privateer-agent 0.10.0 → 0.12.0

package/src/providers/account.ts

@@ -37,7 +37,7 @@ import {
 
 // Seed/fallback catalog: registered synchronously so the account provider has real
 // models the instant it loads (before the live /api/models fetch resolves) — in
-// particular the default, tinfoil/glm-5-2, resolves at startup without a "model not
+// particular ACCOUNT_DEFAULT_MODEL_ID resolves at startup without a "model not
 // found" warning, which matters more than ever now that a signed-OUT terminal also
 // launches on it. The first two entries are the TEE tiers (Tinfoil, then NEAR); the
 // rest are the familiar names. Also the fallback list if the live listing is
@@ -46,6 +46,11 @@ import {
 const DEFAULT_MODELS = [
   ACCOUNT_DEFAULT_MODEL_ID,
   ACCOUNT_NEAR_MODEL_ID,
+  // The default until 2026-08-01 (see TINFOIL_MODEL_ID). It stays in the floor so a
+  // user who saved it as their own default still resolves it synchronously at launch,
+  // rather than falling through to "first model with configured auth" — the BYO dead
+  // end this seed list exists to prevent.
+  "tinfoil/glm-5-2",
   "anthropic/claude-opus-5",
   "anthropic/claude-sonnet-5",
   "openai/gpt-5.6-sol",
@@ -56,7 +61,9 @@ function seedModel(id: string) {
   return {
     id,
     name: id,
-    reasoning: false,
+    // reasoning + how to steer it, for the enclave models where we verified the
+    // control shape live; `reasoning: false` (Pi's "not a thinking model") for the rest.
+    ...(thinkingProfile(id) ?? { reasoning: false as const }),
     input: ["text"] as ("text" | "image")[],
     cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
     contextWindow: 128000,
@@ -64,6 +71,83 @@ function seedModel(id: string) {
   };
 }
 
+// ── Thinking control ─────────────────────────────────────────────────────────
+//
+// Every account model used to register with `reasoning: false`, and that one field
+// silently pinned the whole catalog to maximum thinking. Pi gates EVERY
+// thinking-control branch on `model.reasoning` (pi-ai api/openai-completions.js
+// buildParams) and AgentSession.cycleThinkingLevel() returns undefined without it. So
+// Privateer sent no thinking parameter at all — a thinking model ran at whatever its
+// server-side default was, forever — and the user's thinking toggle was inert.
+//
+// What that cost, measured live against the account channel on 2026-08-01 with
+// "Write a haiku about the sea": the default model emitted 77 reasoning deltas and
+// ZERO content, spending all 300 tokens thinking. The same prompt with thinking off
+// answered in 18 tokens / 1.8s.
+//
+// Annotating a model is a promise that the dial actually moves, so ONLY shapes
+// verified against the live enclave appear below. Pi's default level is "medium", so
+// nothing here turns thinking off behind the user's back — it makes the toggle real.
+interface ThinkingProfile {
+  reasoning: true;
+  thinkingLevelMap?: Record<string, string | null>;
+  compat?: { thinkingFormat: string };
+}
+
+// The vLLM chat-template family (GLM, Qwen). Honours
+// `chat_template_kwargs.enable_thinking`, which is exactly what Pi's
+// "qwen-chat-template" format emits. Verified — enable_thinking=false → 0 reasoning
+// deltas and a direct answer, true → thinking restored, neither errors — on
+// tinfoil/glm-5-2, near/zai-org/GLM-5.1-FP8, near/Qwen/Qwen3.6-35B-A3B-FP8 and
+// phala/z-ai/glm-5.2.
+//
+// The switch is binary (there is no effort dial), so publish exactly two levels
+// instead of five that all mean "on": a null in thinkingLevelMap marks a level
+// unsupported and pi-ai's getSupportedThinkingLevels drops it.
+const CHAT_TEMPLATE_THINKING: ThinkingProfile = {
+  reasoning: true,
+  thinkingLevelMap: { minimal: null, low: null, high: null, xhigh: null },
+  compat: { thinkingFormat: "qwen-chat-template" },
+};
+
+// gpt-oss (harmony) is the other way round: it IGNORES chat_template_kwargs and
+// honours `reasoning_effort` — which is Pi's default format for our baseUrl, so this
+// profile deliberately carries no compat override. Verified on tinfoil/gpt-oss-120b:
+// low → 9 reasoning deltas, high → 61.
+//
+// Harmony has no "none", so "off" is pinned to the floor rather than left unset —
+// unset would send nothing and let the model fall back to its own default (medium),
+// i.e. an "off" that thinks harder than "low". This is the toggle's lowest setting,
+// not silence.
+const REASONING_EFFORT_THINKING: ThinkingProfile = {
+  reasoning: true,
+  thinkingLevelMap: { off: "low", minimal: "low", xhigh: null },
+};
+
+// Only the TEE prefixes are annotated. Those are enclaves we drive directly and can
+// probe. The rest of the catalog is proxied to a third-party gateway whose thinking
+// shape we have NOT verified from here, and an unsupported parameter fails the whole
+// turn — decisively worse than a turn that thinks too much. They keep the old
+// behaviour exactly.
+//
+// Two deliberate omissions inside the TEE set: `*-instruct` ids are the
+// non-thinking variants, and tinfoil/kimi-k2-6 reasons but ignored BOTH levers when
+// probed, so annotating it would hand the user a dial connected to nothing.
+const TEE_MODEL = /^(tinfoil|phala|near)\//;
+
+export function thinkingProfile(id: string): ThinkingProfile | null {
+  if (!TEE_MODEL.test(id)) return null;
+  if (/instruct/i.test(id)) return null;
+  const profile = /gpt-oss/i.test(id)
+    ? REASONING_EFFORT_THINKING
+    : /glm|qwen/i.test(id)
+      ? CHAT_TEMPLATE_THINKING
+      : null;
+  // Hand out a COPY. These entries end up on hundreds of registered models, and a
+  // shared nested object is one careless mutation away from retuning the whole catalog.
+  return profile && { ...profile, thinkingLevelMap: { ...profile.thinkingLevelMap }, ...(profile.compat ? { compat: { ...profile.compat } } : {}) };
+}
+
 // ── Catalog cache ────────────────────────────────────────────────────────────
 //
 // The live catalog (241 models and counting) can only be registered once the network
@@ -114,10 +198,37 @@ export function loadCachedCatalogIds(): string[] {
   }
 }
 
