What a provider is

An idle Apple Silicon Mac that runs open-weight models for Mifr callers.

A provider is an Apple Silicon Mac that runs open-weight models for Mifr callers. The work happens on that machine. Callers get a signed receipt for the hardware that produced the answer.

The Mac dials out to the coordinator. There is no inbound port, so a home machine behind NAT works. The coordinator is a directory. It never decrypts a prompt.

You do not grant yourself trust. The caller does. hardware comes from Apple’s attestation of this Mac. transparent comes from the logged binary. Your process advertises at most process.

Your identity is a Secure Enclave key under your user account (~/.mifr/sep.key). That is why the provider runs as a LaunchAgent, not as a root daemon. A root process would be a different identity and would fail the posture check.

A provider serves one sealed session at a time. Concurrent load queues on the caller side.

If you want to call the hosted API instead, start in Client.