feat(vmm): support tdx acpi table requirement

[kvinwang]

Problem

tdx_attestation_variant is currently selected only from VMM config/auto policy. An app compose requirement cannot force whether TDX ACPI tables are measured, so deployments that require measured ACPI tables can still be launched with TDX lite attestation. Relying parties also cannot tell from verifier output whether ACPI table contents were verified.

Fix

• Add requirements.tdx_measure_acpi_tables: Option<bool> to dstack types and SDK compose-hash types.
• Make VMM resolve TDX attestation mode from this requirement when present:
  • true => legacy TDX attestation, no lite mode.
  • false => TDX lite attestation.
• Add guest-side policy validation so TDX VMs fail closed if vm_config does not satisfy the compose requirement.
• Add verifier output details.acpi_tables_verified and CLI ACPI tables verified: ... line.
• Cover the new behavior with Rust unit/fixture tests.

Verification

• cargo fmt --check --all
• cargo clippy -- -D warnings -D clippy::expect_used -D clippy::unwrap_used --allow unused_variables
• cargo test -p dstack-verifier
• ./run-tests.sh
• cd sdk && ./run-tests.sh
• cd vmm/ui && npm ci && npm run build
• prek run --from-ref origin/master --to-ref HEAD --show-diff-on-failure

[Copilot]

Pull request overview

This PR adds a new compose-level requirement (requirements.tdx_measure_acpi_tables: Option<bool>) that lets an application explicitly force TDX “legacy” vs “lite” attestation behavior, and adds guest-side enforcement so a TDX guest fails closed when the generated vm_config does not satisfy that requirement.

Changes:

• Extend Requirements across Rust types, SDK compose-hash implementations (Python/JS/Go), and the VMM UI typing to include tdx_measure_acpi_tables.
• Update VMM sys-config/vm-config generation so tdx_measure_acpi_tables (when present) overrides the configured/auto TDX attestation variant.
• Add guest-side policy validation (plus unit tests) to ensure TDX guests reject mismatched vm_config attestation mode.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
vmm/ui/src/composables/useVmManager.ts	Adds the new requirement field to UI-side Requirements typing.
vmm/src/one_shot.rs	Passes compose requirements into sys-config generation.
vmm/src/app.rs	Threads requirements into make_sys_config/make_vm_config and resolves TDX variant from the new requirement; adds unit tests.
sdk/python/src/dstack_sdk/get_compose_hash.py	Includes tdx_measure_acpi_tables in Python compose-hash requirements serialization.
sdk/js/src/get-compose-hash.ts	Adds tdx_measure_acpi_tables to JS SDK compose-hash Requirements interface.
sdk/go/dstack/compose_hash.go	Adds TdxMeasureAcpiTables to Go SDK requirements struct for compose hashing.
dstack-util/src/system_setup.rs	Adds guest-side enforcement of tdx_measure_acpi_tables against sys_config.vm_config, with tests.
dstack-types/src/lib.rs	Extends the canonical Rust Requirements type and tests; updates Requirements::is_empty().

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.