← all workers

OutLayer — TEE Attestation

Verifiable off-chain compute for NEAR · outlayer.ai ↗

Full per-aspect verification for app 2ebb053d22438a7c970fc087f60787f562d63dfb.

One running instance of this app on a self-hosted Intel TDX host. Every TDX quote is Intel-DCAP-verified (signature + TCB, via Intel's PCS) and cross-checked against the on-chain approved measurements — independently re-verifiable.
testnet-worker-0193-204 Worker testnet running · up 1day 11h 33s
last push 3m ago app_id 2ebb053d22438a7c970fc087f60787f562d63dfb vm_id 77623788-c503-4ac5-b491-589740dff797 attested via Intel DCAP (Intel PCS collateral) KMS-in-TEE ✓ gateway 2ebb053d22438a7c970fc087f60787f562d63dfb-8081.dstack.outlayer.ai
2

TDX Hardware — Attestation

The hardware-signed TDX quote, verified against Intel's PCS collateral — the Intel DCAP signature chain, not Intel Trust Authority.

Signature ✓ TCB UpToDate Measurements ✓ On-chain ✓ approved (worker.outlayer.testnet)
mrtd7fe60787222bd394cb516abca2435f22f035ab2cc9c0a4b4b3b148e46297f3d931a237b72f359052c6e657d8c1409173
rtmr0573aadb4d478839c803c4b1d3e03dd748976b63a89622f377e32a54dd60546e88ec2097f595ceafc324f48a0d0d31db6
rtmr1e7b3ffa0e72b50557d85f7ecd8dc98a4ffc3dd6f82d01f122ef522d61361abeac310d70d2877e56be9c9408d9bcc320c
rtmr2764489f277a8540189761e72b4238ba36d4d647e11bd958d8ab5522af2a4867b0ff63e06b0c4967f1857236244040a5d
rtmr3f6c4087e601b4300cce4b612e3eb0cbea7641b3417e8a8f2f3db175bd8457a8df67ee06e756806f59da89f476527d372
report_data4b515d1a0b5f55a4d523144d4f8ed0a6bfaac6932bff48ff269040183dfaed102413de391bfb8d09f92db552d376bc435fd2bc4acc674b14fb3e9d7fcf27112f
mr_seam346bc77a1846cac214dd2e8edeb9ee4349449d6c3f9ff2c52149a634c27b7fd1bd314c2ef6b973eeebd55742952531a1
mr_signer_seam000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
tee_tcb_svn0e010400000000000000000000000000
td_attributes0000001000000000
xfame702060000000000
fmspc B0C06F000000
raw Intel TDX quote (hex) 
040002008100000000000000939a7233f79c4ca9940a0db3957f06070a70698a1e9d04b2c4d8d756a5da5721000000000e010400000000000000000000000000346bc77a1846cac214dd2e8edeb9ee4349449d6c3f9ff2c52149a634c27b7fd1bd314c2ef6b973eeebd55742952531a100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000e7020600000000007fe60787222bd394cb516abca2435f22f035ab2cc9c0a4b4b3b148e46297f3d931a237b72f359052c6e657d8c1409173012ebb053d22438a7c970fc087f60787f562d63dfbb334ba68ffe00c8b8bd017e1000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000573aadb4d478839c803c4b1d3e03dd748976b63a89622f377e32a54dd60546e88ec2097f595ceafc324f48a0d0d31db6e7b3ffa0e72b50557d85f7ecd8dc98a4ffc3dd6f82d01f122ef522d61361abeac310d70d2877e56be9c9408d9bcc320c764489f277a8540189761e72b4238ba36d4d647e11bd958d8ab5522af2a4867b0ff63e06b0c4967f1857236244040a5df6c4087e601b4300cce4b612e3eb0cbea7641b3417e8a8f2f3db175bd8457a8df67ee06e756806f59da89f476527d3724b515d1a0b5f55a4d523144d4f8ed0a6bfaac6932bff48ff269040183dfaed102413de391bfb8d09f92db552d376bc435fd2bc4acc674b14fb3e9d7fcf27112fcc100000f40cc66b103308ae529d65a19482b2705da37afe91ea554e9afe169f4da52aec0b378d874192741bcb174fe7d0dd2682af8191a3738b1c4c7c36451b714e40d2ffbdc02d29e681562605cc758a65e873f068217804a256c678a15343e72f8b3f9f42b9d44d018713649bdccb0279c8930399078491a4ab33990b23fd987343960600461000000404191b04ff0006000000000000000000000000000000000000000000000000000000000000000000000000000000001500000000000000e700000000000000e5a3a7b5d830c2953b98534c6c59a3a34fdc34e933f7f5898f0a85cf08846bca0000000000000000000000000000000000000000000000000000000000000000dc9e2a7c6f948f17474e34a7fc43ed030f7c1563f1babddf6340