operandi now speaks Routstr: a network of independent Lightning-paid inference nodes, discovered over Nostr rather than a central API. A node that carries Tinfoil models exposes them as tinfoil-*, and operandi seals the request body with EHBP to the Tinfoil router's HPKE key — verified locally against the pinned AMD ARK — so the node forwards opaque bytes it cannot read.
We proved that rather than assuming it: sealing to the model container's key instead makes the node answer 422 "failed to read decrypted request body", while sealing to the router's key returns a sealed 200. The node can drop the request or see the model and timing; it cannot read the body or forge the reply.
--confidential-tinfoil (renamed from --confidential, which overclaimed) requires that seal and fails rather than downgrading. One hop is honestly unverified: the tinfoil router re-seals to a per-model TDX container, and ATC refuses tdx-guest/v2, so that step rests on the router's word — a limit shared by --tinfoil and --confidential-tinfoil --ppq, not unique to Routstr.
quotingOperandi with routstrd wen? 😁
nevent1q…42fh
https://github.com/Routstr/routstrd
The lightning UX is also smoother.