[CRE] Wire confidential relay handler by nadahalli · Pull Request #21375 · smartcontractkit/chainlink

nadahalli · 2026-03-03T15:50:40Z

Confidential CRE Workflows (implementation plan | relay DON design)

Summary

Wire the confidential-compute relay handler (confidential-compute#265) into chainlink as a CRE subservice. The relay handler validates Nitro attestation and dispatches confidential.secrets.get / confidential.capability.execute messages from the enclave to VaultDON and capability DONs via the gateway connector.

The handler code lives in confidential-compute/capabilities/relay as a standalone Go module. This PR imports it and wires it into the node's lifecycle.

Changes

core/capabilities/confidentialrelay/service.go (new): Thin lifecycle wrapper around the relay handler. The relay handler needs the gateway connector at construction time, but the connector isn't available until ServiceWrapper.Start(). This wrapper defers handler creation to its own Start(), bridging the gap.
core/services/cre/cre.go: Instantiate the relay service inside the gateway connector block, gated by CL_CONFIDENTIAL_RELAY_TRUSTED_PCRS env var.
go.mod: Bump chainlink-common to 3e3f9545d607 (adds confidentialrelay types), add confidential-compute/capabilities/relay and transitive dep confidential-compute/attestation.

Config: env var for now

Trusted PCR measurements are passed via CL_CONFIDENTIAL_RELAY_TRUSTED_PCRS as a JSON string:

{"pcr0":"<hex>","pcr1":"<hex>","pcr2":"<hex>"}

When unset, no relay service is started (zero impact on nodes that don't use confidential workflows). Proper TOML config (Capabilities.ConfidentialRelay section) can be added in a follow-up; PCR values change rarely (only when the enclave binary is rebuilt), so an env var is sufficient for now and avoids config interface boilerplate.

Dependency chain

chainlink-common (3e3f9545d607, confidentialrelay types)
  ^
  |
confidential-compute/capabilities/relay (bb7be43)
  |
  v
confidential-compute/attestation (bb7be43)

Related PRs

Node-side relay handler: confidential-compute#265
Gateway-side relay handler: chainlink#21356
chainlink-common types: chainlink-common#1851 (merged)
ConfidentialModule + attributes plumbing: chainlink#21298

github-actions · 2026-03-03T15:51:02Z

👋 nadahalli, thanks for creating this pull request!

To help reviewers, please consider creating future PRs as drafts first. This allows you to self-review and make any final changes before notifying the team.

Once you're ready, you can mark it as "Ready for review" to request feedback. Thanks!

github-actions · 2026-03-03T15:52:22Z

✅ No conflicts with other open PRs targeting tejaswi/cw-phase4

Copilot

Pull request overview

Wires the confidential-compute relay handler into the CRE service graph as an optional subservice, gated by CL_CONFIDENTIAL_RELAY_TRUSTED_PCRS, and updates dependencies to pull in required relay/confidentialrelay types.

Changes:

Add a new core/capabilities/confidentialrelay lifecycle wrapper that defers handler construction to Start().
Wire the confidential relay service into core/services/cre when CL_CONFIDENTIAL_RELAY_TRUSTED_PCRS is set.
Bump chainlink-common and add confidential-compute relay/attestation dependencies.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 4 comments.

File	Description
go.mod	Adds confidential-compute relay dependency and bumps `chainlink-common`.
go.sum	Updates module sums for new/bumped dependencies.
core/services/cre/cre.go	Conditionally registers the confidential relay service behind an env var gate.
core/capabilities/confidentialrelay/service.go	Introduces a thin service wrapper around the confidential relay handler lifecycle.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-03T15:55:32Z

+		if trustedPCRs := os.Getenv("CL_CONFIDENTIAL_RELAY_TRUSTED_PCRS"); trustedPCRs != "" {
+			relayService := confidentialrelay.NewService(
+				gatewayConnectorWrapper,
+				opts.CapabilitiesRegistry,
+				[]byte(trustedPCRs),
+				lggr,
+			)
+			srvs = append(srvs, relayService)
+		}


The relay service is conditionally enabled via CL_CONFIDENTIAL_RELAY_TRUSTED_PCRS, but there’s no log signal when it is enabled/disabled. This makes it hard to diagnose why the relay handler isn’t running (especially since other conditional subservices here log when they are skipped/created). Consider adding a Debug/Info log when the env var is set (service enabled) and when it’s unset (service disabled).

