Automatic recovery on the AWS parent

attested-relay-host-solvers.service follows the production artifact index on loopback port 8080 every 30 seconds. It verifies the archived Nitro evidence against the exact production PCR0, TLS/signing-key bindings and hardware policy, then starts the published 0.2.0a4 native solver for each distinct puzzle.

It runs at nice 19 / CPUWeight 1 on parent CPUs 0 and 25–31, with at most eight single-chain processes and a 24 GiB memory ceiling. Excess puzzles queue. The enclave's reserved CPUs 1–24 are excluded. The older recovery job still uses CPU 31 and can share that CPU with this service. Normal host work takes priority over recovery.

State is /var/lib/attested-relay-host-solvers, owned by the dedicated attested-relay-solver account. Manifest IDs identify append-only checkpoints, logs, manifests and recovered .key files. Existing verified keys are checked against their commitments and skipped. Failed jobs retry with their checkpoints. The service is enabled at boot and restarts on failure. Its network access is limited to loopback; it has no AWS credentials or enclave-private key access.

This adds host recovery alongside the existing old-epoch recovery and Hetzner follower. It does not publish recovered keys or decrypt/publish records. It also does not add S3 discovery/failover: rediscovery after a follower restart still requires the origin to list and serve the corresponding bundle. Already-running native solvers continue if the origin temporarily becomes unavailable.

Deployment

Install Amazon Linux's Python 3.11 and pip packages first. Copy provision.py, the unit, and measurements/commands-20260911/pypi-proof.json into one staging directory. Run the provisioner as root. It hash-checks the published ARM solver and SDK wheels, installs them in a new versioned venv, saves resolved dependency versions, and validates the unit. It refuses to replace an existing installation.

Before activation, use that venv and service account to call fetch_bundle against the loopback origin with the unit's PCR0 pin. Then:

sudo systemctl enable --now attested-relay-host-solvers.service

Check the actual native child and advancement of its checkpoint, not merely the follower's active state. Production enclave/generation must not be restarted to deploy or test this host-only service.