+// Whether the account channel can actually SERVE a catalog model right now.
+//
+// `phala/*` is sealed-only: it runs through the sealed blind relay and nowhere else.
+// The server's cleartext `/api/agent/v1` has no Phala route and rejects the id
+// outright (verified live 2026-07-31: 400 "phala/… is not a valid model ID"), because
+// Phala models are the Sealed tier by design — the server is not meant to be able to
+// read them. But `/api/models` advertises them to every client regardless of whether
+// that client can reach the sealed path, so they were pickable and then failed on the
+// first prompt. Offering a model we know cannot answer is worse than a shorter list.
+//
+// The condition is the SHIM, not the flag. Sealed mode being enabled only means we
+// intend to seal; `phala/*` is unservable until the loopback shim is actually
+// listening, because that is what its per-model baseUrl points at (see modelEntry).
+// With the flag now defaulting on, "enabled but the shim failed to bind" is a state a
+// user can really land in, and it must not re-offer models that would 400.
+//
+// `tinfoil/*` is deliberately NOT filtered: the cleartext path serves it fine (sealed
+// mode only upgrades the badge from unconfirmed to verified), so it stays either way.
+export function isServableAccountModel(id: string): boolean {
+  if (!id.startsWith("phala/")) return true;
+  return sealedEnabled() && sealedShimBase() !== null;
+}
+
 // The ids to register synchronously at load. DEFAULT_MODELS FIRST and always: the account
 // default has to be index 0 both because it must always resolve and because Pi clones the
 // provider's first/default model when it synthesizes a custom model id
 // (model-resolver.js buildFallbackModel).
+//
+// Returns the server's list as cached, unfiltered — accountProviderConfig decides what
+// is servable at each registration, so a model dropped now (shim not up yet) can be
+// re-offered by a later re-registration without the cache being rewritten.
 export function seedCatalogIds(): string[] {
   const ids = [...DEFAULT_MODELS];
   const seen = new Set(ids);
@@ -202,7 +313,9 @@ export async function fetchAccountCatalog(): Promise<AccountModelInfo[]> {
         .map((m) => (m.modelId ? { id: m.modelId, tier: normalizeTier(m.privacy?.tier, m.modelId) } : null))
         .filter((x): x is AccountModelInfo => !!x);
       // Cache only a real LIVE listing — never the fallback, which would freeze the six
-      // seed ids on disk and read back as though it were the catalog.
+      // seed ids on disk and read back as though it were the catalog. Both the cache and
+      // the returned list are the server's UNFILTERED offer; servability is decided at
+      // registration (accountProviderConfig), which re-evaluates it every time.
       if (parsed.length) saveCachedCatalogIds(parsed.map((p) => p.id));
       infos = parsed.length ? parsed : fallback();
     }
@@ -367,7 +480,7 @@ const TEE_PREFIXES = ["near/", "tinfoil/", "phala/"];
 // Which privacy channel an account model routes through: confidential compute (TEE)
 // for the prefixes above, else a server-side ZDR channel. Ported from tree-cli
 // resolve.ts, then widened — it used to say `near/` only, which quietly labelled the
-// default model (tinfoil/glm-5-2, a TEE model) as a mere ZDR policy claim.
+// then-default model (tinfoil/glm-5-2, a TEE model) as a mere ZDR policy claim.
 export function privateerChannel(modelId: string): "tee" | "zdr" {
   return TEE_PREFIXES.some((p) => modelId.startsWith(p)) ? "tee" : "zdr";
 }
@@ -402,14 +515,15 @@ export async function accountPosture(modelId: string): Promise<AccountPosture> {
     const att = await attestSealed(sealedProvider);
     return att.ok ? { tier: "tee-verified" } : { tier: "tee-unverified", error: att.error };
   }
-  // Honest labelling for the non-NEAR enclaves without sealed mode. Tinfoil and Phala
-  // publish real attestations, but the server proxies the inference in cleartext, so
-  // from here we cannot bind a quote to the connection actually carrying our tokens —
-  // only the account's word that it did. That's `tee-unverified` (yellow "confidential
-  // compute, unconfirmed"), never the green tee-verified we reserve for a quote we
-  // checked ourselves. Turn on sealed mode (PRIVATEER_SEALED=1) for the verified
-  // shield, or set TINFOIL_API_KEY and run `tinfoil/*` direct (pi-privacy attests
-  // client-side over the TLS binding).
+  // Honest labelling for the non-NEAR enclaves when we are NOT sealing — sealed mode
+  // explicitly disabled (PRIVATEER_SEALED=0), or on but the shim never came up. Tinfoil
+  // and Phala publish real attestations, but the server proxies the inference in
+  // cleartext, so from here we cannot bind a quote to the connection actually carrying
+  // our tokens — only the account's word that it did. That's `tee-unverified` (yellow
+  // "confidential compute, unconfirmed"), never the green tee-verified we reserve for a
+  // quote we checked ourselves. Re-enable sealed mode for the verified shield, or set
+  // TINFOIL_API_KEY and run `tinfoil/*` direct (pi-privacy attests client-side over the
+  // TLS binding).
   if (!modelId.startsWith("near/")) {
     return { tier: "tee-unverified" };
   }
@@ -429,11 +543,13 @@ export async function accountPosture(modelId: string): Promise<AccountPosture> {
   }
 }
 
