Embedding Verifier

Rust workspace for the embedding verifier API and secure enclave.

Structure

embedding-verifier/
├── api/              # Axum HTTP API
└── secure-enclave/   # Secure enclave process

Development

# Run formatting and lint checks
cargo fmt --all -- --check
cargo clippy --all-targets --all-features --

# Build and test the workspace
cargo build
cargo test --all

# Run the API on http://localhost:8000
RUST_LOG=info cargo run --bin api
curl http://localhost:8000/health

# Run the secure enclave placeholder
RUST_LOG=info cargo run --bin secure-enclave

Nitro-enabled development host

Use an Amazon Linux 2023 EC2 instance type that supports Nitro Enclaves and launch it with Nitro Enclaves enabled. Limit inbound SSH access to your current public IP.

On the instance, install the development tools and Nitro Enclaves runtime:

sudo dnf install -y \
  git wget jq tmux tree unzip tar gzip \
  gcc gcc-c++ make cmake clang pkgconf-pkg-config openssl-devel \
  bubblewrap docker aws-nitro-enclaves-cli aws-nitro-enclaves-cli-devel

sudo usermod -aG ne "$USER"
sudo usermod -aG docker "$USER"
sudo systemctl enable --now nitro-enclaves-allocator.service
sudo systemctl enable --now docker

These commands follow the AWS Nitro Enclaves setup for Amazon Linux 2023.

The allocator defaults to 2 vCPUs and 512 MiB. Adjust /etc/nitro_enclaves/allocator.yaml before starting the service when the enclave needs more. Log out and reconnect after changing group membership, then verify the host:

nitro-cli --version
nitro-cli describe-enclaves
docker version

Install Rust and the components used by this workspace:

curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
source "$HOME/.cargo/env"
rustup component add rustfmt clippy
cargo test --all

For private repository access, install and authenticate the GitHub CLI using its official RPM instructions.

Optionally install Codex for development on the remote host:

curl -fsSL https://chatgpt.com/codex/install.sh | sh
exec "$SHELL" -l
codex login --device-auth
codex doctor

To use the Codex desktop app, add a concrete host alias to your local ~/.ssh/config, confirm ssh <alias> works, then select the host and repository path under Settings > Connections. See the Codex remote connection guide.