refactor(attestation): drop dcap-qvl dependency from the attestation crate

[pbeza]

Closes #3621

Why

dcap-qvl (Intel TDX quote verification) is ~310 KB / ~21% of the mpc-contract WASM, pushing it toward NEAR's 1.5 MiB deployment cap (NEP-509). The plan (design doc) offloads DCAP to a standalone tee-verifier contract so mpc-contract can drop dcap-qvl. This PR is the prerequisite refactor — it doesn't move DCAP or shrink the WASM yet.

This is the first reviewable slice of #3540, which integrates the standalone tee-verifier contract into mpc-contract. That PR is too large to review in one pass, so it's being split into self-contained PRs that land one at a time.

What changed

Attestation::verify is split so the cryptographic DCAP step is separable from the post-DCAP policy checks (measurement allowlist, report-data binding, RTMR replay):

• verify_with_report(report, …) — post-DCAP checks against an already-verified VerifiedReport; no dcap-qvl. The contract will call this once DCAP runs in the verifier contract.
  

  mpc/crates/attestation/src/attestation.rs

  Line 131 in 231e48d

  pub fn verify_with_report(

• verify_locally(…) — full DCAP + post-DCAP in one call, behind the new local-verify feature; byte-identical signature to the old verify.
  

  mpc/crates/attestation/src/attestation.rs

  Line 160 in 231e48d

  pub fn verify_locally(

dcap-qvl becomes optional, so it's no longer in attestation's default build.

Two supporting changes:

• The per-variant verification logic that was inlined in the old Attestation::verify now lives on each variant: MockAttestation::verify(…) (no DCAP, so a Mock is verifiable without a VerifiedReport) and DstackAttestation::verify(…) via a DstackVerify trait.
  

  mpc/crates/mpc-attestation/src/attestation.rs

  Line 77 in 231e48d

  impl MockAttestation {

• The dcap_qvl ↔ tee-verifier-interface conversions move into a new tee-verifier-conversions crate (renamed from tee-verifier/src/conversions.rs), shared by the tee-verifier contract and the off-chain verify_locally path so the byte-layout pin tests live in one place instead of being duplicated.

Why local-verify exists

Some callers still need full local DCAP:

1. the node verifies its own quote before submitting:
   

   mpc/crates/node/src/tee/remote_attestation.rs

   Lines 105 to 113 in 9717045

   	attestation
   	.verify(
   	expected_report_data.into(),
   	now,
   	allowed_docker_image_hashes,
   	allowed_launcher_compose_hashes,
   	mpc_attestation::attestation::default_measurements(),
   	)
   	.map(|_| ())

2. tee-authority:
   

   mpc/crates/tee-authority/src/tee_authority.rs

   Lines 771 to 776 in 9717045

   	assert_eq!(
   	attestation
   	.verify(report_data.into(), timestamp_s, &[], &[], &[])
   	.is_ok(),
   	quote_verification_result
   	);

3. attestation-cli:
   

   mpc/crates/attestation-cli/src/verify.rs

   Lines 73 to 83 in 9717045

   	// Single verify call — same verification logic as the contract and node
   	let AcceptedAttestation {
   	attestation: verified_attestation,
   	advisory_ids,
   	} = attestation.verify(
   	report_data.into(),
   	timestamp_seconds,
   	&cli.allowed_image_hashes,
   	&[allowed_compose_hash],
   	&measurements,
   	)?;

local-verify is the opt-in that re-adds dcap-qvl for them (gating verify_locally):

mpc/crates/mpc-attestation/src/attestation.rs

Line 266 in 231e48d

#[cfg(feature = "local-verify")]

No behavior change (yet)

mpc-contract enables local-verify and still verifies locally via verify_locally (byte-identical to the old verify), so it links dcap-qvl and behaves exactly as before. The WASM only shrinks in the follow-up, when the contract switches to verify_with_report and drops local-verify.

[Copilot]

Pull request overview

Refactors the attestation verification APIs so DCAP cryptographic verification can be separated from post-DCAP policy checks, and makes dcap-qvl an optional dependency behind a new local-verify feature for off-chain/local verification.

Changes:

• Split verification into “post-DCAP only” (verify_with_report) vs “full local DCAP + post-DCAP” (verify_locally, behind local-verify) and updated call sites accordingly.
• Consolidated QuoteBytes/Collateral to tee-verifier-interface as the single source of truth, adding an off-by-default serde feature for input DTOs.
• Added dcap_conversions boundary for off-chain bridging between dcap-qvl types and interface DTOs, pinned by Borsh-layout tests.

