← all workers

OutLayer — TEE Attestation

Verifiable off-chain compute for NEAR · outlayer.ai ↗

Full per-aspect verification for app 554719ff327f85913fe7fdae76e9851c77b2c52f.

One running instance of this app on a self-hosted Intel TDX host. Every TDX quote is Intel-DCAP-verified (signature + TCB, via Intel's PCS) and cross-checked against the on-chain approved measurements — independently re-verifiable.
instance 1 of 2 testnet-worker-0143-1 Worker testnet ✗ Check failed
testnet-worker-0143-1 Worker testnet instance 1 of 2 stopped · up 13days 4h 13m 58s
last push 1m ago app_id 554719ff327f85913fe7fdae76e9851c77b2c52f vm_id 9d0515fa-8b49-41f6-acae-c34dcb173169 attested via Intel DCAP (Intel PCS collateral) gateway 554719ff327f85913fe7fdae76e9851c77b2c52f-8081.dstack.outlayer.ai
collection error: vm status is 'stopped'
2

TDX Hardware — Attestation

The hardware-signed TDX quote, verified against Intel's PCS collateral — the Intel DCAP signature chain, not Intel Trust Authority.

Signature ✗ TCB unknown Measurements — On-chain — n/a
verification error: no app_cert_pem in report (guest-agent unreachable?)

Quote not decoded yet — showing the measurements as reported (to be cryptographically verified).

3

Source Code — Compose

The measured app-compose that pins exactly which container images run.

compose not reported yet (agent predates app-compose forwarding)

4

Network — Zero Trust Gateway

TLS terminates inside the TEE — the gateway never sees plaintext.

guarded domain554719ff327f85913fe7fdae76e9851c77b2c52f-8081.dstack.outlayer.ai
5

App OS

The measured dstack guest OS image. The version is read live from each CVM's vm_config; the os_image_hash is the precise, measured OS identity. dstack releases ↗.

6

KMS — deploy-time key provisioning

Deploy-time only. Governed by an on-chain contract, the dstack KMS releases this CVM's keys at boot only if its measurements are approved — those keys decrypt the deployment env file (so secrets never enter the measured compose) and provision the CVM's RA-TLS identity + disk encryption. This secures how the worker is deployed; it does not hold OutLayer's application or user secrets — those run through the OutLayer keystore (master derived in-TEE via MPC), not the dstack KMS.

key_provider unknown
instance 2 of 2 testnet-worker-0143-2 Worker testnet ✗ Check failed
testnet-worker-0143-2 Worker testnet instance 2 of 2 stopped · up 7days 54m 48s
last push 1m ago app_id 554719ff327f85913fe7fdae76e9851c77b2c52f vm_id 8472a12e-0827-4a15-916f-c6b72f70540a attested via Intel DCAP (Intel PCS collateral) gateway 554719ff327f85913fe7fdae76e9851c77b2c52f-8081.dstack.outlayer.ai
collection error: vm status is 'stopped'
2

TDX Hardware — Attestation

The hardware-signed TDX quote, verified against Intel's PCS collateral — the Intel DCAP signature chain, not Intel Trust Authority.

Signature ✗ TCB unknown Measurements — On-chain — n/a
verification error: no app_cert_pem in report (guest-agent unreachable?)

Quote not decoded yet — showing the measurements as reported (to be cryptographically verified).

3

Source Code — Compose

The measured app-compose that pins exactly which container images run.

compose not reported yet (agent predates app-compose forwarding)

4

Network — Zero Trust Gateway

TLS terminates inside the TEE — the gateway never sees plaintext.

guarded domain554719ff327f85913fe7fdae76e9851c77b2c52f-8081.dstack.outlayer.ai
5

App OS

The measured dstack guest OS image. The version is read live from each CVM's vm_config; the os_image_hash is the precise, measured OS identity. dstack releases ↗.

6

KMS — deploy-time key provisioning

Deploy-time only. Governed by an on-chain contract, the dstack KMS releases this CVM's keys at boot only if its measurements are approved — those keys decrypt the deployment env file (so secrets never enter the measured compose) and provision the CVM's RA-TLS identity + disk encryption. This secures how the worker is deployed; it does not hold OutLayer's application or user secrets — those run through the OutLayer keystore (master derived in-TEE via MPC), not the dstack KMS.

key_provider unknown