Independent Pi/OpenRouter review: google/gemini-3.8-flash

Source: a10323dede4413fbf295916b8ad12e3dbad7514e. Status: incomplete.

; });

WAIT! Look at `connect_upstream`:
In line 158:
```rust
Ok(Box::new(state.dialer.connect_tls(host, 443, crate::relay::Purpose::Upstream).await?.stream))

Wait! What if the upstream connection redirects? Look at the redirect handling:

        if matches!(parts.status.as_u16(), 301|302|303|307|308) {
            ensure!(redirect < 5, "redirect limit exceeded");
            let location = parts.headers.get("location").ok_or_else(|| anyhow::anyhow!("redirect without location"))?.to_str()?;
            target = target.join(location)?;
            continue;
        }

Wait! If target.join(location) results in a target with a different host: In the next iteration: validate_target(&target, &state.config.tls_dns_name)?; It checks:

• scheme == https
• port == 443
• host is not own name
• host is not localhost, .localhost, .internal
• if IP, must be public. And then it connects to that new host!

WAIT! LOOK AT WHAT HAPPENS TO history: history records EVERY redirect: url: the target URL! status: the status code (e.g. 302)! headers: the headers (e.g. Location)! response_body_b64: the response body of the 302 redirect! All of that is pushed to history. And when the final response is received: record has:

    let record = serde_json::json!({
        "version": 3, "software_version": crate::VERSION,
        "epoch": epoch.manifest.puzzle.epoch, "sequence": sequence,
        "started_at_ms": now, "outcome": outcome, "request": {"method":"GET", "url":target.as_str()},
        "exchanges": history,
    });

Notice: record contains all exchanges, URLs, and responses! And what happens to record? It is CBOR-encoded into plaintext. It is encrypted with relay_timelock::encrypt_record into sealed. It is published to the parent host as <sha256>.record.json.

WAIT! WAIT! WAIT! LOOK AT WHAT IS RETURNED TO THE CLIENT: In v2_proxy.rs lines 108-119:

    let mut result = Response::builder().status(status);
    for (name, value) in &headers {
        if !tlproxy_common::HOP_BY_HOP.contains(&name.as_str()) && ![
            "set-cookie", "content-length", "cache-control", "location", "alt-svc",
        ].contains(&name.as_str()) && !name.as_str().starts_with("x-attested-relay-") {
            result = result.header(name, value);
        }
    }
    Ok(result.header("cache-control", "no-store").header("x-attested-relay-record", name)
        .header("x-attested-relay-puzzle", &epoch.puzzle_artifact)
        .header("x-attested-relay-evidence", &epoch.evidence_artifact)
        .body(Full::new(body))?)

Notice: Headers like set-cookie are stripped! Why? Because cookies might identify a session or state. And location is stripped (since redirects were followed internally). And x-attested-relay-* headers are stripped from upstream to avoid spoofing. The response body is returned to the client over inner TLS.

WAIT! IS THERE ANY WAY FOR AN INTERMEDIARY (Cloudflare, host, network) TO READ THE INNER TLS? Let's check the inner TLS setup again!

1. Client establishes outer HTTP connection to Cloudflare / host (tlproxy-host).
2. Client sends HTTP GET requests to /relay with base64 payloads.
3. Inside those base64 payloads is the raw byte stream of a TLS 1.3 handshake and session.
4. The server certificate presented in this TLS session has SPKI spki_der.
5. The enclave requested an attestation document from AWS NSM binding user_data (the policy) and public_key (spki_der).
6. The client independently verifies the AWS NSM attestation document:
   • Rooted in AWS Nitro Root certificate (nitro-root.pem).
   • Nonce in attestation document matches the client's randomly generated 32-byte nonce.
   • doc["public_key"] matches the SPKI of the certificate presented in the inner TLS session.
   • doc["pcrs"][0] matches the client's expected PCR0.
   • doc["pcrs"][4] matches the expected PCR4 (bound to parent instance ID in hardware verification).
   • user_data contains policy, which specifies graviton5_verified: true, iterations: 43768124, etc.
7. Once the inner TLS handshake completes: All application data (the outer request path /f/https/..., headers, upstream request, upstream response headers, upstream response body) is encrypted using TLS 1.3 session keys negotiated via (EC)DHE during the handshake! Because AWS is trusted and Nitro enclave isolation is trusted: The enclave's TLS private key NEVER leaves the enclave! The ephemeral TLS 1.3 session keys NEVER leave the