docs and SDK follow-up for AWS NitroTPM simplify

- UKI/tools: document no per-app mr_config_id in cmdline; config via PCR8
- auth-simple: KMS allowlist is mrAggregated-only; fix examples and tests
- SDKs (Rust/Python/JS/Go/curl): drop GetQuote/Attest attestation_options
- production runbook + security-model: PCR8 config, single PCR14 event lane,
  no recipient v2; security-eval banner for superseding historical sections

Author: kvinwang

docs/aws-attested-instance-security-evaluation.md

@@ -1,5 +1,14 @@
 # AWS EC2 Instance Attestation Security Evaluation
 
+> **Current model (post-simplify, PR #753):** App/config is **not** embedded
+> in UKI cmdline. Shared-disk `MrConfigV3` is measured into **PCR8**. All dstack
+> events extend **SHA384 PCR14** only (TDX RTMR3 analogue; no PCR23 runtime
+> split). `os_image_hash` prefers unified `sha256(sha256sum.txt)` via
+> `VmConfig.aws_measurement`. GetAppKey is RA-TLS v1 only (no recipient v2).
+> KMS auth pins early **`mrAggregated`** only. Historical sections below that
+> describe cmdline `dstack.mr_config_id`, PCR23 runtime, recipient encryption,
+> or `kms.composeHashes` are superseded by this model.
+
 Date: 2026-07-03
 
 This note compares dstack attestation with AWS EC2 instance

docs/aws-ec2-production-verifier-runbook.md

@@ -151,22 +151,26 @@ PCR12: 0000000000000000000000000000000000000000000000000000000000000000000000000
 UKI AuthentiCode SHA256: <uki-authenticode-sha256>
 ```
 
-For a dynamic app package, use the deployment-specific manifest instead. It adds
-the app package's measured `dstack.mr_config_id` alongside its own boot PCR set:
+For a dynamic app package, the **UKI/AMI stays generic**. App/config identity is
+on the shared disk (`MrConfigV3` in `.sys-config.json` / host-shared) and is
+measured into **PCR8** at guest setup (not embedded as `dstack.mr_config_id` in
+the UKI cmdline). Record the expected config id and shared-disk hash in the
+deployment-specific release package:
 
