@cofy-x/axern-sdk 0.5.1 → 0.7.0

package/dist/proto/axern/control/admin/v1/reliability.proto

@@ -26,45 +26,8 @@ enum ConsistencyIssueSeverity {
 
 enum ConsistencyIssueCode {
   CONSISTENCY_ISSUE_CODE_UNSPECIFIED = 0;
-  CONSISTENCY_ISSUE_CODE_ACTIVE_RESERVATION_MISSING_ALLOCATION = 1;
-  CONSISTENCY_ISSUE_CODE_ACTIVE_RESERVATION_ON_ENDED_ALLOCATION = 2;
-  CONSISTENCY_ISSUE_CODE_ACTIVE_RESERVATION_ALLOCATION_MISMATCH = 3;
-  CONSISTENCY_ISSUE_CODE_ACTIVE_LEASE_MISSING_ALLOCATION = 4;
-  CONSISTENCY_ISSUE_CODE_ACTIVE_LEASE_ON_ENDED_ALLOCATION = 5;
-  CONSISTENCY_ISSUE_CODE_ACTIVE_LEASE_ALLOCATION_NODE_MISMATCH = 6;
-  CONSISTENCY_ISSUE_CODE_ACTIVE_TUNNEL_MISSING_ALLOCATION = 7;
-  CONSISTENCY_ISSUE_CODE_ACTIVE_TUNNEL_ON_ENDED_ALLOCATION = 8;
-  CONSISTENCY_ISSUE_CODE_ACTIVE_TUNNEL_ALLOCATION_NODE_MISMATCH = 9;
-  CONSISTENCY_ISSUE_CODE_SERVICE_REFERENCE_MISSING_ALLOCATION = 10;
-  CONSISTENCY_ISSUE_CODE_SERVICE_REFERENCE_ENDED_ALLOCATION = 11;
-  CONSISTENCY_ISSUE_CODE_SERVICE_REFERENCE_OWNER_MISMATCH = 12;
-}
-
-enum ConsistencyRepairOwner {
-  CONSISTENCY_REPAIR_OWNER_UNSPECIFIED = 0;
-  CONSISTENCY_REPAIR_OWNER_WORKLOAD_CONTROLLER = 1;
-  CONSISTENCY_REPAIR_OWNER_NODE_LIFECYCLE = 2;
-  CONSISTENCY_REPAIR_OWNER_TUNNEL_CONTROLLER = 3;
-  CONSISTENCY_REPAIR_OWNER_SERVICE_CONTROLLER = 4;
-  CONSISTENCY_REPAIR_OWNER_ADMIN_OPERATOR_TRIAGE = 5;
-}
-
-enum ConsistencyRepairAction {
-  CONSISTENCY_REPAIR_ACTION_UNSPECIFIED = 0;
-  CONSISTENCY_REPAIR_ACTION_WORKLOAD_CLEANUP = 1;
-  CONSISTENCY_REPAIR_ACTION_WORKLOAD_CLEANUP_AND_READMIT = 2;
-  CONSISTENCY_REPAIR_ACTION_NODE_LIFECYCLE_RECONCILE = 3;
-  CONSISTENCY_REPAIR_ACTION_TUNNEL_LIFECYCLE_RECONCILE = 4;
-  CONSISTENCY_REPAIR_ACTION_SERVICE_RECONCILE = 5;
-  CONSISTENCY_REPAIR_ACTION_ADMIN_TRIAGE = 6;
-}
-
-enum ConsistencyRepairTargetType {
-  CONSISTENCY_REPAIR_TARGET_TYPE_UNSPECIFIED = 0;
-  CONSISTENCY_REPAIR_TARGET_TYPE_ALLOCATION = 1;
-  CONSISTENCY_REPAIR_TARGET_TYPE_RUN = 2;
-  CONSISTENCY_REPAIR_TARGET_TYPE_SERVICE = 3;
-  CONSISTENCY_REPAIR_TARGET_TYPE_TUNNEL_SESSION = 4;
+  CONSISTENCY_ISSUE_CODE_ACTIVE_ACCESS_GRANT_ON_ENDED_ALLOCATION = 1;
+  CONSISTENCY_ISSUE_CODE_ACTIVE_TUNNEL_ON_ENDED_ALLOCATION = 2;
 }
 