-// A model entry, with a per-model baseUrl override once the EHBP shim is listening:
-// `tinfoil/*` then route through the loopback shim (which seals to the blind relay)
-// instead of the cleartext `/api/agent/v1` proxy. Everything else keeps the provider
-// baseUrl. Until the shim is up (or when sealed mode is off) sealed models fall back to
-// the cleartext path — and the badge stays honestly `tee-unverified` (see accountPosture).
+// A model entry, with a per-model baseUrl override once the sealed shim is listening:
+// `tinfoil/*` and `phala/*` then route through the loopback shim (which seals to the
+// blind relay) instead of the cleartext `/api/agent/v1` proxy. Everything else keeps the
+// provider baseUrl. Until the shim is up (or with sealed mode disabled) `tinfoil/*` falls
+// back to the cleartext path and the badge stays honestly `tee-unverified` (see
+// accountPosture); `phala/*` has no cleartext path at all and is not registered in that
+// state (see isServableAccountModel).
 function modelEntry(id: string) {
   const base = seedModel(id);
   const provider = sealedEnabled() ? sealedProviderFor(id) : null;
@@ -448,7 +564,13 @@ export function accountProviderConfig(ids: string[]): Record<string, unknown> {
     baseUrl: `${serverBaseUrl()}/api/agent/v1`,
     api: "openai-completions",
     oauth: privateerOAuthProvider,
-    models: ids.map(modelEntry),
+    // Filter HERE rather than at the catalog, so callers keep passing the server's
+    // full list and every registration re-evaluates servability against the CURRENT
+    // shim state. That is what lets the post-shim re-registration in makeAccountProvider
+    // put `phala/*` back: had the ids been filtered upstream, the sealed-only models
+    // would have been dropped from `lastIds` before the shim ever finished starting and
+    // nothing would have brought them back.
+    models: ids.filter(isServableAccountModel).map(modelEntry),
   };
 }
 