c82e0e54a8c500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000645a6bec02c28eca73026584c079befc9d37e6fa11fe5e0f240db18a2c7b70910000000000000000000000000000000000000000000000000000000000000000327fbe899d7d9b178e1d0178175b43fad605acfd4984395b08c842fb7fc5646c9c689267fe285605e4c6b4848fde4e7b904ca52d1c4f4e73558d7b50be996faa2000000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f05005e0e00002d2d2d2d2d424547494e2043455254494649434154452d2d2d2d2d0a4d49494538444343424a6167417749424167495557576756566c2b6478713232783158436a576e69652f4845327a4577436759494b6f5a497a6a3045417749770a634445694d434147413155454177775a535735305a577767553064594946424453794251624746305a6d397962534244515445614d42674741315545436777520a535735305a577767513239796347397959585270623234784644415342674e564241634d43314e68626e526849454e7359584a684d51737743515944565151490a44414a445154454c4d416b474131554542684d4356564d774868634e4d6a59774e6a49304d5441304d5441305768634e4d7a4d774e6a49304d5441304d5441300a576a42774d534977494159445651514444426c4a626e526c624342545231676755454e4c49454e6c636e52705a6d6c6a5958526c4d526f77474159445651514b0a4442464a626e526c6243424462334a7762334a6864476c76626a45554d424947413155454277774c553246756447456751327868636d4578437a414a42674e560a4241674d416b4e424d517377435159445651514745774a56557a425a4d424d4742797147534d34394167454743437147534d34394177454841304941424268660a6259335937394a4e76496d53774c5a6c395742717355747958706f50444a592b43424c526c323631664d3650547a7a6e2f6b4d4e48414b64345754714e3167500a466465546878426437413454497a584a5442756a67674d4d4d4949444344416642674e5648534d4547444157674253566231334e765276683655424a796454300a4d383442567776655644427242674e56485238455a4442694d47436758714263686c706f64485277637a6f764c32467761533530636e567a6447566b633256790a646d6c6a5a584d75615735305a577775593239744c334e6e6543396a5a584a3061575a7059324630615739754c3359304c33426a61324e796244396a595431770a624746305a6d397962535a6c626d4e765a476c755a7a316b5a584977485159445652304f42425945464632786963526263414f697a527369637242302b4979410a465969494d41344741315564447745422f775145417749477744414d42674e5648524d4241663845416a41414d4949434f51594a4b6f5a496876684e415130420a424949434b6a4343416959774867594b4b6f5a496876684e41513042415151513655423973394155344551773248306a74454279517a434341574d47436971470a534962345451454e41514977676746544d42414743797147534962345451454e41514942416745454d42414743797147534962345451454e41514943416745450a4d42414743797147534962345451454e41514944416745434d42414743797147534962345451454e41514945416745434d42414743797147534962345451454e0a41514946416745454d42414743797147534962345451454e41514947416745424d42414743797147534962345451454e41514948416745414d424147437971470a534962345451454e41514949416745464d42414743797147534962345451454e4151494a416745414d42414743797147534962345451454e4151494b416745410a4d42414743797147534962345451454e4151494c416745414d42414743797147534962345451454e4151494d416745414d42414743797147534962345451454e0a4151494e416745414d42414743797147534962345451454e4151494f416745414d42414743797147534962345451454e41514950416745414d424147437971470a534962345451454e41514951416745414d42414743797147534962345451454e415149524167454c4d42384743797147534962345451454e41514953424241450a42414943424145414251414141414141414141414d42414743697147534962345451454e41514d45416741414d42514743697147534962345451454e415151450a42724441627741414144415042676f71686b69472b45304244514546436745424d42344743697147534962345451454e4151594545455871485a4a42335245730a636d357a68667551676334775241594b4b6f5a496876684e41513042427a41324d42414743797147534962345451454e415