 enum AdminReliabilitySignalCode {
@@ -72,14 +35,12 @@ enum AdminReliabilitySignalCode {
   ADMIN_RELIABILITY_SIGNAL_CODE_CONSISTENCY_ISSUES = 1;
   ADMIN_RELIABILITY_SIGNAL_CODE_ALLOCATION_LIFECYCLE_RETRIES = 2;
   ADMIN_RELIABILITY_SIGNAL_CODE_RECONCILE_FAILURES = 3;
-  ADMIN_RELIABILITY_SIGNAL_CODE_STORAGE_BINDINGS = 4;
-  ADMIN_RELIABILITY_SIGNAL_CODE_NODE_VOLUME_MANAGERS = 5;
-  ADMIN_RELIABILITY_SIGNAL_CODE_NODE_FLEET = 6;
+  ADMIN_RELIABILITY_SIGNAL_CODE_NODE_FLEET = 4;
 }
 
 message ConsistencyCounts {
-  int64 active_reservations = 1;
-  int64 active_leases = 2;
+  int64 active_allocations = 1;
+  int64 active_access_grants = 2;
   int64 active_tunnels = 3;
   int64 allocation_lifecycle_retries = 4;
   int64 issues = 5;
@@ -89,16 +50,10 @@ message ConsistencyIssue {
   ConsistencyIssueCode code = 1;
   ConsistencyIssueSeverity severity = 2;
   string allocation_id = 3;
-  string owner_type = 4;
-  string owner_id = 5;
-  string node_id = 6;
-  string status = 7;
-  string detail = 8;
-  ConsistencyRepairOwner repair_owner = 9;
-  ConsistencyRepairAction repair_action = 10;
-  bool automatic_repair = 11;
-  ConsistencyRepairTargetType repair_target_type = 12;
-  string repair_target_id = 13;
+  string run_id = 4;
+  string node_id = 5;
+  string status = 6;
+  string detail = 7;
 }
 
 message ConsistencySnapshot {
@@ -120,10 +75,8 @@ message AdminReliabilityHealth {
   int64 due_allocation_lifecycle_retries = 4;
   int64 reconcile_unhealthy_components = 5;
   repeated AdminReliabilitySignal signals = 6;
-  AdminNodeVolumeHealth node_volume_health = 7;
-  AdminStorageBindingHealth storage_binding_health = 8;
-  repeated ReconcileComponentHealth reconcile_components = 9;
-  AdminNodeFleetHealth node_fleet_health = 10;
+  repeated ReconcileComponentHealth reconcile_components = 7;
+  AdminNodeFleetHealth node_fleet_health = 8;
 }
 
 message ReconcileComponentHealth {
@@ -148,14 +101,6 @@ message GetAdminReliabilityHealthResponse {
   AdminReliabilityHealth health = 1;
 }
 
-message AdminNodeVolumeHealth {
-  int64 unhealthy_nodes = 1;
-  int64 published_volumes = 2;
-  int64 last_reconcile_stale_allocations = 3;
-  int64 last_reconcile_invalid_volumes = 4;
-  string error = 5;
-}
-
 message AdminNodeFleetHealth {
   int64 active_nodes = 1;
   int64 ready_nodes = 2;
@@ -166,18 +111,6 @@ message AdminNodeFleetHealth {
   string error = 7;
 }
 
