Secret³ · Secret.Zone · mockup v2 · 2026-09-07

Confidentiality you can measure.

Deploy a site, an app, an agent or a bucket to a confidential computer. Get a name. Hand anyone a link that proves what is running — with no account and no install.

Specified In the Secret³ paper, or shipping in dstack today.
Proposed Our design. Argue with it.

V1 · the substrate everything else rests on

Deploy. Name. Prove.

Three steps, and the third is the one nobody else offers. Site and App are the same machine with different surfaces; Storage and Agent attach to it later.

1 · Connect a source Proposed

Git or a folder, plus a compose file. No new packaging format, no rewrite. The workload is a measured composition, so attestation names exactly what ran.

zone — deploy
$ zone deploy ./ --name api source git · main 02ec796 compose compose.yml · 2 services platform Intel TDX · dstack guest image measured sha256:9f2c…a41d live api.secret.express

2 · Receive a name Specified

Every deployment lives on name.secret.express, or bring your own domain. TLS terminates inside the confidential machine — the certificate is requested, held and used within the attested environment, never at an edge proxy.

This is not new work. dstack-gateway already does it: ACME dns-01 in-process, CAA records pinning issuance to its own account, content-addressed domains. The paper names every other dstack component and decides each one. The gateway is not among them — the word appears three times, meaning network-gateway workloads and retail billing gateways, never the component that terminates TLS. And if TLS terminates anywhere outside the machine, plaintext exists somewhere the tenant never attested.

3 · Prove it Proposed

A link. The person who opens it did not deploy the workload, has no account, and installs nothing. That constraint is the entire product.

api.secret.express/proof
workloadapi · 2 services from compose.yml
measurementsha256:9f2c4b8e…a41dmatches source
hardwareIntel TDX · quote verified against Intel collateralvalid
guest imagemr_td 1e305ac8…70c7admitted on-chain
admitted bygovernance · readable by anyone, see below
tlsterminated inside the enclave · ACME dns-01in-CVM
re-checkedcontinuously · last 41 seconds ago

Rebuild from source and compare the measurement yourself. If the guest image is dstack's published one, the reference to compare against is upstream — no registry we control sits in that path.

The claim behind the claim

The admission policy is already public.

"Which machines may run your code is decided on-chain, in public, rather than by a vendor" is the strongest sentence in this architecture. It reads like a promise. It is already true, and anyone can read it out of the chain today.

Queried directly from Secret's key-management contract on 2026-09-07, with no account and no permission:

23admitted measurement pairs, live on-chainget_all_hw_registers
3distinct guest images currently permitted to runmr_td
19distinct firmware and configuration statesrtmr0
zone — admitted images
$ zone admitted mr_td 1e305ac8284517f73ada985bfc9fded48b23ed09… 17 configurations mr_td ba87a347454466680bfd267446df89d8117c04ea… 4 configurations mr_td feb7486608382c1ff0e15b4648ddc0acea6ca974… 2 configurations 23 pairs · source: on-chain · no account required

A commercial confidential cloud cannot show you this, because its allowlist is a vendor decision. Here a stranger can list exactly which three images are permitted to run, and when governance admitted each one.

Nobody is pointing at it. It is in no documentation, and the contract's own source repository returns 404 — which is a separate and cheap thing to fix.

One confidential computer, exposed four ways

Site, App, Agent, Storage.

Site

A website, on a confidential computer, with a name. You can prove what's being served.

App

Your software, on a confidential computer, with a link. Secrets stay sealed to that machine.

Agent

Confidential AI with its own computer. You message it. You can watch the screen, or sit down at the desk.

Storage

A confidential bucket. Seal it or leave the lid off. Hook up one computer, or many, or none.

These are not four products. They are one machine with four surfaces, plus storage that attaches to none of them, one of them, or many. Site and App need a machine and a name. Storage adds a bucket. Agent needs everything.

Which is why the narrative order and the build order are inverses. Marketing can lead with the agent long before the agent exists.

The hero, and the last thing built

Chat drives. Take over is the same seat.

An agent with its own computer — a real Linux session, not a sandbox behind an API. Message it and it works. Watch the screen without touching. Take over and you are at the same desk; leave, and chat is driving again.

cowboy.secret.express — own computer, default isolation
statusDrafts ready. Nothing sent.awaiting human
drafts · 3Acme Re: invoice 1842 · Northwind Re: invoice 1901 · Helios Re: invoice 1914
bucketrecords · granted to cowboy
cowboy@cvm:~$ ls brief.pdf inbox-drafts calendar.ics compose.yml cowboy@cvm:~$ zone-agent prove tdx compose ok

Nothing is sent without a human, by default. Three replies drafted, none delivered. That default is the trust model — it should be explicit and configurable, not incidental.

It answers the objection every agent platform faces — what happens when it gets something wrong — not with guardrails, but with a seat you can take.

One thing we could not settle Open

How an autonomous agent pays for its own compute. The paper's economics are operator-side burn with retail paying fiat, which does not obviously accommodate an agent paying per workload for itself. The incumbent answered this with x402 and an on-chain identity registration; neither appears in the paper or in the original design. Worth evaluating, not inheriting.

A bucket with a name

Storage that outlives the machine.

S3-compatible, on records.secret.express. Sealed means keys only to who you grant. Open means anyone can see what's inside. Grant a machine, not a user — the grant target has a measurement, which is what makes it different from an access list, and checkable.

records.secret.express — sealed
scans/1842.dcmbafy…c8esealed
aging.csvbafy…11dsealed
granted tocowboy · a machine with a measurement, not an account
$ zone grant records --to cowboy cowboy can read records $ zone revoke records --from cowboy revoked · observable on-chain

A bucket attaches to one computer, many, or none. It is the answer to files being stuck inside the thing that made them.

Positioning

The same runtime. Different rules about who runs it.

Secret.Zone runs on dstack — the same guest stack Phala Cloud sells as a managed product. "We run dstack too" is not a pitch, and pretending otherwise wastes everyone's time.

Here is the honest comparison. Three rows carry the argument. Two are worse.

 Secret.ZonePhala CloudHyperscaler CVM
Runtimedstackdstack, productisedVendor-specific
Who decides which machines may run your codeOn-chain, governance-curated, hardware-bound. Readable by anyone todayVendor allowlistVendor, entirely
Can the operator be made to evict youNo consensus rule can compel a host to run — or stop running — a tenant's codeTerms of serviceTerms of service
Rollback and freshnessLedger-anchored checkpointsNot provided — dstack's own security model says applications must anchor state externallyNot provided
Verification by a strangerA link. No install, no accountAttestation available; surfacing it is the deployer's jobVendor APIs
GPU TEENot this cycleH100, H200, B300Available
MaturityArchitecture in draftShipping and pricedGenerally available

And the counter-argument, before a buyer makes it: for most workloads none of the three differentiators matters, and Phala is available now at a known price. The buyer who cares is the one for whom the operator is part of the threat model — regulated data, adversarial jurisdictions, agents handling money.

That is a narrower market than "confidential compute." It is worth aiming at deliberately rather than arriving at by accident.

Read this before reviewing the rest

What is specified, and what we made up.

This mockup is for argument, not applause. Everything below is our proposal rather than the paper's, and each is somewhere we would rather be corrected than agreed with.

SurfaceStatusWhere the uncertainty is
The name and TLS pathSpecifieddstack-gateway does this today. But the paper never addresses it — its three uses of “gateway” mean something else — so adopting it is a decision nobody has recorded
On-chain admissionSpecifiedAlready live and readable. Whether the same apparatus carries over to CVM hosts is unanswered
The proof linkProposedOur design. Today verification is a CLI subcommand and a paste-two-fields form, and the rebuild path leads to a 404
The zone command surfaceProposedFrom the original design. Nothing matching it is published on npm, and the bare name is taken by an unrelated 2014 package — this is intent, not tooling
Agent seat handoverProposedThe most differentiated idea here and the most dependent on everything else. Built last for that reason
Bucket grants to machinesProposedSemantics, not implementation. The backend is open
Agent paymentOpenUnresolved. See above

What we would most like corrected

Whether any of this already exists. We tested the public endpoints and found nothing serving — which rules out a public deployment and nothing else. If there is a prototype behind the original mockup, we would rather build on it than around it, and we would rather hear that in an hour than discover it in a month.