163424151482f4d424147437971470a534962345451454e415163434151482f4d42414743797147534962345451454e415163444151482f4d416f4743437147534d343942414d43413067414d4555430a4951437478734a6364586c4e2b395370734c6373426e494a4a65446f7a774e4179677a4c51594c38776f5339326749674e527168344730374d4b352b306c45690a63433748696a42786a626c77677a41714b63365470424a563468633d0a2d2d2d2d2d454e442043455254494649434154452d2d2d2d2d0a2d2d2d2d2d424547494e2043455254494649434154452d2d2d2d2d0a4d4949436c6a4343416a32674177494241674956414a567658633239472b487051456e4a3150517a7a674658433935554d416f4743437147534d343942414d430a4d476778476a415942674e5642414d4d45556c756447567349464e48574342536232393049454e424d526f77474159445651514b4442464a626e526c624342440a62334a7762334a6864476c76626a45554d424947413155454277774c553246756447456751327868636d4578437a414a42674e564241674d416b4e424d5173770a435159445651514745774a56557a4165467730784f4441314d6a45784d4455774d5442614677307a4d7a41314d6a45784d4455774d5442614d484178496a41670a42674e5642414d4d47556c756447567349464e4857434251513073675547786864475a76636d306751304578476a415942674e5642416f4d45556c75644756730a49454e76636e4276636d4630615739754d5251774567594456515148444174545957353059534244624746795954454c4d416b474131554543417743513045780a437a414a42674e5642415954416c56544d466b77457759484b6f5a497a6a3043415159494b6f5a497a6a304441516344516741454e53422f377432316c58534f0a3243757a7078773734654a423732457944476757357258437478327456544c7136684b6b367a2b5569525a436e71523770734f766771466553786c6d546c4a6c0a65546d693257597a33714f42757a43427544416642674e5648534d4547444157674251695a517a575770303069664f44744a5653763141624f536347724442530a42674e5648523845537a424a4d45656752614244686b466f64485277637a6f764c324e6c636e52705a6d6c6a5958526c63793530636e567a6447566b633256790a646d6c6a5a584d75615735305a577775593239744c306c756447567355306459556d397664454e424c6d526c636a416442674e5648513445466751556c5739640a7a62306234656c4153636e553944504f4156634c336c517744675944565230504151482f42415144416745474d42494741315564457745422f7751494d4159420a4166384341514177436759494b6f5a497a6a30454177494452774177524149675873566b6930772b6936565947573355462f32327561586530594a446a3155650a6e412b546a44316169356343494359623153416d4435786b66545670766f34556f79695359787244574c6d5552344349394e4b7966504e2b0a2d2d2d2d2d454e442043455254494649434154452d2d2d2d2d0a2d2d2d2d2d424547494e2043455254494649434154452d2d2d2d2d0a4d4949436a7a4343416a53674177494241674955496d554d316c71644e496e7a6737535655723951477a6b6e42717777436759494b6f5a497a6a3045417749770a614445614d4267474131554541777752535735305a5777675530645949464a766233516751304578476a415942674e5642416f4d45556c756447567349454e760a636e4276636d4630615739754d5251774567594456515148444174545957353059534244624746795954454c4d416b47413155454341774351304578437a414a0a42674e5642415954416c56544d423458445445344d4455794d5445774e4455784d466f58445451354d54497a4d54497a4e546b314f566f77614445614d4267470a4131554541777752535735305a5777675530645949464a766233516751304578476a415942674e5642416f4d45556c756447567349454e76636e4276636d46300a615739754d5251774567594456515148444174545957353059534244624746795954454c4d416b47413155454341774351304578437a414a42674e56424159540a416c56544d466b77457759484b6f5a497a6a3043415159494b6f5a497a6a3044415163445167414543366e45774d4449595a4f6a2f69505773437a61454b69370a314f694f534c52466857476a626e42564a66566e6b59347533496a6b4459594c304d784f346d717379596a6c42616c54565978465032734a424b357a6c4b4f420a757a43427544416642674e5648534d4547444157674251695a517a575770303069664f44744a5653763141624f5363477244425342674e5648523845537a424a0a4d45656