CloudX's Open Arbiter

Core arbitration logic and TEE (Trusted Execution Environment) enclave implementation for CloudX revenue arbitration.

https://www.cloudx.ai/

This repository contains the arbitration functionality that has been extracted from the main CloudX platform for independent versioning and reusability. The arbiter ranks already-resolved bids whose revenue may be sealed to a public key held only by the enclave. It includes:

• core/: Core arbitration logic including bid ranking, sealing of encrypted revenue, and wire types
• enclaveapi/: API types for TEE enclave communication
• enclave/: AWS Nitro Enclave implementation for secure arbitration and key management
• enclave-image/: Dockerfile and assets for building the enclave image
• cmd/enclave-server/: vsock entry point that runs inside the enclave
• validation/: Host-side attestation, certificate, and PCR validation helpers

import (
    "github.com/cloudx-io/openarbiter/core"
    "github.com/cloudx-io/openarbiter/enclaveapi"
    "github.com/cloudx-io/openarbiter/enclave"
)

bids := []core.ArbiterBid{
    {Bid: &core.Bid{ID: uuid.New(), Source: "bidder-a"}, Revenue: 2_500_000},
    {Bid: &core.Bid{ID: uuid.New(), Source: "bidder-b"}, Revenue: 3_000_000},
}

// RankBids takes a RandSource for tie-breaking shuffling.
// Pass nil to use math/rand (default).
resp := core.RankBids(bids, nil)
fmt.Printf("Winner: %s @ %d\n", resp.Winner.Bid.Source, resp.Winner.Revenue)

Sealed revenue: Bidders seal their preferred revenue into Bid.EncryptedCPMDollars (via core.SealCPMDollars) under a public key obtained from the enclave's attested key endpoint. The arbiter inside the enclave decrypts and produces an ArbiterBid per input; it falls back to Bid.CleartextRevenue when the ciphertext is absent or unrecoverable. The selection logic in core/ is pure and never touches a private key.

Tie-breaking: RankBids shuffles before a stable sort by revenue descending, so equal-revenue bids break uniformly at random. Tests can inject a deterministic RandSource.

go test ./...

The Dockerfile copies a prebuilt binary from ./bin/, so build the binary before the image. On an amd64 Linux host, first register arm64 emulation for the image's RUN steps, as the workflow does with docker/setup-qemu-action:

docker run --rm --privileged tonistiigi/binfmt --install arm64

These commands match the build in .github/workflows/docker.yml:

CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -a -ldflags '-extldflags "-static"' -tags netgo -o ./bin/tee-arbiter-enclave ./cmd/enclave-server
docker build --platform linux/arm64 -f enclave-image/Dockerfile -t arbiter-enclave .