feat: Phala TDX attestation trust-root for agent-challenge (validator/master, offline-validated)#39
Merged
Merged
Conversation
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (37)
📝 WalkthroughWalkthroughThis change adds an opt-in Agent Challenge Phala Intel TDX attestation path, strict proof and quote verification, fail-closed proxy routing, replay-audit orchestration, and extensive unit and integration coverage while preserving legacy flag-off behavior. ChangesAgent Challenge Phala attestation and replay audit
Estimated code review effort: 5 (Critical) | ~120 minutes Sequence Diagram(s)sequenceDiagram
participant Challenge
participant PublicProxy
participant Master
participant Validator
participant DCAPQVL
Challenge->>PublicProxy: Submit allowlisted signed review/eval request
PublicProxy->>Master: Forward canonical request and sanitized headers
Master->>Validator: Assign R=1 Agent Challenge work
Validator->>DCAPQVL: Verify Phala TDX quote
DCAPQVL-->>Validator: Return quote verdict or unavailable status
Validator-->>Master: Return validated execution result
Master-->>Challenge: Forward accepted replay or evaluation result
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Add the foundational Phala tier to the shared ExecutionProof envelope so the
image emitter (M1) and validator/master verifier (M4) share one canonical
schema (architecture.md sec 6/9):
- schemas/worker.py: PHALA_TDX_TIER constant ('phala-tdx'); PhalaMeasurement
(mrtd, rtmr0-3, compose_hash, os_image_hash) with canonical() static subset;
PhalaAttestation payload (tdx_quote, event_log, report_data, measurement,
vm_config) accepting the tdx_quote_b64/report_data_hex aliases. Widen
ExecutionProof.tier to int | str so it carries the Phala value; tier 0/1/2
behavior is unchanged.
- worker/proof.py: phala_report_data / phala_report_data_hex (sec-6 binding,
sorted task_ids, rtmr3 excluded, 64-byte left-aligned field) and
build_phala_execution_proof (reuses build_execution_proof; keeps the tier-0
worker signature so verify_execution_proof still validates it).
No fork of the envelope; quote verification is layered on later (M4).
Assert phala_report_data/_hex against a fixed input -> expected 64-byte hex that agent-challenge's self-contained sec-6 replica asserts against too, so the two implementations cannot silently drift (VAL-IMG-012).
Validate the exact attested-result envelope the agent-challenge canonical image emits against base's real ExecutionProof/PhalaAttestation models, and assert per-field omission is rejected. Drift guard for VAL-IMG-025/026 (mirrors the report_data golden-vector pin).
… test Correct the type: ignore code from [union-attr] to [attr-defined] on the GOLDEN_EMITTED_ENVELOPE['attestation'].items() access; mypy infers the value as object (attr-defined), so the milestone typecheck gate (uv run mypy src tests) was failing. No behavior change.
… reject tamper, park on outage) Extend verify_execution_proof with a Phala-tier verifier (VAL-VERIFY-001..014): DCAP sig/TCB via QuoteVerifier (dcap-qvl), measurement reconstructed from the signed quote + event-log RTMR3 replay checked against a validator-owned allowlist, report_data bound to the validator's expected (agent_hash, sorted task_ids, scores_digest, fresh single-use nonce), and tier-0 worker signature still enforced (no cross-unit replay). A transient verifier outage raises VerifierUnavailableError so the caller parks (never accepts, never fraud-rejects). The agent_challenge adapter rebinds the lean image's placeholder worker_signature to the ingesting unit; trust root remains the attestation.
…e units (flag ON)
…rifier never invoked)
…ion [VAL-VERIFY-025/027]
…TDX quote golden vector M4 verify-weights scrutiny robustness follow-ups (phala_quote.py): 1. DcapQvlVerifier.verify: a returncode==0 invocation whose stdout is unparseable / non-JSON / missing a TCB status is a dcap-qvl *tooling* regression, not a fraud verdict. Map it to VerifierUnavailableError (PARK, retryable) instead of QuoteVerificationError (permanent reject), so a tooling regression cannot permanently fraud-reject a legitimate result. Genuine invalid-quote/bad-TCB (nonzero exit) still permanently rejects; timeout / missing-binary / subprocess error still parks. Never accept-any. 2. Cross-repo anti-drift: pin a shared golden TDX quote/measurement/RTMR3 vector (fixed quote + event-log bytes -> expected MRTD/RTMR0-3/os_image_hash/RTMR3 compose-hash) as a byte-identical fixture asserted here and in agent-challenge (tests/test_quote_golden_vector.py). A one-sided offset/hash tweak to either parser diverges from the pinned values and fails a test on that side.
