Local NitroTPM key-provider sealing now uses sha384:4,7,8,12,14 —
boot path (4/7/12), shared-disk MrConfigV3 (8), and the dstack event
lane at seal time (14). Seal runs after PCR8 measure and key-provider
events, so reboot unseal matches the same intermediate PCR14 state.

Wire unified os_image_hash + aws_measurement end-to-end:

- dstack-mr aws-measurement-cbor and assemble measurement.aws.cbor
- guest quote embeds sys-config vm_config when aws_measurement binds
  attested PCR4/7/12 (legacy PCR-hash fallback otherwise)
- dstack-cloud: platform=aws, prepare sys-config with aws_measurement,
  full EC2 lifecycle (AMI import, shared snapshot, run/stop/start/logs)
- remove standalone aws-ec2-import/smoke/attach scripts; docs point to
  dstack-cloud. Keep image audit + release-manifest helpers only.

UKI assemble always precomputes NitroTPM PCR4/7/12 into measurement.aws.cbor
and lists it in sha256sum.txt so digest.txt is fixed for the release.
Host nitro-tpm-pcr-compute is preferred; Docker AL2023 is fallback; missing
both fails the build. dstack-cloud prepare only embeds the release material
and refuses packages that lack a checksum-committed measurement.aws.cbor.

AwsOsImageMeasurement now holds sha256(PCR4||PCR7||PCR12) instead of the
three raw SHA384 PCR values, matching the legacy image-hash composition.
hex encoding uses serde_human_bytes (hex_bytes alias). Verifier and guest
quote compare digests; dstack-mr still takes PCR4/7/12 hex and folds them.

Drop panic from cbor_to_vec and the awkward context string parameter.
Callers attach context with .context("…") instead. to_cbor_vec,
from_cbor_slice, measurement_hash, from_measurement, decode_*, and
document verify now use anyhow::Result for a consistent error model.

On the AWS EC2 platform the attestation mode must be NitroTPM only.
Exposing TDX or SEV-SNP devices on an AWS instance must not silently
switch the attestation mode away from the AWS platform path.

The extra sha384(config_id) before the PCR8 extend added no security
(PCR extend already hashes) and hid the config id version byte behind a
second, non-obvious hash step for verifiers. Extend the raw 48-byte
config id directly so PCR8 = sha384(0^48 || config_id), letting a
verifier parse the claimed config id's version byte and recompute the
register in one step.

Also fix stale docs that still described the shared-disk MrConfigV3 /
UKI-cmdline model: the runbook and security-model checklist now state
the guest-computed MrConfig V2 id, and the dated AMI reproducibility
manifest gets a supersession note instead of rewriting its evidence.

the wrapper was a pure delegation to emit_runtime_event; call sites now
use the original name again, matching main.

Restore pre-existing, non-AWS code that had been refactored or churned but
was not required by the NitroTPM feature:

- nsm-qvl: revert cert-chain refactor (verify.rs) and lib.rs to base, keeping
  only the AWS-required #[serde(alias = "nitrotpm_pcrs")] on pcrs.
- tpm-attest/gcp_ak.rs: revert GCP-only quote refactor to base.
- kms proto: drop never-shipped GetAppKey v2 fields (9/10); revert
  AppKeyResponse construction to the direct form.
- kms/dstack-util: drop unused deps (aes-gcm, prost x2).
- dstack-types/mr_config: drop unused MrConfigV3::to_mr_config_id /
  mr_config_id_from_document scaffolding; keep the tdx_-named API.
- auth-simple: revert behavior-neutral empty-allowlist guard.
- SDK js/python: revert attestation-payload helper extraction; keep the new
  'attestation' response field.
- dstack-auth: drop stray comment.

Kept intentionally: dstack-types fallible CBOR refactor and the verifier
--verify-cert mode (per request). Skipped: tpm2 internal comment/test-rename
churn (interleaved with required AWS additions) and dstack-cloud (genuinely
AWS-refactored, help text updated for --platform).

decode_mr_aws_nitro_tpm_from_pcrs bound the quoted PCR14 against a
boot-mr-done-truncated replay when use_boottime_mr was set, so a full
runtime quote (PCR14 covering the whole event log) always failed with
'PCR14 mismatch'. This made KMS SignCert (the only caller passing
use_boottime_mr=true) unusable on AWS NitroTPM.

Align with the TDX (decode_mr_tdx_from_quote) and GCP (decode_mr_gcp_tpm)
architecture: the event-log-to-register binding always uses the full
replay, and the boot-time snapshot boundary is applied only to the MR
value. aws_nitro_tpm_verify_event_pcr now always binds the full replay
(boottime param dropped); decode replays the truncated snapshot
separately for mr_aggregated. The decode-side binding is kept as
defense-in-depth (KMS reject tests exercise it), matching AWS's existing
extra check rather than dropping it like TDX/GCP.

Rewrite the full-log replay test for the corrected semantics and add a
KMS regression test that a full runtime quote decoded with
use_boottime_mr=true succeeds and yields the boot-time snapshot MR.

