pi-privacy 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Patrick (zahnno)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,98 @@
+# pi-privacy
+
+**Privacy posture + TEE attestation for [Pi](https://pi.dev) providers.** A Pi
+extension that cryptographically **verifies** confidential-enclave (TEE) inference,
+**enforces** zero-data-retention (ZDR) routing, detects **on-device** inference, and
+grades every provider on one honest ladder — so a guarantee you can *prove* never
+reads like one a vendor merely *claims*.
+
+## Install
+
+```bash
+pi install npm:pi-privacy
+```
+
+That's it — Pi loads the extension, which registers the privacy providers below and
+starts verifying posture. Check the current model any time with:
+
+```
+/verify
+```
+
+## The one rule: verified ≠ asserted
+
+Every tier states the strength of its evidence. A green "verified TEE" badge means
+remote attestation actually checked the hardware; a ZDR badge means the provider
+*promises* not to retain data. Those are different things, and pi-privacy never lets
+them look the same.
+
+| Tier | Badge | Evidence | Meaning |
+|---|---|---|---|
+| `tee-verified` | **Verified TEE** | cryptographic | Remote attestation proved genuine enclave hardware **and** the live TLS key matched the report. |
+| `local` | **On-device** | observable | Loopback endpoint — inference runs locally, nothing leaves the machine. |
+| `zdr-enforced` | **ZDR (enforced)** | observable | Zero-retention routing actively pinned — requests only reach non-retaining providers. Policy, not hardware. |
+| `tee-unverified` | **TEE (unconfirmed)** | none | Provider claims a TEE, but attestation was incomplete or unmatched. |
+| `zdr-policy` | **ZDR (by policy)** | policy | Provider promises zero retention; unverifiable. Not hardware, not attested. |
+| `standard` | **Standard** | none | No special guarantee. |
+
+## Providers
+
+| Provider | Tier | How it's checked |
+|---|---|---|
+| `tinfoil` | Verified TEE | SEV-SNP attestation; the enclave's TLS key (SPKI) is pinned against the connection Pi actually uses |
+| `nearai` | Verified TEE | Attestation report (Intel TDX + NVIDIA CC) fetched over HTTPS, bound to a fresh nonce |
+| `openrouter` | ZDR (posture-aware) | `zdr-policy` until enforcement pins routing → `zdr-enforced` |
+| `venice`, `fireworks` | ZDR (by policy) | Provider policy; honest limits noted (e.g. Venice is not TEE-attested) |
+| `ollama`, `custom` | On-device | Detected when the endpoint is a loopback URL |
+
+Providers with no verifiable or default privacy channel (Together, DeepSeek, MiniMax,
+Qwen, …) are intentionally left `standard` with **no badge** — anything else would
+overclaim.
+
+## How verification works
+
+- **Tinfoil (SPKI pinning).** Pi's provider requests flow through a process-wide
+  `undici` dispatcher that captures the enclave's TLS public-key fingerprint on the
+  *actual inference connection*. That fingerprint is matched against
+  `report_data[0:32]` of the signed SEV-SNP attestation — so "verified" means the
+  channel you're using demonstrably ends inside the enclave.
+- **NEAR (report body).** A fresh nonce is sent with the attestation request; the
+  returned report must carry a TEE signing key and hardware evidence and echo the
+  nonce (freshness / anti-replay).
+- **ZDR (enforced).** For OpenRouter, requests carry
+  `provider: { zdr: true, data_collection: "deny" }`. OpenRouter filters routing to
+  compliant providers and returns `404 No allowed providers` when the policy can't be
+  met — it doesn't silently ignore the constraint, which is why `zdr-enforced` is honest.
+- **Local.** A loopback endpoint (`localhost` / `127.0.0.1`) is observable, so on-device
+  inference is detected rather than claimed.
+
+These are *pragmatic* checks suited to an interactive agent, not a replacement for a
+full verifier ([nearai/cloud-verifier](https://github.com/nearai/cloud-verifier),
+[tinfoilsh/tinfoil-cli](https://github.com/tinfoilsh/tinfoil-cli)); `/verify` prints
+the raw report so you can take it to one.
+
+## Programmatic use
+
+```ts
+import { makePiPrivacyExtension, verifyModelPosture, effectiveTier } from "pi-privacy";
+
+// Configure the extension (e.g. enforce ZDR, receive posture updates):
+const ext = makePiPrivacyExtension({
+  enforceOpenRouterZdr: true,          // opt-in; a model with no ZDR endpoint will 404
+  onPosture: (r) => renderBadge(r),    // { tier, teePosture?, attestation? }
+});
+
+// Verify a specific model on demand:
+const posture = await verifyModelPosture("tinfoil", "llama3-3-70b");
+// → { tier: "tee-verified", teePosture: "green", attestation: {...} }
+
+// Or just the static/enforcement tier, no network:
+effectiveTier("openrouter", { zdrEnforced: true }); // → "zdr-enforced"
+```
+
+`makePiPrivacyExtension(options?)` — `installDispatcher`, `registerProviders`,
+`enforceOpenRouterZdr`, `useDispatcherTransport`, `onPosture`.
+
+## Requirements
+
+Node ≥ 22.19.0 (the Pi runtime's floor). MIT licensed.

package/extensions/pi-privacy.ts

@@ -0,0 +1,10 @@
+// Pi package extension entry. Pi discovers extensions from this `extensions/`
+// directory (or the `pi.extensions` manifest paths) and loads each file's default
+// export as the extension factory `(pi) => void`.
+//
+// The default export is makePiPrivacyExtension() with default options: install the
+// attestation dispatcher, register the config-only privacy providers, verify TEE
+// posture, and add /verify. Consumers who want to configure it (e.g. enforce
+// OpenRouter ZDR, or hook onPosture) import { makePiPrivacyExtension } from the
+// package root instead.
+export { default } from "../src/extension.ts";