 ```text
-dstack_os_image_hash: <os-image-hash>
-PCR4: <pcr4>
-PCR7: <pcr7>
-PCR12: 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
-UKI AuthentiCode SHA256: <uki-authenticode-sha256>
-dstack.mr_config_id: <mr-config-id>
+dstack_os_image_hash: <os-image-hash>   # prefer sha256(sha256sum.txt) + aws_measurement
+PCR4/PCR7/PCR12: <boot PCRs for the AMI UKI>
+PCR8: <sha384 extend of MrConfigV3 config id from shared disk>
+PCR14: <event-log replay; early pin uses boot-mr-done cutoff>
+shared MrConfigV3 document hash / config id: <mr-config-id>
 ```
 
 ## 3. Verify Attestation Freshness
 
 Production challenge-response verification must use a non-empty freshness
-policy. The verifier rejects empty freshness objects.
+policy. The verifier rejects empty freshness objects. Challenge binding uses
+**report_data → NitroTPM user_data** (same role as TDX/GCP); there is no
+GetAppKey recipient `public_key` / v2 encryption path.
 
 Example verifier request shape:
 
@@ -175,8 +179,6 @@ Example verifier request shape:
   "attestation": "hex-encoded-dstack-attestation",
   "freshness": {
     "expected_report_data": "hex-encoded-64-byte-challenge",
-    "expected_nonce": "hex-encoded-nitrotpm-nonce",
-    "expected_public_key": "hex-encoded-nitrotpm-recipient-public-key",
     "max_age_seconds": 300
   }
 }
@@ -216,13 +218,14 @@ The relying party should then check `details.boot_info` against its auth policy.
 For AWS NitroTPM, the policy must require:
 
 - accepted `tcbStatus` (`UpToDate` by default, matching the normalized value);
-- accepted `osImageHash`;
+- accepted `osImageHash` (unified `sha256(sha256sum.txt)` when `aws_measurement`
+  is present; otherwise legacy PCR-derived hash);
 - accepted app `composeHash` and `appId`;
-- accepted KMS identity, preferably stable KMS `composeHash` plus OS image for
-  allow-any-device deployments;
-- verified PCR14-derived `mrAggregated`;
-- recipient-key binding for key release;
-- non-empty freshness verification for external verifier flows.
+- accepted KMS identity via **early `mrAggregated`** (boot-mr-done), same as
+  bare TDX — not `kms.composeHashes`;
+- verified PCR14 event-log replay (single event lane; no PCR23 runtime split);
+- verified PCR8 config commitment against shared-disk MrConfigV3;
+- non-empty freshness via `report_data` for external verifier flows.
 
 The `attestationMode` field is carried in the verified boot info for
 observability; a relying party may additionally assert

docs/security/security-model.md

@@ -43,7 +43,7 @@ Infrastructure operators can still deny service. They can shut down your workloa
 | Firmware and boot path | Boot measurement | TDX/SNP MRTD and RTMR0-2, or AWS NitroTPM PCR4/PCR7/PCR12 |
 | OS image | Reproducible image measurement | dstack OS image hash and platform reference measurements |
 | Application launch identity | Event-log replay | RTMR3 on TDX-family platforms, SHA384 PCR14 on AWS NitroTPM |
-| Application runtime telemetry | Event-log replay when policy requires it | RTMR3 on TDX-family platforms, SHA384 PCR23 on AWS NitroTPM |
+| Application runtime telemetry | Event-log replay when policy requires it | RTMR3 on TDX-family platforms; SHA384 PCR14 on AWS NitroTPM (same event lane as launch; TDX RTMR3 analogue) |
 
 ### Isolation
 
@@ -90,7 +90,7 @@ dstack implements layered verification from platform hardware to application ide
 
 **Application launch layer.** Your application launch identity includes the compose-hash, app ID, instance ID, key-provider identity, and OS image hash. On TDX-family platforms, dstack extends those events into RTMR3. On AWS NitroTPM, dstack extends those launch events into non-resettable SHA384 PCR14 and treats `system-ready` as the launch boundary. Each container image must use SHA256 digest pinning. This proves which normalized container configuration was authorized before key release.
 
-**Runtime telemetry layer.** Application-owned runtime events remain available after launch. On AWS NitroTPM, those events use PCR23, which is resettable and must not gate pre-secret launch authorization. Treat PCR23 as runtime telemetry unless a workload-specific policy explicitly verifies it.
+**Runtime telemetry layer.** Application-owned runtime events remain available after launch. On AWS NitroTPM they extend the same SHA384 PCR14 event lane as OS launch events (like TDX RTMR3). Policy may still treat `system-ready` as a logical boundary when interpreting the event log; there is no separate PCR23 runtime split.
 
 **Key management layer.** The KMS root CA public key hash is recorded as the key-provider launch event. This binds your workload to a specific KMS instance. The KMS itself runs with its own attestation evidence, so you can verify the KMS the same way you verify any workload.
 
@@ -153,7 +153,7 @@ Use this checklist to verify a workload running in a dstack CVM.
 - [ ] compose-hash matches your docker-compose
 - [ ] All images use SHA256 digests (no mutable tags)
 - [ ] Launch event log replays correctly (RTMR3 on TDX-family platforms, PCR14 on AWS NitroTPM)
-- [ ] `mr_config_id` matches the expected app/config target when the platform uses measured config IDs
+- [ ] Config commitment matches the expected app/config target (TDX `mr_config_id` / SEV `HOST_DATA` / AWS PCR8 from shared-disk MrConfigV3)
 - [ ] reportData contains your challenge (replay protection)
 
 **Key management verification:**

dstack/kms/auth-simple/README.md

@@ -21,15 +21,15 @@ bun install
 Create `auth-config.json` (see `auth-config.example.json`).
 
 For KMS deployment, you must allowlist the OS image hash and at least one KMS
-identity value. Use `kms.composeHashes` for stable KMS app identity, especially
-on AWS NitroTPM where `mrAggregated` includes per-instance key-provider state.
-Use `kms.mrAggregated` when you want to pin an exact aggregate MR.
+identity value via `kms.mrAggregated` (the early/boot-mr-done aggregate MR,
+same pinning model as bare TDX). App compose hashes still use
+`apps.<appId>.composeHashes`.
 