Reviewed changes

Copilot reviewed 26 out of 27 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
crates/test-utils/src/attestation.rs	Adjust fixtures to build QuoteBytes directly and parse collateral via new helper.
crates/tee-verifier-interface/src/lib.rs	Add optional serde derives for verifier input types (QuoteBytes, Collateral).
crates/tee-verifier-interface/Cargo.toml	Introduce off-by-default serde feature with no_std-friendly serde dep config.
crates/tee-authority/src/tee_authority.rs	Update collateral conversion usage and switch verification call to verify_locally; adjust docs.
crates/tee-authority/Cargo.toml	Enable mpc-attestation/local-verify for off-chain local verification path.
crates/node/src/trait_extensions/convert_to_contract_dto.rs	Update collateral DTO mapping after collapsing collateral types.
crates/node/src/tee/remote_attestation.rs	Switch remote attestation validation to verify_locally.
crates/node/Cargo.toml	Enable mpc-attestation/local-verify for node usage.
crates/mpc-attestation/tests/test_attestation_verification.rs	Gate integration tests behind local-verify; add agreement test for split paths.
crates/mpc-attestation/src/report_data.rs	Gate DCAP-quote-parsing unit test behind local-verify; adjust fixture usage.
crates/mpc-attestation/src/lib.rs	Re-export dcap_conversions only when local-verify is enabled.
crates/mpc-attestation/src/attestation.rs	Introduce verify_with_report + verify_mock_only + verify_locally and shared helpers.
crates/mpc-attestation/Cargo.toml	Add local-verify feature and dev setup for tests that require it.
crates/contract/src/tee/tee_state.rs	Switch contract attestation verification call to verify_locally.
crates/contract/src/dto_mapping.rs	Update collateral DTO conversions for new single-source collateral type.
crates/contract/Cargo.toml	Enable mpc-attestation/local-verify so current sync contract path still links DCAP.
crates/attestation/tests/collateral.rs	Update tests to use new collateral parse helpers rather than type methods.
crates/attestation/src/quote.rs	Remove local QuoteBytes newtype; re-export from tee-verifier-interface.
crates/attestation/src/measurements.rs	Switch VerifiedReport dependency to tee-verifier-interface.
crates/attestation/src/lib.rs	Add dcap_conversions module behind local-verify.
crates/attestation/src/dcap_conversions.rs	New: explicit interface↔dcap conversions with Borsh-layout pin tests.
crates/attestation/src/collateral.rs	Remove local collateral newtype; re-export interface type + add JSON parse helpers (test-utils).
crates/attestation/src/attestation.rs	Split DCAP and post-DCAP; add verify_with_report + verify_locally + dcap_report (feature-gated).
crates/attestation/Cargo.toml	Make dcap-qvl optional behind local-verify; forward borsh-schema feature to interface.
crates/attestation-cli/src/verify.rs	Switch CLI to full local verification via verify_locally.
crates/attestation-cli/Cargo.toml	Enable mpc-attestation/local-verify for CLI verification.
Cargo.lock	Reflect new feature/dependency edges (including optional serde and dev self-deps).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[claude]

PR title type suggestion: This PR's primary change is dropping a dependency (dcap-qvl), which falls under the build type per conventional commits. Suggested title: build(attestation): drop dcap-qvl dependency from the attestation crate

[pbeza]

@claude review

[Copilot]

Pull request overview

Copilot reviewed 31 out of 32 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

crates/attestation/tests/collateral.rs:66

• These signatures are parsed from hex into raw bytes, so len() is in bytes. The assertions are fine, but the comments currently describe “64 hex chars (32 bytes)”, which doesn’t match the actual encoding (the fixture is 128 hex chars → 64 bytes). Updating the comments avoids confusion.

    // TCB info signature should be 64 hex chars (32 bytes)
    assert_eq!(collateral.tcb_info_signature.len(), 64);
    // QE identity signature should be 64 hex chars (32 bytes)
    assert_eq!(collateral.qe_identity_signature.len(), 64);

[claude]

Pull request overview

Refactor that prepares mpc-contract to drop its dcap-qvl dependency by splitting Attestation::verify into a DCAP step (gated behind a new local-verify feature) and a post-DCAP step that takes an already-verified report. Also moves the dcap-qvl ↔ tee-verifier-interface conversion code into a new shared tee-verifier-conversions crate so both the verifier contract and the off-chain verify_locally path use a single definition. No behavior change yet: every caller (including mpc-contract) still verifies locally via verify_locally and links dcap-qvl.

