Cloud adapter: AWS/GCP/Azure instance-metadata attestation

[jeremymanning]

Description

adapters/cloud/src/main.rs (143 lines) has a cloud provider enum and CLI scaffold but no cloud SDK integration. Join and Status commands return stubs.

Requirements

• Verify instance identity via cloud metadata services:
  • AWS: IMDSv2 token → instance identity document → verify signature
  • GCP: metadata server → instance identity token → verify JWT
  • Azure: IMDS → attested data → verify signature
• Join as first-class donor with cloud-attested identity
• Report instance capabilities (CPU, GPU, memory, region, AZ)
• Handle spot/preemptible instance termination notices
• Support auto-scaling group participation

Success Criteria

• Identity verified via at least one cloud provider's metadata service
• Instance joins as attested donor node
• Capabilities reported accurately from metadata
• Spot termination notice triggers clean preemption
• Integration test on at least one real cloud instance

Testing (Principle V)

• Deploy on real AWS EC2 instance → verify IMDSv2 attestation
• Deploy on real GCP CE instance → verify metadata attestation
• Test spot termination handling (AWS spot interruption notice)

[jeremymanning]

Partially addressed by spec 004 / PR #59 — not closing. Parsers for AWS IMDSv2, GCP metadata, Azure IMDS identity documents exist. HOWEVER, no integration test exercises live cloud metadata endpoints.

Remaining work tracked here.

[jeremymanning]

Spec 005 progress — PR #61

STATUS: No change beyond spec 004 — cloud-live-tests workflow deferred.

Cloud adapter IMDS parsers (AWS/GCP/Azure) from spec 004 unchanged. T062+T063 (live IMDS fetchers + .github/workflows/cloud-live-tests.yml with workflow_dispatch gated to maintainer permission) not done — deferred because cloud credentials not available in this session's environment.

Next-session decision needed: whether to defer entirely (recommended — cloud accounts are serious plumbing) or provision AWS/GCP/Azure free-tier credentials for CI secrets. See notes/session-2026-04-19-spec-005-kickoff.md Q2.

See the notes.