docs: warn about debug-mode PCR attestations

README.md

@@ -172,7 +172,8 @@ integrator (see [docs](docs/hinted-p384-nitro-attestation.md#integrator-responsi
   integrators must still never use attestation signatures as uniqueness keys; dedupe on canonical
   attestation fields instead.
 - **Enclave policy** — checking `pcrs` / `moduleID` against the enclave image(s) you trust is your
-  responsibility.
+  responsibility. AWS debug-mode and attach-console attestations contain all-zero PCR values and
+  must not be trusted for production cryptographic attestation.
 - **Revocation operations** — the contract enforces the on-chain revoked set, but an off-chain
   operator must monitor AWS CRLs and submit the affected certificate identity keys
   (`keccak256(issuerHash, serialHash)`, computed via `computeCertId` or directly from the CRL's

docs/hinted-p384-nitro-attestation.md

@@ -603,7 +603,9 @@ deliberately left to the caller and must be handled in the consuming contract:
   `attestationTbs + signature`, or its hash) as a unique key — dedupe on canonical
   attestation fields (e.g. `moduleID + timestamp + nonce`).
 - **Enclave-image / PCR policy.** The contract returns the parsed `pcrs` and
-  `moduleID`; deciding which enclave images you trust is application policy.
+  `moduleID`; deciding which enclave images you trust is application policy. AWS
+  debug-mode and attach-console attestations have all-zero PCR values and must not
+  be used for production cryptographic attestation.
 - **CRL monitoring.** `CertManager` enforces the certificate identity keys that have been
   marked revoked on-chain, but it does not fetch or parse AWS CRLs. A trusted off-chain
   operator must monitor AWS CRLs and submit `revokeCert` / `revokeCerts` transactions

src/NitroValidator.sol

@@ -110,7 +110,8 @@ contract NitroValidator {
     ///        so do not use `signature` (or its hash) as a uniqueness key — dedupe on attestation
     ///        fields instead.
     ///      - PCR / moduleID policy: the caller must check `ptrs.pcrs` / `ptrs.moduleID` against the
-    ///        enclave image(s) they trust.
+    ///        enclave image(s) they trust. AWS debug-mode and attach-console attestations have
+    ///        all-zero PCR values and must not be trusted for production cryptographic attestation.
     /// @param attestationTbs The COSE Sign1 to-be-signed bytes (from `decodeAttestationTbs`).
     /// @param signature The 96-byte (r||s) P-384 attestation signature.
     /// @param attestationSigHints Off-chain inverse hints for the attestation signature; re-verified