Changes:

• New methods on DstackAttestation / Attestation: verify_with_report (post-DCAP only) and verify_locally (full local DCAP + post-DCAP, behind local-verify); old verify removed.
• dcap-qvl becomes optional = true in attestation, gated by local-verify.
• attestation::Collateral and attestation::QuoteBytes become re-exports of tee-verifier-interface types; JSON parse helpers (collateral_from_str, collateral_from_json) moved out of Collateral impls into a parse module.
• New tee-verifier-conversions crate (renamed from tee-verifier/src/conversions.rs); traits become pub; adds collateral_from_dcap / collateral_into_dcap helpers.
• tee-verifier-interface gains an off-by-default serde feature on the input types (QuoteBytes, Collateral).
• Self-dependencies added to attestation and mpc-attestation dev-deps to exercise local-verify in tests; agreement test added between verify_with_report and verify_locally.

Reviewed changes

Per-file summary

File	Description
crates/attestation/src/attestation.rs	Split verify into verify_with_report + verify_locally (+ new dcap_report); switch helper signatures to tee-verifier-interface types.
crates/attestation/src/collateral.rs	Drop the local Collateral newtype; re-export from tee-verifier-interface; move JSON parsing into free functions.
crates/attestation/src/quote.rs	Re-export QuoteBytes from tee-verifier-interface.
crates/attestation/src/dcap_conversions.rs	New module re-exporting tee-verifier-conversions items under local-verify.
crates/attestation/src/measurements.rs	TryFrom<VerifiedReport> switched to the interface type.
crates/attestation/Cargo.toml	Make dcap-qvl optional behind local-verify; pull tee-verifier-interface with serde; self-dep dev-dep.
crates/attestation/tests/collateral.rs	Use the new free-function parse helpers.
crates/mpc-attestation/src/attestation.rs	Introduce MockAttestation::verify, DstackVerify extension trait, Attestation::verify_with_report, and feature-gated verify_locally; factor shared helpers (verify_dstack_mpc_hashes, accepted_dstack_attestation).
crates/mpc-attestation/src/report_data.rs	Gate DCAP-quote-parsing test behind local-verify.
crates/mpc-attestation/src/lib.rs	Re-export dcap_conversions under local-verify.
crates/mpc-attestation/Cargo.toml	Add local-verify feature; self-dep dev-dep with local-verify.
crates/mpc-attestation/tests/test_attestation_verification.rs	Gate file behind local-verify; add verify_with_report__should_agree_with_verify_locally.
crates/contract/src/{dto_mapping,tee/tee_state}.rs	Switch to verify_locally; collateral mapping uses the new struct directly.
crates/contract/Cargo.toml	Enable mpc-attestation/local-verify.
crates/node/src/tee/remote_attestation.rs, convert_to_contract_dto.rs, Cargo.toml	Switch to verify_locally; collateral mapping uses the new struct; enable local-verify.
crates/tee-authority/src/tee_authority.rs, Cargo.toml	Switch to verify_locally; use collateral_from_dcap / collateral_into_dcap; doc tweak about the 7-day collateral window.
crates/attestation-cli/src/verify.rs, Cargo.toml	Switch to verify_locally; enable local-verify.
crates/tee-verifier-conversions/{Cargo.toml,src/lib.rs}	New crate renamed from tee-verifier/src/conversions.rs; no_std; traits made pub; add collateral_from_dcap / collateral_into_dcap.
crates/tee-verifier/{Cargo.toml,src/lib.rs}	Depend on the new tee-verifier-conversions crate; drop the inline conversions module.
crates/tee-verifier-interface/{Cargo.toml,src/lib.rs}	Add off-by-default serde feature; derive Serialize/Deserialize on QuoteBytes / Collateral when enabled.
crates/test-utils/src/attestation.rs	Parse quote.json to Vec<u8> then wrap in QuoteBytes; parse collateral.json via the new collateral_from_str.
Cargo.toml, Cargo.lock	Register tee-verifier-conversions member; lockfile updates.

Findings

Blocking (must fix before merge):

• crates/tee-verifier-interface/src/lib.rs:14-20 — The crate-level docstring still asserts the crate is "Borsh-only on purpose" with the rationale "there is no JSON wire and serde would just add dependencies", and that "byte fields stay plain Vec<u8> / arrays rather than serde/hex wrappers". This PR adds an off-by-default serde feature on QuoteBytes and Collateral, which directly contradicts that paragraph. Per the project's documentation-alignment requirement ("Doc drift is a review-blocking issue, not a follow-up"), please update the module-level prose to mention the off-by-default serde feature on the input types and the invariant that the cross-contract Borsh ABI never enables it (you already have a good single-sentence version of this on the type-level #[cfg_attr] lines — lifting that up here would resolve the drift).