-message AdminStorageBindingHealth {
-  bool unavailable = 1;
-  string error = 2;
-  int64 failed_bindings = 3;
-  int64 releasing_bindings = 4;
-  int64 stuck_releasing_bindings = 5;
-  int64 inconsistent_claims = 6;
-  int64 invalid_bindings = 7;
-  int64 deleting_claims = 8;
-  int64 stuck_deleting_claims = 9;
-}
-
 service AdminReliability {
   rpc CheckConsistency(CheckConsistencyRequest) returns (CheckConsistencyResponse) {}
   rpc GetAdminReliabilityHealth(GetAdminReliabilityHealthRequest) returns (GetAdminReliabilityHealthResponse) {}

package/dist/proto/axern/control/capability/v1/capability.proto

@@ -11,23 +11,22 @@ import "google/protobuf/timestamp.proto";
 // claims; only the owning observed-capability provider may publish them.
 enum PlatformCapability {
   PLATFORM_CAPABILITY_UNSPECIFIED = 0;
-  PLATFORM_CAPABILITY_PORT_FORWARDING = 1;
-  PLATFORM_CAPABILITY_NETWORK_BRIDGE = 2;
-  PLATFORM_CAPABILITY_NETWORK_BPFNET = 3;
-  PLATFORM_CAPABILITY_CGROUP_V2_MEMORY_CONTROLLER = 4;
-  PLATFORM_CAPABILITY_RUNC_MEMORY_HARD_LIMIT = 5;
-  PLATFORM_CAPABILITY_RUNSC_MEMORY_HARD_LIMIT = 6;
-  PLATFORM_CAPABILITY_FILESTORE_OVERLAYFS_UPPER = 7;
-  PLATFORM_CAPABILITY_XFS_PROJECT_QUOTA = 8;
-  PLATFORM_CAPABILITY_RUNC_EPHEMERAL_STORAGE_HARD_LIMIT = 9;
-  PLATFORM_CAPABILITY_RUNSC_EPHEMERAL_STORAGE_HARD_LIMIT = 10;
-  PLATFORM_CAPABILITY_ROOTFS_LOWER_EROFS = 11;
-  // Provider facts consumed by the catalog's derived workload capabilities.
+  PLATFORM_CAPABILITY_NETWORK_BRIDGE = 1;
+  PLATFORM_CAPABILITY_NETWORK_BPFNET = 2;
+  PLATFORM_CAPABILITY_CGROUP_V2_MEMORY_CONTROLLER = 3;
+  PLATFORM_CAPABILITY_RUNSC_MEMORY_HARD_LIMIT = 4;
+  PLATFORM_CAPABILITY_FILESTORE_OVERLAYFS_UPPER = 5;
+  PLATFORM_CAPABILITY_RUNSC_EPHEMERAL_STORAGE_HARD_LIMIT = 6;
+  PLATFORM_CAPABILITY_ROOTFS_LOWER_EROFS = 7;
+  // Provider facts consumed by derived workload capability definitions.
   // They are not valid workload requirements on their own.
-  PLATFORM_CAPABILITY_RUNC_MEMORY_ENFORCEMENT_SELF_TEST = 12;
-  PLATFORM_CAPABILITY_RUNSC_MEMORY_ENFORCEMENT_SELF_TEST = 13;
-  PLATFORM_CAPABILITY_RUNC_EPHEMERAL_ENFORCEMENT_SELF_TEST = 14;
-  PLATFORM_CAPABILITY_RUNSC_EPHEMERAL_ENFORCEMENT_SELF_TEST = 15;
+  PLATFORM_CAPABILITY_RUNSC_MEMORY_ENFORCEMENT_SELF_TEST = 8;
+  PLATFORM_CAPABILITY_RUNSC_EPHEMERAL_ENFORCEMENT_SELF_TEST = 9;
+  PLATFORM_CAPABILITY_EGRESSD_DNS_POLICY_SELF_TEST = 10;
+  PLATFORM_CAPABILITY_EGRESSD_STRICT_EGRESS_SELF_TEST = 11;
+  // Workload-facing capabilities derived from the egressd self-test facts.
+  PLATFORM_CAPABILITY_DNS_POLICY_ENFORCEMENT = 12;
+  PLATFORM_CAPABILITY_STRICT_EGRESS_ENFORCEMENT = 13;
 }
 