package/package.json

@@ -0,0 +1,68 @@
+{
+  "name": "pi-privacy",
+  "version": "0.1.0",
+  "description": "Privacy posture + TEE attestation for Pi providers: cryptographically verified confidential-enclave (TEE) inference, enforced/labeled zero-data-retention (ZDR), and on-device detection — honestly graded so a verified guarantee never reads like a claimed one.",
+  "type": "module",
+  "license": "MIT",
+  "author": "Patrick (zahnno)",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/privateer-agent/pi-privacy.git"
+  },
+  "homepage": "https://github.com/privateer-agent/pi-privacy",
+  "keywords": [
+    "pi-package",
+    "pi",
+    "pi-extension",
+    "tee",
+    "attestation",
+    "confidential-computing",
+    "tinfoil",
+    "near",
+    "zdr",
+    "zero-data-retention",
+    "privacy",
+    "sev-snp"
+  ],
+  "pi": {
+    "extensions": ["./extensions"]
+  },
+  "exports": {
+    ".": "./src/index.ts",
+    "./attest": "./src/attest/dispatcher.ts",
+    "./attestation": "./src/attest/attestation.ts",
+    "./extension": "./src/extension.ts"
+  },
+  "files": [
+    "src",
+    "extensions",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "typecheck": "tsc --noEmit",
+    "test": "for f in tests/*.test.ts; do node --import tsx --test \"$f\" || exit 1; done"
+  },
+  "engines": {
+    "node": ">=22.19.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "peerDependencies": {
+    "@earendil-works/pi-coding-agent": ">=0.80.0",
+    "@earendil-works/pi-ai": ">=0.80.0"
+  },
+  "peerDependenciesMeta": {
+    "@earendil-works/pi-coding-agent": { "optional": true },
+    "@earendil-works/pi-ai": { "optional": true }
+  },
+  "dependencies": {
+    "undici": "^7.28.0"
+  },
+  "devDependencies": {
+    "@types/node": "^20.14.0",
+    "tsx": "^4.16.0",
+    "typescript": "^5.5.0"
+  }
+}

