[kvinwang]

Register and rotate root/app key epochs, retain authorized historical keys, migrate disk headers and SealedEnv, and enforce epoch-scoped authorization while preserving temporary-CA compatibility.

This aggregates the linear split stack:
#1516 → #1519 → #1517 → #1520 → #1521 → #1528 → #1530 → #1532.

Restores all original feature commits after the previous stack rewrite omitted application epoch support. Includes the review fixes from #1534: optional selectors, grouped epoch fields, scoped operation names, consistent authorization methods, removal of legacy KMS setters, consolidated app epoch policy interface, and RPC injection/isolation regression coverage. No KMS contract-address equality check was added.

The final tree is identical to #1534 at 2c017875bf. It was independently compared against the original complete #1533/#1534 tree plus the intended review fixes; no unrelated feature changes remain.

Validation on Linux x86_64 with Rust 1.92.0, Bun 1.4.4, Forge 1.8.4 and Solc 0.8.24: cert-client 7, KMS 75, local auth 9, Solidity 87, VMM SealedEnv 4, simple auth 33, mock auth 15, Bun Ethereum auth 50 and Jest Ethereum auth 22 tests passed. Guest-agent and dstack-util compile checks passed, including the earlier guest-key split independently. Solidity used pinned submodules and forge test --offline --ffi -vv; Rust reused Cargo caches. Injection tests use loopback HTTP, a supplied vsock CID, synthetic payloads and temporary VM storage; no live TEE/chain or kernel AF_VSOCK identity test was performed. Tree equality, stack ancestry, Rust formatting and diff whitespace checks passed.

GitHub currently locks the base of #1519 because it is a stack member. Its commits descend from #1516, but its PR base remains next; both GraphQL and REST base updates were rejected.

[kvinwang]

@Leechael Thanks for the thorough review. Below is how each item in the review (against 08b3f262) was handled.

The follow-up PRs from this review (#1539, #1540, #1542, #1543, #1544) are all merged into feat/kms-epochs-combined. "Done" below means merged.

Blocking

Item	Decision	Severity	Where	Status
#1 LUKS format/migration atomicity	Accepted. Also fixed a permanent boot failure when a rotation follows an interrupted migration	Medium	#1539 e087e135, 0deb65d1	Done
#2 Contract upgrade and epoch-0 registration not atomic	Rejected	None	—	No change
#3 Handover authorization check	Mostly rejected: legacy endpoints refuse once a later root epoch is current (#1545). Added audit logging and tests	Low	#1539 b9139453, ebbd969b, 7161298c; #1540	Done
#4 Epoch-less legacy setters write only the pending row	Accepted. They now apply to every row in current..latest	High	#1539 57b7af82	Done
#5 Ethereum backends do not read finalized blocks	Partially accepted: new ETH_BLOCK_TAG, default finalized, overridden per network in each deployment	Low	#1543	Done
#6 KMS-local high-water mark	Rejected	None	—	No change
#7 App epoch cannot be staged ahead	Accepted. Staging allowed up to current+1	Low	#1539 41e8328b	Done
#8 App epoch side lookup fails open	Accepted	Low	#1539 c45bbc7e	Done
#9 Allowed when the KMS omits rootEpoch	Partially accepted: rejected when current ≠ 0	Medium	#1539 3e7296ca	Done
#10 Join does not verify the pending epoch	Accepted. Only the latest chain hash is verified	Medium	#1542	Done
#11 DstackApp.isAppAllowed at non-zero epochs	Accepted	Low	#1539 f17d72f2	Done
#12 popRootEpoch leaves stale policy rows	Accepted. Policy rows are now keyed by chainHash	Low	#1539 2aab4c1f	Done
#13 Empty list means "any" in dstack-auth	Accepted	Low	#1539 5676e0ff	Done
#14 Upgrade reference does not match production	Accepted	Low	#1539 751c2304, 0cf765ce	Done
Required removal: legacy cert fallback	Accepted, removed	Low	#1539 d701ed6b	Done

Should-fix

Item	Decision	Severity	Where	Status
1 SealedEnv pins are a flat set	Rejected, documented	Low	#1539 ba8d16ce	Done
2 Trusting ListImages.sealed_env	Rejected	Low	—	No change
3 Historical env search continues after a rejection	Rejected, design doc corrected	None	#1539 7ea3e50c	Done
4 No read-back check after resealing	Rejected, covered by integration tests instead	Low	Docs #1539 9861dddb; tests in #841	Docs done, tests pending
5 Self-check cache may be stale	Cache kept; comments and docs fixed; tests in #841	Low	#1539 f81db3cc; tests in #841	Docs done, tests pending
6 File backend has no per-epoch rows	Rejected (dev-only backend)	None	—	No change
7 Legacy getters/events cover epoch 0 only	Rejected, natspec added	None	#1539 ea699452	Done
8 Rotate does not require the admin token	Rejected, design doc corrected	Low	#1539 e0fa7e54	Done
9 GetTempCaCert returns temp_ca_key	Rejected	None	—	No change
10 v2 report data	v2 dropped, v1 only, test vectors added	Low	#1539 3a6b8772	Done
11 evidenceUrl is mutable	Rejected, comment corrected	None	#1539 07a68bca	Done
12 DstackApp.authorizeApp accepts KMS operations	Rejected, already handled by existing code	None	—	No change
13 SDK guidance for derived wallets	Accepted, docs only	Low	#1539 bd387fac	Done

Crash consistency and resource exhaustion

Item	Decision	Severity	Where	Status
1 Core dumps may contain the keyring	Rejected here; CVM-wide disabling handled separately	None	—	No change
2 No cleanup on abnormal exit	Rejected	None	—	No change
3 Owner env update may be lost	Rejected	Low	—	No change
4 Inconsistent env size limits	Rejected (pre-existing)	Low	—	No change
5 Unauthenticated request amplification	Partially accepted: bounded 1 s cache for /app/:id	Medium	#1539 f0d2c63e	Done
6 guest-agent historical root cache comment	Comment corrected	None	#1539 32a4d09c	Done
7 epochs/<n>/ directory entry not persisted	Accepted, create_dir_all removed	Low	#1539 0170966e	Done

Changes that came out of the discussion

Change	Where	Status
Rename isAllowed to authorized, unify the app-level AuthorizationRequest/Result, separate the error body from /bootAuth	#1542	Done
Rename the private contract helper _isKmsAllowed to _kmsPolicy (ABI unchanged)	#1544	Done
Legacy isKmsAllowed/isAppAllowed refuse once a later root epoch is current	#1545	Done
Sealed env write-back window fails closed: it is always closed before application code runs	#1546	Done
vmm-cli strips the 0x prefix when comparing pinned KMS signers	#1535	Done

Not yet decided

Section	Content	Proposal
Informational	Marked no action	No reply
Test coverage	7 minimum test groups	Groups 3–6 covered, group 7 rejected. Still missing: handler-level rejection tests for GetAppKey/SignCert (group 1) and SDK unit tests with app_epoch ≠ 0 (group 2), proposed for this PR. The end-to-end part goes to #841
Follow-up issues	One-time handover tickets, emergencyHalt/retireRootEpoch, documenting the residual historical GetAppKey risk, residual-risk list	Tracked as follow-ups
Follow-up: squash	Squash the stack into 8 logical PRs	Undecided
Deployment prerequisite	Off-chain backend endpoint requirements	Document in the release notes

Still pending: integration tests in #841 (not merged yet) for Should-fix 4, Should-fix 5, and the end-to-end part of Test coverage.