docs: refresh Cloud verification guides

cloud/private-inference.mdx

@@ -26,7 +26,7 @@ NEAR AI Cloud's private inference provides three core guarantees:
     Your prompts, model weights, and outputs are encrypted and isolated in hardware-secured environments. Infrastructure providers, model providers, and NEAR cannot access your data at any point in the process.
   </Card>
   <Card title="Cryptographic Verification" icon="file-check" horizontal>
-    Every computation generates cryptographic proof that it occurred inside a genuine, secure TEE. You can independently verify that your AI requests were processed in a protected environment without trusting any third party.
+    Attestation reports provide cryptographic evidence for a specific runtime and request path. When a response signature is available, you can also verify response integrity.
   </Card>
   <Card title="Production Performance" icon="gauge" horizontal>
     Hardware-accelerated TEEs with [NVIDIA Confidential Computing](https://www.nvidia.com/en-us/data-center/solutions/confidential-computing/) deliver high-throughput inference with minimal latency overhead, making private inference practical for real-world applications.
@@ -54,13 +54,13 @@ NEAR AI Cloud combines Intel TDX and NVIDIA TEE technologies to create isolated,
 
 If you're using a standard OpenAI SDK or curl, your prompts are automatically protected by TLS encryption—no additional setup required.
 
-NEAR AI Cloud supports two connection modes — both provide TLS termination inside a TEE:
+NEAR AI Cloud supports two connection modes. Each has its own TLS-attestation flow when your application requires evidence for the TLS endpoint of a particular connection:
 
 **Gateway mode** routes through `cloud-api.near.ai`, which runs in its own TEE before forwarding to the model TEE:
 
 ```mermaid
 flowchart LR
-    A["Your Machine"] -->|"🔒 Encrypted"| B["Gateway TEE"] -->|"🔒 Encrypted"| C["Model TEE: TLS Termination → LLM"]
+    A["Your Machine"] -->|"🔒 HTTPS"| B["NEAR AI Cloud gateway"] -->|"🔒 HTTPS"| C["Model endpoint → LLM"]
 
     style A fill:#1a1a2e,stroke:#4fc3f7,stroke-width:2px,color:#fff
     style B fill:#1b5e20,stroke:#66bb6a,stroke-width:2px,color:#fff
@@ -71,23 +71,23 @@ flowchart LR
 
 ```mermaid
 flowchart LR
-    A["Your Machine"] -->|"🔒 Encrypted"| C["Model TEE: TLS Termination → LLM"]
+    A["Your Machine"] -->|"🔒 HTTPS"| C["Model endpoint → LLM"]
 