 message ExtensionCapability {
@@ -58,10 +57,9 @@ enum CapabilityProvider {
   CAPABILITY_PROVIDER_CONFIG = 1;
   CAPABILITY_PROVIDER_HOST_CGROUP = 2;
   CAPABILITY_PROVIDER_FILESTORE = 3;
-  CAPABILITY_PROVIDER_RUNC_SELF_TEST = 4;
-  CAPABILITY_PROVIDER_RUNSC_SELF_TEST = 5;
-  CAPABILITY_PROVIDER_NETWORK_HEALTH = 6;
-  CAPABILITY_PROVIDER_DERIVED = 7;
+  CAPABILITY_PROVIDER_RUNSC_SELF_TEST = 4;
+  CAPABILITY_PROVIDER_NETWORK_HEALTH = 5;
+  CAPABILITY_PROVIDER_DERIVED = 6;
 }
 
 enum CapabilityReasonCode {
@@ -77,10 +75,6 @@ enum CapabilityReasonCode {
   CAPABILITY_REASON_CODE_ENFORCEMENT_LOST = 9;
 }
 
-message ConfigEvidenceIdentity {
-  string config_digest = 1;
-}
-
 message BootEvidenceIdentity {
   string boot_id = 1;
 }
@@ -92,72 +86,35 @@ message MountEvidenceIdentity {
 
 message RuntimeEvidenceIdentity {
   string boot_id = 1;
-  string runtime_name = 2;
-  string runtime_binary_digest = 3;
-  string runtime_config_digest = 4;
-}
-
-message DerivedEvidenceIdentity {
-  string catalog_digest = 1;
-  // Canonical digest of the typed evidence identities for every catalog
-  // dependency. This makes the derived subject change when its mount,
-  // runtime, boot, or config subjects change without treating a normal TTL
-  // refresh as a new identity.
-  string dependency_evidence_digest = 2;
+  string runtime_binary_digest = 2;
+  string runtime_config_digest = 3;
 }
 
-// CapabilityEvidence identifies the concrete subject that was probed. Its
-// identity is orthogonal to observation freshness: a mount or runtime proof
-// may still require valid_until even though its subject identity is stable.
+// CapabilityEvidence identifies the concrete host subject that was inspected.
+// It is descriptive evidence, not an identity, version, or cryptographic
+// proof. Derived and configuration capabilities need no additional evidence.
 message CapabilityEvidence {
-  string evidence_id = 1;
   oneof identity {
-    ConfigEvidenceIdentity config = 2;
-    BootEvidenceIdentity boot = 3;
-    MountEvidenceIdentity mount = 4;
-    RuntimeEvidenceIdentity runtime = 5;
-    DerivedEvidenceIdentity derived = 6;
+    BootEvidenceIdentity boot = 1;
+    MountEvidenceIdentity mount = 2;
+    RuntimeEvidenceIdentity runtime = 3;
   }
 }
 
-// CapabilityObservationProof is the durable, non-recursive proof selected
-// from a snapshot. Dependencies are represented as one bounded flat proof set
-// so persistence and validation remain bounded.
-message CapabilityObservationProof {
+message CapabilityObservation {
   CapabilityKey key = 1;
-  string observation_id = 2;
+  CapabilityState state = 2;
   CapabilityProvider provider = 3;
   google.protobuf.Timestamp observed_at = 4;
   google.protobuf.Timestamp valid_until = 5;
   CapabilityEvidence evidence = 6;
-}
-
-message CapabilityObservation {
-  CapabilityKey key = 1;
-  CapabilityState state = 2;
-  CapabilityProvider provider = 3;
-  string observation_id = 4;
-  google.protobuf.Timestamp observed_at = 5;
-  google.protobuf.Timestamp valid_until = 6;
-  CapabilityEvidence evidence = 7;
-  repeated CapabilityObservationProof dependencies = 8;
-  CapabilityReasonCode reason_code = 9;
-  string reason = 10;
+  CapabilityReasonCode reason_code = 7;
+  string reason = 8;
 }
 
