Changelog

What shipped across Confidential AI: Confidential Inference, Confidential VMs, C8s and our open-source tools. Newest first, one entry per week, updated every Monday. Code: github.com/confidential-dot-ai.

19 Oct 2026

  • C8s (v0.54 to v0.59): the front door routes by a signed route manifest that the CDS stores and serves at /routes, and the route digest is bound into the attestation transcripts. Clients now verify which routes a cluster exposes, not just what it runs.
  • C8s allowlist: authorizes executable host files by node-root provenance.
  • c8s-verify-js and TEErminator: verify the route digest. A breaking change, so upgrade both alongside C8s.
  • attestation-rs: one collateral layer for every platform. Evidence carries its own vendor collateral, and a verified collateral cache can run inside a CVM or for a whole site.
  • Confidential Inference: production moved to C8s v0.59.1.
  • Docs: Inference API how-to guides for the OpenAI SDK, LangChain, Vercel AI SDK and LiteLLM, plus performance overhead with the full Blackwell benchmark results.

12 Oct 2026

  • Encrypted KV Cache Offloading: KV cache offloading under confidential computing, in production on MiniMax M3. Throughput up 141% on llm-d's benchmark with CC on.
  • Verify our production inference cluster in your browser: Intel TDX quotes, pinned image measurements, operator key, mesh identity and admission allowlist, checked client-side.
  • C8s allowlist: pins each component's environment variables, arguments and mount table. /healthz reports the applied allowlist version.
  • C8s: c8s verify reports the serving leaf digest of an attest-lb verdict.
  • attestation-rs: checks Google's GCE launch endorsement (gcp-tdx, gcp-snp), pins Azure vTPM PCRs, and accepts a set of allowed values for MRTD, RTMRs and the launch digest.
  • Confidential OS Builder: confos run sets SEV-SNP HOST_DATA, picks the CPU count and SNP variant, and attaches read-only launch media. Images attest their SSH host keys through a nonce-only endpoint.

5 Oct 2026

  • C8s: release tags are signed with cosign keyless. c8s verify checks saved attest-lb receipts and bundles offline.
  • C8s: week-long operator and log-reader certificates. Egress-isolating NetworkPolicies keep a mesh egress companion.
  • TEErminator and attestation-go: a configurable Intel TDX TCB status policy.
  • Confidential Inference: release image digests come from signed evidence at build time, and the Helm chart is published as a package.
  • FAQ: answers on attestation, data handling, models and Confidential VMs.

21 Sep 2026

  • C8s: GPUs are attested before a node reports CC Ready. Nodes boot from signed configuration bundles with core Kubernetes workloads and images baked in.
  • C8s: denies host privilege outside the node TCB and seals post-start exec at the runc boundary. The operator credential is bounded, with a separate logs-only role.
  • Confidential VMs: the 24-hour minimum term is gone. CPU VMs are billed per core-hour.
  • Confidential Inference runs on C8s: verify the attestation once per session at /attestation, rather than per response.

14 Sep 2026

  • Confidential OS Builder v0.5.0: immutable root by default. This rolls measurements, so re-pin after upgrading.
  • C8s: mount policies authored, linted and enforced end to end. Tenant containers are confined with AppArmor. Workload environment is pinned.
  • attestation-go: takes over the generic attestation and measurement code from C8s, and binds launch anchors to image policies.

31 Aug 2026

  • C8s: ACME and nginx ingress at the gateway. Nodes fail closed on a GPU that isn't in CC mode, or a missing scratch disk. New c8s operator-keygen.
  • TEErminator v0.0.1: a localhost proxy that verifies the attestation, pins it to the TLS session and can fail closed.
  • attestation-rs: AMD certificate chains survive a KDS outage. POST /verify accepts expected measurements.

24 Aug 2026

10 Aug 2026

  • C8s: SEV-SNP node image. Cross-node pod traffic encrypted with WireGuard. Secret paths bounded per allowlist entry.
  • Confidential OS Builder v0.4: out-of-tree build profiles, and SNP operator-key binding through HOST_DATA.

27 Jul 2026

  • C8s: application secrets, released only to attested workloads, and encrypted volumes via c8s volume create.
  • c8s-verify-js: attest the CDS in the browser, derive the mesh CA and pin RTMR[3]. attestation-rs v0.5.0.

20 Jul 2026

  • c8s-verify-js: verify Azure TDX and bare-metal Intel TDX attestation in the browser.
  • Confidential OS Builder: GPU profile.
  • Kettle: an agent skill for running attested builds.

13 Jul 2026

Earlier releases: blog.