package/src/attest/attestation.ts

@@ -0,0 +1,268 @@
+import { randomBytes, createHash, X509Certificate } from "node:crypto";
+import { request as httpsRequest } from "node:https";
+import type { TLSSocket } from "node:tls";
+import { gunzipSync } from "node:zlib";
+
+// Ported from privateer 0.2 (tree-cli/src/providers/attestation.ts). The pure
+// attestation logic is verbatim; what changed for the public package:
+//   - DROPPED the privateer-server-proxy path (fetchAttestationViaServer + the
+//     auth/privateer import) — that's the private account channel, not public.
+//   - config type + base-URL constants inlined (no config/schema / registry deps).
+// The SEV-SNP report_data parse, SPKI match, posture mappings are untouched.
+
+const TIMEOUT_MS = 12_000;
+
+export const NEARAI_BASE_URL = "https://cloud-api.near.ai/v1";
+export const TINFOIL_BASE_URL = "https://inference.tinfoil.sh/v1";
+
+// Minimal provider config the attestation calls need (replaces ProviderConfig).
+export interface AttestConfig {
+  apiKey?: string;
+  baseURL?: string;
+}
+
+export type TeePosture = "green" | "yellow" | "red";
+
+// ── NEAR AI TEE attestation ──────────────────────────────────────────────────
+// Every NEAR AI Cloud model runs inside a Trusted Execution Environment (Intel TDX
+// confidential VM + NVIDIA confidential-computing GPU). On request, the gateway
+// returns a cryptographic attestation report proving the model is running on
+// genuine TEE hardware, with a signing key that never leaves the enclave bound to
+// a caller-supplied nonce (report_data = signing_address || nonce).
+//
+// Pragmatic check suited to a TUI: fetch a fresh report bound to our nonce and
+// confirm it carries a TEE signing key plus hardware evidence. We do NOT re-validate
+// the raw NVIDIA/Intel quote chains here — that's the full verifier's job
+// (github.com/nearai/cloud-verifier); expose `raw` so a user can take it there.
+
+export interface Attestation {
+  model: string;
+  nonce: string; // the 32-byte hex nonce we sent (freshness / anti-replay)
+  signingAddress?: string; // TEE-bound key that signs inference responses
+  nonceEchoed: boolean; // our nonce appears in the report → it's fresh, not replayed
+  hardware: string[]; // detected evidence, e.g. ["NVIDIA", "Intel TDX"]
+  raw: unknown; // full report, for display + external verification
+}
+
+function baseFor(cfg: AttestConfig): string {
+  return (cfg.baseURL ?? NEARAI_BASE_URL).replace(/\/+$/, "");
+}
+
+// A 32-byte (64 hex char) random nonce, per NEAR's attestation API guidance.
+export function randomNonce(): string {
+  return randomBytes(32).toString("hex");
+}
+
+// Recursively find the first string value under any of `keys` (case-insensitive).
+function deepFindString(obj: unknown, keys: string[]): string | undefined {
+  const want = new Set(keys.map((k) => k.toLowerCase()));
+  const stack: unknown[] = [obj];
+  while (stack.length) {
+    const cur = stack.pop();
+    if (Array.isArray(cur)) {
+      stack.push(...cur);
+    } else if (cur && typeof cur === "object") {
+      for (const [k, v] of Object.entries(cur)) {
+        if (typeof v === "string" && want.has(k.toLowerCase()) && v.trim()) return v.trim();
+        if (v && typeof v === "object") stack.push(v);
+      }
+    }
+  }
+  return undefined;
+}
+
+// Fetch and interpret the attestation report for a model. Throws a readable error
+// on missing key / network / HTTP failure so a caller can show "unverified".
+export async function fetchAttestation(cfg: AttestConfig, modelId: string): Promise<Attestation> {
+  if (!cfg.apiKey) throw new Error("no API key");
+  const nonce = randomNonce();
+  const url =
+    `${baseFor(cfg)}/attestation/report` +
+    `?model=${encodeURIComponent(modelId)}&signing_algo=ecdsa&nonce=${nonce}`;
+
+  const ac = new AbortController();
+  const timer = setTimeout(() => ac.abort(), TIMEOUT_MS);
+  let raw: unknown;
+  try {
+    const res = await fetch(url, {
+      headers: { authorization: `Bearer ${cfg.apiKey}` },
+      signal: ac.signal,
+    });
+    if (!res.ok) {
+      const body = await res.text().catch(() => "");
+      const hint = body.slice(0, 200).trim();
+      throw new Error(`HTTP ${res.status} ${res.statusText}${hint ? ` — ${hint}` : ""}`);
+    }
+    raw = await res.json();
+  } catch (err) {
+    if (err instanceof Error && err.name === "AbortError") {
+      throw new Error(`timed out after ${TIMEOUT_MS / 1000}s`);
+    }
+    throw err;
+  } finally {
+    clearTimeout(timer);
+  }
+
+  return interpretReport(modelId, nonce, raw);
+}
+
+// Turn a raw NEAR attestation report into our Attestation posture. Pure.
+export function interpretReport(modelId: string, nonce: string, raw: unknown): Attestation {
+  const signingAddress = deepFindString(raw, ["signing_address", "signingAddress", "address"]);
+  // Hardware evidence is detected by scanning the serialized report for the quote
+  // markers each vendor uses — robust to the exact response shape.
+  const blob = JSON.stringify(raw).toLowerCase();
+  const hardware: string[] = [];
+  if (/nvidia|gpu/.test(blob)) hardware.push("NVIDIA");
+  if (/intel|tdx/.test(blob)) hardware.push("Intel TDX");
+  const nonceEchoed = blob.includes(nonce.toLowerCase());
+
+  return { model: modelId, nonce, signingAddress, nonceEchoed, hardware, raw };
+}
+
+// Map an attestation to a status color. GREEN: fresh report bound to our nonce with
+// a TEE signing key and hardware evidence. YELLOW: a report came back but it's
+// missing the signing key, hardware evidence, or nonce echo. RED: no material.
+export function teePosture(att: Attestation): TeePosture {
+  if (!att.signingAddress && att.hardware.length === 0) return "red";
+  if (att.signingAddress && att.hardware.length > 0 && att.nonceEchoed) return "green";
+  return "yellow";
+}
+
+// ── Tinfoil TEE attestation ──────────────────────────────────────────────────
+// Tinfoil enclaves publish an attestation document at /.well-known/tinfoil-attestation:
+// { format: <predicate URL>, body: <base64 (gzipped) hardware report> }. The
+// document attests the *host* — the gateway itself runs in the enclave. For the
+// SEV-SNP predicate, report_data[0:32] is the SHA-256 of the enclave's TLS public
+// key (SPKI DER): TLS terminates inside the enclave, so matching that hash against
+// the key on the connection that served the document proves the channel ends in
+// attested hardware. Pragmatic check — we do NOT re-validate the AMD signature
+// chain or Sigstore measurements (that's github.com/tinfoilsh/tinfoil-cli's job).
+
+export interface TinfoilAttestation {
+  host: string; // host the document came from (attestation is per-host, not per-model)
+  format: string; // predicate URL declaring the report type
+  hardware: string[]; // TEE platform(s) the predicate names, e.g. ["AMD SEV-SNP"]
+  attestedTlsKeyFp?: string; // report_data[0:32]: hash of the enclave's TLS key
+  liveTlsKeyFp?: string; // hash of the TLS key that actually served the document
+  tlsKeyMatched: boolean; // live key is the attested key → channel ends in the enclave
+  raw: unknown; // full document, for display + external verification
+}
+
+// What the transport hands back: the parsed well-known document plus the SPKI
+// SHA-256 of the leaf cert on the connection that served it. Injectable so tests
+// can exercise interpretation without a TLS handshake, and so the connection can be
+// the real inference socket (see dispatcherTransport in ./dispatcher.ts).
+export type TinfoilTransport = (host: string) => Promise<{ doc: unknown; liveTlsKeyFp?: string }>;
+
+// Node's fetch never exposes the peer certificate, so the default transport drops
+// to https.request and reads the leaf cert off the socket that delivered the body —
+// the binding is only meaningful against that exact connection.
+export const httpsTransport: TinfoilTransport = (host) =>
+  new Promise((resolve, reject) => {
+    const url = new URL(`https://${host}/.well-known/tinfoil-attestation`);
+    const req = httpsRequest(
+      {
+        hostname: url.hostname,
+        port: url.port ? Number(url.port) : 443,
+        path: url.pathname,
+        method: "GET",
+        timeout: TIMEOUT_MS,
+      },
+      (res) => {
+        let liveTlsKeyFp: string | undefined;
+        try {
+          const peer = (res.socket as TLSSocket).getPeerCertificate();
+          if (peer?.raw) {
+            const spki = new X509Certificate(peer.raw).publicKey.export({ type: "spki", format: "der" });
+            liveTlsKeyFp = createHash("sha256").update(spki).digest("hex");
+          }
+        } catch {
+          // cert unavailable → binding stays unconfirmed (yellow), not an error
+        }
+        let body = "";
+        res.on("data", (chunk) => (body += chunk));
+        res.on("end", () => {
+          if (!res.statusCode || res.statusCode < 200 || res.statusCode >= 300) {
+            const hint = body.slice(0, 200).trim();
+            reject(new Error(`HTTP ${res.statusCode} ${res.statusMessage ?? ""}${hint ? ` — ${hint}` : ""}`));
+            return;
+          }
+          try {
+            resolve({ doc: JSON.parse(body), liveTlsKeyFp });
+          } catch {
+            reject(new Error("attestation endpoint returned non-JSON"));
+          }
+        });
+        res.on("error", reject);
+      },
+    );
+    req.on("timeout", () => req.destroy(new Error(`timed out after ${TIMEOUT_MS / 1000}s`)));
+    req.on("error", reject);
+    req.end();
+  });
+
+// Fetch and interpret the attestation document for the configured Tinfoil endpoint.
+// Needs no API key — the well-known endpoint is public.
+export async function fetchTinfoilAttestation(
+  cfg: AttestConfig,
+  transport: TinfoilTransport = httpsTransport,
+): Promise<TinfoilAttestation> {
+  const host = new URL(cfg.baseURL ?? TINFOIL_BASE_URL).host;
+  const { doc, liveTlsKeyFp } = await transport(host);
+  return interpretTinfoilDoc(host, doc, liveTlsKeyFp);
+}
+
+// Turn a raw attestation document into our posture inputs. Pure and lenient: a
+// malformed document degrades to "no material" (red) rather than throwing.
+export function interpretTinfoilDoc(
+  host: string,
+  doc: unknown,
+  liveTlsKeyFp?: string,
+): TinfoilAttestation {
+  const d = (doc ?? {}) as { format?: unknown; body?: unknown };
+  const format = typeof d.format === "string" ? d.format : "";
+  // Hardware evidence comes from the predicate URL itself (e.g.
+  // ".../predicate/sev-snp-guest/v2", ".../snp-tdx-multiplatform/v1").
+  const fmt = format.toLowerCase();
+  const hardware: string[] = [];
+  if (/sev|snp/.test(fmt)) hardware.push("AMD SEV-SNP");
+  if (/tdx/.test(fmt)) hardware.push("Intel TDX");
+  if (/nitro/.test(fmt)) hardware.push("AWS Nitro");
+
+  // Decode the report: base64, gunzipped when the gzip magic leads.
+  let report: Buffer | undefined;
+  if (typeof d.body === "string" && d.body) {
+    try {
+      let bytes = Buffer.from(d.body, "base64");
+      if (bytes[0] === 0x1f && bytes[1] === 0x8b) bytes = gunzipSync(bytes);
+      report = bytes;
+    } catch {
+      // undecodable body → treated as absent
+    }
+  }
+
+  // The SEV-SNP report layout puts report_data (64 bytes) at 0x50; Tinfoil packs
+  // the TLS-key hash into its first half. Only that predicate's layout is known, so
+  // other formats fall back to scanning the report for the live key's bytes.
+  const attestedTlsKeyFp =
+    /sev-snp-guest/.test(fmt) && report && report.length >= 0x90
+      ? report.subarray(0x50, 0x70).toString("hex")
+      : undefined;
+  const tlsKeyMatched =
+    !!liveTlsKeyFp &&
+    !!report &&
+    (attestedTlsKeyFp === liveTlsKeyFp || report.includes(Buffer.from(liveTlsKeyFp, "hex")));
+
+  return { host, format, hardware, attestedTlsKeyFp, liveTlsKeyFp, tlsKeyMatched, raw: doc };
+}
+
+// Posture mapping for Tinfoil, mirroring teePosture. GREEN: a TEE predicate plus the
+// live TLS key found inside the attested report (channel demonstrably ends in the
+// enclave). YELLOW: a report came back but the binding couldn't be confirmed here.
+// RED: no attestation material at all.
+export function tinfoilTeePosture(att: TinfoilAttestation): TeePosture {
+  if (att.hardware.length === 0 && !att.attestedTlsKeyFp) return "red";
+  if (att.hardware.length > 0 && att.tlsKeyMatched) return "green";
+  return "yellow";
+}