 message CapabilitySnapshot {
-  string node_instance_id = 1;
-  int64 sequence = 2;
-  string snapshot_id = 3;
-  google.protobuf.Timestamp collected_at = 4;
-  repeated CapabilityObservation observations = 5;
-}
-
-message CapabilitySnapshotReference {
-  string node_instance_id = 1;
-  int64 sequence = 2;
-  string snapshot_id = 3;
-  google.protobuf.Timestamp collected_at = 4;
+  google.protobuf.Timestamp collected_at = 1;
+  repeated CapabilityObservation observations = 2;
 }
 
 message ExtensionCapabilityRequirement {
@@ -171,18 +128,9 @@ enum CapabilityLossPolicy {
   CAPABILITY_LOSS_POLICY_FAIL_STOP = 3;
 }
 
-message CapabilityDependency {
+message CapabilityRequirement {
   CapabilityKey key = 1;
   CapabilityLossPolicy loss_policy = 2;
-  CapabilitySnapshotReference selected_snapshot = 3;
-  CapabilityObservationProof selected_observation = 4;
-  repeated CapabilityObservationProof dependency_observations = 5;
-}
-
-// CapabilityDependencySet is the durable representation stored with an
-// allocation. A wrapper keeps JSON persistence on the canonical proto shape.
-message CapabilityDependencySet {
-  repeated CapabilityDependency dependencies = 1;
 }
 
 enum CapabilityConditionState {
@@ -198,12 +146,9 @@ message CapabilityCondition {
   CapabilityConditionState state = 2;
   CapabilityReasonCode reason_code = 3;
   string message = 4;
-  google.protobuf.Timestamp observed_at = 5;
-  CapabilityObservationProof proof = 6;
 }
 
 message CapabilityConditionSet {
-  int64 revision = 1;
-  google.protobuf.Timestamp observed_at = 2;
-  repeated CapabilityCondition conditions = 3;
+  google.protobuf.Timestamp observed_at = 1;
+  repeated CapabilityCondition conditions = 2;
 }

package/dist/proto/axern/control/common/v1/common.proto

@@ -4,21 +4,18 @@ package axern.control.common.v1;
 
 option go_package = "github.com/cofy-x/axern/sdk/go/gen/axern/control/common/v1;commonv1";
 
-import "google/protobuf/timestamp.proto";
 import "axern/control/capability/v1/capability.proto";
-import "axern/control/storage/v1/storage_types.proto";
 
 message ResourceQuantity {
   int64 cpu_milli = 1;
   // Total sandbox memory budget. requests.memory_bytes is the placement,
-  // reservation, and namespace-quota commitment. limits.memory_bytes is the
+  // node-capacity charge and namespace-quota commitment. limits.memory_bytes is the
   // host cgroup v2 hard boundary and includes runtime processes, guest
   // accounting, kernel memory, shmem, and charged file/page cache.
   int64 memory_bytes = 2;
   // Sandbox-lifetime node-local disposable storage managed by Axern. The
   // current accounting scope is the runtime writable root overlay and its
-  // metadata/copy-up/whiteouts; persistent volumes and immutable image data
-  // are excluded.
+  // metadata/copy-up/whiteouts; immutable image data is excluded.
   int64 ephemeral_storage_bytes = 3;
 }
 
@@ -27,19 +24,6 @@ message ResourceSpec {
   ResourceQuantity limits = 2;
 }
 
-enum PortProtocol {
-  PORT_PROTOCOL_UNSPECIFIED = 0;
-  PORT_PROTOCOL_TCP = 1;
-  PORT_PROTOCOL_UDP = 2;
-}
-
-message PortSpec {
-  string name = 1;
-  PortProtocol protocol = 2;
-  int32 container_port = 3;
-  int32 host_port = 4;
-}
-
 enum NetworkMode {
   NETWORK_MODE_UNSPECIFIED = 0;
   NETWORK_MODE_DEFAULT = 1;
@@ -49,6 +33,49 @@ enum NetworkMode {
 
 message NetworkSpec {
   NetworkMode mode = 1;
+  NetworkEgressPolicy egress_policy = 2;
+}
+
+// NetworkEgressPolicy deliberately separates strict enforcement from the
+// DNS-only convenience policy. Callers must not treat dns_deny as an egress
+// security boundary: direct IP traffic, encrypted DNS, and already-known
+// addresses remain outside that policy.
+message NetworkEgressPolicy {
+  oneof policy {
+    StrictEgressPolicy strict = 1;
+    DnsDenyPolicy dns_deny = 2;
+  }
+}
+
+// StrictEgressPolicy is default-deny. Domain grants authorize HTTP and HTTPS
+// only, on TCP ports 80 and 443, and require controlled DNS plus matching HTTP
+// Host or TLS SNI. Other protocols require an explicit CIDR rule.
+message StrictEgressPolicy {
+  repeated string allowed_domains = 1;
+  repeated CIDREgressRule allowed_cidrs = 2;
+}
+
+// DnsDenyPolicy returns REFUSED for matching conventional UDP/TCP DNS queries.
+// It does not block direct IP traffic, DoH, DoT, or previously resolved IPs.
+message DnsDenyPolicy {
+  repeated string denied_domains = 1;
+}
+
+enum EgressProtocol {
+  EGRESS_PROTOCOL_UNSPECIFIED = 0;
+  EGRESS_PROTOCOL_TCP = 1;
+  EGRESS_PROTOCOL_UDP = 2;
+}
+
+message PortRange {
+  uint32 start = 1;
+  uint32 end = 2;
+}
+
+message CIDREgressRule {
+  string cidr = 1;
+  EgressProtocol protocol = 2;
+  repeated PortRange ports = 3;
 }
 
 message PlacementConstraints {
@@ -70,71 +97,38 @@ message SecretFile {
   bool optional = 5;
 }
 
-message ServiceVolumeMount {
-  string name = 1;
-  string target = 2;
-  bool readonly = 3;
-  repeated string options = 4;
-  axern.control.storage.v1.VolumeReclaimPolicy reclaim_policy = 5;
-}
-
 message ImageMount {
   string image = 1;
   string target = 2;
   bool readonly = 3;
 }
 
