@opensoha/contracts 0.1.23 → 0.1.25

package/COMPATIBILITY.md

@@ -364,6 +364,14 @@ role migration and consumer conformance prove no active dependency.
 
 ## Consumer Adoption
 
+Session access tokens may add the optional positive `authzVersion` claim. Core
+binds versioned tokens to the current user authorization version; refreshing a
+session cannot revive a token issued before a membership change. During migration,
+tokens without the claim must resolve current roles, teams, projects and tags from
+the authoritative identity store rather than trusting their embedded membership.
+Refresh tokens and existing client login/refresh response fields are unchanged.
+This does not replace session revocation, account-state or per-resource authorization.
+
 Connection tests and Compute provider health checks return HTTP 200 with
 `ConnectionCheckResultEnvelope` after each fresh probe. Consumers read `healthy`
 and the diagnostic fields directly; no task or task log is created. The Compute
@@ -435,3 +443,90 @@ only with an explicit compatibility reason and successful matrix evidence.
 Manual CI may select `consumer_mode=latest` for separate integration evidence.
 This does not rewrite the fixed manifest or replace fixed-combination acceptance.
 Record the actual contracts and consumer commits, not only the selected mode.
+
+The matrix includes the independent App frontend. Its initial pin
+`0c3c76c373246f7d2218b48f68b89bf3097f777b` was built from isolated committed source
+against the packed Contracts 0.1.23 working tree to establish backward compatibility.
+That commit predates the uncommitted Native client adaptation; current-worktree
+checks are separate, and release of that adaptation requires a reviewed new App
+pin and verification with the published SDK rather than the local package overlay.
+
+## External knowledge source import ceilings
+
+`knowledge/source-import-policy.schema.json` defines optional trusted
+`config.importPolicy` for external HTTP/Git/Object connectors. