@cofy-x/axern-sdk 0.6.2 → 0.7.0

package/dist/node/client.js

@@ -7,11 +7,10 @@ import { uploadArchive, downloadArchive } from "./archive.js";
 import { capabilityStatus } from "./capabilities.js";
 import * as computerUse from "./computer_use.js";
 import { process as startProcess } from "./attached_process.js";
-import { processImage as startImageProcess } from "./attached_process.js";
 import { NodeClientContext } from "./context.js";
-import { exec, execImage } from "./exec.js";
+import { exec } from "./exec.js";
 import * as files from "./files.js";
-export class NodeSandboxClient {
+export class AllocationClient {
     allocationId;
     ctx;
     constructor(options) {
@@ -24,12 +23,6 @@ export class NodeSandboxClient {
     async process(command, options = {}) {
         return startProcess(this.ctx, command, options);
     }
-    async execImage(image, command, options = {}) {
-        return execImage(this.ctx, image, command, options);
-    }
-    async processImage(image, command, options = {}) {
-        return startImageProcess(this.ctx, image, command, options);
-    }
     async capabilityStatus(options = {}) {
         return capabilityStatus(this.ctx, options);
     }

package/dist/node/exec.d.ts

@@ -3,10 +3,8 @@
  * Copyright 2026 cofy-x
  * SPDX-License-Identifier: Apache-2.0
  */
-import type { Command, ExecOptions, ExecResult, ImageExecOptions, ImageProcessOptions, ProcessOptions } from "../types.js";
+import type { Command, ExecOptions, ExecResult, ProcessOptions } from "../types.js";
 import type { NodeClientContext } from "./context.js";
 export declare function exec(ctx: NodeClientContext, command: Command, options?: ExecOptions): Promise<ExecResult>;
-export declare function execImage(ctx: NodeClientContext, image: string, command: Command, options?: ImageExecOptions): Promise<ExecResult>;
 export declare function execSpec(argv: string[], options: ExecOptions | ProcessOptions): Record<string, unknown>;
-export declare function imageProcessSpec(image: string, argv: string[], options: ImageExecOptions | ImageProcessOptions): Record<string, unknown>;
 export declare function execResult(response: Record<string, unknown>): ExecResult;

package/dist/node/exec.js

@@ -25,28 +25,6 @@ export async function exec(ctx, command, options = {}) {
         throw mapRpcError(error, "sandbox exec", ctx.allocationId);
     }
 }
-export async function execImage(ctx, image, command, options = {}) {
-    if (image.trim() === "") {
-        throw new Error("image is required");
-    }
-    const argv = normalizeCommand(command);
-    try {
-        const response = await ctx.withAuthRetry(options.leaseTtlSeconds ?? 300, async (client) => unary(client, "ExecImage", ctx.authRequest({
-            spec: imageProcessSpec(image, argv, options),
-        }), options.rpcTimeoutMs));
-        const result = execResult(response);
-        if (options.check === true && result.exitCode !== 0) {
-            throw new SandboxExecError(argv, result);
-        }
-        return result;
-    }
-    catch (error) {
-        if (error instanceof SandboxExecError) {
-            throw error;
-        }
-        throw mapRpcError(error, "sandbox exec image", ctx.allocationId);
-    }
-}
 export function execSpec(argv, options) {
     return {
         argv,
@@ -57,27 +35,6 @@ export function execSpec(argv, options) {
         user: options.user ?? "",
     };
 }
-export function imageProcessSpec(image, argv, options) {
-    return {
-        image,
-        argv,
-        env: options.env ?? {},
-        cwd: options.cwd ?? "",
-        timeout_seconds: options.timeoutSeconds ?? 0,
-        tty: options.tty ?? false,
-        user: options.user ?? "",
-        mounts: imageProcessMounts(options.mounts),
-    };
-}
-function imageProcessMounts(mounts) {
-    const effective = mounts ?? [{ sandboxPath: "/workspace", targetPath: "/workspace" }];
-    return effective.map((mount) => ({
-        sandbox_path: mount.sandboxPath,
-        target_path: mount.targetPath,
-        readonly: mount.readonly ?? false,
-        options: [...(mount.options ?? [])],
-    }));
-}
 export function execResult(response) {
     const stdout = Buffer.from(response.stdout ?? []);
     const stderr = Buffer.from(response.stderr ?? []);