752614244686b466f64485277637a6f764c324e6c636e52705a6d6c6a5958526c63793530636e567a6447566b63325679646d6c6a5a584d75615735300a5a577775593239744c306c756447567355306459556d397664454e424c6d526c636a416442674e564851344546675155496d554d316c71644e496e7a673753560a55723951477a6b6e4271777744675944565230504151482f42415144416745474d42494741315564457745422f7751494d4159424166384341514577436759490a4b6f5a497a6a3045417749445351417752674968414f572f35516b522b533943695344634e6f6f774c7550524c735747662f59693747535839344267775477670a41694541344a306c72486f4d732b586f356f2f7358364f39515778485241765a55474f6452513763767152586171493d0a2d2d2d2d2d454e442043455254494649434154452d2d2d2d2d0a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000280300000001000008004073797374656d2d707265706172696e6700030000000100000800186170702d6964502ebb053d22438a7c970fc087f60787f562d63dfb03000000010000080030636f6d706f73652d68617368802ebb053d22438a7c970fc087f60787f562d63dfbb334ba68ffe00c8b8bd017e10300000001000008002c696e7374616e63652d69640003000000010000080030626f6f742d6d722d646f6e6500030000000100000800186d722d6b6d73807b50661a7f307c707c2a94f1d7b9f21b5a180afb6a8228f005f8e70880e856ce030000000100000800346f732d696d6167652d68617368808db40cb23008d6213668b5816702d100b37b859a8a5bfd18d938ae3a1b3715bd030000000100000800306b65792d70726f766964657231037b226e616d65223a226b6d73222c226964223a223330353933303133303630373261383634386365336430323031303630383261383634386365336430333031303730333432303030343338666530366237316338346163356139306366643333303136636530663134356230663536633564613236323832373766646532613531663535326264323532636262633530323563663834656338653139616664653036363937646561316565353366303664393438356431393261353463643861653361306566666664227d0300000001000008002873746f726167652d66730c7a66730300000001000008003073797374656d2d726561647900284073797374656d2d707265706172696e6700186170702d6964502ebb053d22438a7c970fc087f60787f562d63dfb30636f6d706f73652d68617368802ebb053d22438a7c970fc087f60787f562d63dfbb334ba68ffe00c8b8bd017e12c696e7374616e63652d69640030626f6f742d6d722d646f6e6500186d722d6b6d73807b50661a7f307c707c2a94f1d7b9f21b5a180afb6a8228f005f8e70880e856ce346f732d696d6167652d68617368808db40cb23008d6213668b5816702d100b37b859a8a5bfd18d938ae3a1b3715bd306b65792d70726f766964657231037b226e616d65223a226b6d73222c226964223a223330353933303133303630373261383634386365336430323031303630383261383634386365336430333031303730333432303030343338666530366237316338346163356139306366643333303136636530663134356230663536633564613236323832373766646532613531663535326264323532636262633530323563663834656338653139616664653036363937646561316565353366303664393438356431393261353463643861653361306566666664227d2873746f726167652d66730c7a66733073797374656d2d7265616479004b515d1a0b5f55a4d523144d4f8ed0a6bfaac6932bff48ff269040183dfaed102413de391bfb8d09f92db552d376bc435fd2bc4acc674b14fb3e9d7fcf27112f1d057b226f735f696d6167655f68617368223a2238646234306362323330303864363231333636386235383136373032643130306233376238353961386135626664313864393338616533613162333731356264222c226370755f636f756e74223a322c226d656d6f72795f73697a65223a313037333734313832342c2271656d755f76657273696f6e223a22382e322e32222c227063695f686f6c6536345f73697a65223a302c22687567657061676573223a66616c73652c226e756d5f67707573223a302c226e756d5f6e767377697463686573223a302c22686f74706c75675f6f6666223a66616c73652c22696d616765223a2264737461636b2d302e352e3132222c22686f73745f73686172655f6d6f6465223a223970222c226f766d665f76617269616e74223a22707265323032353035222c22737065635f76657273696f6e223a317d
independently verify this quote ↗
3

