Independent Pi/OpenRouter review: deepseek/deepseek-v4-pro-0813

Source: a10323dede4413fbf295916b8ad12e3dbad7514e. Status: incomplete.

Scope

Static review of the frozen runtime at a10323dede4413fbf295916b8ad12e3dbad7514e, following the attested-relay-enclave bin target from crates/enclave/src/v2_main.rs. I did not execute any Rust/Python tests, CI jobs, EIF measurements, or production traffic. The review assumes the RandX primitive is strong, but does not assume this composition, FFI integration, memory handling, lifecycle, verifier, or production rollover is correct.

1. Verdict

Request/response body, path, and query confidentiality before the intended computational delay:
SUPPORTED CONDITIONALLY by the code, not proved. I found no code path that moves request path, query, or response body/header plaintext into a host/Cloudflare/archive-visible channel before record encryption. But this is conditional on AWS/Nitro isolation, WebPKI/TLS, Ed25519/AEAD security, no memory side channel, and acceptance of the metadata disclosures below.
Destination hostname and traffic metadata:
VIOLATED / not protected by design. The hostname is disclosed early to the DNS-over-HTTPS resolver, and often to the parent/network via outbound SNI. If the full URL, including its host, is considered “request contents,” this is a real early inference path. The threat model documentation calls this metadata, but the user explicitly warned not to hide content-inference under metadata labels.
Early epoch-key/intermediate recovery or forcing an already-solved puzzle without breaking RandomX:
SUPPORTED CONDITIONALLY from static review. No input path from the malicious host/network into puzzle material was found. Generation is internal, entropy is direct NSM in production, publication/activation ordering is bounded by dual NSM+monotonic time, and records/ciphertext are cryptographically bound to the signed manifest and segment chain. Parallelism/shared checkpoints can shorten wall-clock delay, but that is the documented approximate-delay property, not a primitive bypass.

2. Property assessment

Property	Verdict
Request path/query/body hidden from parent/operator/Cloudflare before delay	Supported conditionally
Response body/headers hidden from parent/operator/Cloudflare before delay	Supported conditionally
Destination hostname hidden from DNS/network/parent	Not supported; early metadata/content inference
Response size/timing hidden from parent/network	Not supported; metadata/candidate inference remains
Epoch key/seeds/intermediates remain in enclave and non-recoverable early	Supported conditionally
Service cannot be made to accept a pre-solved/replayed puzzle	Supported conditionally
Per-request delay equals full seven days for every record	Not supported; publication-relative delay, last records lose about one day
Availability / full-duration rollover	Insufficient evidence

3. Substantive findings

3.1 Destination hostname is disclosed early via DoH and SNI/ECH fallback

Files:
crates/enclave/src/dns.rs:89-168, crates/enclave/src/dns.rs:170-211,
crates/enclave/src/net.rs:96-108, crates/enclave/src/net.rs:110-124, crates/enclave/src/net.rs:150-151, crates/enclave/src/net.rs:251-256,
crates/enclave/src/v2_main.rs:156-158.

Trace

Client sends /f/https/<host>/<path>?<query> inside inner TLS.
Enclave resolves <host> itself via DoH to hard-coded 1.1.1.1 and 8.8.8.8:
- v2_main.rs:157 creates Resolver::new(..., vec!["1.1.1.1", "8.8.8.8"], true).
- dns.rs:99-101 puts the lowercase host into a DNS Name and sends A/HTTPS queries.
- The queried host is therefore visible to whichever DoH resolver answers, in plaintext to that resolver’s logs/operator.
The parent/network sees the resolver IP and then the upstream IP.
The outbound TLS connection to the upstream uses ECH only if an HTTPS record supplies an ECH config. If no ECH config exists, net.rs:115-123 uses plain rustls with real SNI.
Even when ECH is tried:
- net.rs:96-108 catches any error containing EncryptedClientHello or Ech and retries without ECH.
- A returned EchStatus::Rejected is captured at net.rs:150-151 but is not enforced as a failure; traffic continues with whatever privacy level resulted.
v2_main.rs:156 creates relay::Net::new(transport.clone(), false, Vec::new()), disabling the WireGuard user-space relay. All traffic goes directly through the parent tunnel.