@@ -460,7 +582,7 @@ export function accountProviderConfig(ids: string[]): Record<string, unknown> {
 // REPLACES a provider's model list and its request config, so whichever registration
 // lands last wins — and pi extensions are discovered with an unsorted readdirSync, which
 // on a typical box puts privateer-privacy after privateer-account. The account channel's
-// whole catalog was then replaced by that one model, so the default `tinfoil/glm-5-2` no
+// whole catalog was then replaced by that one model, so the account default no
 // longer resolved ("not found for provider privateer. Using custom model id") and the
 // synthesized model inherited the PUBLIC endpoint instead of `/api/agent/v1`.
 //

package/src/providers/defaultModel.ts

@@ -15,13 +15,29 @@ import { join } from "node:path";
 import { hasCredentials } from "../auth/privateer.ts";
 import { agentDir } from "../config/paths.ts";
 
-// Tinfoil's most capable chat model, and Privateer's default everywhere. Tinfoil runs
-// GLM 5.2 inside an attestable TEE (the serving enclave's quote is published and the
-// live TLS key is bound to it), which is the strongest privacy tier we offer — so the
-// most capable model on that tier is what a privacy-first agent should boot on.
+// A capable Tinfoil chat model, and Privateer's default everywhere. Tinfoil runs it
+// inside an attestable TEE (the serving enclave's quote is published and the live TLS
+// key is bound to it), which is the strongest privacy tier we offer — so a capable
+// model on that tier is what a privacy-first agent should boot on.
 // One definition, three consumers: this resolver, providers/account.ts's seed catalog,
 // and bin/privateer-launch.mjs (which mirrors the id — keep them in step).
-export const TINFOIL_MODEL_ID = "tinfoil/glm-5-2";
+//
+// It was `tinfoil/glm-5-2` until 2026-08-01, and the swap is a LATENCY decision, not a
+// capability one. Measured over 22 requests spaced 20s apart on the account channel,
+// glm-5-2 stalled before its first token on 9 of them — 33s to 98s each, with the
+// model demonstrably warm 20 seconds earlier, so it is contention in that deployment
+// rather than a cold start anything here can warm up. kimi-k2-6 and gpt-oss-120b, same
+// enclave provider, same tier, same transport, stalled 0 times in 20 (medians 1.2s and
+// 1.0s). The same run reproduced glm-5-2's stalls on BOTH the sealed and the cleartext
+// path, which is what rules out the shim, the relay and the proxy as the cause.
+//
+// Two consequences worth knowing when revisiting this: glm-5-2 remains in the live
+// catalog and is one pick away for anyone who wants it, and kimi-k2-6 reasons on every
+// turn with no working off switch (see thinkingProfile in providers/account.ts — its
+// levers were probed and none of them moved the reasoning volume). Its reasoning is
+// short and it always reaches an answer, which is why that is acceptable here and was
+// not for glm-5-2.
+export const TINFOIL_MODEL_ID = "tinfoil/kimi-k2-6";
 
