From d3c2ed66b992bb06ba577214fe8fe8b929baf852 Mon Sep 17 00:00:00 2001 From: Robert Yan Date: Wed, 14 Oct 2026 16:02:41 +0800 Subject: [PATCH] docs(go): clarify Gateway policies and manual TLS pinning --- cloud/inference-sdk/go.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/cloud/inference-sdk/go.mdx b/cloud/inference-sdk/go.mdx index 7620a39..62dfde5 100644 --- a/cloud/inference-sdk/go.mdx +++ b/cloud/inference-sdk/go.mdx @@ -103,7 +103,7 @@ These receipts do not establish a complete cryptographic chain through Gateway t Deployment checks are cached for 60 minutes by default. `AttestationTTL` and `ResponseTTL` accept `*time.Duration`; a pointer to zero disables reuse or retention. Response retention begins after full body consumption, lasts 60 minutes by default, and is also subject to cache eviction. Verify receipts before they expire or are evicted. -Optionally call `client.Verify(ctx, model)` before Chat to retrieve verified deployment evidence without sending a prompt. It shares Chat's cache and in-flight verification work and preserves the original verification timestamp. The SDK has no default application deployment allowlist; configure deployment and image provenance policies when your application requires approved images. See the [Go verification guide](https://github.com/nearai/inference-sdk/blob/main/go/docs/verification-guide.md#configure-verification-and-deployment-policies) for policy examples. +Optionally call `client.Verify(ctx, model)` before Chat to retrieve verified deployment evidence without sending a prompt. It shares Chat's cache and in-flight verification work and preserves the original verification timestamp. The SDK has no default application deployment allowlist; configure deployment and image provenance policies when your application requires approved images. `DeploymentPolicy` applies to model deployments; Gateway policies use `GatewayVerification.DeploymentVerifier`, whose callback has no model argument. See the [Go verification guide](https://github.com/nearai/inference-sdk/blob/main/go/docs/verification-guide.md#configure-verification-and-deployment-policies) for policy examples. ## Use the OpenAI Go SDK @@ -140,7 +140,7 @@ Set `OHTTP: true` in `InferenceOptions` to encapsulate the Chat HTTP exchange to ## Advanced APIs -`NewAttestationClient` fetches evidence without verifying it. Standalone verification functions let your application verify deployments and signatures over exact retained wire bytes. `PrepareE2EEChatRequest` supports raw HTTP request encryption after your application authenticates the model key; retain ciphertext when verifying receipts manually. +`NewAttestationClient` fetches evidence without verifying it. Standalone verification functions let your application verify deployments and signatures over exact retained wire bytes. In a manual Gateway flow, rebuild the attestation client with the pinned HTTP transport before fetching model evidence or completion signatures; creating the transport alone does not change an existing client. See the [manual verification walkthrough](https://github.com/nearai/inference-sdk/blob/main/go/docs/verification-guide.md#manual-verification). `PrepareE2EEChatRequest` supports raw HTTP request encryption after your application authenticates the model key; retain ciphertext when verifying receipts manually. `NewDirectInferenceClient` and `NewDirectAttestationClient` support experimental direct endpoints. Direct inference defaults E2EE to enabled and omits Gateway verification and direct TLS attestation binding; normal HTTPS validation remains enabled. Use Gateway clients for production. See the [direct-endpoint guide](https://github.com/nearai/inference-sdk/blob/main/go/docs/verification-guide.md#experimental-direct-endpoints) for configuration and limitations.