Source Code — Compose

The measured app-compose that pins exactly which container images run.

ContainerImageDigestVerify
worker docker.io/outlayer/near-outlayer-workerOutLayer-built sha256:33762e11c4fbc2dfda9728a9498930f0eaa1181a771af195c3d495969c639259 Sigstore ↗ release ↗

Each digest above is the one measured into RTMR3, so the attestation binds the running code to this exact image; the Sigstore link ties that digest back to its build provenance.

app-compose (measured source identity) 
{
    "manifest_version": 2,
    "name": "outlayer-worker-testnet-0.1.93",
    "runner": "docker-compose",
    "docker_compose_file": "# OutLayer worker — deployed as a dstack CVM on a self-hosted TDX node.\n#\n# - image is pinned BY DIGEST (verifiable, Sigstore-attested release build) so the\n#   app-compose hash (measured into RTMR3) is deterministic. 40-deploy-worker.sh\n#   rewrites this digest for the chosen --version from the GitHub release.\n# - secrets are NOT here: env VALUES come via `vmm-cli ... --env-file worker.env`\n#   (encrypted by the per-node KMS + embedded as a ciphertext blob). The compose text\n#   keeps only ${VAR} references, so plaintext secrets never enter the measured compose;\n#   dstack decrypts the env inside the CVM and docker-compose substitutes at runtime.\n# - the worker is outbound-only (polls the coordinator); no inbound ports.\n# - /var/run/dstack.sock is provided by dstack inside the CVM (TDX quotes).\n# - single worker service, no compiler sidecar (COMPILATION_ENABLED=false); no docker.sock —\n#   execution is in-process wasmedge.\n\nservices:\n  worker:\n    image: docker.io/outlayer/near-outlayer-worker@sha256:33762e11c4fbc2dfda9728a9498930f0eaa1181a771af195c3d495969c639259\n    restart: on-failure:5\n    # A soft stop (`worker-ctl.sh stop`, i.e. `vmm stop` without -f) sends SIGTERM:\n    # the worker takes no new task, finishes the one in hand and exits 0. 85 s covers\n    # one 30 s poll plus p99.9 of a task (35 s on mainnet) and stays under the\n    # guest systemd's 90 s stop timeout.\n    stop_grace_period: 85s\n    environment:\n      API_BASE_URL: ${API_BASE_URL}\n      API_AUTH_TOKEN: ${API_AUTH_TOKEN}\n      NEAR_RPC_URL: ${NEAR_RPC_URL}\n      OFFCHAINVM_CONTRACT_ID: ${OFFCHAINVM_CONTRACT_ID}\n      OPERATOR_ACCOUNT_ID: ${OPERATOR_ACCOUNT_ID}\n      # In TEE mode the operator key is generated at registration; only set for legacy mode.\n      OPERATOR_PRIVATE_KEY: ${OPERATOR_PRIVATE_KEY:-}\n      TEE_MODE: ${TEE_MODE}\n      USE_TEE_REGISTRATION: ${USE_TEE_REGISTRATION}\n      # Signature scheme for the on-chain worker key: ed25519 (default) or ml-dsa-65.\n      WORKER_KEY_TYPE: ${WORKER_KEY_TYPE:-ed25519}\n      COMPILATION_ENABLED: ${COMPILATION_ENABLED}\n      # NOTE: do NOT pass COMPILATION_MODE to an EXECUTION worker. The worker rejects\n      # COMPILATION_MODE=native + EXECUTION_ENABLED=true (a native compiler could exfiltrate\n      # env secrets). This is an execution-only worker (COMPILATION_ENABLED=false), so leave\n      # COMPILATION_MODE unset for an execution-only worker. (The env file may still\n      # carry it harmlessly; the worker only sees what this compose passes.)\n      EXECUTION_ENABLED: ${EXECUTION_ENABLED}\n      # Init account pays gas for worker registration when USE_TEE_REGISTRATION=true.