package/dist/proto/axern/control/admin/v1/access.proto

@@ -30,7 +30,12 @@ enum AccessRole {
   ACCESS_ROLE_NAMESPACE_ADMIN = 2;
   ACCESS_ROLE_NAMESPACE_EDITOR = 3;
   ACCESS_ROLE_NAMESPACE_VIEWER = 4;
-  ACCESS_ROLE_ROLLOUT_EXECUTOR = 5;
+}
+
+enum CredentialKind {
+  CREDENTIAL_KIND_UNSPECIFIED = 0;
+  CREDENTIAL_KIND_X509 = 1;
+  CREDENTIAL_KIND_SSH = 2;
 }
 
 message Principal {
@@ -39,19 +44,19 @@ message Principal {
   string display_name = 3;
   PrincipalKind kind = 4;
   PrincipalStatus status = 5;
-  int64 version = 6;
-  google.protobuf.Timestamp created_at = 7;
-  google.protobuf.Timestamp updated_at = 8;
+  google.protobuf.Timestamp created_at = 6;
+  google.protobuf.Timestamp updated_at = 7;
 }
 
 message PrincipalCredential {
   string credential_id = 1;
   string principal_id = 2;
   string fingerprint = 3;
-  google.protobuf.Timestamp certificate_not_after = 4;
+  google.protobuf.Timestamp expires_at = 4;
   string label = 5;
   google.protobuf.Timestamp created_at = 6;
   google.protobuf.Timestamp revoked_at = 7;
+  CredentialKind kind = 8;
 }
 
 message RoleBinding {
@@ -83,6 +88,8 @@ message AddPrincipalCredentialRequest {
   string principal_id = 1;
   bytes certificate_der = 2;
   string label = 3;
+  string ssh_public_key = 4;
+  google.protobuf.Timestamp expires_at = 5;
 }
 message AddPrincipalCredentialResponse { PrincipalCredential credential = 1; }
 

package/dist/proto/axern/control/admin/v1/audit.proto

@@ -11,27 +11,25 @@ enum AdminAuditOperation {
   ADMIN_AUDIT_OPERATION_FORCE_ALLOCATION_LIFECYCLE_RETRY = 1;
   ADMIN_AUDIT_OPERATION_FAIL_ALLOCATION_LIFECYCLE_RETRY = 2;
   ADMIN_AUDIT_OPERATION_CLEAR_ALLOCATION_LIFECYCLE_RETRY = 3;
-  ADMIN_AUDIT_OPERATION_RETRY_STORAGE_BINDING = 4;
-  ADMIN_AUDIT_OPERATION_PURGE_SERVICE = 5;
-  ADMIN_AUDIT_OPERATION_RETIRE_NODE = 6;
-  ADMIN_AUDIT_OPERATION_CREATE_PRINCIPAL = 7;
-  ADMIN_AUDIT_OPERATION_DISABLE_PRINCIPAL = 8;
-  ADMIN_AUDIT_OPERATION_ADD_CREDENTIAL = 9;
-  ADMIN_AUDIT_OPERATION_REVOKE_CREDENTIAL = 10;
-  ADMIN_AUDIT_OPERATION_GRANT_ROLE_BINDING = 11;
-  ADMIN_AUDIT_OPERATION_REVOKE_ROLE_BINDING = 12;
-  ADMIN_AUDIT_OPERATION_BOOTSTRAP_ACCESS = 13;
+  ADMIN_AUDIT_OPERATION_RETIRE_NODE = 4;
+  ADMIN_AUDIT_OPERATION_CREATE_PRINCIPAL = 5;
+  ADMIN_AUDIT_OPERATION_DISABLE_PRINCIPAL = 6;
+  ADMIN_AUDIT_OPERATION_ADD_CREDENTIAL = 7;
+  ADMIN_AUDIT_OPERATION_REVOKE_CREDENTIAL = 8;
+  ADMIN_AUDIT_OPERATION_GRANT_ROLE_BINDING = 9;
+  ADMIN_AUDIT_OPERATION_REVOKE_ROLE_BINDING = 10;
+  ADMIN_AUDIT_OPERATION_BOOTSTRAP_ACCESS = 11;
+  ADMIN_AUDIT_OPERATION_ADMIT_NODE = 12;
+  ADMIN_AUDIT_OPERATION_REVOKE_NODE = 13;
 }
 
 enum AdminAuditTargetType {
   ADMIN_AUDIT_TARGET_TYPE_UNSPECIFIED = 0;
   ADMIN_AUDIT_TARGET_TYPE_ALLOCATION = 1;
-  ADMIN_AUDIT_TARGET_TYPE_STORAGE_BINDING = 2;
-  ADMIN_AUDIT_TARGET_TYPE_SERVICE = 3;
-  ADMIN_AUDIT_TARGET_TYPE_NODE = 4;
-  ADMIN_AUDIT_TARGET_TYPE_PRINCIPAL = 5;
-  ADMIN_AUDIT_TARGET_TYPE_CREDENTIAL = 6;
-  ADMIN_AUDIT_TARGET_TYPE_ROLE_BINDING = 7;
+  ADMIN_AUDIT_TARGET_TYPE_NODE = 2;
+  ADMIN_AUDIT_TARGET_TYPE_PRINCIPAL = 3;
+  ADMIN_AUDIT_TARGET_TYPE_CREDENTIAL = 4;
+  ADMIN_AUDIT_TARGET_TYPE_ROLE_BINDING = 5;
 }
 
 message AdminAuditEvent {

package/dist/proto/axern/control/admin/v1/node.proto

@@ -6,12 +6,12 @@ option go_package = "github.com/cofy-x/axern/sdk/go/gen/axern/control/admin/v1;a
 
 import "google/protobuf/timestamp.proto";
 import "axern/control/capability/v1/capability.proto";
-import "axern/control/node/v1/node_control.proto";
 
 enum AdminNodeLifecycleStatus {
   ADMIN_NODE_LIFECYCLE_STATUS_UNSPECIFIED = 0;
   ADMIN_NODE_LIFECYCLE_STATUS_ACTIVE = 1;
-  ADMIN_NODE_LIFECYCLE_STATUS_RETIRED = 2;
+  ADMIN_NODE_LIFECYCLE_STATUS_REVOKED = 2;
+  ADMIN_NODE_LIFECYCLE_STATUS_RETIRED = 3;
 }
 
 message AdminNode {
@@ -22,8 +22,8 @@ message AdminNode {
   bool axnoded_ready = 5;
   int64 heartbeat_age_seconds = 6;
   int64 summary_age_seconds = 7;
-  google.protobuf.Timestamp registered_at = 8;
-  google.protobuf.Timestamp updated_at = 9;
+  google.protobuf.Timestamp admitted_at = 8;
+  google.protobuf.Timestamp last_heartbeat_at = 9;
   google.protobuf.Timestamp retired_at = 10;
   string retired_reason = 11;
 }
@@ -36,67 +36,40 @@ message ListAdminNodesResponse {
   repeated AdminNode nodes = 1;
 }
 
-message RetireAdminNodeRequest {
+message AdmitAdminNodeRequest {
   string node_id = 1;
-  string operator_reason = 2;
+  string enrollment_token = 2;
+  string operator_reason = 3;
 }
 
-message RetireAdminNodeResponse {
+message AdmitAdminNodeResponse {
   AdminNode node = 1;
 }
 
-message GetNodeCapabilitySnapshotRequest {
+message RevokeAdminNodeRequest {
   string node_id = 1;
+  string operator_reason = 2;
 }
 
-message GetNodeCapabilitySnapshotResponse {
-  axern.control.capability.v1.CapabilitySnapshot snapshot = 1;
-}
-
-message AdminCapabilityTransition {
-  string transition_id = 1;
-  string node_id = 2;
-  string snapshot_id = 3;
-  int64 snapshot_sequence = 4;
-  axern.control.capability.v1.CapabilityKey key = 5;
-  axern.control.capability.v1.CapabilityState old_state = 6;
-  axern.control.capability.v1.CapabilityState new_state = 7;
-  axern.control.capability.v1.CapabilityEvidence old_evidence = 8;
-  axern.control.capability.v1.CapabilityEvidence new_evidence = 9;
-  axern.control.capability.v1.CapabilityReasonCode old_reason_code = 10;
-  axern.control.capability.v1.CapabilityReasonCode new_reason_code = 11;
-  string reason = 12;
-  google.protobuf.Timestamp observed_at = 13;
-  google.protobuf.Timestamp reported_at = 14;
+message RevokeAdminNodeResponse {
+  AdminNode node = 1;
 }
 
-message ListNodeCapabilityTransitionsRequest {
+message RetireAdminNodeRequest {
   string node_id = 1;
-  int32 limit = 2;
-}
-
-message ListNodeCapabilityTransitionsResponse {
-  repeated AdminCapabilityTransition transitions = 1;
+  string operator_reason = 2;
 }
 
