feat(tee): hardware-validated Azure CVM (vTPM-rooted SEV-SNP) attestation

[imran-siddique]

What

Adds Azure confidential-VM attestation to cMCP, validated end to end on a live Azure SEV-SNP VM (DCasv5), matching the treatment just landed in agent-manifest.

Why the design is what it is

cMCP's collector assumed the classic model: open /dev/sev-guest, ioctl a report, and write its nonce (jwk_thumbprint(gateway_key) || sha256(audit_root), i.e. CRYPTO-001 + AUDIT-006) into the guest-controlled SNP REPORT_DATA. None of that holds on Azure:

• Azure runs SEV-SNP behind a Hyper-V paravisor — there is no /dev/sev-guest. The SNP report is read from the vTPM NV index 0x01400001 ("HCLA" wrapper, SNP report at offset 0x20).
• The guest cannot control REPORT_DATA. The paravisor sets it to sha256(runtime_data), binding the vTPM AK. Confirmed on the live report: REPORT_DATA[:32] == sha256(runtime_data) exactly.

So on Azure cMCP's nonce must be committed via the vTPM, not the SNP report.

What's in the PR

• AzureCVMProvider (collector, cmcp_runtime/tee/azure_cvm.py): reads the SNP/HCL report from the vTPM, verifies the AK-to-silicon binding, and commits the nonce into an AK-signed TPM2_Quote (qualifying data). Auto-detected first in detect.py (Azure exposes no /dev/sev-guest).
• verify_azure_cvm_measurement (cmcp_verify/azure_cvm.py): verifies SNP report signature + VCEK→ASK→ARK to a pinned ARK (reusing cmcp_verify.sev_snp), the REPORT_DATA == sha256(runtime_data) binding, that the AK equals the HCLAkPub in runtime_data, and that the AK-signed quote's extraData commits the nonce. Fully fail-closed.
• Azure maps to the existing amd-sev-snp platform and is distinguished at verify time by its JSON evidence envelope — no new platform literal in agentrust-trace, so no cross-package release is needed. The bare-metal SNP path is unchanged.

Verified on real silicon

nonce → AK-signed quote (extraData) → AK == HCLAkPub bound in SNP REPORT_DATA → SNP report signed by VCEK → VCEK ← ASK ← ARK (AMD Milan root) — all six checks green on the live VM.

Two real bugs the hardware surfaced (and fixed): the Azure vTPM rejects a 64-byte quote qualifyingData (TPM_RC_SIZE) → commit sha256(nonce); tpm2_quote -m emits a raw TPMS_ATTEST with no outer TPM2B size prefix.

Tests

• Synthetic self-consistent path (SNP report + RSA ASK/ARK chain + EC VCEK + RSA AK-signed quote) covering happy path, tampered quote nonce, wrong AK, broken paravisor binding, missing chain → partial, plus a monkeypatched collector↔verifier round-trip.
• Env-gated real-hardware fixture test (CMCP_AZURE_FIXTURE_DIR); the real report/chip_id is not committed.
• Local: ruff clean, mypy clean, full unit suite 813 passed / 6 skipped.

🤖 Generated with Claude Code