-message WorkspaceImageVariant {
-  string format = 1;
-  string image = 2;
-}
-
-message WorkspaceImageSource {
-  repeated WorkspaceImageVariant variants = 1;
-  string source_path = 2;
-  string target = 3;
-}
-
-// WorkspacePreparationFacts records the node-observed preparation result for
-// one allocation's immutable TaskSet workspace. These facts describe the
-// variant that was actually selected by the node, not the variant preference
-// declared by the client.
-message WorkspacePreparationFacts {
-  string payload_format = 1;
-  string payload_digest = 2;
-  bool cache_hit = 3;
-  int64 image_resolve_ms = 4;
-  int64 image_pull_ms = 5;
-  int64 cow_prepare_ms = 6;
-}
-
 message ExecutionConfig {
   repeated string argv = 1;
   map<string, string> env = 2;
   string cwd = 3;
   ResourceSpec resources = 4;
-  repeated PortSpec ports = 5;
-  NetworkSpec network = 6;
-  repeated axern.control.capability.v1.ExtensionCapabilityRequirement extension_capability_requirements = 7;
-  PlacementConstraints placement = 8;
-  repeated SecretEnvVar secret_env = 9;
-  repeated SecretFile secret_files = 10;
-  repeated ServiceVolumeMount volume_mounts = 11;
-  string runtime_class = 12;
-  repeated ImageMount image_mounts = 13;
-  WorkspaceImageSource workspace_image = 14;
-}
-
-enum AllocationStatus {
-  ALLOCATION_STATUS_UNSPECIFIED = 0;
-  ALLOCATION_STATUS_RESERVED = 1;
-  ALLOCATION_STATUS_BOUND = 2;
-  ALLOCATION_STATUS_STARTING = 3;
-  ALLOCATION_STATUS_RUNNING = 4;
-  ALLOCATION_STATUS_EXITED = 5;
-  ALLOCATION_STATUS_FAILED = 6;
-  ALLOCATION_STATUS_RELEASING = 7;
-  ALLOCATION_STATUS_RELEASED = 8;
+  NetworkSpec network = 5;
+  repeated axern.control.capability.v1.ExtensionCapabilityRequirement extension_capability_requirements = 6;
+  PlacementConstraints placement = 7;
+  repeated SecretEnvVar secret_env = 8;
+  repeated SecretFile secret_files = 9;
+  repeated ImageMount image_mounts = 10;
+}
+
+// AllocationLifecycleState tracks only placement and infrastructure cleanup.
+// Workload outcome, exit status, diagnostics, and user-visible status belong to
+// the owning Run.
+enum AllocationLifecycleState {
+  ALLOCATION_LIFECYCLE_STATE_UNSPECIFIED = 0;
+  ALLOCATION_LIFECYCLE_STATE_BOUND = 1;
+  ALLOCATION_LIFECYCLE_STATE_STARTING = 2;
+  ALLOCATION_LIFECYCLE_STATE_ACTIVE = 3;
+  // STOPPED is a node observation. Controld transitions it atomically to
+  // RELEASING when it commits the owning Run result and cleanup work.
+  ALLOCATION_LIFECYCLE_STATE_STOPPED = 4;
+  ALLOCATION_LIFECYCLE_STATE_RELEASING = 5;
+  ALLOCATION_LIFECYCLE_STATE_RELEASED = 6;
 }
 
 enum WorkloadDiagnosticCode {
@@ -145,34 +139,10 @@ enum WorkloadDiagnosticCode {
   WORKLOAD_DIAGNOSTIC_CODE_NODE_SELECTION_ERROR = 4;
   WORKLOAD_DIAGNOSTIC_CODE_RUNTIME_START_ERROR = 5;
   WORKLOAD_DIAGNOSTIC_CODE_PROCESS_EXITED = 6;
-  WORKLOAD_DIAGNOSTIC_CODE_LIVENESS_PROBE_FAILED = 7;
-  WORKLOAD_DIAGNOSTIC_CODE_ADMISSION_BLOCKED = 8;
-  WORKLOAD_DIAGNOSTIC_CODE_STORAGE_TOPOLOGY_UNSATISFIED = 9;
-  WORKLOAD_DIAGNOSTIC_CODE_STORAGE_RESERVE_ERROR = 10;
-  WORKLOAD_DIAGNOSTIC_CODE_VOLUME_PUBLISH_ERROR = 11;
-  WORKLOAD_DIAGNOSTIC_CODE_VOLUME_RELEASE_ERROR = 12;
-  WORKLOAD_DIAGNOSTIC_CODE_VOLUME_SPEC_CONFLICT = 13;
-  WORKLOAD_DIAGNOSTIC_CODE_CAPABILITY_ENFORCEMENT_LOST = 14;
-  WORKLOAD_DIAGNOSTIC_CODE_MEMORY_LIMIT_EXCEEDED = 15;
-}
-
-enum LeaseType {
-  LEASE_TYPE_UNSPECIFIED = 0;
-  LEASE_TYPE_RUN = 1;
-  LEASE_TYPE_SERVICE = 2;
-  LEASE_TYPE_INVOKE = 3;
-}
-
-message ExecutionLease {
-  string lease_id = 1;
-  string allocation_id = 2;
-  string node_id = 3;
-  int64 attempt = 4;
-  LeaseType lease_type = 5;
-  string plaintext_token = 6;
-  int64 revision = 7;
-  google.protobuf.Timestamp expires_at = 8;
-  bool revoked = 9;
-  string node_target = 10;
-  string validation_token_hash = 11;
+  WORKLOAD_DIAGNOSTIC_CODE_ADMISSION_BLOCKED = 7;
+  WORKLOAD_DIAGNOSTIC_CODE_CAPABILITY_ENFORCEMENT_LOST = 8;
+  WORKLOAD_DIAGNOSTIC_CODE_MEMORY_LIMIT_EXCEEDED = 9;
+  WORKLOAD_DIAGNOSTIC_CODE_EXECUTION_LEASE_EXPIRED = 10;
+  WORKLOAD_DIAGNOSTIC_CODE_OPERATOR_FORCE_TERMINATED = 11;
+  WORKLOAD_DIAGNOSTIC_CODE_OPERATOR_FORCE_CLEANUP = 12;
 }