-message AdminCapabilityReconcileItem {
-  string allocation_id = 1;
-  string node_id = 2;
-  repeated axern.control.capability.v1.CapabilityDependency pending_dependencies = 3;
-  int32 attempts = 4;
-  google.protobuf.Timestamp next_run_at = 5;
-  google.protobuf.Timestamp lease_expires_at = 6;
-  string last_error = 7;
-  google.protobuf.Timestamp updated_at = 8;
+message RetireAdminNodeResponse {
+  AdminNode node = 1;
 }
 
-message ListCapabilityReconcileQueueRequest {
+message GetNodeCapabilitySnapshotRequest {
   string node_id = 1;
-  int32 limit = 2;
 }
 
-message ListCapabilityReconcileQueueResponse {
-  repeated AdminCapabilityReconcileItem items = 1;
+message GetNodeCapabilitySnapshotResponse {
+  axern.control.capability.v1.CapabilitySnapshot snapshot = 1;
 }
 
 message GetAllocationCapabilityDiagnosticsRequest {
@@ -106,32 +79,15 @@ message GetAllocationCapabilityDiagnosticsRequest {
 message GetAllocationCapabilityDiagnosticsResponse {
   string allocation_id = 1;
   string node_id = 2;
-  repeated axern.control.capability.v1.CapabilityDependency required_dependencies = 3;
-  repeated axern.control.capability.v1.CapabilityDependency admitted_dependencies = 4;
-  axern.control.capability.v1.CapabilityConditionSet condition_set = 5;
-  AdminCapabilityReconcileItem reconcile = 6;
-  int64 allocation_attempt = 7;
-  bool create_admission_recorded = 8;
-  string create_dependency_set_digest = 9;
-  google.protobuf.Timestamp create_admitted_at = 10;
-  AllocationMemoryAdmissionEvidence memory_admission = 11;
-  axern.control.node.v1.AllocationMemoryObservation latest_memory_observation = 12;
-}
-
-message AllocationMemoryAdmissionEvidence {
-  int64 sandbox_memory_request_bytes = 1;
-  int64 sandbox_memory_limit_bytes = 2;
-  axern.control.node.v1.NodeMemoryBudget node_memory_budget = 3;
-  google.protobuf.Timestamp summary_collected_at = 4;
-  int64 node_local_commitment_bytes = 5;
-  google.protobuf.Timestamp admitted_at = 6;
+  repeated axern.control.capability.v1.CapabilityRequirement requirements = 3;
+  axern.control.capability.v1.CapabilityConditionSet condition_set = 4;
 }
 
 service NodeAdmin {
+  rpc AdmitAdminNode(AdmitAdminNodeRequest) returns (AdmitAdminNodeResponse) {}
   rpc ListAdminNodes(ListAdminNodesRequest) returns (ListAdminNodesResponse) {}
+  rpc RevokeAdminNode(RevokeAdminNodeRequest) returns (RevokeAdminNodeResponse) {}
   rpc RetireAdminNode(RetireAdminNodeRequest) returns (RetireAdminNodeResponse) {}
   rpc GetNodeCapabilitySnapshot(GetNodeCapabilitySnapshotRequest) returns (GetNodeCapabilitySnapshotResponse) {}
-  rpc ListNodeCapabilityTransitions(ListNodeCapabilityTransitionsRequest) returns (ListNodeCapabilityTransitionsResponse) {}
-  rpc ListCapabilityReconcileQueue(ListCapabilityReconcileQueueRequest) returns (ListCapabilityReconcileQueueResponse) {}
   rpc GetAllocationCapabilityDiagnostics(GetAllocationCapabilityDiagnosticsRequest) returns (GetAllocationCapabilityDiagnosticsResponse) {}
 }

