relay sees who asks and a gateway sees what; no x0ne binary uses it yet.
• A tokenizer whose memory accesses follow length, not textprototype 24 October 2026A measurement of what a standard tokenizer leaks through memory accesses, and a tested countermeasure, off the served path.
• Small release binaries25 October 2026Release binaries are stripped: x0ne-infer goes from 89.6 MB to 9.9 MB.
• AMD confidential VMs: the guest side, builtprototype 28 October 2026The AMD SEV-SNP guest path and its launch-measurement tool are built and tested locally, never run on an AMD machine.
• A conversation keeps its memory between turnsprototype 30 October 2026The engine before x0ne Core kept a conversation's working memory under a single-use handle, so a follow-up did not recompute it.
• The SDK remembers the log it verified31 October 2026The SDK keeps the last log checkpoint it verified; a log that forks, goes back, or grows without proof is refused.
• NVIDIA's signing certificates are checked for revocation31 October 2026Revocation answers about NVIDIA's signing certificates are verified; a revoked one is refused, and the verdict says what was checked.