Copilot · 2026-03-03T15:55:32Z

+				lggr,
+			)
+			srvs = append(srvs, relayService)
+		}


If CL_CONFIDENTIAL_RELAY_TRUSTED_PCRS is set but capCfg.GatewayConnector().DonID() is empty, the relay will silently not start because the gateway connector wrapper isn’t created. Consider logging a warning in that case (env var set but gateway connector not configured), since it’s a misconfiguration that’s otherwise non-obvious.

Suggested change

}

}

} else {

if trustedPCRs := os.Getenv("CL_CONFIDENTIAL_RELAY_TRUSTED_PCRS"); trustedPCRs != "" {

lggr.Warn("CL_CONFIDENTIAL_RELAY_TRUSTED_PCRS is set but GatewayConnector DonID is empty; confidential relay will not start")

}

Copilot · 2026-03-03T15:55:32Z

+	h, err := relay.NewHandler(s.capRegistry, conn, s.trustedPCRs, s.lggr)
+	if err != nil {
+		return err
+	}
+	s.handler = h
+	return h.Start(ctx)


start returns raw errors from relay.NewHandler/h.Start without adding context. To make startup failures actionable in logs, wrap these errors with service-specific context (e.g., include that this is the confidential relay handler startup and whether it was due to handler construction vs start).

Copilot · 2026-03-03T15:55:33Z

+func (s *Service) start(ctx context.Context) error {
+	conn := s.wrapper.GetGatewayConnector()
+	if conn == nil {
+		return errors.New("gateway connector not available")
+	}
+	h, err := relay.NewHandler(s.capRegistry, conn, s.trustedPCRs, s.lggr)
+	if err != nil {
+		return err
+	}
+	s.handler = h
+	return h.Start(ctx)
+}
+
+func (s *Service) close() error {
+	if s.handler != nil {
+		return s.handler.Close()
+	}
+	return nil
+}


There are no unit tests covering the new lifecycle wrapper behavior (e.g., that it errors when the gateway connector isn’t available, and that it closes the underlying handler when started). Since the repo has extensive Go service tests elsewhere, consider adding a small test for Service.start/close using a fake ServiceWrapper/connector to prevent regressions.

Both #21298 and #21375 independently claimed migration version 291. Renumber add_workflow_attributes_column to 292 to fix the conflict.

Instantiate the confidential-compute relay handler as a CRE subservice. The handler validates Nitro attestation and dispatches secrets.get / capability.execute messages to VaultDON and capability DONs via the gateway connector. Gated by CL_CONFIDENTIAL_RELAY_TRUSTED_PCRS env var (JSON with PCR0-2 hex values). When unset, no relay service is started.

Gateway-side handler that receives JSON-RPC requests from the enclave, fans them out to relay DON nodes, and aggregates 2F+1 quorum responses. Follows the vault handler pattern but simplified: no authorization, no caching, no OCR3 signatures, no owner-prefixed request IDs.

Add gateway handler type, capability flag, and Feature implementation so the CRE test framework can spin up a relay DON for remote-mode E2E tests.

Pass CL_CONFIDENTIAL_RELAY_CA_ROOTS_PEM env var to relay handler for custom attestation certificate validation. Update go.mod to use remote confidential-compute module commits.

… gateway service name Dockerfile: mount GIT_AUTH_TOKEN during go mod download for private module access in Docker builds. gateway_job.go: set ServiceName "confidential" on the confidential-relay handler so the gateway can route requests from the enclave's RemoteDispatcher (which sends methods like "confidential.capability.execute").

Adds mock binary to the GetCapabilityIDFromCommand and inverse mapping so the standard capabilities delegate properly associates the mock binary with its capability ID.

Both confidential plugins now point at ed10df3 which has replace directives removed from go.mod, allowing loopinstall to build from the module cache on a clean checkout.

Update relay and attestation pseudo-versions to the latest tejaswi/cw-e2e-test commit which fixes stale attestation pseudo-version and E2E subtest isolation bugs.

The full commit hash was wrong (first 12 chars matched, rest was garbage). Corrected to actual 1efd81acd9949fc79d14a46b1b55faa74fcb436e.

