Confidential Sealing for Lotus with TEE-backed Worker Policy Enforcement

Project Name:
Confidential Sealing for Lotus with TEE-backed Worker Policy Enforcement

Proposal Category:
Storage

Individual or Entity Name:
Phil Yang (Individual)

Proposer:
@skymiss18

Project Repo(s):

https://github.com/skymiss18/filecointee
https://github.com/filecoin-project/lotus
(Optional) Filecoin ecosystem affiliations:
None at this time. I am applying as an independent open-source builder.

(Optional) Technical Sponsor:
None confirmed yet.

Do you agree to open source all work you do on behalf of this RFP under the MIT/Apache-2 dual-license?:
Yes

Project Summary
Filecoin is a decentralized storage network with strong verifiability guarantees, but it does not provide default end-to-end data confidentiality against storage providers. In practical terms, providers can still process customer data during sealing and unsealing workflows. For enterprise and regulated use cases, this is a major adoption blocker.

This project adds a confidentiality layer to Lotus by using TEE-backed workers for sensitive storage tasks. I introduce policy controls so operators can explicitly mark confidentiality-required tasks, and the scheduler will only assign those tasks to workers that advertise confidential execution capability. This creates a clear and enforceable path from node configuration to runtime scheduling decisions.

My goal is simple: customer plaintext and data keys should not be exposed to miner host environments. I achieve this by moving sensitive operations into trusted execution environments, and by enforcing worker capability checks at scheduling time. The result is a practical, open-source path for confidential storage processing on Filecoin while keeping compatibility with existing Lotus operational patterns.

Impact
Today, teams that need both decentralized storage and strict confidentiality controls have limited options in standard Lotus operations. Even with strong proof systems, organizations in finance, healthcare, government, and enterprise data governance often require additional runtime confidentiality guarantees during processing.

By introducing TEE-aware scheduling controls, this project reduces the trust surface between clients and storage providers. It gives operators a clear way to separate standard and confidentiality-required workloads, and gives clients stronger assurances about where sensitive data is processed.

If successful, this work can unlock higher-value Filecoin adoption in regulated and security-sensitive markets, while remaining fully open-source and aligned with ecosystem standards. If this gap is not addressed, many enterprise workloads will continue to stay off-network due to policy and compliance concerns.

Outcomes
Final deliverables:

Confidentiality requirement flags for selected sealing-related task types.
Worker security capability model with confidential execution metadata.
Scheduler filtering that enforces confidentiality-required task placement.
Minimal sealer configuration wiring for confidential execution flags.
Unit tests for policy checks and worker capability enforcement.
Operator setup notes and validation guide.
Demo package showing scheduling behavior on confidential vs non-confidential workers.
Success metrics:

Confidentiality-required tasks are never assigned to non-confidential workers.
All new policy paths have automated tests.
Setup and validation can be completed through documented configuration steps.
At least 1 pilot operator validates the workflow and provides feedback.
Code quality is ready for upstream maintainer review.
Data Onboarding
This project does not directly target data onboarding volume. It focuses on confidentiality controls for storage task processing.

Month #1: N/A
Month #3: N/A
Month #6: N/A
Month #12: N/A
Adoption, Reach, and Growth Strategies
Target audience:

Lotus storage providers serving compliance-sensitive customers.
Enterprise teams evaluating Filecoin for sensitive workloads.
Filecoin core and ecosystem developers focused on secure infrastructure.
Adoption strategy:

Publish implementation docs, config examples, and test procedures.
Share milestone demos with Lotus and Filecoin builder communities.
Work with early pilot operators for real-world feedback and hardening.
Initial growth plan:

First 10 users: direct onboarding support with reproducible examples.
First 100 users: standardized setup guide, troubleshooting docs, best-practice configs.
Development Roadmap
Milestone 1: Confidential task policy and worker capability baseline
Functionality:
Define confidentiality-required task types.
Extend worker info with confidential execution capability fields.
Add unit tests for task-policy and worker-capability checks.
Team and roles:
1 protocol engineer.
Timeline:
2026-08-01 to 2026-09-10.
Funding:
4000 USD.
Milestone 2: Scheduler enforcement and minimal operator package
Functionality:
Enforce confidential-worker checks in scheduler assignment path.
Add minimal sealer config wiring for confidential execution flags.
Run regression checks and publish operator setup notes and demo.
Team and roles:
1 protocol engineer.
Timeline:
2026-09-11 to 2026-10-31.
Funding:
6000 USD.
Total Budget Requested
| Milestone # | Description | Deliverables | Completion Date | Funding |
|===|===|===|===|===|
| 1 | Confidential policy baseline | Policy mapping, worker security fields, unit tests | 2026-09-10 | 4000 USD |
| 2 | Scheduler enforcement and operator package | Scheduler filter, minimal config wiring, regression check, docs and demo | 2026-10-31 | 6000 USD |

Total requested funding: 10000 USD

Maintenance and Upgrade Plans
After grant completion, I will maintain the project in a public repository with:

Ongoing issue triage and bug-fix releases.
Compatibility updates for upstream Lotus changes.
Additional policy coverage for new confidential task scenarios.
Better observability and operator troubleshooting guidance.
Community feedback cycles and upstream merge proposals.
Team
Team Members
Phil Yang (Phil) - Project Lead, Protocol Engineer, Implementer
Team Member LinkedIn Profiles
N/A
Team Website
https://github.com/skymiss18
Relevant Experience
I have practical experience making source-level Lotus changes in storage and scheduler paths, secure systems design, and open-source delivery workflows. In this project branch, I have already implemented core components of confidentiality-aware task classification, worker capability modeling, scheduler filtering, and configuration propagation, with tests for key logic paths.

This existing implementation progress reduces execution risk and provides a strong foundation for milestone-based delivery.

Team code repositories
https://github.com/skymiss18/filecointee
Additional Information
How did you learn about the Open Grants Program?

Through the Filecoin Foundation grants page and the devgrants repository.
Best email address for discussing the grant agreement and next steps:

philyang8348@gmail.com
Additional information:

I can provide milestone demos and architecture walkthroughs during review.
I welcome scope calibration feedback before contracting.
I can support pilot deployments with selected storage providers during the grant period.

Start by reviewing the existing implementation in the linked filecointee repository and the Lotus scheduler assignment path, worker information, and sealer configuration areas named in the proposal. Check the policy and capability unit tests first. Done means confidential tasks are filtered to capable workers, configuration is wired, automated tests pass, and operator setup notes and a demo are available.

Written by the indexing model from the issue text.