package/src/attest/dispatcher.ts

@@ -0,0 +1,94 @@
+// The out-of-band attestation interposer — the moat, as a reusable module.
+//
+// Pi's extension hooks can't reach the TLS peer certificate (pi-ai strips the
+// provider response to { status, headers }), so a process-wide undici global
+// dispatcher captures the enclave's TLS SPKI hash on the `connect` hook — exactly
+// what a Tinfoil attestation report pins. Spike-proven to work even when installed
+// at extension-init (Pi resolves the global dispatcher at call time), so a Pi
+// extension can install this without a pre-import boot shim.
+
+import crypto from "node:crypto";
+import { Agent, buildConnector, setGlobalDispatcher } from "undici";
+
+export interface CapturedCert {
+  subject: string;
+  issuer: string;
+  // SHA-256 of the peer cert's SubjectPublicKeyInfo (SPKI DER) — the value a
+  // Tinfoil attestation report pins (the enclave TLS key fingerprint).
+  spkiSha256: string;
+  fingerprint256?: string;
+  error?: string;
+}
+
+// host -> captured cert. Keyed per-host because undici pools keep-alive sockets:
+// the connect hook fires ONLY on a NEW connection, so a reused socket skips it.
+// Do NOT pre-pool a connection to an attested host before the first read.
+const captured = new Map<string, CapturedCert>();
+let installed = false;
+
+// Install the global dispatcher (idempotent). Call from an extension factory or a
+// pre-Pi boot module — both work (see spike-ext-dispatcher).
+export function installAttestationDispatcher(): void {
+  if (installed) return;
+  installed = true;
+
+  const baseConnect = buildConnector({});
+  const attestingConnector: typeof baseConnect = (opts, cb) =>
+    baseConnect(opts, (err, socket) => {
+      const host = opts.hostname;
+      if (
+        !err &&
+        socket &&
+        host &&
+        !captured.has(host) &&
+        typeof (socket as any).getPeerCertificate === "function"
+      ) {
+        try {
+          const cert = (socket as any).getPeerCertificate(true);
+          if (cert && cert.raw) {
+            const spkiDer = new crypto.X509Certificate(cert.raw).publicKey.export({
+              type: "spki",
+              format: "der",
+            });
+            captured.set(host, {
+              subject: cert.subject?.CN ?? JSON.stringify(cert.subject),
+              issuer: cert.issuer?.O ?? cert.issuer?.CN ?? JSON.stringify(cert.issuer),
+              spkiSha256: crypto.createHash("sha256").update(spkiDer).digest("hex"),
+              fingerprint256: cert.fingerprint256,
+            });
+          }
+        } catch (e) {
+          captured.set(host, { error: String(e) } as CapturedCert);
+        }
+      }
+      cb(err, socket as any);
+    });
+
+  setGlobalDispatcher(new Agent({ connect: attestingConnector, connectTimeout: 8000 }));
+}
+
+export function getCapturedCert(host: string): CapturedCert | undefined {
+  return captured.get(host);
+}
+
+export function capturedHosts(): ReadonlyMap<string, CapturedCert> {
+  return captured;
+}
+
+// A TinfoilTransport that binds attestation to the SPKI captured on the real
+// provider connection (rather than a separate https.request). Fetches the
+// well-known document via global fetch — which flows through the dispatcher, so the
+// connect hook records the enclave's SPKI — then reads it back per host. Stronger
+// than httpsTransport: it proves the CONNECTION Pi actually uses ends in the enclave.
+import type { TinfoilTransport } from "./attestation.ts";
+
+export const dispatcherTransport: TinfoilTransport = async (host) => {
+  const res = await fetch(`https://${host}/.well-known/tinfoil-attestation`);
+  if (!res.ok) {
+    const hint = (await res.text().catch(() => "")).slice(0, 200).trim();
+    throw new Error(`HTTP ${res.status} ${res.statusText}${hint ? ` — ${hint}` : ""}`);
+  }
+  const doc = await res.json();
+  const cert = getCapturedCert(host);
+  return { doc, liveTlsKeyFp: cert && !cert.error ? cert.spkiSha256 : undefined };
+};

