Attestation tasks permanently die after 12h retry timeout

[pbeza]

Background

Both periodic_attestation_submission and monitor_attestation_removal tasks will eventually terminate if the node keeps trying to post an invalid attestation (for example, if it's running outdated firmware). periodic_attestation_submission exits after ~12 hours of failed retries; monitor_attestation_removal follows later — once the old attestation expires and is cleaned up — and exits after its own 12-hour retry window. Both just log an error.

Is this behavior intentional, or should we avoid terminating them permanently?

Acceptance Criteria

• Decide whether attestation tasks should be allowed to terminate permanently
• If they terminate: consider propagating the failure to trigger a node shutdown, since the MPC node currently continues running

Resources & Additional Notes

• periodic_attestation_submission: remote_attestation.rs:140
• monitor_attestation_removal: remote_attestation.rs:187
• 12h retry timeout (MAX_RETRY_DURATION): remote_attestation.rs:29
• Both tasks spawned as fire-and-forget tokio::spawn: cli.rs:449-494
• Related: Refine TEE Context section in tee-lifecycle.md #2282 (TEE Context refinement, shutdown signal propagation)

[netrome]

Yes, we should fix this. Last week we had freshness issues with collaterals, meaning the periodic attestation submission task was failing for longer than 12 hours. If intel would upload a collateral that passed the freshness check during that period, the node should self-heal but this 12 hour timeout would have prevented that.

This should be easy to fix, setting as P1 and we'll prioritize it this week.