package/dist/proto/axern/control/admin/v1/reliability.proto

@@ -26,45 +26,8 @@ enum ConsistencyIssueSeverity {
 
 enum ConsistencyIssueCode {
   CONSISTENCY_ISSUE_CODE_UNSPECIFIED = 0;
-  CONSISTENCY_ISSUE_CODE_ACTIVE_RESERVATION_MISSING_ALLOCATION = 1;
-  CONSISTENCY_ISSUE_CODE_ACTIVE_RESERVATION_ON_ENDED_ALLOCATION = 2;
-  CONSISTENCY_ISSUE_CODE_ACTIVE_RESERVATION_ALLOCATION_MISMATCH = 3;
-  CONSISTENCY_ISSUE_CODE_ACTIVE_LEASE_MISSING_ALLOCATION = 4;
-  CONSISTENCY_ISSUE_CODE_ACTIVE_LEASE_ON_ENDED_ALLOCATION = 5;
-  CONSISTENCY_ISSUE_CODE_ACTIVE_LEASE_ALLOCATION_NODE_MISMATCH = 6;
-  CONSISTENCY_ISSUE_CODE_ACTIVE_TUNNEL_MISSING_ALLOCATION = 7;
-  CONSISTENCY_ISSUE_CODE_ACTIVE_TUNNEL_ON_ENDED_ALLOCATION = 8;
-  CONSISTENCY_ISSUE_CODE_ACTIVE_TUNNEL_ALLOCATION_NODE_MISMATCH = 9;
-  CONSISTENCY_ISSUE_CODE_SERVICE_REFERENCE_MISSING_ALLOCATION = 10;
-  CONSISTENCY_ISSUE_CODE_SERVICE_REFERENCE_ENDED_ALLOCATION = 11;
-  CONSISTENCY_ISSUE_CODE_SERVICE_REFERENCE_OWNER_MISMATCH = 12;
-}
-
-enum ConsistencyRepairOwner {
-  CONSISTENCY_REPAIR_OWNER_UNSPECIFIED = 0;
-  CONSISTENCY_REPAIR_OWNER_WORKLOAD_CONTROLLER = 1;
-  CONSISTENCY_REPAIR_OWNER_NODE_LIFECYCLE = 2;
-  CONSISTENCY_REPAIR_OWNER_TUNNEL_CONTROLLER = 3;
-  CONSISTENCY_REPAIR_OWNER_SERVICE_CONTROLLER = 4;
-  CONSISTENCY_REPAIR_OWNER_ADMIN_OPERATOR_TRIAGE = 5;
-}
-
-enum ConsistencyRepairAction {
-  CONSISTENCY_REPAIR_ACTION_UNSPECIFIED = 0;
-  CONSISTENCY_REPAIR_ACTION_WORKLOAD_CLEANUP = 1;
-  CONSISTENCY_REPAIR_ACTION_WORKLOAD_CLEANUP_AND_READMIT = 2;
-  CONSISTENCY_REPAIR_ACTION_NODE_LIFECYCLE_RECONCILE = 3;
-  CONSISTENCY_REPAIR_ACTION_TUNNEL_LIFECYCLE_RECONCILE = 4;
-  CONSISTENCY_REPAIR_ACTION_SERVICE_RECONCILE = 5;
-  CONSISTENCY_REPAIR_ACTION_ADMIN_TRIAGE = 6;
-}
-
-enum ConsistencyRepairTargetType {
-  CONSISTENCY_REPAIR_TARGET_TYPE_UNSPECIFIED = 0;
-  CONSISTENCY_REPAIR_TARGET_TYPE_ALLOCATION = 1;
-  CONSISTENCY_REPAIR_TARGET_TYPE_RUN = 2;
-  CONSISTENCY_REPAIR_TARGET_TYPE_SERVICE = 3;
-  CONSISTENCY_REPAIR_TARGET_TYPE_TUNNEL_SESSION = 4;
+  CONSISTENCY_ISSUE_CODE_ACTIVE_ACCESS_GRANT_ON_ENDED_ALLOCATION = 1;
+  CONSISTENCY_ISSUE_CODE_ACTIVE_TUNNEL_ON_ENDED_ALLOCATION = 2;
 }
 
 enum AdminReliabilitySignalCode {
@@ -72,14 +35,12 @@ enum AdminReliabilitySignalCode {
   ADMIN_RELIABILITY_SIGNAL_CODE_CONSISTENCY_ISSUES = 1;
   ADMIN_RELIABILITY_SIGNAL_CODE_ALLOCATION_LIFECYCLE_RETRIES = 2;
   ADMIN_RELIABILITY_SIGNAL_CODE_RECONCILE_FAILURES = 3;
-  ADMIN_RELIABILITY_SIGNAL_CODE_STORAGE_BINDINGS = 4;
-  ADMIN_RELIABILITY_SIGNAL_CODE_NODE_VOLUME_MANAGERS = 5;
-  ADMIN_RELIABILITY_SIGNAL_CODE_NODE_FLEET = 6;
+  ADMIN_RELIABILITY_SIGNAL_CODE_NODE_FLEET = 4;
 }
 
