feat(guest-agent): fail EmitEvent with an explicit removal message

`EmitEvent` is gone for good -- runtime RTMR3 events are system-owned in
0.6.0, so an app extending the measurement chain is no longer something
this API should offer.

Deleting the method outright is the wrong way to say that. prpc answers
both "no such method" and "the handler failed" with HTTP 400 and drops
the message, so a 0.5.x app that emits events gets a bare 400 that reads
identically to a wrong socket path or a broken build, and its author has
no way to learn why the events stopped being recorded.

Keep the method and the args message on the unversioned service, and have
the handler always bail with the reason. Nothing reaches
`emit_runtime_event`; this is a deliberate error, not a code path.

Author: Kevin Wang

CHANGELOG.md

@@ -44,6 +44,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Removed
 - sdk: the client-side `verify()` method is gone from the Rust, Python, Go and JavaScript SDKs, replaced by the standalone `verify_signature` above -- it never needed a client connection in the first place. Checking a signature needs no key material and no attestation, and the agent's verdict arrived over the socket unattested, so a caller who believed the TEE was vouching for it was mistaken and one who did not gained nothing over checking the signature locally. Verification also became stricter in one respect: non-canonical high-S secp256k1 signatures are now rejected explicitly everywhere. `k256` accepted only the canonical form, so the Rust agent already behaved this way, but a naive port to Python or Go would have silently accepted both `(r, s)` and `(r, n-s)` for the same message. The server-side `Verify` RPC (`/Verify`, present since v0.5.6) is **retained** on the unversioned guest-agent path so 0.5.x SDKs keep working against a 0.6 agent unchanged; it is deprecated, its semantics are frozen at the v0.5.11 wire surface, and it will not be carried into the v1 API. New code should verify locally
+- guest-agent: the `EmitEvent` RPC no longer records anything -- runtime RTMR3 events are system-owned in 0.6.0, so an app can no longer extend the measurement chain. The method itself stays on the unversioned path and always fails with an error naming the removal, rather than being deleted outright: prpc answers both "no such method" and "the handler failed" with HTTP 400 and drops the message, so a deleted method would leave a 0.5.x caller with a generic error indistinguishable from a wrong socket or a version skew. **Breaking:** any app extending RTMR3 at runtime must stop; bind app data through `report_data` instead, which is what most callers wanted anyway
+
 
 ## [0.5.5] - 2025-10-20
 

dstack/guest-agent/rpc/proto/agent_rpc.proto

@@ -60,6 +60,14 @@ service DstackGuest {
   // Returns a dstack-defined attestation format that supports different attestation modes across platforms.
   rpc Attest(AttestArgs) returns (AttestResponse) {}
 
+  // Removed in v0.6.0: always fails. Runtime RTMR3 events are system-owned now,
+  // so an app can no longer extend them.
+  //
+  // The method is kept only so a pre-0.6 client gets a self-explanatory error.
+  // prpc answers both "no such method" and "the handler failed" with HTTP 400,
+  // so the message text is the only thing that tells the two apart.
+  rpc EmitEvent(EmitEventArgs) returns (google.protobuf.Empty) {}
+
   // Get app info
   rpc Info(google.protobuf.Empty) returns (AppInfo) {}
 
@@ -300,6 +308,15 @@ message GetQuoteResponse {
   string vm_config = 4;
 }
 
+// The request of the removed EmitEvent RPC. Kept so a pre-0.6 client's request
+// still decodes and reaches the handler that explains the removal.
+message EmitEventArgs {
+  // The event name
+  string event = 1;
+  // The event data
+  bytes payload = 2;
+}
+
 // The request to derive a key
 message AppInfo {
   // App ID

dstack/guest-agent/src/rpc_service.rs

@@ -16,10 +16,10 @@ use dstack_guest_agent_rpc::{
     tappd_server::{TappdRpc, TappdServer},
     worker_server::{WorkerRpc, WorkerServer},
     AppInfo, AttestAppKeyRequest, AttestArgs, AttestGpuArgs, AttestGpuResponse, AttestResponse,
-    DeriveK256KeyResponse, DeriveKeyArgs, GetKeyArgs, GetKeyResponse, GetQuoteResponse,
-    GetTlsKeyArgs, GetTlsKeyResponse, GpuEvidenceBundle, GpuInfoResponse, HealthResponse,
-    RawQuoteArgs, SignRequest, SignResponse, TdxQuoteArgs, TdxQuoteResponse, VerifyRequest,
-    VerifyResponse, WorkerVersion,
+    DeriveK256KeyResponse, DeriveKeyArgs, EmitEventArgs, GetKeyArgs, GetKeyResponse,
+    GetQuoteResponse, GetTlsKeyArgs, GetTlsKeyResponse, GpuEvidenceBundle, GpuInfoResponse,
+    HealthResponse, RawQuoteArgs, SignRequest, SignResponse, TdxQuoteArgs, TdxQuoteResponse,
+    VerifyRequest, VerifyResponse, WorkerVersion,
 };
 use dstack_types::{AppKeys, SysConfig, GPU_ATTESTATION_OUTPUT};
 use ed25519_dalek::ed25519::signature::hazmat::{PrehashSigner, PrehashVerifier};
@@ -389,6 +389,16 @@ impl DstackGuestRpc for InternalRpcHandler {
         self.state.quote_response(report_data)
     }
 
+    /// Always fails. See the RPC's doc comment in agent_rpc.proto: the method
+    /// exists so a pre-0.6 client learns why its events stopped being recorded
+    /// instead of getting an unknown-method 400 it cannot tell apart from
+    /// talking to the wrong socket.
+    async fn emit_event(self, _request: EmitEventArgs) -> Result<()> {
+        anyhow::bail!(
+            "EmitEvent was removed in dstack 0.6.0; runtime RTMR3 events are system-owned and cannot be extended by apps"
+        )
+    }
+
     async fn info(self) -> Result<AppInfo> {
         get_info(&self.state, false).await
     }
@@ -1598,4 +1608,18 @@ pNs85uhOZE8z2jr8Pg==
 
         assert_eq!(result.unwrap_err().to_string(), "Unsupported algorithm");
     }
+
+    #[tokio::test]
+    async fn emit_event_reports_its_removal() {
+        let (state, _guard) = setup_test_state().await;
+        let result = InternalRpcHandler { state }
+            .emit_event(EmitEventArgs {
+                event: "test-event".to_string(),
+                payload: b"payload".to_vec(),
+            })
+            .await;
+
+        let err = result.unwrap_err().to_string();
+        assert!(err.contains("removed in dstack 0.6.0"), "{err}");
+    }
 }