 // Same model, reached two ways:
 //   - TINFOIL_DEFAULT_SPEC — direct to inference.tinfoil.sh with the user's own
@@ -63,6 +79,31 @@ export interface ResolveDefaultModelOptions {
   env?: NodeJS.ProcessEnv;
   // Override the signed-in check (testing). Defaults to hasCredentials().
   signedIn?: boolean;
+  // The user's saved Pi default ("provider/id"). undefined (the default) reads it
+  // from agentDir()/settings.json; null skips it entirely — resolveSignedInModel
+  // uses null because the sign-in TARGET must stay the confidential model (the
+  // decision to stay on a saved pick is made explicitly at its call sites, where
+  // the account channel still gets armed either way).
+  saved?: string | null;
+}
+
+// The user's own persisted model pick: Pi writes defaultProvider + defaultModel to
+// agentDir()/settings.json on EVERY interactive switch (AgentSession.setModel →
+// setDefaultModelAndProvider — both the built-in selector and pi-privacy's /models
+// picker land there). That makes it the strongest non-env signal of deliberate
+// intent we have, so resolveDefaultModel ranks it right after PRIVATEER_MODEL.
+// Returns "provider/id", or null when either half is missing.
+export function savedPiDefaultSpec(): string | null {
+  try {
+    const raw = readFileSync(join(agentDir(), "settings.json"), "utf8").trim();
+    if (!raw) return null;
+    const s = JSON.parse(raw) as Record<string, unknown>;
+    const provider = typeof s.defaultProvider === "string" ? s.defaultProvider.trim() : "";
+    const modelId = typeof s.defaultModel === "string" ? s.defaultModel.trim() : "";
+    return provider && modelId ? `${provider}/${modelId}` : null;
+  } catch {
+    return null;
+  }
 }
 
 // Resolve the model spec ("provider/id") to use when no model is named. Pure and
@@ -71,10 +112,13 @@ export interface ResolveDefaultModelOptions {
 // so the launcher, the REPL, and the next-launch seed all agree):
 //   1. explicit user choice (config/channel)      — deliberate, always wins
 //   2. PRIVATEER_MODEL env                         — dev/global override
-//   3. Tinfoil key present → Tinfoil GLM 5.2       — strongest (client-attested) privacy
-//   4. signed into Privateer → the same model over the subscription
-//   5. a BYO provider whose key is present         — anthropic, openai, openrouter
-//   6. nothing at all → the account default anyway — so the failure names Privateer
+//   3. the SAVED Pi default (settings.json)        — the model the user last picked
+//      interactively; Pi persists every switch, so honoring it here is what makes a
+//      /models pick actually stick across launches on every entry point
+//   4. Tinfoil key present → the Tinfoil default   — strongest (client-attested) privacy
+//   5. signed into Privateer → the same model over the subscription
+//   6. a BYO provider whose key is present         — anthropic, openai, openrouter
+//   7. nothing at all → the account default anyway — so the failure names Privateer
 //      and /login is the visible fix, instead of a keyless OpenRouter dead end
 export function resolveDefaultModel(opts: ResolveDefaultModelOptions = {}): string {
   const env = opts.env ?? process.env;
@@ -85,6 +129,9 @@ export function resolveDefaultModel(opts: ResolveDefaultModelOptions = {}): stri
   const fromEnv = env.PRIVATEER_MODEL?.trim();
   if (fromEnv) return fromEnv;
 
+  const saved = opts.saved === undefined ? savedPiDefaultSpec() : opts.saved;
+  if (saved) return saved;
+
   // Privacy-first: a Tinfoil key means we can run verifiable TEE inference right now,
   // which we prefer even over the account's NEAR channel — same order the launcher uses.
   if (env.TINFOIL_API_KEY?.trim()) return TINFOIL_DEFAULT_SPEC;
@@ -110,8 +157,11 @@ export function resolveDefaultModel(opts: ResolveDefaultModelOptions = {}): stri
 // model sign-in should activate RIGHT AWAY: Tinfoil GLM 5.2, direct when a Tinfoil key
 // is present and over the subscription otherwise — no BYO key needed.
 // PRIVATEER_MODEL still wins — a deliberate override is never stomped.
+// `saved: null` on purpose: this is the sign-in TARGET, and the target is always the
+// confidential model. Whether to actually move a session that sits on a deliberate
+// saved pick is decided at the call sites (which arm the account channel either way).
 export function resolveSignedInModel(env: NodeJS.ProcessEnv = process.env): string {
-  return resolveDefaultModel({ env, signedIn: true });
+  return resolveDefaultModel({ env, signedIn: true, saved: null });
 }
 
