How it works

The subnet is a TEE-required video-serving network. Everyframe's coordinator assigns jobs; approved workers inside Intel TDX confidential VMs render them through a fixed provider endpoint; a hardware-attested key signs a receipt over the input, the job, the provider request and the output bytes. The coordinator verifies the receipt, decodes the video in a sandbox and only then records accepted work.

#The trust boundary

Everyframe coordinator (trusted)
    │  signed + encrypted immutable assignment
    ▼
Approved measured worker inside Phala TDX
    │  fixed provider endpoint, authenticated HTTPS
    ▼
Fal API → provider's returned video URL
    │  bytes downloaded and hashed INSIDE the TEE
    ▼
Attested-key signature over input ↔ job ↔ request ↔ output hash
    │
    ▼
Coordinator verifies receipt + video bytes → sandbox decode → durable acceptance

#What the TEE proves

• That the approved worker image — digest-pinned, no shell, no HTTP server, no debugger, no generic signing endpoint — is what ran.
• That the quote is UpToDate, has no advisories and is not a debug build. MRTD and RTMR0–2 are pinned; RTMR3 is replayed event by event with payload-to-digest verification in an exact expected order.
• That the receipt was signed by a key generated inside that worker session. Keys are never exported or persisted; a restart means a fresh attested session.

#What it does not prove

• The provider's internal model execution or the cinematic quality of the clip. The provider and its authenticated result store remain trusted.
• Resistance to every hardware vulnerability.
• Availability. A miner can stop working, revoke its API key or withhold results. The coordinator handles that with deadlines and refund-required events, not with guesses.

#A job's life

1. Assignment. The coordinator creates a job with a locked quote (miner reward target, provider cost estimate, customer planning price — three independent fields). The assignment is signed and encrypted to the worker's session key; only one job is active per miner.
2. Claim and start. The worker claims the job and asks for a provider-submission grant. The grant is returned exactly once. If the response is lost, the job becomes unknown rather than being resubmitted — the design sacrifices a possible delivery to avoid duplicate provider spend.
3. Render. The worker calls Fal with the exact signed fields of the model contract. Models cannot be substituted; inputs are {model, prompt[, seed]} and nothing else.
4. Download inside the enclave. The MP4 comes from the provider's returned CDN URL — no caller-selected output URLs, no redirects, no private-network destinations. Bytes are hashed inside the TEE.
5. Receipt. The signed completion receipt binds job, attempt, session, original input hash, the one-use grant, provider request ID, provider response hash and the actual output bytes/hash.
6. Acceptance. The coordinator verifies everything, then decodes the full MP4 in a no-network bubblewrap sandbox with CPU, address-space, time and output limits. There is no unsandboxed fallback. Video bytes, receipt, metadata, payable and fulfilment event are committed together.
7. Review and reward. Accepted work is review-held. Only operator-approved, reward-eligible, organic work counts toward the sealed epoch that sets weights. See Rewards & emissions.

#Deadlines and failure

• Each contract has a deadline: 120 s for MiniMax H3 models, 480 s for everything else. A timeout emits a single refund-required event; late outputs cannot reopen a refunded job.
• A starting job with no durable provider ID becomes unknown on restart. A known provider ID is resumable, with polling bound to the original model.
• Repeated acceptance of the same result returns the existing record without another payable.

#Miner-facing protocol

Workers talk to the coordinator over three public routes, all fronted by Caddy at subnet.everyframe.studio:

everycli uses three more: GET /v1/miner/status, POST /v1/miner/drain and POST /v1/miner/resume. Every response is coordinator-signed and bound to your nonce, session and miner ID, so the CLI never mistakes a stale or foreign answer for a live one. Everything under /control/* is private to the operator.