     style A fill:#1a1a2e,stroke:#4fc3f7,stroke-width:2px,color:#fff
     style C fill:#2e7d32,stroke:#81c784,stroke-width:2px,color:#fff
 ```
 
-**Key insight:** In both modes, TLS termination happens inside the TEE (green boxes), not at an external load balancer. Your prompts remain encrypted until they reach the secure enclave.
+**Key insight:** TLS protects traffic in transit. When the route-specific TLS attestation flow passes for a particular connection, it binds that connection's endpoint to verified attestation evidence.
 
 Here's why this works:
 
 1. **Standard HTTPS = TLS encryption**: When you make API calls using the OpenAI SDK or curl, you're connecting via HTTPS. This means TLS encryption is applied automatically by your client before any data leaves your machine.
 
-2. **TLS terminates inside the TEE**: Unlike traditional cloud services where TLS terminates at an external load balancer, NEAR AI Cloud terminates TLS connections **inside the Trusted Execution Environment**. Your encrypted data travels from your laptop directly into the secure enclave before being decrypted.
+2. **TLS endpoint verification**: Use TLS attestation when your application needs to verify the endpoint for a particular connection. The same TLS connection must supply both the peer certificate and attestation report.
 
-3. **No plaintext exposure**: Because TLS termination happens within the TEE, your prompts are never exposed in plaintext outside the hardware-secured environment—not to network infrastructure, not to cloud providers, not to anyone.
+3. **Evidence-driven trust**: Use attestation and the workload policy appropriate for your application to decide which environment properties are required.
 
-This means you get the same seamless developer experience as any OpenAI-compatible API, while your data remains encrypted from your machine all the way into the secure TEE.
+This gives you the same OpenAI-compatible development flow while allowing your application to verify the properties it requires.
 
 ### Direct Completions
 
@@ -138,8 +138,8 @@ Gateway and direct completions responses include an `X-Request-Id` response head
 
 **Benefits of direct completions:**
 - **Fewer hops** — Your request reaches the model TEE directly, reducing latency
-- **Simpler trust model** — Only the model TEE needs to be verified (no [gateway verification](/cloud/verification/gateway) required)
-- **TLS binds to attestation** — The `include_tls_fingerprint=true` parameter on the attestation endpoint binds the TLS certificate to the attestation report
+- **Simpler trust model** — Only the model TEE needs to be verified (no [NEAR AI Cloud gateway attestation](/cloud/verification/cloud-api/gateway-attestation) required)
+- **TLS binds to attestation** — The `include_tls_fingerprint=true` parameter can bind the direct endpoint TLS certificate to its attestation report when the [direct TLS flow](/cloud/verification/direct/tls) is completed
 
 ### The Inference Process
 
@@ -148,7 +148,7 @@ When you make a request to NEAR AI Cloud, your data flows through a secure pipel
 **Via Gateway (`cloud-api.near.ai`):**
 
     1. **Request Initiation:**
-    You send chat completion requests via HTTPS to the LLM Gateway. TLS encryption protects your data in transit, and the TLS connection terminates inside the TEE, ensuring your prompts are decrypted only within the secure environment.
+    You send chat completion requests via HTTPS to the LLM Gateway. TLS protects data in transit; use [NEAR AI Cloud gateway TLS connection binding](/cloud/verification/cloud-api/tls) when your application needs to verify the endpoint for a particular connection.
 
     2. **Secure Request Routing:**
     The LLM Gateway routes your request to the appropriate Private LLM Node based on the requested model, availability, and load balancing requirements.
@@ -157,27 +157,27 @@ When you make a request to NEAR AI Cloud, your data flows through a secure pipel
     AI inference computations execute inside the Private LLM Node's TEE, where all data and model weights are protected by hardware-enforced isolation.
 
     4. **Attestation Generation**
-    The TEE generates CPU and GPU attestation reports that provide cryptographic proof of the environment's integrity and configuration.
+    Attestation reports provide evidence about the environment and its measured configuration.
 
-    5. **Cryptographic Signing:**
-    The TEE cryptographically signs both your original request and the inference results to ensure authenticity and prevent tampering.
+    5. **Response Signing:**
+    Supported flows can make a response signature available for integrity verification.
 
     6. **Verifiable Response:**
-    You receive the AI response along with cryptographic signatures and attestation data for independent verification.
+    Use [verification](/cloud/verification) to check the evidence required by your application. A response without an available signature is not response-verified.
 
 **Via Direct Completions (`{slug}.completions.near.ai`):**
 
     1. **Direct Request:**
-    You send chat completion requests via HTTPS directly to the model's subdomain. TLS terminates inside the model's TEE — there is no intermediate gateway.
+    You send chat completion requests via HTTPS directly to the model's subdomain, with no intermediate NEAR AI Cloud gateway in the request path. Use [direct TLS connection binding](/cloud/verification/direct/tls) when endpoint verification is required.
 
     2. **Secure Inference:**
     The model processes your request entirely within its TEE, where all data and model weights are protected by hardware-enforced isolation.
 
     3. **Attestation & Signing:**
-    The TEE generates attestation reports and cryptographically signs both your request and the inference results.
+    Attestation reports provide environment evidence; supported flows can make response signatures available for integrity verification.
 
     4. **Verifiable Response:**
-    You receive the response with cryptographic signatures. Only [model verification](/cloud/verification/model) is needed — no gateway attestation to check.
+    Use [direct model attestation](/cloud/verification/direct/model-attestation) for the direct endpoint. If response verification is required, also check that a signature is available and valid.
 
 ---
 
@@ -215,13 +215,13 @@ NEAR AI Cloud's private inference implements multiple layers of security to prot
   TEEs create isolated execution environments enforced at the hardware level, preventing unauthorized access to memory and computation even from privileged system administrators or cloud providers.
 
 - **Secure Communication** :
-All communication between your applications and the LLM infrastructure uses TLS encryption. Critically, TLS termination occurs inside the TEE—not at an external load balancer—so your prompts remain encrypted until they reach the secure enclave.
+All communication between your applications and the LLM infrastructure uses TLS encryption. Use the route-specific [verification guide](/cloud/verification) to verify endpoint binding for a particular connection when that property is required.
 
 - **Cryptographic Attestation** :
 Every TEE environment generates cryptographic proofs that verify the integrity of the execution environment, allowing you to independently confirm your computations occurred in a genuine, unmodified TEE.
 
 - **Result Authentication** :
-All AI outputs are cryptographically signed inside the TEE before leaving the secure environment, ensuring the authenticity and integrity of responses.
+When a response signature is available, it can be verified against the attested signer to check response integrity.
 
 ### Threat Protection
 
@@ -247,8 +247,8 @@ Cryptographic signatures generated inside the TEE ensure that responses cannot b
   <Card title="Verification" icon="file-check" href="/cloud/verification">
     Understand how to verify and validate secure interactions with AI models
   </Card>
-  <Card title="TLS Attestation Verification" icon="book-open" href="/cloud/verification/tls">
-    Verify that your HTTPS connection terminates inside the TEE using hardware-backed TLS attestation
+  <Card title="NEAR AI Cloud Gateway Verification" icon="book-open" href="/cloud/verification/cloud-api">
+    Verify gateway, model, TLS, and response evidence for requests sent through the NEAR AI Cloud gateway
   </Card>
   <Card title="E2EE Chat Completions" icon="book-open" href="/cloud/guides/e2ee-chat-completions">
     Add client-side encryption for defense-in-depth protection of your messages