 // Split a "provider/id" spec on its first slash (model ids themselves contain "/", so
@@ -135,7 +185,12 @@ function splitSpec(spec: string): { provider: string; modelId: string } | null {
 // `defaultModel` key), so a deliberate /model choice is never stomped. Best-effort —
 // any read/parse/write failure is swallowed; a missing seed just means the user picks
 // a model once via /model. Returns the spec written, or null if we left it alone.
-export function ensurePiDefaultModel(spec: string = ACCOUNT_DEFAULT_SPEC): string | null {
+//
+// The default seed is resolveSignedInModel(), not the static account spec: now that
+// the launcher HONORS a saved default (omits --model when one exists), seeding
+// `privateer/…` for a Tinfoil-keyed user would demote them from direct
+// client-attested inference to the subscription proxy on every later launch.
+export function ensurePiDefaultModel(spec: string = resolveSignedInModel()): string | null {
   const parts = splitSpec(spec);
   if (!parts) return null;
   const settingsPath = join(agentDir(), "settings.json");

package/src/providers/phala/aci-verifier/VENDORED.md

@@ -21,3 +21,19 @@ Everything else is byte-for-byte upstream. The crypto runs on `globalThis.crypto
 (Node ≥ 22) these are all native — **no polyfills needed** (unlike the treeview RN app,
 which bridges them via `react-native-quick-crypto`). Re-pull from upstream to update;
 re-apply only the `.js`-extension strip.
+
+## What lives OUTSIDE this directory (and why)
+`../reportBinding.ts` — `verifyAciReportBinding`, the algorithm dispatch for §10.1
+checks 2–6. Callers use it instead of importing `verifyReportBinding` from here.
+
+Upstream's verifier is Web-Crypto-only, so it throws `UnsupportedAlgorithmError` on
+an `ecdsa-secp256k1` keyset endorsement — which §4.3 explicitly permits alongside
+ed25519, and which the deployed `inference.phala.com` gateway actually uses. Rather
+than patch this tree (and re-patch it on every re-pull), the dispatch sits outside:
+ed25519 delegates here verbatim, secp256k1 takes a parallel path over `@noble/curves`,
+and any other algorithm still throws. Nothing here changed, so the re-pull recipe
+above stays exactly the `.js`-extension strip.
+
+If upstream ever adds secp256k1 (or a check 7) to `report.ts`, collapse
+`reportBinding.ts` back to a straight re-export — `tests/phalaReportBinding.test.ts`
+pins the behaviour either way.

