Follow-up to #407 (Azure SEV-SNP, hardware-validated). TDX is the remaining unvalidated platform, and cMCP's TDX path likely has the same Azure incompatibility SNP had.
Problem
cmcp_runtime/tee/tdx.py uses the direct /dev/tdx-guest ioctl and binds cMCP's nonce into the TD REPORTDATA. On Azure confidential VMs, Intel TDX also runs behind a paravisor, so (as with SEV-SNP #407) the guest likely cannot control REPORTDATA directly and the report is surfaced via the vTPM. The nonce (jwk_thumbprint || audit-root) would then need to ride an AK-signed vTPM quote, with the AK rooted in silicon by the TD report / quote — mirroring AzureCVMProvider.
Scope
- Determine Azure TDX's attestation surface (vTPM NV index vs
/dev/tdx-guest); build the collector path accordingly.
- Implement DCAP quote verification in
cmcp_verify.tdx: convert TDREPORT→Quote (QGS), verify the quote signature + PCK cert chain against a pinned Intel SGX/TDX root (Intel PCS collateral). This is the TDX analogue of the SNP VCEK chain.
- If Azure is vTPM-rooted, add an
azure-cvm-tdx platform value to agentrust-trace (mirrors the azure-cvm-sev-snp work) — or reuse the SNP-style envelope, TBD by the hardware finding.
- Env-gated real-vector test + live validation on real TDX silicon.
Provisioning
TDX is reachable for our Azure subscription in westeurope via EC*es_v6 (Emerald Rapids); the v5 DC*es_v5 SKUs only appear in the inaccessible EastUS2EUAP canary region.
Done when
TDX quote + Intel PCS chain verify against a report captured from real TDX hardware; verify_trace_claim supports TDX end to end; LIMITATIONS updated.
Related: agent-manifest#228 (same TDX gap on the SDK side).
Follow-up to #407 (Azure SEV-SNP, hardware-validated). TDX is the remaining unvalidated platform, and cMCP's TDX path likely has the same Azure incompatibility SNP had.
Problem
cmcp_runtime/tee/tdx.pyuses the direct/dev/tdx-guestioctl and binds cMCP's nonce into the TD REPORTDATA. On Azure confidential VMs, Intel TDX also runs behind a paravisor, so (as with SEV-SNP #407) the guest likely cannot control REPORTDATA directly and the report is surfaced via the vTPM. The nonce (jwk_thumbprint || audit-root) would then need to ride an AK-signed vTPM quote, with the AK rooted in silicon by the TD report / quote — mirroringAzureCVMProvider.Scope
/dev/tdx-guest); build the collector path accordingly.cmcp_verify.tdx: convert TDREPORT→Quote (QGS), verify the quote signature + PCK cert chain against a pinned Intel SGX/TDX root (Intel PCS collateral). This is the TDX analogue of the SNP VCEK chain.azure-cvm-tdxplatform value to agentrust-trace (mirrors theazure-cvm-sev-snpwork) — or reuse the SNP-style envelope, TBD by the hardware finding.Provisioning
TDX is reachable for our Azure subscription in westeurope via
EC*es_v6(Emerald Rapids); the v5DC*es_v5SKUs only appear in the inaccessible EastUS2EUAP canary region.Done when
TDX quote + Intel PCS chain verify against a report captured from real TDX hardware;
verify_trace_claimsupports TDX end to end; LIMITATIONS updated.Related: agent-manifest#228 (same TDX gap on the SDK side).