 message ConsistencyCounts {
-  int64 active_reservations = 1;
-  int64 active_leases = 2;
+  int64 active_allocations = 1;
+  int64 active_access_grants = 2;
   int64 active_tunnels = 3;
   int64 allocation_lifecycle_retries = 4;
   int64 issues = 5;
@@ -89,16 +50,10 @@ message ConsistencyIssue {
   ConsistencyIssueCode code = 1;
   ConsistencyIssueSeverity severity = 2;
   string allocation_id = 3;
-  string owner_type = 4;
-  string owner_id = 5;
-  string node_id = 6;
-  string status = 7;
-  string detail = 8;
-  ConsistencyRepairOwner repair_owner = 9;
-  ConsistencyRepairAction repair_action = 10;
-  bool automatic_repair = 11;
-  ConsistencyRepairTargetType repair_target_type = 12;
-  string repair_target_id = 13;
+  string run_id = 4;
+  string node_id = 5;
+  string status = 6;
+  string detail = 7;
 }
 
 message ConsistencySnapshot {
@@ -120,10 +75,8 @@ message AdminReliabilityHealth {
   int64 due_allocation_lifecycle_retries = 4;
   int64 reconcile_unhealthy_components = 5;
   repeated AdminReliabilitySignal signals = 6;
-  AdminNodeVolumeHealth node_volume_health = 7;
-  AdminStorageBindingHealth storage_binding_health = 8;
-  repeated ReconcileComponentHealth reconcile_components = 9;
-  AdminNodeFleetHealth node_fleet_health = 10;
+  repeated ReconcileComponentHealth reconcile_components = 7;
+  AdminNodeFleetHealth node_fleet_health = 8;
 }
 
 message ReconcileComponentHealth {
@@ -148,14 +101,6 @@ message GetAdminReliabilityHealthResponse {
   AdminReliabilityHealth health = 1;
 }
 
-message AdminNodeVolumeHealth {
-  int64 unhealthy_nodes = 1;
-  int64 published_volumes = 2;
-  int64 last_reconcile_stale_allocations = 3;
-  int64 last_reconcile_invalid_volumes = 4;
-  string error = 5;
-}
-
 message AdminNodeFleetHealth {
   int64 active_nodes = 1;
   int64 ready_nodes = 2;
@@ -166,18 +111,6 @@ message AdminNodeFleetHealth {
   string error = 7;
 }
 
-message AdminStorageBindingHealth {
-  bool unavailable = 1;
-  string error = 2;
-  int64 failed_bindings = 3;
-  int64 releasing_bindings = 4;
-  int64 stuck_releasing_bindings = 5;
-  int64 inconsistent_claims = 6;
-  int64 invalid_bindings = 7;
-  int64 deleting_claims = 8;
-  int64 stuck_deleting_claims = 9;
-}
-
 service AdminReliability {
   rpc CheckConsistency(CheckConsistencyRequest) returns (CheckConsistencyResponse) {}
   rpc GetAdminReliabilityHealth(GetAdminReliabilityHealthRequest) returns (GetAdminReliabilityHealthResponse) {}

