From 181064545da28dfc953259d7f1ceee6e61085c60 Mon Sep 17 00:00:00 2001
From: Maxime Beauchamp <15185355+baktun14@users.noreply.github.com>
Date: Wed, 24 Jun 2026 15:02:47 -0400
Subject: [PATCH] fix(jwt): remove attestation from global managed-wallet token
 scope

PR #3353 added "attestation" to the global managed-wallet provider JWT
scope unconditionally. Field and non-TEE providers validate the scope
against an enum that does not include "attestation" and reject the entire
JWT with "JWT has invalid claims", so manifest sends fail for every managed
deployment and the deployment never goes active.

Revert the global scope back to the base set. The attestation scope is only
needed to call the provider attestationQuote endpoint, which has no consumer
on this token; it moves to a per-provider granular token for confidential
compute attestation-evidence downloads (#3359).
---
 .../deploy-web/src/hooks/useProviderJwt/useProviderJwt.spec.tsx | 2 +-
 apps/deploy-web/src/hooks/useProviderJwt/useProviderJwt.ts      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/apps/deploy-web/src/hooks/useProviderJwt/useProviderJwt.spec.tsx b/apps/deploy-web/src/hooks/useProviderJwt/useProviderJwt.spec.tsx
index e2dc1b6db..026bc5b75 100644
--- a/apps/deploy-web/src/hooks/useProviderJwt/useProviderJwt.spec.tsx
+++ b/apps/deploy-web/src/hooks/useProviderJwt/useProviderJwt.spec.tsx
@@ -66,7 +66,7 @@ describe(useProviderJwt.name, () => {
         ttl: 1800, // 30 * 60
         leases: {
           access: "scoped",
-          scope: ["status", "shell", "events", "logs", "send-manifest", "get-manifest", "attestation"]
+          scope: ["status", "shell", "events", "logs", "send-manifest", "get-manifest"]
         }
       }
     });
diff --git a/apps/deploy-web/src/hooks/useProviderJwt/useProviderJwt.ts b/apps/deploy-web/src/hooks/useProviderJwt/useProviderJwt.ts
index eb5a6e541..f625931a7 100644
--- a/apps/deploy-web/src/hooks/useProviderJwt/useProviderJwt.ts
+++ b/apps/deploy-web/src/hooks/useProviderJwt/useProviderJwt.ts
@@ -62,7 +62,7 @@ export function useProviderJwt({ dependencies: d = DEPENDENCIES }: { dependencie
         ttl: 30 * 60,
         leases: {
           access: "scoped",
-          scope: ["status", "shell", "events", "logs", "send-manifest", "get-manifest", "attestation"]
+          scope: ["status", "shell", "events", "logs", "send-manifest", "get-manifest"]
         }
       }
     });