…rity Offline complements to the agent-challenge cross-integration suite: the master keeps attested agent-challenge units at replication factor 1 with no worker-plane reconcile (a sibling prism gpu unit still replicates to R=2, so the result is non-vacuous), and the TDX quote/report_data/measurement survive the challenge<->BASE JSON boundary and validator tier-0 rebind byte-for-byte (a single flipped byte / re-encoded report_data breaks it). Uses a deterministic in-test signer to keep bittensor's import-time logging reconfiguration out of the module. Covers VAL-CROSS-003 and VAL-CROSS-007 (base leg).
The scheduler error-log test only restored the logger's .disabled flag, so a bittensor import (forces existing loggers to CRITICAL) or alembic fileConfig (logging.disable) run earlier in the process silenced the ERROR record and failed the test only in the full alphabetical suite. Snapshot and neutralize logging.disable, the scheduler logger's .disabled/.level/.propagate in a fixture, capture on its own logger, then restore. Assertions unchanged (a compute raise is logged and the schedule keeps ticking).
…-021) With the flag OFF the master bridges an attested agent-challenge submission exactly like legacy: cpu units at R=1, no worker plane / reconciliation, and the legacy reassign-on-failure (never replicate) path (owner crash -> revert -> reassign to a different validator, +1 attempt, zero worker replicas). The sibling gpu R=2 replica in VAL-CROSS-003 keeps this non-vacuous. bittensor-free (reuses the file's fixtures) to avoid the supervisor-weights log-test ordering hazard.
Replace the attested agent-challenge deny-list residual fallthrough with an explicit enabled-mode allowlist so capability, assignment, evidence, key-release, direct-result, and results aliases 404 before any upstream call while status, events, benchmark, and signed review/eval routes remain forwardable.
Align EVAL_MAX_VM_CONFIG_BYTES with contract eval_result_max_vm_config_bytes and exercise the one-over budget via closed three-field encoding.
Mirror agent-challenge: live TDX quote hex is not a path argument for dcap-qvl and trips "File name too long" when passed on argv.
…ted) Assert full-attested mode creates zero agent-challenge master assignment/ replica rows (empty challenge work feed), while sibling prism GPU R=2 stays non-vacuous for the worker plane.
Call out Phala-tier proof carry, R=1 for attested units, and public-proxy deny rules so agent-challenge result routes stay challenge-direct.
Document BASE-owned ExecutionProof Phala tier, failing-closed public proxy allowlist, R=1 full-attested path, and security residual risks without inventing challenge-side behavior.
Keep Phala-tier verifier functions while using main's challenge_sdk proof helpers after the rebase onto Swarm main.
Use digest-pinned challenge images and current assignment core fields after rebasing Phala attestation commits onto main.
echobt
force-pushed
the
mission/phala-attest
branch
from
b0d1cb4 to
c4ec5c0
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Base-side (validator / master) integration for the Phala TEE (Intel TDX) attestation-rooted agent-challenge evaluation. This is the trust-root half of the cross-repo change whose miner/enclave half lives in
BaseIntelligence/agent-challenge(branchmission/phala-attest, available after PR merge).What's included (offline-validated)
src/base/schemas/worker.py,src/base/worker/proof.py) — new attestation payload{tdx_quote, event_log, report_data, measurement{mrtd,rtmr0-3,compose_hash,os_image_hash}, vm_config}+ single-sourcephala_report_databinding (tagbase-agent-challenge-v1). Existing tier-0/1/2 behavior unchanged.src/base/worker/phala_quote.py,phala_verify.py) — TDX quote parse, RTMR3 event-log replay, DCAP verify with park-vs-reject split;MeasurementAllowlist(fail-closed on empty, multi-entry image rotation, fail-closed loaders).verify_execution_proofextended with a conjunctive Phala path (attestation as trust root; nonce consumed last so a park never burns it).rebind_worker_signaturereplaces the lean-image placeholder signature when ingesting the attested result.Validation
uv run pytest(withBASE_TEST_DATABASE_URL),uv run mypy src tests, andruffall clean; per-milestone scrutiny + user-testing gates passed. Base test suite green (~1860 passed).Pending: live TDX validation
Live verification of a real TDX quote against a deployed CVM is pending the live infrastructure described in the companion agent-challenge PR (registry, public RA-TLS-fronted key-release ingress, LLM gateway).
Draft PR. Commits authored as
echobt.Summary by CodeRabbit
New Features
Documentation
Bug Fixes