docs(verifier): correct the acpi_tables_verified contract

[kvinwang]

The problem

VerificationDetails::acpi_tables_verified documents the opposite of what the code does:

/// This is true for the full-image TDX path, where the verifier recomputes
/// ACPI tables and checks the resulting RTMRs against the quote. It remains
/// false for TDX lite, which replays ACPI DATA digests from the event log
/// without validating the table contents.

TDX lite has validated them since 7f63d5f (verify TDX lite ACPI tables against the declared VM shape). verify_os_image_hash_for_dstack_tdx_lite reads the three named RTMR0 ACPI DATA digests from the event log, recomputes them with expected_rtmr0_acpi_hashes() from the declared VM shape, bails on any mismatch, and then rebuilds RTMR0 from the recomputed digests — so host-reported table content never reaches the expected measurement. verification.rs sets the flag true on both TDX paths (lines 984 and 1057); only the comment was left behind.

Why it is worth a PR

This field is part of the verifier's response. It is precisely what someone reads to decide how much a lite attestation proves, and today it tells them the ACPI check is skipped. I hit this myself while auditing the ACPI measurement chain and concluded — wrongly — that RTMR0's ACPI entries were unconstrained under lite.

What changed

Two doc comments, no code.

• verifier/src/types.rs — state that both dstack TDX paths verify, and that the flag is false only where the check does not apply: GCP TDX (measures through the vTPM), SEV-SNP, and Nitro Enclave. Confirmed by tracing every assignment: verify_os_image_hash_for_dstack_tdx and verify_os_image_hash_for_dstack_tdx_lite set it; verify_os_image_hash_for_gcp_tdx and the SNP/Nitro paths do not.
• dstack-mr/src/tdx.rs — the note on expected_rtmr0_acpi_hashes was accurate but read as if the lite path only ever replays reported digests. Added that the verifier calls it on both paths and treats a mismatch, or a VM shape the generator cannot model, as fatal rather than unverified.

Testing

cargo check -p dstack-verifier -p dstack-mr and cargo fmt --check clean. Documentation only; no behaviour change.

[Copilot]

🟢 Approval recommended

The changes are documentation-only and align with the current verifier implementation (the flag is set true in both dstack TDX verification paths and remains false on non-applicable platforms).

Pull request overview

This PR corrects verifier-facing documentation to accurately reflect how acpi_tables_verified is computed for dstack TDX attestations, ensuring relying parties interpret lite attestations correctly.

Changes:

• Update VerificationDetails::acpi_tables_verified docs to state it is set on both dstack TDX paths (full-image and lite), and remains false only where ACPI verification is not applicable.
• Clarify expected_rtmr0_acpi_hashes() documentation to emphasize the verifier uses it to enforce (fail-closed) ACPI digest verification on both TDX paths.

File summaries

File	Description
dstack/verifier/src/types.rs	Fixes the field contract documentation for acpi_tables_verified to match actual verifier behavior on both dstack TDX paths.
dstack/dstack-mr/src/tdx.rs	Clarifies that expected ACPI digest recomputation is enforced by the verifier (mismatch / unmodelable shapes are fatal).

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.