package/src/ext/patches.ts

@@ -0,0 +1,36 @@
+// Pure `before_provider_request` payload transforms. Kept separate so they're unit
+// -testable without a live session; the extension wires them per current provider.
+
+function asObject(payload: unknown): Record<string, unknown> {
+  return payload && typeof payload === "object" ? { ...(payload as Record<string, unknown>) } : {};
+}
+
+// Venice: disable Venice's injected system prompt by setting
+// venice_parameters.include_venice_system_prompt = false on the request body.
+// This is the code-blocker from the migration plan (Appendix A) — no models.json
+// equivalent exists, so it's a request-body patch. Returns a NEW payload.
+export function veniceRequestPatch(payload: unknown): Record<string, unknown> {
+  const p = asObject(payload);
+  const vp = p.venice_parameters && typeof p.venice_parameters === "object"
+    ? (p.venice_parameters as Record<string, unknown>)
+    : {};
+  return { ...p, venice_parameters: { ...vp, include_venice_system_prompt: false } };
+}
+
+// OpenRouter: pin ZERO-DATA-RETENTION routing so requests only reach endpoints that
+// don't retain data. Turns openrouter's tier from zdr-policy → zdr-enforced.
+//
+// VERIFIED LIVE (2026-07-07): OpenRouter honors `provider.data_collection: "deny"`
+// and `provider.zdr: true` — it filters routing to compliant providers and returns
+// 404 "No allowed providers are available" when the policy can't be satisfied
+// (i.e. it does NOT silently ignore the constraint). Mirrors pi-ai's native
+// OpenRouterRouting (`compat.openRouterRouting`), so the request body is identical
+// whether it comes from here or pi-ai. This is enforcement (observable routing),
+// NOT attestation — the zdr-enforced tier says so.
+export function openRouterZdrPatch(payload: unknown): Record<string, unknown> {
+  const p = asObject(payload);
+  const provider = p.provider && typeof p.provider === "object"
+    ? (p.provider as Record<string, unknown>)
+    : {};
+  return { ...p, provider: { ...provider, zdr: true, data_collection: "deny" } };
+}

package/src/extension.ts

@@ -0,0 +1,172 @@
+// The Pi extension entry — what a marketplace install (or privateer-agent) loads.
+//
+// Wires the package together: installs the attestation dispatcher at extension-init
+// (spike-proven to intercept provider TLS from here), registers the config-only
+// privacy providers, patches venice / OpenRouter requests, tracks the current model
+// to compute its posture, and adds a `/verify` command. Structural Pi typing keeps
+// it decoupled from Pi's exact internal types (verified against the installed
+// ExtensionAPI / ProviderConfigInput in 0.80.3).
+
+import { installAttestationDispatcher, dispatcherTransport } from "./attest/dispatcher.ts";
+import { PRIVACY_PROVIDERS, type PrivacyProvider } from "./providers/catalog.ts";
+import { veniceRequestPatch, openRouterZdrPatch } from "./ext/patches.ts";
+import { verifyModelPosture, type PostureResult } from "./posture/verify.ts";
+import { TIERS } from "./posture/tiers.ts";
+
+// ── structural Pi surface (subset we use) ────────────────────────────────────
+interface PiModel {
+  provider?: string;
+  id?: string;
+}
+interface PiCtx {
+  ui?: { notify?: (message: string, level?: string) => void };
+}
+interface PiExtensionApiLike {
+  registerProvider?(name: string, config: unknown): void;
+  registerCommand?(
+    name: string,
+    options: { description?: string; handler: (args: unknown, ctx: PiCtx) => unknown },
+  ): void;
+  on(event: string, handler: (event: any, ctx: PiCtx) => any): void;
+}
+
+export interface PiPrivacyOptions {
+  // Install the process-wide attestation dispatcher (default true). Set false if the
+  // host already installed one (e.g. privateer-agent's boot.ts).
+  installDispatcher?: boolean;
+  // Register the config-only privacy providers (tinfoil/nearai/venice/ollama) with
+  // seed models (default true). Built-in providers (openrouter/fireworks) are left
+  // to Pi so their model listings aren't clobbered.
+  registerProviders?: boolean;
+  // Enforce OpenRouter ZDR routing (default false — opt-in, since a model with no
+  // zero-retention endpoint will 404 rather than fall back). VERIFIED honest: when
+  // on, requests carry provider.{zdr:true,data_collection:"deny"}, which OpenRouter
+  // observably enforces (it 404s if unsatisfiable), so the zdr-enforced badge is earned.
+  enforceOpenRouterZdr?: boolean;
+  // Called whenever the current model's posture is (re)computed — the badge feed.
+  onPosture?: (result: PostureResult) => void;
+  // Bind Tinfoil attestation to the real provider connection via the dispatcher
+  // (default true when the dispatcher is installed). Falls back to httpsTransport.
+  useDispatcherTransport?: boolean;
+}
+
+// Config-only providers Pi doesn't ship: register these. Built-ins + custom skipped.
+const BUILTIN = new Set(["openrouter", "fireworks"]);
+const SEED_MODELS: Record<string, string> = {
+  tinfoil: "deepseek-v4-pro",
+  nearai: "zai-org/GLM-5.1-FP8",
+  venice: "qwen3-coder-480b-a35b-instruct-turbo",
+  ollama: "llama3.1",
+};
+
+function registerable(p: PrivacyProvider): boolean {
+  return !!p.baseUrl && !BUILTIN.has(p.id) && p.id !== "custom";
+}
+
+function providerConfig(p: PrivacyProvider): unknown {
+  const seed = SEED_MODELS[p.id];
+  const models = seed
+    ? [
+        {
+          id: seed,
+          name: seed,
+          reasoning: false,
+          input: ["text"] as ("text" | "image")[],
+          cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+          contextWindow: 128000,
+          maxTokens: 4096,
+        },
+      ]
+    : [];
+  const cfg: Record<string, unknown> = { name: p.label, baseUrl: p.baseUrl, api: p.api, models };
+  if (p.keyEnv) {
+    cfg.apiKey = p.keyEnv; // env template ${...}; Pi resolves it
+    cfg.authHeader = true;
+  } else if (p.local && models.length) {
+    // Pi requires apiKey (or oauth) whenever a provider defines models. Local
+    // servers (ollama) ignore the auth header, so a placeholder satisfies the
+    // validation without sending a meaningful credential.
+    cfg.apiKey = "local";
+  }
+  return cfg;
+}
+
+function nearApiKey(): string | undefined {
+  // Both spellings are used in the wild (see privateer redact.ts).
+  return process.env.NEARAI_API_KEY ?? process.env.NEAR_AI_API_KEY;
+}
+
+export function makePiPrivacyExtension(opts: PiPrivacyOptions = {}) {
+  const {
+    installDispatcher = true,
+    registerProviders = true,
+    enforceOpenRouterZdr = false,
+    onPosture,
+    useDispatcherTransport = true,
+  } = opts;
+
+  return function piPrivacy(pi: PiExtensionApiLike): void {
+    if (installDispatcher) installAttestationDispatcher();
+
+    if (registerProviders && typeof pi.registerProvider === "function") {
+      for (const p of PRIVACY_PROVIDERS) {
+        if (registerable(p)) pi.registerProvider(p.id, providerConfig(p));
+      }
+    }
+
+    let currentProviderId: string | undefined;
+    let currentModelId: string | undefined;
+
+    // Recompute + publish posture for the current model.
+    const refreshPosture = async () => {
+      if (!currentProviderId || !currentModelId || !onPosture) return;
+      const result = await verifyModelPosture(currentProviderId, currentModelId, {
+        apiKey: currentProviderId === "nearai" ? nearApiKey() : undefined,
+        zdrEnforced: currentProviderId === "openrouter" && enforceOpenRouterZdr,
+        transport: useDispatcherTransport && installDispatcher ? dispatcherTransport : undefined,
+      });
+      onPosture(result);
+    };
+
+    pi.on("model_select", (event) => {
+      const model = event?.model as PiModel | undefined;
+      currentProviderId = model?.provider;
+      currentModelId = model?.id;
+      void refreshPosture();
+    });
+
+    // Per-provider request patches. Scoped to the current provider so we never
+    // mutate a payload bound for a different endpoint.
+    pi.on("before_provider_request", (event) => {
+      if (currentProviderId === "venice") return veniceRequestPatch(event?.payload);
+      if (currentProviderId === "openrouter" && enforceOpenRouterZdr) {
+        return openRouterZdrPatch(event?.payload);
+      }
+      return undefined;
+    });
+
+    if (typeof pi.registerCommand === "function") {
+      pi.registerCommand("verify", {
+        description: "Verify the current model's privacy posture (TEE attestation)",
+        handler: async (_args, ctx) => {
+          if (!currentProviderId || !currentModelId) {
+            ctx.ui?.notify?.("No model selected.", "warning");
+            return;
+          }
+          const res = await verifyModelPosture(currentProviderId, currentModelId, {
+            apiKey: currentProviderId === "nearai" ? nearApiKey() : undefined,
+            zdrEnforced: currentProviderId === "openrouter" && enforceOpenRouterZdr,
+            transport: useDispatcherTransport && installDispatcher ? dispatcherTransport : undefined,
+          });
+          const info = TIERS[res.tier];
+          const detail = res.teePosture ? ` [${res.teePosture}]` : "";
+          const err = res.error ? ` — ${res.error}` : "";
+          ctx.ui?.notify?.(`${info.label}${detail}: ${info.blurb}${err}`, "info");
+        },
+      });
+    }
+  };
+}
+
+// Default export: the marketplace-installable extension with default options.
+export default makePiPrivacyExtension();

