vta-tee

The VTA's TEE (Trusted Execution Environment) bootstrap subsystem, extracted from vta-service. Only the vta-enclave binary exercises it at runtime; the local/dev VTA builds it behind the tee feature.

• provider / nitro / sev_snp / simulated / detect — attestation provider abstraction and the concrete backends.
• kms_bootstrap — KMS attest/decrypt, JWT-fingerprint check, storage-key derivation, and the CMS unwrap (aws-lc-rs).
• anchor — the DynamoDB-backed anti-rollback anchor MAC.
• admin_bootstrap — Mode-B first-boot admin provisioning + the single-use carve-out.
• did_autogen — first-boot DID autogeneration.
• mnemonic_guard — the one-shot, timed, zeroized mnemonic export window.

Depends only on the extracted leaf/foundation crates (vti-common, vta-keyspaces, vta-config, vta-keys, vta-support) plus the AWS SDK / crypto stack — never on vta-service. vta-service re-exports it as crate::tee (behind the tee feature), so vta_service::tee::… keeps resolving for vta-enclave and every existing call site.

Part of the Verifiable Trust Infrastructure workspace. Apache-2.0.