package/dist/proto/axern/control/environment/v1/environment.proto

@@ -4,14 +4,45 @@ package axern.control.environment.v1;
 
 option go_package = "github.com/cofy-x/axern/sdk/go/gen/axern/control/environment/v1;environmentv1";
 
-import "axern/control/catalog/v1/catalog.proto";
 import "google/protobuf/timestamp.proto";
 
+message EnvironmentMount {
+  string type = 1;
+  string source = 2;
+  string target = 3;
+  repeated string options = 4;
+}
+
+message OciImageDescriptor {
+  string digest = 1;
+  string media_type = 2;
+  int64 size_bytes = 3;
+  map<string, string> annotations = 4;
+}
+
+message OciBaselinePolicy {
+  repeated string capabilities = 1;
+  uint64 no_file_limit = 2;
+}
+
+message OciExecutionProfile {
+  OciBaselinePolicy baseline = 1;
+}
+
+message ResolvedEnvironmentSpec {
+  bool rootfs_readonly = 1;
+  repeated string image_default_argv = 2;
+  string default_cwd = 3;
+  map<string, string> default_env = 4;
+  repeated EnvironmentMount mounts = 5;
+  OciImageDescriptor image_descriptor = 6;
+  OciExecutionProfile execution_profile = 7;
+}
+
 message EnvironmentImageSource {
   string ref = 1;
-  string digest = 2;
-  bool rootfs_readonly = 3;
-  string registry_credential_id = 4;
+  bool rootfs_readonly = 2;
+  string registry_credential_id = 3;
 }
 
 message EnvironmentSpec {
@@ -21,35 +52,20 @@ message EnvironmentSpec {
   EnvironmentImageSource image = 4;
 }
 
-enum EnvironmentStatus {
-  ENVIRONMENT_STATUS_UNSPECIFIED = 0;
-  ENVIRONMENT_STATUS_PENDING = 1;
-  ENVIRONMENT_STATUS_READY = 2;
-  ENVIRONMENT_STATUS_FAILED = 3;
-  ENVIRONMENT_STATUS_DELETING = 4;
-  ENVIRONMENT_STATUS_DELETED = 5;
-}
-
 message Environment {
   string id = 1;
   string namespace = 2;
-  EnvironmentStatus status = 3;
-  EnvironmentSpec spec = 4;
-  string spec_hash = 5;
-  axern.control.catalog.v1.RuntimeTemplate resolved_template = 6;
-  map<string, string> labels = 7;
-  int64 version = 8;
-  google.protobuf.Timestamp created_at = 9;
-  google.protobuf.Timestamp updated_at = 10;
-  string message = 11;
+  EnvironmentSpec spec = 3;
+  ResolvedEnvironmentSpec resolved_spec = 4;
+  map<string, string> labels = 5;
+  google.protobuf.Timestamp created_at = 6;
 }
 
 message ListFilter {
   string namespace = 1;
-  repeated EnvironmentStatus statuses = 2;
-  map<string, string> labels = 3;
-  string cursor = 4;
-  int32 page_size = 5;
+  map<string, string> labels = 2;
+  string cursor = 3;
+  int32 page_size = 4;
 }
 
 message CreateEnvironmentRequest {