[kvinwang]

KMS root keys are retained by epoch and selected from explicit authorization results. authorizeKms / authorizeApp now carry a required operation, represented by a shared serde-derived Rust enum and hashed bytes32 on chain. Known operations share the existing policy; unknown or wrong-scope operations fail closed. Self-authorization caching is operation-specific.

Preserve GetTempCaCert, its response, temporary CA persistence/renewal and the legacy handover field so KMS nodes can be upgraded before old OS images. Tokenless onboarding retains CA-issued client certificates for legacy sources. The recipient authorizes the source through authorizeKms(export_kms_keys) on the key-carrying connection; bootstrap uses its own operation before epoch-zero registration. Existing bootAuth routes remain for old KMS binaries.

Application certificate authorization uses Rust GetAppCert and JSON/on-chain operation name get_app_cert; the existing SignCert KMS RPC is unchanged.

Prior layer validation: 73 KMS, 8 Rust auth, 36 DstackKms contract tests and 116 adapter tests passed; strict production Rust Clippy passed. Local Linux x86_64, Rust 1.92.0, Solc 0.8.24 / Forge 1.8.4, synthetic certificates/policies and loopback HTTP. Full-stack validation and dependency limitations are recorded in #1533; no live TEE onboarding was exercised.