\n      INIT_ACCOUNT_ID: ${INIT_ACCOUNT_ID:-}\n      INIT_ACCOUNT_PRIVATE_KEY: ${INIT_ACCOUNT_PRIVATE_KEY:-}\n      KEYSTORE_BASE_URLS: ${KEYSTORE_BASE_URLS:-}\n      # Routes this node will not run (`<project>:<operation>`, comma-separated) —\n      # the node's geography, declared by the operator; the coordinator hands\n      # those tasks to another worker. Passed through here or the worker never\n      # sees it: this compose lists every variable the container gets.\n      EXECUTE_EXCLUDES: ${EXECUTE_EXCLUDES:-}\n      KEYSTORE_AUTH_TOKEN: ${KEYSTORE_AUTH_TOKEN:-}\n      RUST_LOG: ${RUST_LOG:-info}\n      SAVE_SYSTEM_HIDDEN_LOGS_TO_DEBUG: ${SAVE_SYSTEM_HIDDEN_LOGS_TO_DEBUG:-false}\n      PRINT_WASM_STDERR: ${PRINT_WASM_STDERR:-false}\n      ENABLE_EVENT_MONITOR: ${ENABLE_EVENT_MONITOR:-false}\n      NEARDATA_API_URL: ${NEARDATA_API_URL:-}\n      FASTNEAR_API_URL: ${FASTNEAR_API_URL:-}\n      START_BLOCK_HEIGHT: ${START_BLOCK_HEIGHT:-0}\n      WASM_CACHE_MAX_SIZE_MB: ${WASM_CACHE_MAX_SIZE_MB:-100}\n      POLL_TIMEOUT_SECONDS: 30\n    volumes:\n      - /var/run/dstack.sock:/var/run/dstack.sock:ro\n",
    "kms_enabled": true,
    "gateway_enabled": false,
    "local_key_provider_enabled": false,
    "key_provider_id": "",
    "public_logs": true,
    "public_sysinfo": false,
    "allowed_envs": [
        "API_BASE_URL",
        "API_AUTH_TOKEN",
        "NEAR_RPC_URL",
        "NEARDATA_API_URL",
        "FASTNEAR_API_URL",
        "START_BLOCK_HEIGHT",
        "OFFCHAINVM_CONTRACT_ID",
        "OPERATOR_ACCOUNT_ID",
        "TEE_MODE",
        "USE_TEE_REGISTRATION",
        "EXECUTION_ENABLED",
        "COMPILATION_ENABLED",
        "COMPILATION_MODE",
        "ENABLE_EVENT_MONITOR",
        "INIT_ACCOUNT_ID",
        "INIT_ACCOUNT_PRIVATE_KEY",
        "WORKER_KEY_TYPE",
        "KEYSTORE_AUTH_TOKEN",
        "RUST_LOG",
        "WASM_CACHE_MAX_SIZE_MB",
        "SAVE_SYSTEM_HIDDEN_LOGS_TO_DEBUG",
        "PRINT_WASM_STDERR",
        "KEYSTORE_BASE_URLS",
        "EXECUTE_EXCLUDES"
    ],
    "no_instance_id": true,
    "secure_time": false
}
image_digests docker.io/outlayer/near-outlayer-worker@sha256:33762e11c4fbc2dfda9728a9498930f0eaa1181a771af195c3d495969c639259
4

Network — Zero Trust Gateway

TLS terminates inside the TEE — the gateway never sees plaintext.

guarded domain2ebb053d22438a7c970fc087f60787f562d63dfb-8081.dstack.outlayer.ai
5

App OS

The measured dstack guest OS image. The version is read live from each CVM's vm_config; the os_image_hash is the precise, measured OS identity. dstack releases ↗.

os_versiondstack-0.5.12
os_image_hash8db40cb23008d6213668b5816702d100b37b859a8a5bfd18d938ae3a1b3715bd
mr_aggregated2bc0f98751ab226c49f0521e130647f23b9c4927686cff5734c7c9fad10f4719
compose_hash2ebb053d22438a7c970fc087f60787f562d63dfbb334ba68ffe00c8b8bd017e1
6

KMS — deploy-time key provisioning

Deploy-time only. Governed by an on-chain contract, the dstack KMS releases this CVM's keys at boot only if its measurements are approved — those keys decrypt the deployment env file (so secrets never enter the measured compose) and provision the CVM's RA-TLS identity + disk encryption. This secures how the worker is deployed; it does not hold OutLayer's application or user secrets — those run through the OutLayer keystore (master derived in-TEE via MPC), not the dstack KMS.

key_provider kms