Background
The async attestation flow's failure branches are covered in sandbox (#3715), but the successful Verified store path is not: submit_participant_info reads the account key from env::signer_account_pk(), and the fixture quote's report_data binds the fixture node's key, of which only the .pub was ever kept. No sandbox account could produce a matching submission, so the store-path tests landed #[ignore]d in #4085.
Approach
Regenerate the fixtures from a fresh localnet CVM on a TDX host and keep the node's signer key this time. The catch: that key is generated in-enclave, and the only way to run anything inside a CVM is an app-compose script, which validate_app_compose_config rejects as arbitrary root code — so a CVM we can extract the key from is one the contract refuses. Details here. Resolved by relaxing that single field for test builds behind allow-pre-launch-script; init_script and bash_script stay rejected and the production wasm never enables it.
Acceptance Criteria
Dropped: the out-of-gas test for resolve_verification, and the related right-sizing of resolve_verification_tera_gas. near-sdk forwards unused prepaid gas to the callback, so it cannot be starved while the caller attaches max gas — the config is a floor, not a cap.
PR: #4104 (stacked on #4085). Parent: #3738. Epic: #3642.
Background
The async attestation flow's failure branches are covered in sandbox (#3715), but the successful Verified store path is not:
submit_participant_inforeads the account key fromenv::signer_account_pk(), and the fixture quote'sreport_databinds the fixture node's key, of which only the.pubwas ever kept. No sandbox account could produce a matching submission, so the store-path tests landed#[ignore]d in #4085.Approach
Regenerate the fixtures from a fresh localnet CVM on a TDX host and keep the node's signer key this time. The catch: that key is generated in-enclave, and the only way to run anything inside a CVM is an app-compose script, which
validate_app_compose_configrejects as arbitrary root code — so a CVM we can extract the key from is one the contract refuses. Details here. Resolved by relaxing that single field for test builds behindallow-pre-launch-script;init_scriptandbash_scriptstay rejected and the production wasm never enables it.Acceptance Criteria
TlsKeyOwnedByOtherAccountguard run in sandbox, un-ignored.verify_quotegas measured on a valid quote against the production budget (Add a gas-metered sandbox test for verify_quote with a valid quote (cover the verifier_tera_gas budget) #3897).Dropped: the out-of-gas test for
resolve_verification, and the related right-sizing ofresolve_verification_tera_gas. near-sdk forwards unused prepaid gas to the callback, so it cannot be starved while the caller attaches max gas — the config is a floor, not a cap.PR: #4104 (stacked on #4085). Parent: #3738. Epic: #3642.