v0.1.0

First public release of the AnonRouter SDKs: independently verify AnonRouter's
confidential inference routes, and run confidential inference, from your own
process.

What is here

Package	Language
@anonrouter/confidential	JavaScript / TypeScript
@anonrouter/client	JavaScript / TypeScript
anonrouter-confidential	Python 3.10+

None of the three is on a registry yet. Install from this repository, or from
the tarball / wheel / sdist attached below — they are the exact artifacts a
registry would carry, built by the release workflow and installed into empty
environments by scripts/smoke-artifacts.mjs on every CI run.

Two hops, verified separately

A request passes through two parties, and verifying one establishes nothing about
the other. verifyRoute() / verify_route() checks both and reports them
separately, then cross-binds them: two individually honest hops serving a
different provider, model or privacy class than you asked for is still the wrong
route, and lands in bindingMismatches.

Hop 1 — AnonRouter's own routing plane — reaches hardware_verified with the
DCAP engine below, having chained the quote's signature to Intel's roots with an
UpToDate TCB. Without an engine it fails closed on quote_signature_chain
rather than quietly reporting the weaker level as success.

Verifying this release

sha256sum -c SHA256SUMS

anonrouter-dcap-verifier-linux-amd64 is the offline Intel DCAP engine. It is
worth not trusting: its source is in native/dcap-verifier (AGPL-3.0-only, and
shipped here as anonrouter-dcap-verifier-src-0.1.0.tar.gz), and

scripts/build-dcap-verifier.sh --reproduce

builds it twice from clean inside a registry image pinned by digest, fails unless
the two outputs are byte-identical, and prints the SHA-256 for you to compare
with ours. linux/amd64 is the only target with a reproducible artifact and the
only one this release claims.

The v0.1.0 tag is signed with the SSH key
SHA256:5jBE6glVoub83Qw7wcigW44zew4UnbAsx+ufIQGIzXs.

What a green run does not cover

docs/release-readiness.md
records every gate with exact counts, what the shipped pin refuses as well as
what it accepts, and the limits. The short version of the limits:

• RTMR0 in the hop-1 pin was not reproduced offline with dstack-mr;
• the release manifest still records two unproven third-party source-to-image
  links, named rather than rounded up;
• Tinfoil's evidence format exposes no caller nonce, so nonce_binding is
  advisory on those routes;
• Chutes' evidence names no model, so model_binding is advisory there and the
  route model rests on AnonRouter's own attested echo — weaker than a provider
  enclave naming its own weights;
• hop 2 does not reach hardware_verified: several provider routes run GPU
  enclaves whose NVIDIA attestation chain is not available to verify, and
  chaining only the CPU quote while printing hardware_verified would claim more
  than was checked.

Full changes: CHANGELOG.md.