package/dist/proto/axern/control/capability/v1/capability.proto

@@ -11,28 +11,22 @@ import "google/protobuf/timestamp.proto";
 // claims; only the owning observed-capability provider may publish them.
 enum PlatformCapability {
   PLATFORM_CAPABILITY_UNSPECIFIED = 0;
-  PLATFORM_CAPABILITY_PORT_FORWARDING = 1;
-  PLATFORM_CAPABILITY_NETWORK_BRIDGE = 2;
-  PLATFORM_CAPABILITY_NETWORK_BPFNET = 3;
-  PLATFORM_CAPABILITY_CGROUP_V2_MEMORY_CONTROLLER = 4;
-  PLATFORM_CAPABILITY_RUNC_MEMORY_HARD_LIMIT = 5;
-  PLATFORM_CAPABILITY_RUNSC_MEMORY_HARD_LIMIT = 6;
-  PLATFORM_CAPABILITY_FILESTORE_OVERLAYFS_UPPER = 7;
-  PLATFORM_CAPABILITY_XFS_PROJECT_QUOTA = 8;
-  PLATFORM_CAPABILITY_RUNC_EPHEMERAL_STORAGE_HARD_LIMIT = 9;
-  PLATFORM_CAPABILITY_RUNSC_EPHEMERAL_STORAGE_HARD_LIMIT = 10;
-  PLATFORM_CAPABILITY_ROOTFS_LOWER_EROFS = 11;
-  // Provider facts consumed by the catalog's derived workload capabilities.
+  PLATFORM_CAPABILITY_NETWORK_BRIDGE = 1;
+  PLATFORM_CAPABILITY_NETWORK_BPFNET = 2;
+  PLATFORM_CAPABILITY_CGROUP_V2_MEMORY_CONTROLLER = 3;
+  PLATFORM_CAPABILITY_RUNSC_MEMORY_HARD_LIMIT = 4;
+  PLATFORM_CAPABILITY_FILESTORE_OVERLAYFS_UPPER = 5;
+  PLATFORM_CAPABILITY_RUNSC_EPHEMERAL_STORAGE_HARD_LIMIT = 6;
+  PLATFORM_CAPABILITY_ROOTFS_LOWER_EROFS = 7;
+  // Provider facts consumed by derived workload capability definitions.
   // They are not valid workload requirements on their own.
-  PLATFORM_CAPABILITY_RUNC_MEMORY_ENFORCEMENT_SELF_TEST = 12;
-  PLATFORM_CAPABILITY_RUNSC_MEMORY_ENFORCEMENT_SELF_TEST = 13;
-  PLATFORM_CAPABILITY_RUNC_EPHEMERAL_ENFORCEMENT_SELF_TEST = 14;
-  PLATFORM_CAPABILITY_RUNSC_EPHEMERAL_ENFORCEMENT_SELF_TEST = 15;
-  PLATFORM_CAPABILITY_EGRESSD_DNS_POLICY_SELF_TEST = 16;
-  PLATFORM_CAPABILITY_EGRESSD_STRICT_EGRESS_SELF_TEST = 17;
+  PLATFORM_CAPABILITY_RUNSC_MEMORY_ENFORCEMENT_SELF_TEST = 8;
+  PLATFORM_CAPABILITY_RUNSC_EPHEMERAL_ENFORCEMENT_SELF_TEST = 9;
+  PLATFORM_CAPABILITY_EGRESSD_DNS_POLICY_SELF_TEST = 10;
+  PLATFORM_CAPABILITY_EGRESSD_STRICT_EGRESS_SELF_TEST = 11;
   // Workload-facing capabilities derived from the egressd self-test facts.
-  PLATFORM_CAPABILITY_DNS_POLICY_ENFORCEMENT = 18;
-  PLATFORM_CAPABILITY_STRICT_EGRESS_ENFORCEMENT = 19;
+  PLATFORM_CAPABILITY_DNS_POLICY_ENFORCEMENT = 12;
+  PLATFORM_CAPABILITY_STRICT_EGRESS_ENFORCEMENT = 13;
 }
 
 message ExtensionCapability {
@@ -63,10 +57,9 @@ enum CapabilityProvider {
   CAPABILITY_PROVIDER_CONFIG = 1;
   CAPABILITY_PROVIDER_HOST_CGROUP = 2;
   CAPABILITY_PROVIDER_FILESTORE = 3;
-  CAPABILITY_PROVIDER_RUNC_SELF_TEST = 4;
-  CAPABILITY_PROVIDER_RUNSC_SELF_TEST = 5;
-  CAPABILITY_PROVIDER_NETWORK_HEALTH = 6;
-  CAPABILITY_PROVIDER_DERIVED = 7;
+  CAPABILITY_PROVIDER_RUNSC_SELF_TEST = 4;
+  CAPABILITY_PROVIDER_NETWORK_HEALTH = 5;
+  CAPABILITY_PROVIDER_DERIVED = 6;
 }
 
 enum CapabilityReasonCode {
@@ -82,10 +75,6 @@ enum CapabilityReasonCode {
   CAPABILITY_REASON_CODE_ENFORCEMENT_LOST = 9;
 }
 
-message ConfigEvidenceIdentity {
-  string config_digest = 1;
-}
-
 message BootEvidenceIdentity {
   string boot_id = 1;
 }
@@ -97,72 +86,35 @@ message MountEvidenceIdentity {
 
 message RuntimeEvidenceIdentity {
   string boot_id = 1;
-  string runtime_name = 2;
-  string runtime_binary_digest = 3;
-  string runtime_config_digest = 4;
-}
-
-message DerivedEvidenceIdentity {
-  string catalog_digest = 1;
-  // Canonical digest of the typed evidence identities for every catalog
-  // dependency. This makes the derived subject change when its mount,
-  // runtime, boot, or config subjects change without treating a normal TTL
-  // refresh as a new identity.
-  string dependency_evidence_digest = 2;
+  string runtime_binary_digest = 2;
+  string runtime_config_digest = 3;
 }
 
