Module reference · Identity & security
x/enclave — Enclave
Confidential-compute and enclave attestation for sensitive workloads.
What it does
Inside x/enclave
The enclave module records and verifies attestations from trusted execution environments. A provider offering confidential compute can prove on-chain that a workload runs inside a genuine hardware enclave with a specific measured configuration, and a tenant can require that proof before their workload — or its data — is delivered.
Attestation evidence is validated against the state machine's expectations, turning "trust me, it's confidential" into a verifiable claim any counterparty can check.
Why it exists
The design rationale
Some workloads cannot leave their trust boundary on faith alone — regulated data, proprietary models, private keys. Confidential computing solves the technical problem; the enclave module solves the marketplace problem of proving it, so confidential capacity can be advertised, verified, and priced like any other attribute.
Interactions
How it connects to the rest of the chain
No module stands alone — these are the protocol surfaces this module depends on or serves.
- x/encryption
Workload secrets are encrypted for delivery only after attestation verifies.
- x/provider
Confidential-compute capability is a provider attribute tenants filter on.
- x/market
Orders can require attested enclave execution as a placement constraint.
Key concepts
Terms that matter here
- TEE
- Trusted execution environment — hardware-isolated compute whose state the host cannot inspect.
- Attestation
- Cryptographic evidence, signed by hardware, of exactly what code runs inside an enclave.
- Measurement
- The digest of an enclave's code and configuration that attestation commits to.
Keep exploring