 ```json
 {
   "osImages": ["0x0b327bcd642788b0517de3ff46d31ebd3847b6c64ea40bacde268bb9f1c8ec83"],
   "kms": {
-    "composeHashes": ["0x<kms-compose-hash>"],
+    "mrAggregated": ["0x<kms-early-mr-aggregated>"],
     "allowAnyDevice": true
   },
   "apps": {}
@@ -45,8 +45,7 @@ Add more fields as you deploy Gateway and apps:
   "allowedAdvisoryIds": [],
   "gatewayAppId": "0x...",
   "kms": {
-    "composeHashes": ["0x..."],
-    "mrAggregated": [],
+    "mrAggregated": ["0x..."],
     "devices": [],
     "allowAnyDevice": true
   },
@@ -64,18 +63,16 @@ Add more fields as you deploy Gateway and apps:
 
 AWS NitroTPM has no TDX/SNP-style TCB advisory surface, so the KMS normalizes a
 verified NitroTPM attestation to `tcbStatus: "UpToDate"` before calling
-auth-simple; no mode-specific TCB handling is needed here. Use the OS image hash
-plus KMS/app compose hashes for stable policy, since `mrAggregated` includes
-per-instance key-provider state. Use `mrAggregated` only when you want to pin one
-exact instance measurement.
+auth-simple. Pin KMS via early `mrAggregated` (boot-mr-done snapshot), same as
+bare TDX. Prefer a stable AMI/`os_image_hash` and empty TPM key-provider id so
+that early MR is precomputable.
 
 ```json
 {
   "osImages": ["0x<aws-os-image-hash>"],
   "allowedAdvisoryIds": [],
   "kms": {
-    "composeHashes": ["0x<kms-compose-hash>"],
-    "mrAggregated": [],
+    "mrAggregated": ["0x<kms-early-mr-aggregated>"],
     "devices": [],
     "allowAnyDevice": true
   },
@@ -103,8 +100,7 @@ not verify raw NitroTPM evidence by itself.
 | `gatewayAppId` | No | Gateway app ID (add after Gateway deployment) |
 | `allowedTcbStatuses` | No | Allowed verifier-derived TCB status strings. Defaults to `["UpToDate"]`; non-up-to-date SNP/TDX statuses remain fail-closed unless explicitly allowlisted for testing. |
 | `allowedAdvisoryIds` | No | Advisory IDs permitted in `advisoryIds`. Defaults to `[]`, which rejects any advisory. |
-| `kms.composeHashes` | Required if `kms.mrAggregated` is empty | Allowed KMS compose hashes. Use this for stable KMS app identity. |
-| `kms.mrAggregated` | Required if `kms.composeHashes` is empty | Allowed KMS aggregate MR values. Use this for exact MR pinning. |
+| `kms.mrAggregated` | Yes | Allowed KMS early aggregate MR values (boot-mr-done). |
 | `kms.devices` | No | Allowed KMS device IDs |
 | `kms.allowAnyDevice` | No | If true, skip device ID check for KMS |
 | `apps.<appId>.composeHashes` | No | Allowed compose hashes for this app |
@@ -211,9 +207,7 @@ KMS boot authorization.
 2. Every `advisoryIds` entry must be listed in `allowedAdvisoryIds` (default: none allowed)
 3. `osImageHash` must be in `osImages` array
 4. At least one KMS identity allowlist must be configured:
-   - `kms.composeHashes`, for stable KMS app identity such as AWS NitroTPM where `mrAggregated` can include per-instance key-provider state
-   - `kms.mrAggregated`, for exact aggregate-MR authorization
-5. Every configured KMS identity allowlist must match. If both `kms.composeHashes` and `kms.mrAggregated` are non-empty, both are enforced.
+   - `kms.mrAggregated` early/boot-mr-done aggregate MR (required)
 6. `deviceId` must be in `kms.devices` unless `allowAnyDevice` is true
 