Secrets are prefetched by the executor before enclave dispatch, so the relay handler no longer needs to route secrets.get requests.

vreff · 2026-03-12T19:37:37Z

+		if trustedPCRs := os.Getenv("CL_CONFIDENTIAL_RELAY_TRUSTED_PCRS"); trustedPCRs != "" {
+			caRootsPEM := os.Getenv("CL_CONFIDENTIAL_RELAY_CA_ROOTS_PEM")


We can't fetch these from envars. We should use the capability registry configs here. And as for the CA_ROOTS_PEM, I assume it is the nitro one, so we could also have that in the config of the capabilities registry.

I would say if the on-chain configs aren't ready here, we use a node-level toml config that is "EnableConfidentialRelay" or something, and then read those values from the on-chain config within the handler/service.

Done. Replaced env vars with TOML config under [CRE.ConfidentialRelay]. Enabled/TrustedPCRs/CARootsPEM. CTF feature updated to set TOML config on nodes instead of env vars.

github-actions · 2026-03-12T19:38:01Z

CORA - Pending Reviewers

Codeowners Entry	Overall	Num Files	Owners
`*`	⏳	11	@smartcontractkit/foundations, @smartcontractkit/core
`.changeset`	⏳	1	@smartcontractkit/foundations, @smartcontractkit/core
`/core/capabilities/`	⏳	3	@smartcontractkit/keystone, @smartcontractkit/capabilities-team
`/core/services/standardcapabilities`	⏳	1	@smartcontractkit/keystone
`/deployment/cre`	⏳	1	@smartcontractkit/keystone, @smartcontractkit/operations-platform
`go.mod`	⏳	1	@smartcontractkit/core, @smartcontractkit/foundations
`go.sum`	⏳	1	@smartcontractkit/core, @smartcontractkit/foundations

For more details, see the full review summary.

vreff · 2026-03-12T19:38:58Z

+type aggregator struct{}
+
+func (a *aggregator) Aggregate(resps map[string]jsonrpc.Response[json.RawMessage], donF int, donMembersCount int, l logger.Logger) (*jsonrpc.Response[json.RawMessage], error) {
+	requiredQuorum := 2*donF + 1


we need 2F+1 responses? why not f+1?

Good call, changed to F+1. Each honest node already validates the Nitro attestation independently, so F+1 matching guarantees at least one honest node vouched for the result. Consistent with the workflow metadata handler precedent.

TDH2 threshold is T=F+1. With up to F Byzantine nodes, you need 2F+1 responses to guarantee at least F+1 valid shares for reconstruction.

vreff · 2026-03-12T19:47:29Z

+package confidentialrelay
+


This entire file seems like boilerplate. Do they not support some generic version of this?

No generic handler in the framework. Every handler (functions, capabilities, vault) implements the Handler interface from scratch. Ours is comparable in size to the capabilities handler (431 vs 362 lines).

vreff · 2026-03-12T19:48:43Z

+RUN --mount=type=secret,id=GIT_AUTH_TOKEN \
+    --mount=type=cache,target=/go/pkg/mod \
+    set -e && \
+    export GIT_CONFIG_GLOBAL=/tmp/gitconfig-gomod-download && \
+    if [ -f /run/secrets/GIT_AUTH_TOKEN ] && [ -s /run/secrets/GIT_AUTH_TOKEN ]; then \
+        TOKEN=$(cat /run/secrets/GIT_AUTH_TOKEN) && \
+        git config --file "$GIT_CONFIG_GLOBAL" \
+            url."https://oauth2:${TOKEN}@github.com/".insteadOf "https://github.com/" ; \
+    fi && \
+    go mod download && \
+    rm -f "$GIT_CONFIG_GLOBAL"


obviously this cannot be included in the changes

Agreed, will remove.

Removed. Copied the attestation and relay handler code into chainlink directly, dropped the CC module dependency entirely. The Dockerfile no longer needs private repo access.

vreff · 2026-03-12T19:49:47Z

+			ns.EnvVars["CL_CONFIDENTIAL_RELAY_TRUSTED_PCRS"] = fmt.Sprintf("%v", v)
+		}
+		if v, exists := capConfig.Values["caRootsPEM"]; exists {
+			ns.EnvVars["CL_CONFIDENTIAL_RELAY_CA_ROOTS_PEM"] = fmt.Sprintf("%v", v)


again, we cannot use envars here.