Non-blocking (nits, follow-ups, suggestions):

• crates/test-utils/src/attestation.rs:69-71 — The new comment says \"The verifier wire \QuoteBytes` is Borsh-only (no serde)", but after this PR QuoteBytesdoes have an optionalserdederive — it's just thattest-utilsdoesn't enable the feature. Consider rephrasing to e.g."this crate doesn't enable tee-verifier-interface/serde, so QuoteBytes has no Deserialize here — parse to Vec and wrap"` to avoid the same drift surfacing again later.
• crates/mpc-attestation/src/attestation.rs:235-262 — Attestation::verify_with_report requires &VerifiedReport even for the Mock variant where the report is ignored. The doc on the method acknowledges this and points callers at MockAttestation::verify, but the unified entry still forces Mock callers to fabricate an unused value. Worth a TODO(#…) linking the follow-up that introduces the contract's async dispatch (where Mock won't go through the verifier promise at all), so this transitional shape isn't load-bearing forever.
• crates/mpc-attestation/Cargo.toml (dev-deps) — dcap-qvl = { workspace = true } is now unconditional in dev-deps, but the only consumer is report_data.rs's test_from_str_valid which is gated #[cfg(feature = "local-verify")]. Since the self-dep already enables local-verify, this just makes the gating implicit; could be removed entirely (the self-dep would pull dcap-qvl transitively via attestation/local-verify) to keep the feature gating in one place.
• crates/contract/src/dto_mapping.rs:127-140, crates/node/src/trait_extensions/convert_to_contract_dto.rs:88-104 — Both TODO(#3494) comments anticipate the follow-up that lets the DTO carry tee-verifier-interface::Collateral directly. Good signposting; just make sure that issue is open and tracks deleting both call sites together.

⚠️ Issues found

[claude]

PR title type suggestion: Since the primary change is removing a dependency, the type prefix should be build: instead of refactor:
Suggested title: build(attestation): drop dcap-qvl dependency from the attestation crate

[Copilot]

Pull request overview

Copilot reviewed 31 out of 32 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (2)

crates/attestation/tests/collateral.rs:66

• The parsed tcb_info_signature / qe_identity_signature fields are Vec<u8> (decoded from hex), so this comment about “hex chars (32 bytes)” is misleading. The assertion value (64) matches the byte length for these ECDSA signatures; update the comment to reflect the actual units/encoding.

    // TCB info signature should be 64 hex chars (32 bytes)
    assert_eq!(collateral.tcb_info_signature.len(), 64);
    // QE identity signature should be 64 hex chars (32 bytes)
    assert_eq!(collateral.qe_identity_signature.len(), 64);

crates/tee-verifier-conversions/src/lib.rs:10

• This module doc says the crate needs dcap-qvl + tee-verifier-interface + borsh, but borsh is only used in the test suite (it’s a dev-dependency). Consider clarifying this to avoid implying borsh is required by downstream users of the conversions API.

[barakeinav1]

wrote some comments

[netrome]

Looks good to me. Didn't go deep as this doesn't seem to change any behavior. I second Barak's duplication concern but it's not a blocker imo.

[claude]

PR title type suggestion: This PR primarily removes a dependency (dcap-qvl) and updates code to reflect that change. The type prefix should probably be build: instead of refactor: — dependency changes fall under build-system concerns.

Suggested title: build(attestation): drop dcap-qvldependency from theattestation crate

[pbeza]

All nits addressed, @barakeinav1 @netrome. ✅

Feel free to take re-review/approve. cc @gilcu3 @kevindeforth if you’re up for reviewing too.

[gilcu3]

Thank you!

[gilcu3]

not sure I understand that comment, what conversion it refers to? in the diff what I see is that we are removing a conversion

[pbeza]

"This conversion" = the whole impl (the field-by-field mapping from the JSON DTO dtos::Collateral to the internal Collateral), not the line changed in the diff; that line just drops the old QuoteCollateralV3 wrapper.

Right now there are two Collateral types: the serde JSON one in near-mpc-contract-interface (dtos::Collateral) and the internal one (tee_verifier_interface::Collateral), so we need this impl to convert between them. #3494 removes the duplicate DTO so only one Collateral remains, at which point this impl is dead and can be deleted.