package/src/index.ts

@@ -0,0 +1,68 @@
+// Public API for the pi-privacy package (working name).
+//
+// Two things a consumer wants: (1) the honest privacy taxonomy — tiers + provider
+// catalog — and (2) [coming next] the Pi extension that registers these providers,
+// installs the attestation dispatcher, verifies TEE posture, and enforces/labels
+// ZDR. This turn ships (1) + the catalog; the attestation engine + extension land
+// next (ported from privateer 0.2 attestation.ts).
+
+export {
+  type PrivacyTier,
+  type Verifiability,
+  type TierInfo,
+  TIERS,
+  tierRank,
+  tierFromTeePosture,
+} from "./posture/tiers.ts";
+
+export {
+  type ProviderApi,
+  type PrivacyProvider,
+  PRIVACY_PROVIDERS,
+  PROVIDER_BY_ID,
+  isLocalEndpoint,
+} from "./providers/catalog.ts";
+
+// Attestation engine (ported from privateer 0.2, minus the private server-proxy path).
+export {
+  type TeePosture,
+  type AttestConfig,
+  type Attestation,
+  type TinfoilAttestation,
+  type TinfoilTransport,
+  NEARAI_BASE_URL,
+  TINFOIL_BASE_URL,
+  randomNonce,
+  fetchAttestation,
+  interpretReport,
+  teePosture,
+  httpsTransport,
+  fetchTinfoilAttestation,
+  interpretTinfoilDoc,
+  tinfoilTeePosture,
+} from "./attest/attestation.ts";
+
+export {
+  type CapturedCert,
+  installAttestationDispatcher,
+  getCapturedCert,
+  capturedHosts,
+  dispatcherTransport,
+} from "./attest/dispatcher.ts";
+
+export { effectiveTier } from "./posture/effective.ts";
+
+// Posture verification (attestation-backed) + the Pi extension entry.
+export {
+  type PostureResult,
+  type VerifyOptions,
+  verifyModelPosture,
+} from "./posture/verify.ts";
+
+export {
+  type PiPrivacyOptions,
+  makePiPrivacyExtension,
+  default as piPrivacyExtension,
+} from "./extension.ts";
+
+export { veniceRequestPatch, openRouterZdrPatch } from "./ext/patches.ts";

package/src/posture/effective.ts

@@ -0,0 +1,24 @@
+import { PROVIDER_BY_ID, isLocalEndpoint } from "../providers/catalog.ts";
+import type { PrivacyTier } from "./tiers.ts";
+
+// Resolve a provider's effective tier, accounting for on-device detection and
+// posture-aware providers. `zdrEnforced` reflects whether ZDR routing is actively
+// pinned this session (OpenRouter). The one honest source of truth shared by the
+// badge layer, the picker sort, and posture verification.
+//
+// NOTE: for TEE providers this returns only the pre-attestation CEILING
+// (tee-verified as an advertised capability). The real green/yellow/red verdict
+// comes from verifyModelPosture() at runtime — never claim tee-verified from this
+// function alone.
+export function effectiveTier(
+  providerId: string,
+  opts: { baseUrl?: string; zdrEnforced?: boolean } = {},
+): PrivacyTier {
+  const p = PROVIDER_BY_ID[providerId];
+  if (!p) return "standard";
+  if (p.local || isLocalEndpoint(opts.baseUrl)) return "local";
+  if (p.postureAware && p.id === "openrouter") {
+    return opts.zdrEnforced ? "zdr-enforced" : "zdr-policy";
+  }
+  return p.tier;
+}