Done. Moved to TOML config.

vreff · 2026-03-12T19:54:04Z

lot of boilerplate wiring. only major comment is the envars.

HandlerServiceName was missing a case for GatewayHandlerTypeConfidentialRelay, so it fell through to the default which returned "confidential-compute-relay". The JSON-RPC method "confidential.capability.execute" produces ServiceName() "confidential", causing "Service name not found" at the gateway.

… dependency

…ency)

nadahalli · 2026-03-16T17:17:43Z

Envars replaced with TOML config. Dockerfile dependency removed. Also, product direction has changed: remote secret fetching from the enclave is now the only path. No upfront vault_don_secrets declaration. This relay handler will carry the GetSecrets traffic at runtime.

Node-side handler: adds handleSecretsGet which validates Nitro attestation, looks up vault capability, builds vault GetSecrets request with the enclave's ephemeral public key, translates the vault response (hex to base64 encoding), and returns encrypted TDH2 shares. Gateway handler: registers MethodSecretsGet alongside MethodCapabilityExec so the gateway routes secrets requests to relay DON nodes. No per-secret authorization. Relay DON validates attestation + PCR measurements only. Trust boundary is the TEE itself.

cl-sonarqube-production · 2026-03-16T19:24:06Z

Quality Gate failed

Failed conditions
12.7% Duplication on New Code (required ≤ 10%)
C Reliability Rating on New Code (required ≥ A)
9 New Major Issues (required ≤ 5)

See analysis details on SonarQube

Catch issues before they fail your Quality Gate with our IDE extension SonarQube IDE

trunk-io · 2026-03-16T19:27:55Z

Failed Test	Failure Summary	Logs
`TestScripts/node/validate/disk-based-logging-disabled`	The test failed during validation of node disk-based logging configuration.	Logs ↗︎
`TestScripts/node/validate/disk-based-logging-disabled`	The test failed without a specific error message, indicating an unspecified failure during script execution.	Logs ↗︎
`TestDocsTOMLComplete`	The test failed due to an unexpected nil value for CRE.ConfidentialRelay.	Logs ↗︎
`TestResolver_ConfigV2/empty`	The test failed without a specific error message, indicating an unspecified failure during configuration validation or execution.	Logs ↗︎

... and 32 more

View Full Report ↗︎ ⋅ Docs

nadahalli · 2026-03-19T12:11:24Z

Superseded by #21603

Copilot AI review requested due to automatic review settings March 3, 2026 15:50

nadahalli requested review from a team as code owners March 3, 2026 15:50

product-security-plaid-production Bot requested review from ettec and ilija42 March 3, 2026 15:50

Copilot started reviewing on behalf of nadahalli March 3, 2026 15:51 View session

Copilot AI reviewed Mar 3, 2026

View reviewed changes

nadahalli mentioned this pull request Mar 4, 2026

[CRE] Add test framework support for confidential relay DON #21396

Closed

nadahalli requested a review from a team as a code owner March 4, 2026 16:12

product-security-plaid-production Bot requested a review from DimitriosNaikopoulos March 4, 2026 16:12

nadahalli requested a review from a team as a code owner March 5, 2026 13:55

nadahalli mentioned this pull request Mar 5, 2026

[CRE] Add confidential relay gateway handler #21356

Closed

product-security-plaid-production Bot requested a review from kdihalas March 5, 2026 13:55

kdihalas previously approved these changes Mar 5, 2026

View reviewed changes

nadahalli added a commit that referenced this pull request Mar 5, 2026

Renumber duplicate migration 291 to 292

3eb8a06

Both #21298 and #21375 independently claimed migration version 291. Renumber add_workflow_attributes_column to 292 to fix the conflict.

nadahalli dismissed kdihalas’s stale review via 2732a5d March 5, 2026 16:51

This was referenced Mar 6, 2026

[CRE] Support confidential workflow engine path #21443

Closed

[CRE] Support confidential workflow engine path #21444

Closed

nadahalli added a commit that referenced this pull request Mar 10, 2026

Renumber duplicate migration 291 to 292

1eeae80

Both #21298 and #21375 independently claimed migration version 291. Renumber add_workflow_attributes_column to 292 to fix the conflict.

nadahalli added 7 commits March 10, 2026 17:07

Add changeset for confidential relay wiring

8cd2be4

Bump confidential-compute/attestation to rebased commit

9cb441a

Bump chainlink-common, use shared confidentialrelay types

dd6000b

Add CRE test framework support for confidential relay DON

4950b8b

Add gateway handler type, capability flag, and Feature implementation so the CRE test framework can spin up a relay DON for remote-mode E2E tests.