…hortcut

PCR8 is not part of dstack's own verification path: the authoritative AWS
NitroTPM app-identity binding is the PCR14 event-log replay. PCR8 carries a
MrConfig V2 config commitment only so a lightweight third-party verifier can
confirm the compose hash and key-provider by recomputing
sha384(0^48 || config_id) instead of replaying the event log.

Several docs described PCR8 as a required verifier check. Reword them (and the
auth-simple README's mr_config_id mention) to present it as the optional
shortcut it is, and note that dstack's verifier and KMS do not check it.

run_cert_oneshot previously emitted app_info.os_image_hash under
is_valid:true without checking that it is bound to the attested boot
measurement, so a relying party reading the output could trust a host
claim. Add verify_cert_os_image_hash, which runs the existing
CvmVerifier::verify_os_image_hash binding and reports the result as
app_info.os_image_hash_verified.

The binding is self-contained (no image download) for AWS NitroTPM,
SEV-SNP, Nitro Enclave, GCP TDX, and TDX lite. TDX legacy would require
an image download that this oneshot cert mode does not perform, so it is
reported as os_image_hash_verified: false; use /verify for that path.

Document the new field in the verifier README and require
os_image_hash_verified == true in the AWS production runbook's jq check.

The FreshnessPolicy / verify_freshness_policy / details.freshness_verified
machinery was added by this PR and has no in-tree consumer: KMS key release is
replay-protected by the live RA-TLS handshake and timestamped signatures, and
the gateway authorizes over live RA-TLS connections. Freshness for the external
/verify path was an opt-in advisory field that nothing else depended on.

Remove the request FreshnessPolicy, the freshness_verified detail field,
verify_freshness_policy and its helpers (aws_nitro_tpm_report,
attestation_timestamp_ms, ensure_expected_bytes, ensure_attestation_max_age,
FRESHNESS_CLOCK_SKEW), and the four freshness tests. External /verify callers
that need liveness embed their own report_data challenge and check it against
the returned boot_info. Update the verifier README, verification.md, the AWS
production runbook, and the dated evaluation doc's supersession note.

reuse policy_tcb_fields when filling VerificationDetails so
details.tcb_status matches boot_info.tcbStatus (notably AWS NitroTPM,
which is normalized to "UpToDate" for the auth gate but surfaced as
null at the top level). also picks up the pending rustfmt import
reorder that broke CI.

the "legacy paths without aws_measurement use the value directly"
path no longer exists; aws_measurement is mandatory on AWS.

the KMS key-release pipeline gates non-SNP quotes through
CvmVerifier::verify_os_image_hash; pin down that the AWS path rejects
a vm_config without aws_measurement, accepts a unified vm_config bound
to the quoted PCRs, and rejects a boot_pcr_digest mismatch.

- audit-aws-ec2-image-hardening.sh: a supplied --rootfs-squashfs with
  no unsquashfs available is now a FAIL instead of WARN + exit 0
- generate-aws-ec2-release-manifest.sh: capture the audit exit status
  explicitly so a failing audit prints its output instead of silently
  aborting the manifest run under set -e

hop limit 2 lets processes behind the docker bridge fetch IMDSv2
tokens, exposing instance-role credentials to app containers when
iam_instance_profile is set. dstack itself never talks to IMDS, so
default metadata_hop_limit to 1 and leave 2 as an explicit opt-in for
deployments whose containers legitimately need the instance role.

generate_tpm_app_keys now fails closed on platforms whose TPM is not
part of the platform trust model; document that in the app-compose
key_provider field description.

drop the unpinned docker amazonlinux:2023 + dnf fallback from
assemble.sh: the computed PCRs feed measurement.aws.cbor ->
sha256sum.txt -> os_image_hash, i.e. the measurement the KMS and
verifiers enforce, so only a version-pinned operator-installed
nitro-tpm-pcr-compute may produce it.

release images and their evidence (sha256sum.txt, digest.txt,
measurement.aws.cbor, aws-pcrs.json) are produced by the unified
os/build.sh flow now, so drop generate-aws-ec2-release-manifest.sh and
the reproducibility-manifest doc written around it. rework the
production verifier runbook around the build.sh release package
(reproducible rebuild + pinned host tools for reference measurements)
and note the removal in the dated security evaluation. the hardening
audit script stays.

Trim the superseded security evaluation to the live threat model and property table, document the actual UKI archive and PCR sidecar layout, and remove stale recipient/fallback claims. Also simplify the certificate output and build fragments referenced by the updated runbook.

Drop the write-only AppInfo.attestation field and its backend, simulator, SDK, and documentation plumbing. GetQuoteResponse.attestation remains the platform-agnostic evidence field.

Parameterize GCP/AWS vm-config generation, reuse one shared-disk builder with required-file checks, and remove dead config serialization and save helpers. Correct all project-file diagnostics to app.json.

Restore the established string-error measurement API while using or_panic for invariant-only CBOR encoding. Consolidate TCB and key-release policy helpers, move AWS image-binding tests to the verifier, and remove redundant tests, dead accessors, and unrelated TPM/NSM diff noise.