package/src/posture/tiers.ts

@@ -0,0 +1,110 @@
+// The graded privacy ladder — the honest-labeling contract, as code.
+//
+// The single rule this file exists to enforce: NEVER conflate a *verified*
+// guarantee with an *asserted* one. A TEE tier means we cryptographically checked
+// the enclave (remote attestation + a live-TLS-key match against the report). A
+// ZDR tier means the provider *promises* zero retention — we can't verify it, and
+// the badge must say so. Local means the bytes never left the machine (a loopback
+// endpoint we can observe). Rendering these the same would overclaim; the whole
+// credibility of the package rests on keeping them distinct.
+
+// Strongest → weakest. Ordered so a picker can sort by privacy strength.
+export type PrivacyTier =
+  | "tee-verified" // attestation ran, enclave genuine, live TLS key matched the report
+  | "tee-unverified" // provider claims a TEE; attestation incomplete/unconfirmed (TeePosture "yellow")
+  | "local" // loopback endpoint — inference on-device, nothing leaves the machine
+  | "zdr-enforced" // zero-retention actively pinned this session (e.g. OpenRouter ZDR routing on)
+  | "zdr-policy" // zero-retention by provider policy only — not verifiable
+  | "standard"; // no special guarantee
+
+// How strong the EVIDENCE is behind a tier — the honest core. Only "cryptographic"
+// is a real proof; "observable" is a weak local check (loopback / route pinned);
+// "policy" is a promise; "none" is nothing.
+export type Verifiability = "cryptographic" | "observable" | "policy" | "none";
+
+export interface TierInfo {
+  tier: PrivacyTier;
+  // One-word status for the badge. Deliberately different words for verified vs
+  // asserted tiers so they never read alike.
+  label: string;
+  verifiability: Verifiability;
+  // Traffic-light bucket, mirroring the 0.2 TeePosture green/yellow/red so the
+  // status-bar shield + picker badges keep the same semantics.
+  posture: "green" | "yellow" | "red" | "neutral";
+  // Honest one-liner shown on hover / in the picker. States the LIMIT of the claim.
+  blurb: string;
+}
+
+export const TIERS: Record<PrivacyTier, TierInfo> = {
+  "tee-verified": {
+    tier: "tee-verified",
+    label: "Verified TEE",
+    verifiability: "cryptographic",
+    posture: "green",
+    blurb:
+      "Confidential-enclave inference, cryptographically verified: remote attestation " +
+      "proved genuine TEE hardware and the live TLS key matched the attestation report.",
+  },
+  "tee-unverified": {
+    tier: "tee-unverified",
+    label: "TEE (unconfirmed)",
+    verifiability: "none",
+    posture: "yellow",
+    blurb:
+      "Provider claims a TEE, but attestation was incomplete or the live key could not " +
+      "be matched here — treat as unverified until it goes green.",
+  },
+  local: {
+    tier: "local",
+    label: "On-device",
+    verifiability: "observable",
+    posture: "green",
+    blurb: "Runs against a loopback endpoint — inference is local; no prompt leaves the machine.",
+  },
+  "zdr-enforced": {
+    tier: "zdr-enforced",
+    label: "ZDR (enforced)",
+    verifiability: "observable",
+    posture: "green",
+    blurb:
+      "Routing is constrained to providers that contractually don't retain data — " +
+      "verified observable: OpenRouter refuses to serve when the policy can't be met. " +
+      "Enforcement of a policy, not hardware attestation.",
+  },
+  "zdr-policy": {
+    tier: "zdr-policy",
+    label: "ZDR (by policy)",
+    verifiability: "policy",
+    posture: "yellow",
+    blurb:
+      "The provider states it doesn't retain data, but this is a policy promise we can't " +
+      "verify — not hardware, not attested.",
+  },
+  standard: {
+    tier: "standard",
+    label: "Standard",
+    verifiability: "none",
+    posture: "neutral",
+    blurb: "No special privacy guarantee.",
+  },
+};
+
+// Sort key: strongest privacy first. Used by pickers to rank providers/models.
+const ORDER: PrivacyTier[] = [
+  "tee-verified",
+  "local",
+  "zdr-enforced",
+  "tee-unverified",
+  "zdr-policy",
+  "standard",
+];
+export function tierRank(t: PrivacyTier): number {
+  const i = ORDER.indexOf(t);
+  return i === -1 ? ORDER.length : i;
+}
+
+// Map the 0.2 TeePosture (green/yellow/red) onto the graded ladder, so the ported
+// attestation engine's output slots into this vocabulary without a rewrite.
+export function tierFromTeePosture(p: "green" | "yellow" | "red"): PrivacyTier {
+  return p === "green" ? "tee-verified" : p === "yellow" ? "tee-unverified" : "standard";
+}

package/src/posture/verify.ts

@@ -0,0 +1,73 @@
+import { PROVIDER_BY_ID } from "../providers/catalog.ts";
+import { effectiveTier } from "./effective.ts";
+import { type PrivacyTier, tierFromTeePosture } from "./tiers.ts";
+import {
+  fetchTinfoilAttestation,
+  fetchAttestation,
+  tinfoilTeePosture,
+  teePosture,
+  httpsTransport,
+  type TeePosture,
+  type TinfoilTransport,
+} from "../attest/attestation.ts";
+
+// The badge/queryable posture for a specific model. For TEE providers this ACTIVELY
+// verifies (attestation → green/yellow/red); for everything else it resolves the
+// static tier + on-device / ZDR-enforcement. The one place a `tee-verified` verdict
+// can legitimately come from — never from effectiveTier() alone.
+
+export interface PostureResult {
+  providerId: string;
+  modelId: string;
+  tier: PrivacyTier;
+  teePosture?: TeePosture; // present for TEE providers
+  attestation?: unknown; // raw report, for /verify display + external verification
+  error?: string; // attestation fetch failed → tier falls back to tee-unverified
+}
+
+export interface VerifyOptions {
+  apiKey?: string; // for NEAR (report is key-gated)
+  baseUrl?: string; // override the provider's default endpoint
+  zdrEnforced?: boolean; // OpenRouter: is ZDR routing actively pinned?
+  transport?: TinfoilTransport; // inject for tests / to bind to the real connection
+}
+
+export async function verifyModelPosture(
+  providerId: string,
+  modelId: string,
+  opts: VerifyOptions = {},
+): Promise<PostureResult> {
+  const p = PROVIDER_BY_ID[providerId];
+
+  if (p?.id === "tinfoil") {
+    try {
+      const att = await fetchTinfoilAttestation(
+        { baseURL: opts.baseUrl },
+        opts.transport ?? httpsTransport,
+      );
+      const tp = tinfoilTeePosture(att);
+      return { providerId, modelId, tier: tierFromTeePosture(tp), teePosture: tp, attestation: att };
+    } catch (e) {
+      // A TEE provider we couldn't verify is unverified — NOT downgraded to a
+      // false "standard": the honest state is "claims TEE, unconfirmed".
+      return { providerId, modelId, tier: "tee-unverified", error: (e as Error).message };
+    }
+  }
+
+  if (p?.id === "nearai") {
+    try {
+      const att = await fetchAttestation({ apiKey: opts.apiKey, baseURL: opts.baseUrl }, modelId);
+      const tp = teePosture(att);
+      return { providerId, modelId, tier: tierFromTeePosture(tp), teePosture: tp, attestation: att };
+    } catch (e) {
+      return { providerId, modelId, tier: "tee-unverified", error: (e as Error).message };
+    }
+  }
+
+  // Non-TEE: static tier + on-device detection + ZDR enforcement state.
+  return {
+    providerId,
+    modelId,
+    tier: effectiveTier(providerId, { baseUrl: opts.baseUrl, zdrEnforced: opts.zdrEnforced }),
+  };
+}

