← All posts

Sharding · 28 Oct 2026 · 5 min read

Splitting and rebuilding now happen inside an attested enclave.

Until now the part of WISPR that cuts a request into shards, and the part that puts the answers back together, ran on our gateway. That meant we could read your full request. We promised not to. Today that promise is replaced by a measurement you can check.

What changed

The pseudonymiser, the splitter, the router and the rebuilder now run inside an Intel TDX enclave hosted on Phala. Your client encrypts the request to the enclave's key. The gateway outside the enclave carries ciphertext and a key id, nothing else. The enclave decrypts, replaces identifiers with typed placeholders, splits the task, sends each shard to its model, merges the replies, validates the merge, restores the identifiers, encrypts the answer back to you and signs the receipt.

client │ encrypted to the enclave key ▼ gateway ciphertext and a key id only │ ▼ WISPR enclave (TDX) decrypt · pseudonymise · split · route ├─▶ shard 1 ─▶ catalogue model, WISPR hardware ├─▶ shard 2 ─▶ catalogue model, WISPR hardware └─▶ shard 3 ─▶ frontier model, placeholders only │ rebuild · restore · sign · encrypt to client ▼ client one answer + signed receipt

The enclave key is bound to a published code measurement. A modified enclave carries a different measurement, and the SDK refuses to send to it.

How to verify it

npx wispr attest # checks the quote against the published build curl https://api.wispr.xyz/v1/attest # raw quote, verify with any TDX tool

Measurements for every released enclave build are published next to the source commit. The SDK pins the current one and raises 424 attestation_mismatch if the enclave it is talking to is not on the list. Every reply also carries the quote in the receipt, so you can check after the fact.

Who sees what now

BeforeNow
Frontier modelone shard, WISPR exit addressone shard, WISPR exit address
Enclavedid not existwhole request, inside TDX, attested
WISPR gatewaywhole request, in memoryciphertext and a key id
WISPR operatorscould read memoryaccount id, balance, shard shapes, model ids

What it does not do

It does not protect against a flaw in TDX itself, and it does not change what a frontier provider does with the shard it receives. Sharding exists so that shard is useless alone. Both limits are written into the privacy policy, because a privacy claim that hides its limits is not one.