 ### App Boot Validation

dstack/kms/auth-simple/auth-config.example.json

@@ -3,11 +3,8 @@
     "0x0b327bcd642788b0517de3ff46d31ebd3847b6c64ea40bacde268bb9f1c8ec83"
   ],
   "kms": {
-    "composeHashes": [
-      "0x<kms-compose-hash>"
-    ],
     "mrAggregated": [
-      "0x<kms-mr-aggregated>"
+      "0x<kms-early-mr-aggregated-boot-mr-done>"
     ],
     "devices": [],
     "allowAnyDevice": true

dstack/kms/auth-simple/index.test.ts

@@ -238,62 +238,9 @@ describe('auth-simple', () => {
       const json = await res.json();
 
       expect(json.isAllowed).toBe(false);
-      expect(json.reason).toContain('identity');
-    });
-
-    it('allows KMS boot with a stable compose hash identity', async () => {
-      writeTestConfig({
-        gatewayAppId: '0xgateway',
-        osImages: ['0x1fbb0cf9cc6cfbf23d6b779776fabad2c5403d643badb9e5e238615e4960a78a'],
-        kms: {
-          composeHashes: ['0xcompose456'],
-          allowAnyDevice: true
-        }
-      });
-
-      const res = await app.fetch(new Request('http://localhost/bootAuth/kms', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ ...baseBootInfo, mrAggregated: '0xinstanceboundmr' })
-      }));
-      const json = await res.json();
-
-      expect(json.isAllowed).toBe(true);
-      expect(json.reason).toBe('');
+      expect(json.reason).toContain('MR');
     });
 
-    it('requires all configured KMS identity allowlists to match', async () => {
-      writeTestConfig({
-        gatewayAppId: '0xgateway',
-        osImages: ['0x1fbb0cf9cc6cfbf23d6b779776fabad2c5403d643badb9e5e238615e4960a78a'],
-        kms: {
-          composeHashes: ['0xcompose456'],
-          mrAggregated: ['0xabc123'],
-          allowAnyDevice: true
-        }
-      });
-
-      const wrongCompose = await app.fetch(new Request('http://localhost/bootAuth/kms', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ ...baseBootInfo, composeHash: '0xwrong' })
-      }));
-      expect((await wrongCompose.json()).isAllowed).toBe(false);
-
-      const wrongMr = await app.fetch(new Request('http://localhost/bootAuth/kms', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ ...baseBootInfo, mrAggregated: '0xwrong' })
-      }));
-      expect((await wrongMr.json()).isAllowed).toBe(false);
-
-      const matching = await app.fetch(new Request('http://localhost/bootAuth/kms', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify(baseBootInfo)
-      }));
-      expect((await matching.json()).isAllowed).toBe(true);
-    });
 
     it('allows KMS boot with allowAnyDevice', async () => {
       writeTestConfig({

dstack/kms/auth-simple/index.ts

@@ -36,7 +36,6 @@ const AppConfigSchema = z.object({
 
 const KmsConfigSchema = z.object({
   mrAggregated: z.array(z.string()).default([]),
-  composeHashes: z.array(z.string()).default([]),
   devices: z.array(z.string()).default([]),
   allowAnyDevice: z.boolean().default(false)
 });

os/yocto/layers/meta-dstack/recipes-core/images/dstack-uki.bb

@@ -18,7 +18,10 @@ INITRAMFS_FSTYPES = "cpio.gz"
 # Kernel settings
 KERNEL_IMAGETYPE = "bzImage"
 
-# Base kernel cmdline (verity hash added dynamically)
+# Base kernel cmdline (verity hash added dynamically).