package/src/providers/catalog.ts

@@ -0,0 +1,128 @@
+import type { PrivacyTier } from "../posture/tiers.ts";
+
+// The privacy-oriented providers this package registers with Pi, with their tier
+// and the config a Pi provider entry needs (baseUrl / api / key env). The honest
+// notes are ported ~verbatim from privateer 0.2 (tree-cli catalog.ts) — that copy
+// is load-bearing: it states the LIMIT of each guarantee, and must not be softened.
+//
+// Providers deliberately NOT here (together/deepseek/minimax/qwen/…): they have no
+// verifiable or default privacy channel, so claiming one would overclaim. They stay
+// "standard" and get no badge — same stance as 0.2.
+
+export type ProviderApi =
+  | "openai-completions"
+  | "openai-responses"
+  | "anthropic-messages";
+
+export interface PrivacyProvider {
+  id: string;
+  label: string;
+  // The BEST tier this provider can offer. `postureAware` providers resolve their
+  // actual tier at runtime (OpenRouter is zdr-policy until ZDR routing is enforced,
+  // then zdr-enforced), so this is the ceiling, not a promise.
+  tier: PrivacyTier;
+  postureAware?: boolean;
+  // True when the provider exposes a remote-attestation endpoint we actively verify
+  // (the only path to tee-verified). NEAR = report-body over HTTPS; Tinfoil = SPKI
+  // pinned via the out-of-band dispatcher.
+  attestable?: boolean;
+  baseUrl?: string;
+  api: ProviderApi;
+  keyEnv?: string; // env template, e.g. "${TINFOIL_API_KEY}"; omit for keyless/local
+  local?: boolean;
+  // Honest note (ported): states where to get a key AND the limit of the guarantee.
+  note: string;
+  // Provider-specific request nuances Pi needs (compat), carried through to the entry.
+  compat?: Record<string, unknown>;
+}
+
+export const PRIVACY_PROVIDERS: PrivacyProvider[] = [
+  {
+    id: "tinfoil",
+    label: "Tinfoil (private TEE inference)",
+    tier: "tee-verified",
+    attestable: true,
+    baseUrl: "https://inference.tinfoil.sh/v1",
+    api: "openai-completions",
+    keyEnv: "${TINFOIL_API_KEY}",
+    note: "tinfoil.sh → dashboard → API Keys. Confidential-enclave inference; verified by attestation + live-TLS-key match.",
+  },
+  {
+    id: "nearai",
+    label: "NEAR AI (private TEE inference)",
+    tier: "tee-verified",
+    attestable: true,
+    baseUrl: "https://cloud-api.near.ai/v1",
+    api: "openai-completions",
+    keyEnv: "${NEARAI_API_KEY}",
+    note: "cloud.near.ai → API Keys. Confidential-compute TEE; attestation carried in the report body (verified over HTTPS).",
+  },
+  {
+    id: "venice",
+    label: "Venice (no-retention inference)",
+    tier: "zdr-policy",
+    baseUrl: "https://api.venice.ai/api/v1",
+    api: "openai-completions",
+    keyEnv: "${VENICE_API_KEY}",
+    // Honest copy: policy, not hardware. Venice injects a body param to disable its
+    // system prompt — handled by a before_provider_request hook, not config.
+    note: 'venice.ai → API Keys (no retention by policy, not TEE-attested; "anonymized" models proxy upstream).',
+    compat: { veniceDisableSystemPrompt: true },
+  },
+  {
+    id: "fireworks",
+    label: "Fireworks (no-retention inference)",
+    tier: "zdr-policy",
+    baseUrl: "https://api.fireworks.ai/inference/v1",
+    api: "openai-completions",
+    keyEnv: "${FIREWORKS_API_KEY}",
+    // Honest copy: ZDR is the default for OPEN models only; Fireworks's own f1 /
+    // FireFunction may log. Not TEE-attested.
+    note: "fireworks.ai → API Keys (open models: zero retention by default, not TEE-attested; Fireworks's own f1/FireFunction may log).",
+  },
+  {
+    id: "openrouter",
+    label: "OpenRouter",
+    tier: "zdr-enforced", // ceiling; posture-aware — see postureAware
+    postureAware: true,
+    baseUrl: "https://openrouter.ai/api/v1",
+    api: "openai-completions",
+    keyEnv: "${OPENROUTER_API_KEY}",
+    // Honest copy: ZDR is per-model/account. Yellow (zdr-policy) until enforcement
+    // pins requests to zero-retention endpoints, then green (zdr-enforced).
+    note: "openrouter.ai/keys. ZDR is per-model; not guaranteed until ZDR routing is enforced (then requests only hit zero-retention endpoints).",
+    compat: { openRouterRouting: { zdr: true } },
+  },
+  {
+    id: "ollama",
+    label: "Ollama (local)",
+    tier: "local",
+    local: true,
+    baseUrl: "http://localhost:11434/v1", // OpenAI-compat surface, not native /api
+    api: "openai-completions",
+    note: "runs locally — no key needed. Inference on-device; nothing leaves the machine.",
+  },
+  {
+    id: "custom",
+    label: "Custom (OpenAI-compatible)",
+    tier: "standard", // resolved to `local` at runtime when the baseUrl is loopback
+    api: "openai-completions",
+    note: "any OpenAI-compatible endpoint — LM Studio, vLLM, llama.cpp, a proxy. Detected as on-device when the URL is loopback.",
+  },
+];
+
+export const PROVIDER_BY_ID: Record<string, PrivacyProvider> = Object.fromEntries(
+  PRIVACY_PROVIDERS.map((p) => [p.id, p]),
+);
+
+// A loopback / on-device endpoint? Used to promote `custom` (and confirm `ollama`)
+// to the `local` tier — observable, not merely claimed.
+export function isLocalEndpoint(baseUrl?: string): boolean {
+  if (!baseUrl) return false;
+  try {
+    const h = new URL(baseUrl).hostname;
+    return h === "localhost" || h === "127.0.0.1" || h === "::1" || h.endsWith(".local");
+  } catch {
+    return false;
+  }
+}