Wire CA roots PEM through confidential relay service

f55a479

Pass CL_CONFIDENTIAL_RELAY_CA_ROOTS_PEM env var to relay handler for custom attestation certificate validation. Update go.mod to use remote confidential-compute module commits.

nadahalli added 7 commits March 10, 2026 17:08

Add mock capability to command-to-capabilityID mapping

2a24e4a

Adds mock binary to the GetCapabilityIDFromCommand and inverse mapping so the standard capabilities delegate properly associates the mock binary with its capability ID.

Add confidential-workflows plugin, update gitRefs to clean commit

e603c34

Both confidential plugins now point at ed10df3 which has replace directives removed from go.mod, allowing loopinstall to build from the module cache on a clean checkout.

Bump confidential-compute deps to include E2E test fixes

197180a

Update relay and attestation pseudo-versions to the latest tejaswi/cw-e2e-test commit which fixes stale attestation pseudo-version and E2E subtest isolation bugs.

Fix corrupted gitRef hash in plugins.private.yaml

d658ea3

The full commit hash was wrong (first 12 chars matched, rest was garbage). Corrected to actual 1efd81acd9949fc79d14a46b1b55faa74fcb436e.

Remove MethodSecretsGet from confidential relay gateway handler

250456f

Secrets are prefetched by the executor before enclave dispatch, so the relay handler no longer needs to route secrets.get requests.

Bump confidential-compute pseudo-versions to rebased branch tips

768dd59

nadahalli changed the base branch from develop to tejaswi/cw-phase4 March 10, 2026 16:31

vreff reviewed Mar 12, 2026

View reviewed changes

nadahalli added 5 commits March 13, 2026 00:44

Wire confidential relay handler in gateway job switch

e05476a

Replace env vars with TOML config for confidential relay handler

96ad322

Copy attestation and relay handler from confidential-compute, drop CC…

0da1f19

… dependency

Revert Dockerfile auth token hack (no longer needed without CC depend…

98b9b1e

…ency)

nadahalli added 2 commits March 16, 2026 18:35

Use teeattestation from chainlink-common, delete local attestation copy

3fa6372

nadahalli closed this Mar 19, 2026

-		}
+		}
+	} else {
+		if trustedPCRs := os.Getenv("CL_CONFIDENTIAL_RELAY_TRUSTED_PCRS"); trustedPCRs != "" {
+			lggr.Warn("CL_CONFIDENTIAL_RELAY_TRUSTED_PCRS is set but GatewayConnector DonID is empty; confidential relay will not start")
+		}

		if trustedPCRs := os.Getenv("CL_CONFIDENTIAL_RELAY_TRUSTED_PCRS"); trustedPCRs != "" {
		caRootsPEM := os.Getenv("CL_CONFIDENTIAL_RELAY_CA_ROOTS_PEM")

		package confidentialrelay

Conversation

nadahalli commented Mar 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Config: env var for now

Dependency chain

Related PRs

Uh oh!

github-actions Bot commented Mar 3, 2026

Uh oh!

github-actions Bot commented Mar 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Mar 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CORA - Pending Reviewers

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

vreff commented Mar 12, 2026

Uh oh!

nadahalli commented Mar 16, 2026

Uh oh!

cl-sonarqube-production Bot commented Mar 16, 2026

Quality Gate failed

Uh oh!

trunk-io Bot commented Mar 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nadahalli commented Mar 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

nadahalli commented Mar 3, 2026 •

edited

Loading

github-actions Bot commented Mar 3, 2026 •

edited

Loading

github-actions Bot commented Mar 12, 2026 •

edited

Loading

trunk-io Bot commented Mar 16, 2026 •

edited

Loading