Security tiers are a routing policy. They decide whether one operator sees the whole chat, or whether prefill and decode are split across two machines.
Developers cannot ship code to your machine. You host catalog models with the open-source agent. You can pause earning at any time.
tier1 is the default. tier2.5 is split inference. Set it per request or as a dashboard default.
Prefill on one operator. Decode on another. Neither holds a readable full request and response.
If two agents are not free, tier2.5 returns an error. It is not downgraded to tier1.
You send an OpenAI-compatible request to Scalattice Cloud. Cloud authorizes the key, then routes work to GPU operators running scalattice-agent. Those machines run a catalog model. They do not run your container, your script, or weights you uploaded.
The remaining question is who can read the chat while it runs. That is what X-Scalattice-Security controls. It is not a TEE, and it does not encrypt the GPU.
tier1 is standard routing. One operator (or each vetting replica) receives the messages as a whole and generates the completion. Use it for ordinary traffic and for streaming.
tier2.5 is split inference. Cloud tokenizes the prompt, then one attempt uses two operators that already host the same catalog model. The protocol is invoke_split.
Gets prompt token IDs, not a readable transcript. Builds the KV cache and returns opaque stateB64. Never generates the answer.
Loads that KV state on a second machine and generates the completion. Does not receive the original messages or the token-ID list.
Cloud may warm the upper agent while the lower layer runs, then returns the assembled completion to you. Streaming with tier2.5 is rejected (400). If two idle agents are not available, the request fails.
Scalattice Cloud sees the prompt. It authorizes, routes, meters, and for tier2.5 tokenizes before split work. Tiers limit operator visibility. They are not a claim that the platform never handles the content.
Vetting replicas are a quality check: independent passes compared before a result returns. They are not encryption. Combining vetting with tier2.5 costs more operator slots (each replica needs a lower and an upper).
Per request: X-Scalattice-Security: tier1 or tier2.5. Defaults live under Default API rules on the Developers dashboard.
Use tier1 when you need streaming. Use tier2.5 when you do not want any single network participant to hold a readable full request and response.
The agent never runs a developer container, shell, or uploaded binary. Catalog GGUF inference only.
Pause the machine schedule in Scalattice Cloud. Downloads can continue. Earning stops.
MIT-licensed on GitHub. Official installers are checksummed. Rotate the machine token if a host leaves.
You install scalattice-agent. You enable catalog models. The agent downloads those GGUF weights and connects to Scalattice Cloud. When you are in the pool, Cloud may send inference jobs for models you already host.
Developers cannot choose your GPU, push a container, or run a command. Incomplete weights are not advertised. That is the host-safety model: the workload is narrow. Scalattice does not take over your operating system, and it does not install a per-job VM or confidential-computing enclave.
tier1 sends invoke: the chat messages, in the clear, for the duration of the job. Your process generates the completion.
tier2.5 is split inference. Your machine is one layer of a pair, not both:
invoke_split / segment: lower. Token IDs in. You build the KV cache and return opaque state. You do not generate the answer.
invoke_split / segment: upper. Opaque KV state in. You generate the completion text. You do not receive the original messages.
Same agent binary as tier1. Same privileges on the OS you installed it on. The split is developer privacy on the network, not a stronger jail around your GPU.
Treat job content as visible on the machine that runs the agent. On tier1 that includes the prompt and the completion in process memory. On tier2.5, a lower job holds token IDs and KV state; an upper job holds KV state and generated text, including a short-lived state file the agent writes and deletes.
Do not host on a machine you would not trust with that class of data. Other users with login access to the box can see what the process can see.
Schedule: always, paused, or hour windows. Pause stops new jobs; it does not uninstall the agent.
Models: enable only what you want to serve. Remove weights from disk when you are done with a catalog entry.
The agent is open source. Read it, keep it on a current release, and rotate the slt_provider_… token if a host is decommissioned. Hardware and driver licences are yours.