Real Nitro NSM entropy and canonical CBOR diagnostic

This is an eight-iteration diagnostic, not a seven-day delay demonstration. The frozen production parent commit is a10323dede4413fbf295916b8ad12e3dbad7514e; its only diagnostic patch sets measured iterations to eight. The resulting diagnostic commit is e006a3353dff39fbc304492eb51c76669fdf46d6. Source/config-only patch, binary entropy markers, EIF SHA256, CRC, and PCRs were checked before stopping the previously warming v2 enclave. Prior source, images, evidence and legacy deployments were preserved.

The non-debug diagnostic actually executed direct NSM GetRandom, privileged Linux entropy injection, sufficient-credit checks, and both forced CRNG reseeds before TLS initialization. Its successful startup markers are included. It then passed CPU MIDR, fresh NSM PCR4 parent binding, and live AWS DescribeInstances authenticated inside the enclave. Fresh client nonce, AWS Nitro chain/COSE signature, pinned PCR0 and actual TLS peer SPKI verified. The signed policy reported ready with eight iterations and Graviton5 verified.

A real inner-TLS GET of https://example.com/ returned HTTP200 with559 bytes. Only public diagnostic content was used, through SSH to loopback8080; there was no public Cloudflare route or application ingress to this diagnostic. The archived evidence and signed puzzle were authenticated. Native offline RandomX recovery used the copied public files and an attestation-verified key. The recovered record is canonical CBOR version3, includes the exact diagnostic software_version, and contains the identical559-byte response, SHA256 ff67a9d764d6a2367a187734e697f6a53217db9a21c101d410a113ca871a299d.

The first boot passed NSM entropy initialization but failed closed during parent credential retrieval. The parent logged no credential exception. The enclave reads a bounded credential JSON stream through EOF. The unmeasured parent helper previously closed immediately after sendall; it now performs shutdown(SHUT_WR), then waits at most5 seconds for at most1 peer byte before closing. A socketpair regression confirmed orderly EOF and slot release. The same EIF subsequently passed actual hardware authentication. This establishes recovery after the change, not a proven root cause for the earlier failure. Both failure and successful boot logs are retained with hashes; no credential values, epoch key file, or solver checkpoint are included here.

These captured attestations concern their signed timestamps and sessions. Archived evidence does not establish present liveness or seven-day completion.