package/src/providers/phala/reportBinding.ts

@@ -0,0 +1,193 @@
+// Algorithm dispatch for the ACI report-binding checks (§10.1 checks 2–6).
+//
+// The ACI spec (§4.3) allows the keyset endorsement to be signed with EITHER
+// `ed25519` OR `ecdsa-secp256k1` — the former because "every primitive in it is
+// available in the Web Crypto API", the latter for "clients in the EVM/dstack
+// ecosystem". Upstream's reference TS verifier implements only the Web Crypto half:
+// `verifySignature` throws `UnsupportedAlgorithmError` on secp256k1
+// (aci-verifier/crypto.ts), and `verifyReportBinding` propagates that.
+//
+// The deployed gateway (inference.phala.com) signs with `ecdsa-secp256k1`, so the
+// vendored verifier can never attest it — a limit of upstream's CLIENT, not of the
+// spec or the gateway. Verified live 2026-07-31: attestation fetched, endorsement
+// rejected with UnsupportedAlgorithmError.
+//
+// This module owns the dispatch so `aci-verifier/` stays byte-for-byte upstream
+// (see its VENDORED.md — only the `.js`-extension strip diverges, and re-pulls stay
+// mechanical):
+//   ed25519         → delegate to the vendored verifyReportBinding, verbatim
+//   ecdsa-secp256k1 → the same checks 2–6, with check 5 done over @noble/curves
+//   anything else   → still throws (never a silent pass)
+//
+// The secp256k1 path deliberately mirrors report.ts check-for-check, in the same
+// order and with the same check names, so a caller cannot tell which path ran.
+
+import { secp256k1 } from "@noble/curves/secp256k1.js";
+import {
+  verifyReportBinding,
+  computeWorkloadId,
+  computeKeysetDigest,
+  computeReportData,
+  keysetEndorsementPayload,
+  sha256,
+  fromHex,
+  UnsupportedAlgorithmError,
+  type AttestationReport,
+  type Check,
+  type ReportVerification,
+  type ReportBindingOptions,
+} from "./aci-verifier/index.ts";
+
+const ED25519 = "ed25519";
+const SECP256K1 = "ecdsa-secp256k1";
+
+/**
+ * Verify a report's cryptographic bindings for `nonce` (§10.1 checks 2–6),
+ * dispatching on the algorithm the attested identity key declares. Drop-in
+ * replacement for the vendored `verifyReportBinding`: same arguments, same result
+ * shape, same "a failed check is `ok: false`, never thrown" contract.
+ *
+ * Like upstream, this is the crypto-binding half only — compose it with a hardware
+ * quote verifier (phalaSeal.ts `verifyHardwareQuote`) for Level 2.
+ */
+export async function verifyAciReportBinding(
+  report: AttestationReport,
+  nonce: string | null | undefined,
+  options: ReportBindingOptions = {},
+): Promise<ReportVerification> {
+  const algo = report.attestation.workload_keyset.workload_identity.public_key.algo;
+  if (algo === ED25519) return verifyReportBinding(report, nonce, options);
+  if (algo !== SECP256K1) {
+    // Same fail-closed posture as upstream: an algorithm we cannot check is a
+    // refusal, not a pass.
+    throw new UnsupportedAlgorithmError(algo, "keyset endorsement (§4.3)");
+  }
+  return verifySecp256k1ReportBinding(report, nonce, options);
+}
+
+async function verifySecp256k1ReportBinding(
+  report: AttestationReport,
+  nonce: string | null | undefined,
+  options: ReportBindingOptions,
+): Promise<ReportVerification> {
+  const now = options.now ?? Math.floor(Date.now() / 1000);
+  const checks: Check[] = [];
+
+  const keyset = report.attestation.workload_keyset;
+  const identityKey = keyset.workload_identity.public_key;
+
+  // Check 2: workload_id == digest of the identity public key in the report's keyset.
+  const workloadId = await computeWorkloadId(identityKey);
+  pushEqual(checks, "workload_id", report.workload_id, workloadId);
+
+  // Check 3: workload_keyset_digest == digest of the report's keyset.
+  const workloadKeysetDigest = await computeKeysetDigest(keyset);
+  pushEqual(checks, "workload_keyset_digest", report.workload_keyset_digest, workloadKeysetDigest);
+
+  // Check 4 (binding half): report_data == the §4.4 statement digest for this nonce.
+  // The hardware-evidence-binds-report_data half is verifyHardwareQuote's job.
+  const expectedReportData = await computeReportData(workloadId, workloadKeysetDigest, nonce);
+  pushEqual(checks, "report_data", report.attestation.report_data, expectedReportData);
+
+  // Check 5: keyset endorsement verifies under the identity key, algo matching.
+  const endorsement = report.attestation.keyset_endorsement;
+  if (endorsement.algo !== identityKey.algo) {
+    checks.push({
+      name: "keyset_endorsement",
+      ok: false,
+      detail: `endorsement.algo "${endorsement.algo}" != identity key algo "${identityKey.algo}"`,
+    });
+  } else {
+    const ok = await verifySecp256k1(
+      identityKey.public_key,
+      endorsement.value,
+      keysetEndorsementPayload(workloadKeysetDigest),
+    );
+    checks.push({
+      name: "keyset_endorsement",
+      ok,
+      ...(ok ? {} : { detail: "endorsement signature failed under identity key" }),
+    });
+  }
+
+  // Check 6: freshness. Nonce binding is check 4; here bound the epoch and, when
+  // the profile trusts it, the declared validity window.
+  const notAfter = keyset.keyset_epoch.not_after;
+  const epochOk = now < notAfter;
+  checks.push({
+    name: "keyset_epoch.not_after",
+    ok: epochOk,
+    ...(epochOk ? {} : { detail: `now ${now} >= not_after ${notAfter}` }),
+  });
+  if (options.trustPlatformClock) {
+    const freshness = report.attestation.freshness;
+    const fetchedAt = freshness?.fetched_at;
+    const staleAfter = freshness?.stale_after;
+    const windowOk =
+      typeof fetchedAt === "number" &&
+      typeof staleAfter === "number" &&
+      fetchedAt <= now &&
+      now < staleAfter;
+    checks.push({
+      name: "freshness_window",
+      ok: windowOk,
+      ...(windowOk ? {} : { detail: `now ${now} outside [${fetchedAt}, ${staleAfter})` }),
+    });
+  }
+
+  return { ok: checks.every((c) => c.ok), checks, workloadId, workloadKeysetDigest };
+}
+
+/**
+ * §4.3 secp256k1 endorsement: a 64-byte `r || s` signature over
+ * `sha256(payload bytes)`. Returns false on malformed input rather than throwing —
+ * a bad signature is a failed check, not an exception.
+ *
+ * NOT the §8.5 *receipt* shape, which is a 65-byte recoverable `r || s || v` and
+ * where the spec says 64-byte signatures MUST be rejected. Different shapes; easy
+ * to conflate if this ever grows a receipt path.
+ */
+async function verifySecp256k1(
+  publicKeyHex: string,
+  signatureHex: string,
+  payload: Uint8Array,
+): Promise<boolean> {
+  try {
+    const sig = fromHex(signatureHex);
+    if (sig.length !== 64) return false; // r||s only; DER / recoverable forms are not §4.3
+    const msgHash = await sha256(payload);
+    return secp256k1.verify(sig, msgHash, publicKey(publicKeyHex), {
+      prehash: false, // we hand it the sha256 digest, per §4.3
+      // Accept high-s as well as low-s. ECDSA malleability is meaningless for a
+      // signature over a FIXED payload — an attacker who can flip s already has a
+      // valid endorsement and still cannot sign a different keyset digest. Leaving
+      // the default on would reject ~half of otherwise-valid endorsements from any
+      // signer that doesn't normalize, as an intermittent attestation failure.
+      lowS: false,
+    });
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Identity key bytes. §7.1 pins secp256k1 public keys as 65-byte uncompressed SEC1
+ * and requires that "the 64-byte uncompressed form without the `0x04` prefix MUST be
+ * accepted and treated as the same key" — so restore the prefix when it's absent.
+ * The live gateway sends the 65-byte form; do NOT prefix that one again.
+ */
+function publicKey(hex: string): Uint8Array {
+  const raw = fromHex(hex);
+  if (raw.length === 64) {
+    const sec1 = new Uint8Array(65);
+    sec1[0] = 0x04;
+    sec1.set(raw, 1);
+    return sec1;
+  }
+  return raw;
+}
+
+function pushEqual(checks: Check[], name: string, actual: string, expected: string): void {
+  const ok = actual === expected;
+  checks.push({ name, ok, ...(ok ? {} : { detail: `report ${actual} != recomputed ${expected}` }) });
+}

