feat: accept azure-cvm-sev-snp platform in conformance suite

CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## Unreleased
+
+- `azure-cvm-sev-snp` platform accepted (`runtime.platform`): Azure confidential VMs run SEV-SNP behind a Hyper-V paravisor (vTPM-rooted). Added to the bundled schema enum and the TR-RTE valid-platform set so Azure TRACE records pass conformance. Matches `agentrust-trace>=0.4`.
+
 ## v0.2.0 — 2026-06-19
 
 - DID subject support: `subject` now accepts `did:` URIs in addition to `spiffe://`.

schemas/trace-claim.json

@@ -28,7 +28,7 @@
       "type": "object",
       "required": ["platform", "measurement"],
       "properties": {
-        "platform": {"type": "string", "enum": ["intel-tdx", "amd-sev-snp", "nvidia-h100", "nvidia-blackwell", "aws-nitro", "arm-cca", "google-confidential-space", "tpm2", "software-only"]},
+        "platform": {"type": "string", "enum": ["intel-tdx", "amd-sev-snp", "azure-cvm-sev-snp", "nvidia-h100", "nvidia-blackwell", "aws-nitro", "arm-cca", "google-confidential-space", "tpm2", "software-only"]},
         "measurement": {"type": "string", "pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$"},
         "rim_uri": {"type": "string", "format": "uri"},
         "nonce": {"type": "string"},

src/trace_tests/modules/tr_rte.py

@@ -11,6 +11,8 @@
 _VALID_PLATFORMS = frozenset({
     "intel-tdx",
     "amd-sev-snp",
+    # Azure confidential VM: SEV-SNP behind a Hyper-V paravisor (vTPM-rooted).
+    "azure-cvm-sev-snp",
     "nvidia-h100",
     "nvidia-blackwell",
     "aws-nitro",

tests/test_level0.py

@@ -5,7 +5,7 @@
 SUBJECT_RE = re.compile(r"^(spiffe://|did:)")
 DIGEST_RE = re.compile(r"^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$")
 VALID_PLATFORMS = {
-    "intel-tdx", "amd-sev-snp", "nvidia-h100", "nvidia-blackwell",
+    "intel-tdx", "amd-sev-snp", "azure-cvm-sev-snp", "nvidia-h100", "nvidia-blackwell",
     "aws-nitro", "arm-cca", "google-confidential-space", "tpm2",
 }
 VALID_ENFORCEMENT = {"enforce", "advisory", "silent"}

tests/unit/test_tr_rte.py

@@ -17,6 +17,13 @@ def test_valid_runtime_passes():
     assert all(not f.failed() for f in findings), findings
 
 
+def test_azure_cvm_platform_passes():
+    """azure-cvm-sev-snp is a recognized hardware platform (vTPM-rooted SEV-SNP)."""
+    trace = {"runtime": {"platform": "azure-cvm-sev-snp", "measurement": "sha384:" + "a" * 96}}
+    findings = check(trace, level=2)
+    assert all(not f.failed() for f in findings), findings
+
+
 def test_invalid_platform_fails():
     trace = {"runtime": {**_VALID["runtime"], "platform": "unknown-tee"}}
     codes = {f.code for f in check(trace) if f.failed()}