[kvinwang]

Summary

• Run the default KMS deployment against Phala L2 through proof-verified Helios reads.
• Package KMS, auth-api, Helios and the relay in one image; Compose has no build directives and requires an explicit KMS_IMAGE digest.
• Pin Dstack-TEE/helios master 645af74 (#1), which proves the Phala sequencer signer from Ethereum L1 before accepting any block.
• Default deploy-to-vmm.sh to dstack-0.6.0: secure_time hangs on older guests (secure_time: true can never sync — guest chrony is built without NTS #745).
• ETH_MAX_BLOCK_AGE_SECONDS bounds state age in both Helios and auth-api.

Trust model

Contract reads are verified against blocks signed by the sequencer key registered in Phala's L1 SystemConfig, proven through the Ethereum light client. L1 settlement is not checked, so the sequencer key remains trusted. Freshness depends on guest time: approve only KMS app-composes with secure_time: true.

Validation

Hardware TDX, QEMU 8.2.2, dstack-0.6.0 guest (OS hash 621080…471ca), Phala chain 2035, test KMS proxy 0xf4bcb0A454838a776D79D3e341D7f4aa2Cf366F0, block lag 2, max age 300s, relay idle timeout 30s, secure_time: true. Image built from fd2bbcf and served from a private test registry.

• Helios rejects every block until the L1 signer proof succeeds; a tampered L1 storage proof is rejected.
• Real key release: the app CVM reported key_provider=kms with the new KMS CA key. After removing its compose hash, a fresh CVM got Boot denied: Compose hash not allowed; the hash was restored.
• Relay outage: authorization still succeeded 96s into the outage (previously Helios capped state age at 60s), was refused with authorization backend unavailable at 413s, and recovered after the network returned without restarting containers.
• 340 eth_calls on 20 recent blocks matched the Phala RPC except 3 rate-limited RPC replies.
• Two clean-cache builds of a6a38d9 from a fresh clone produced the same digest sha256:b1cc5ff158e20337c2c901e37bcf41b8d9b8b6d3eb0d47e26869fdef09349ec1.
• 15 auth-api Jest tests pass.
• Helios 645af74 (Rust 1.94.1): workspace fmt/clippy/wasm checks and tests pass, except network tests needing RPC secrets or Holesky. Local relay + Helios against Phala: signer proven from L1, head within one block of the Phala RPC, 12/12 eth_calls at head-2 matched. Calls in the first minute can fail closed until three blocks are cached.

[kvinwang]

Rebased onto next and added two emSign CA distrust fixes:

• 650cdad auth-builder node:20 -> node:22.23.4-bookworm-slim (same digest as fix(kms): run auth-api on Node 22.23.4 and pin the auth-mock Bun image #1466). The image copies this node binary into the runtime, so auth-api ran on Node 20.20.2, which still trusts the compromised intermediates. auth-eth npm ci, npm run build and the 15 jest tests pass on 22.23.4.
• 72fd3df Helios pin 645af74 -> ff3820a (chore(deps): bump rustls-webpki and webpki-roots for the emSign distrust helios#2: rustls-webpki 0.103.16, webpki-roots 1.0.10). The pin points at the PR branch; re-pin to the merge commit if it is not fast-forwarded.

Rebase conflicts were only in docker-compose.yaml / compose-dev.yaml, where #1466 had touched the old auth-api block; this PR's side was kept. The runtime stage now gets ca-certificates 20250419~deb12u2 from #1464. Helios uses native-tls with that trust store by default; with the old rust:1.92.0 bundle it accepted dv-g3b-emudhra.we-have-a-problem.com, and with the new bundle it rejects it. A full KMS image build has not been run.

#1492 deletes the legacy docker-compose.yaml. If it lands first, keep this PR's version of the file when rebasing.