package/src/providers/phalaSeal.ts

@@ -13,7 +13,7 @@
 // no polyfills, unlike the RN app.
 //
 // Two-layer attestation, fail-secure:
-//   (1) verifyReportBinding — the report's crypto binding (keyset digest,
+//   (1) verifyAciReportBinding — the report's crypto binding (keyset digest,
 //       report_data == statement(nonce), endorsement sig). Self-attesting alone.
 //   (2) verifyHardwareQuote — the hardware root: @phala/dcap-qvl verifies the TDX quote
 //       against Intel collateral and binds the quote's report_data to (1)'s statement
@@ -22,7 +22,6 @@
 
 import type { Report } from "@phala/dcap-qvl";
 import {
-  verifyReportBinding,
   openE2eeChannel,
   toHex,
   fromHex,
@@ -30,6 +29,11 @@ import {
   type ReportVerification,
   type E2eeChannel,
 } from "./phala/aci-verifier/index.ts";
+// Not the vendored verifyReportBinding directly: the deployed gateway signs its
+// keyset endorsement with ecdsa-secp256k1, which upstream's Web-Crypto-only verifier
+// refuses. This wrapper delegates ed25519 to it unchanged and adds the secp256k1 arm
+// the spec allows (§4.3), leaving aci-verifier/ pristine for re-pulls.
+import { verifyAciReportBinding } from "./phala/reportBinding.ts";
 import { serverBaseUrl } from "../auth/privateer.ts";
 
 const DEFAULT_ACCEPTABLE_TCB = ["UpToDate"];
@@ -94,7 +98,7 @@ async function establishAttestation(): Promise<VerifiedAttestation> {
   if (!res.ok) throw new Error(`phala attestation HTTP ${res.status}`);
   const report = (await res.json()) as AttestationReport;
 
-  const verification = await verifyReportBinding(report, nonce);
+  const verification = await verifyAciReportBinding(report, nonce);
   if (!verification.ok) {
     const failed = verification.checks.filter((c) => !c.ok).map((c) => c.name).join(", ");
     throw new Error(`phala attestation binding failed: ${failed}`);