Intel TDX (Trust Domain Extensions) GA on 4th Gen Xeon

A dated reading of what is claimed, reported, and independently verified in the current evidence.

Current reading

Readiness band and full integer triple

AI-assisted assembly · derived results

Readiness band

Ready

Primary summary from verified readiness

Evidence strength Strong

Decision

Human editorial judgment · 2026-08-20

Adopt with guardrails

Why: TDX is now the multi-cloud GA confidential-computing baseline on Intel silicon (GCP GA 2024-09-27 on C3; Azure has supported TDX guests since 2023) and directly underpins later ecosystem-relevant work (NVIDIA H100 confidential AI, Intel TDX Connect), but production feature gaps (no live migration/Accelerated Networking/Backup on Azure, no S3/CPU-hotplug support at the kernel level) and continued side-channel research on the same silicon generation (Downfall, disclosed months after launch) mean adoption should carry explicit guardrails rather than blanket trust in the hardware root.
Next: Evaluate whether trust-authority's future attestation roadmap should target TDX/DCAP quote verification directly, given the register's own 'Intel TDX Connect' (2023-03-01) already extends this same hardware generation to GPU-attached trust domains — any TEE-based trust-root change is a Rule #29 protected surface requiring human approval before implementation.

Constraints

No named blocker is present in the current public projection.

Evidence summary

AI-assisted assembly

Counts and dates only. Raw signals, private excerpts, trust records, and internal corpus material are not published here.

Publication record

Initial public reading