+# Do NOT embed per-app dstack.mr_config_id here: AWS app/config binding is
+# measured from the shared-disk MrConfigV3 into NitroTPM PCR8 at guest setup,
+# so the UKI/AMI stays app-independent (PCR4 is OS-only).
 UKI_CMDLINE_BASE = "console=ttyS0 init=/init panic=1 net.ifnames=0 biosdevname=0 \
 mce=off oops=panic pci=noearly pci=nommconf random.trust_cpu=y random.trust_bootloader=n \
 tsc=reliable no-kvmclock"

os/yocto/tools/README.md

@@ -10,6 +10,9 @@ the guest-OS backend interface; the supported build entrypoint is
 - `aws/` contains AWS EC2 NitroTPM image validation, AMI promotion, live-smoke,
   and release-evidence helpers. These scripts are Yocto OS artifact consumers,
   so they stay with the backend rather than in the repository-wide `tools/`.
+  App/config binding for AWS is **not** baked into the UKI cmdline; release
+  packages should ship a shared-disk MrConfigV3 (measured into PCR8 at boot)
+  and optional `aws_measurement` for unified `os_image_hash`.
 
 The legacy cross-cutting helpers live under [`../../../tools/`](../../../tools/)
 instead of inside this backend.

sdk/curl/api.md

@@ -118,22 +118,14 @@ Generates a quote with given plain report data. For platform-agnostic verificati
 | Field | Type | Description | Example |
 |-------|------|-------------|----------|
 | `report_data` | string | Report data of max length 64 bytes. Padding with 0s if less than 64 bytes. | `"1234deadbeaf"` |
-| `attestation_options.aws_nitro_tpm.nonce` | string | Optional AWS EC2 NitroTPM attestation document nonce, hex-encoded. Only valid on `dstack-aws-nitro-tpm`. | `"001122"` |
-| `attestation_options.aws_nitro_tpm.public_key` | string | Optional AWS EC2 NitroTPM attestation document public key, hex-encoded. Only valid on `dstack-aws-nitro-tpm`. | `"deadbeef"` |
 
 **Example:**
 ```bash
 curl --unix-socket /var/run/dstack.sock -X POST \
   http://dstack/GetQuote \
   -H 'Content-Type: application/json' \
   -d '{
-    "report_data": "1234deadbeaf",
-    "attestation_options": {
-      "aws_nitro_tpm": {
-        "nonce": "001122",
-        "public_key": "deadbeef"
-      }
-    }
+    "report_data": "1234deadbeaf"
   }'
 ```
 Or
@@ -272,22 +264,14 @@ You can submit the returned `attestation` directly to the verifier `/verify` end
 | Field | Type | Description | Example |
 |-------|------|-------------|----------|
 | `report_data` | string | Report data of max length 64 bytes. Padding with 0s if less than 64 bytes. | `"1234deadbeaf"` |
-| `attestation_options.aws_nitro_tpm.nonce` | string | Optional AWS EC2 NitroTPM attestation document nonce, hex-encoded. Only valid on `dstack-aws-nitro-tpm`. | `"001122"` |
-| `attestation_options.aws_nitro_tpm.public_key` | string | Optional AWS EC2 NitroTPM attestation document public key, hex-encoded. Only valid on `dstack-aws-nitro-tpm`. | `"deadbeef"` |
 
 **Example:**
 ```bash
 curl --unix-socket /var/run/dstack.sock -X POST \
   http://dstack/Attest \
   -H 'Content-Type: application/json' \
   -d '{
-    "report_data": "1234deadbeaf",
-    "attestation_options": {
-      "aws_nitro_tpm": {
-        "nonce": "001122",
-        "public_key": "deadbeef"
-      }
-    }
+    "report_data": "1234deadbeaf"
   }'
 ```
 Or