Shield now splits and merges inside an attested enclave
Until now the part of WISPR that cuts your request into shards, and the part that puts the answers back together, ran on our gateway. That meant we could read your full prompt. We promised not to. Today that promise is replaced by a measurement you can check.
What changed
The Shield analyzer and reconstructor now run inside an Intel TDX enclave hosted on Phala. Your client encrypts the request to the enclave's key. The gateway outside the enclave carries ciphertext and shard metadata, nothing else. The enclave decrypts, redacts, splits, sends each shard out through a Relay exit, merges the replies, validates the merge, encrypts the answer back to you and attaches its attestation quote.
The enclave key is bound to a published code measurement. A modified enclave carries a different measurement, and the SDK refuses to send to it.
How to verify it
wispr attest shield # checks the quote against the published build
curl https://api.wispr.xyz/v1/attest # raw quote, verify with any TDX toolMeasurements for every released enclave build are listed at wispr.xyz/measurements next to the source commit. The SDK pins the current one and raises 424 attestation_mismatch if the enclave it is talking to is not on the list. Every response also includes the quote in the wispr.attestation field, so you can check after the fact.
Who sees what now
| Before | Now (Protected level) | |
|---|---|---|
| Model provider | one shard, WISPR exit IP | one shard, WISPR exit IP |
| Shield enclave | did not exist | whole prompt, inside TDX, attested |
| WISPR gateway | whole prompt, in memory | ciphertext, shard metadata, session id |
| WISPR operators | could read memory | session id, spend, shard classes, model names |
Standard level, where Shield is off, is unchanged: the gateway holds the prompt in memory to route it and does not log it. That is the weak mode and the docs say so. Confidential level puts the gateway path and the agent box in enclaves as well.
The honest part
Two things an attestation does not fix. Split mode makes two to four provider calls for one request, so it costs more tokens than a direct call. And a model that only sees a fragment can answer worse on tasks that need the whole context at once. We do not hide either. Every response lists each call at provider price, and redact mode stays at one call when hiding identifiers is enough.
Next: a local mode in the Python and Node SDKs that runs the planner on your own machine, for people who will not trust any enclave. Watch the changelog.
Try it on a Protected session. Shield is on by default there.
Quickstart→