feat(compute): AMD SEV-SNP hardware attestation adapter (K-HW, live run outstanding)

[gkalombo21]

Summary

K-HW — the first hardware-backed attestation adapter behind K's AttestationVerifier boundary: AMD SEV-SNP (snp-adapter-v1, hardware-attestation-v1). Refs #144 (the K-HW issue), #142 (K) and #140 (J).

Gate status, stated first: BLOCKED_NO_ACCESSIBLE_HARDWARE. The adapter, its real trust chain, its binding, its policy and its normalization are implemented and proven on real captured AMD EPYC Milan evidence. The live run — a SEV-SNP guest answering a fresh Mbongo challenge, verified, released, decrypted inside the guest — has not been performed: the development host is an Intel laptop with no SEV-SNP/TDX/CC-GPU capability, WSL exposes no guest device, and the only cloud credential is expired and would in any case require a paid confidential VM, a maintainer action. PROVIDER_RESISTANT_CONFIDENTIALITY_PROVEN stays NO until the live result is recorded in #144. The document, the INDEX row and the CI job all say so; nothing in this PR presents a skipped hardware run as a pass.

Backend selection (evidence-driven)

SEV-SNP is the only candidate with a fully offline verification path against vendor roots pinned in an official maintained library (VirTEE/AMD sev 8.0.0, crypto_nossl — builds on the Windows host without OpenSSL), a guest-chosen 64-byte REPORT_DATA inside the platform signature, explicit debug/migration policy bits, per-component TCB, and real captured reports publicly available for fixtures. TDX (collateral service), NVIDIA CC-GPU (needs H100 + CPU TEE; own memory boundary), Nitro (cloud format) are deferred behind the same trait; the laptop's TPM is rejected (host boot state only; the host still reads memory).

What is in the PR

• crates/mbongo-compute/src/confidential/snp.rs — SnpVerifier in two stages: (1) anchor resolution by BLAKE3 digest of the pinned ARK in the K trust policy, VCEK → ASK → ARK, report signature by the VCEK (official crate); (2) REPORT_DATA == SHA-512(domain || challenge_id || nonce || session_id || executor || task_id || purpose || environment_public_key), chip denylist, VMPL, debug, migration, SMT, report version, per-component reported and current TCB minimums, guest SVN, measurement allowlist/revocation over BLAKE3 of the 48-byte launch measurement, bounded report window, VCEK X.509 validity — then normalization into K's VerifiedAttestation with HARDWARE_ATTESTED. No test root exists in the adapter; production_grade() is a function of policy strictness. Three negative-control verifiers live only for tests.
• test-vectors/attestation/snp/ — a real Milan report + its VCEK (Google go-sev-guest, Apache-2.0, commit 609f29a2) and a second Milan VCEK (VirTEE); provenance and SHA-256 in the README. No secrets: reports and VCEKs are public material.
• tests/hardware_attestation.rs — 18 tests on captured evidence and unsigned stage-2 copies (parse, chain, signature tamper ×5, untrusted/wrong/revoked anchor, other chip, chip denylist, real debug-allowed guest refused by a production policy, SMT/VMPL/version, measurement allowlist, TCB and SVN component-wise, windows and certificate validity, binding derivation over every field, session/executor/task/key substitution, normalization, J CONFIDENTIAL eligibility, key wrap to the bound key only, redacted renderings, reference root never accepted, K suite unchanged, negative controls caught) + 1 #[ignore]d live test.
• src/bin/snp_live_test.rs — the live harness (Linux only; RESULT=SKIPPED_NO_HARDWARE, exit 3, elsewhere): session → lease → challenge → guest-generated X25519 key → real report from /dev/sev-guest with the bound REPORT_DATA → VCEK from the extended report → strict verifier → J → release → wrapped key → decrypt inside the guest → REAL_* lines. Type-checked on Linux in a container.
• docs/architecture/compute-hardware-attestation-adapter.md — NORMATIVE, non-consensus, 23 sections: selection matrix, security boundary (CPU memory yes, GPU no), trust chain, binding, environment-key binding, measurement mapping, TCB policy and freshness dimensions, collateral/revocation, adapter and failure taxonomy, normalization, J and key-release integration, the real-hardware test record, failure semantics, privacy, known limitations (durability gap), production-readiness classification, invariants HW1–HW44, future adapters. Indexed.
• CI: unit step Mbongo Compute Hardware Attestation in the checks job; a gated job Mbongo Compute Hardware Attestation (live, SEV-SNP) that runs only on a self-hosted sev-snp runner when MBONGO_SNP_LIVE_RUNNER == 'true', otherwise skipped (never green).
• K's VerifyError gains five classes additively (ExpiredCollateral, PlatformStateUnacceptable, RevokedPlatform, VendorServiceUnavailable); nothing else in K changes; confidential-auth-v1 30/30 unchanged.

Preserved

ComputeTask, Receipt, rpc_v0.3, SDK wire, RFC 0005/0002, lock v0.4, compute-conformance-v1 (38/38), J semantics (41/41), K's release state machine, suite and reference verifier: all byte-identical to d2bd1429 (52 protected blobs). PUBLIC unchanged (reference harness, v0.4 vertical). No GPU execution, AI inference, metering, pricing, MBO, marketplace. Cargo.lock gains the sev dependency tree (31 crates); no protocol crate changes.

Verification

Local at the source: fmt, clippy -D warnings (Windows and Linux container), workspace tests, replay harness, reference harness, conformance 38/38, provider policy 41/41, confidential authorization 30/30, hardware attestation 18 passed / 1 ignored, SDK typecheck/tests/build, v0.4 vertical PASS, git diff --check; 45 links and 46 distinct citations resolve; INDEX integrity; LF endings; workflow YAML parses.

🤖 Generated with Claude Code