-// CapabilityEvidence identifies the concrete subject that was probed. Its
-// identity is orthogonal to observation freshness: a mount or runtime proof
-// may still require valid_until even though its subject identity is stable.
+// CapabilityEvidence identifies the concrete host subject that was inspected.
+// It is descriptive evidence, not an identity, version, or cryptographic
+// proof. Derived and configuration capabilities need no additional evidence.
 message CapabilityEvidence {
-  string evidence_id = 1;
   oneof identity {
-    ConfigEvidenceIdentity config = 2;
-    BootEvidenceIdentity boot = 3;
-    MountEvidenceIdentity mount = 4;
-    RuntimeEvidenceIdentity runtime = 5;
-    DerivedEvidenceIdentity derived = 6;
+    BootEvidenceIdentity boot = 1;
+    MountEvidenceIdentity mount = 2;
+    RuntimeEvidenceIdentity runtime = 3;
   }
 }
 
-// CapabilityObservationProof is the durable, non-recursive proof selected
-// from a snapshot. Dependencies are represented as one bounded flat proof set
-// so persistence and validation remain bounded.
-message CapabilityObservationProof {
+message CapabilityObservation {
   CapabilityKey key = 1;
-  string observation_id = 2;
+  CapabilityState state = 2;
   CapabilityProvider provider = 3;
   google.protobuf.Timestamp observed_at = 4;
   google.protobuf.Timestamp valid_until = 5;
   CapabilityEvidence evidence = 6;
-}
-
-message CapabilityObservation {
-  CapabilityKey key = 1;
-  CapabilityState state = 2;
-  CapabilityProvider provider = 3;
-  string observation_id = 4;
-  google.protobuf.Timestamp observed_at = 5;
-  google.protobuf.Timestamp valid_until = 6;
-  CapabilityEvidence evidence = 7;
-  repeated CapabilityObservationProof dependencies = 8;
-  CapabilityReasonCode reason_code = 9;
-  string reason = 10;
+  CapabilityReasonCode reason_code = 7;
+  string reason = 8;
 }
 
 message CapabilitySnapshot {
-  string node_instance_id = 1;
-  int64 sequence = 2;
-  string snapshot_id = 3;
-  google.protobuf.Timestamp collected_at = 4;
-  repeated CapabilityObservation observations = 5;
-}
-
-message CapabilitySnapshotReference {
-  string node_instance_id = 1;
-  int64 sequence = 2;
-  string snapshot_id = 3;
-  google.protobuf.Timestamp collected_at = 4;
+  google.protobuf.Timestamp collected_at = 1;
+  repeated CapabilityObservation observations = 2;
 }
 
 message ExtensionCapabilityRequirement {
@@ -176,18 +128,9 @@ enum CapabilityLossPolicy {
   CAPABILITY_LOSS_POLICY_FAIL_STOP = 3;
 }
 
-message CapabilityDependency {
+message CapabilityRequirement {
   CapabilityKey key = 1;
   CapabilityLossPolicy loss_policy = 2;
-  CapabilitySnapshotReference selected_snapshot = 3;
-  CapabilityObservationProof selected_observation = 4;
-  repeated CapabilityObservationProof dependency_observations = 5;
-}
-
-// CapabilityDependencySet is the durable representation stored with an
-// allocation. A wrapper keeps JSON persistence on the canonical proto shape.
-message CapabilityDependencySet {
-  repeated CapabilityDependency dependencies = 1;
 }
 
 enum CapabilityConditionState {
@@ -203,12 +146,9 @@ message CapabilityCondition {
   CapabilityConditionState state = 2;
   CapabilityReasonCode reason_code = 3;
   string message = 4;
-  google.protobuf.Timestamp observed_at = 5;
-  CapabilityObservationProof proof = 6;
 }
 
 message CapabilityConditionSet {
-  int64 revision = 1;
-  google.protobuf.Timestamp observed_at = 2;
-  repeated CapabilityCondition conditions = 3;
+  google.protobuf.Timestamp observed_at = 1;
+  repeated CapabilityCondition conditions = 2;
 }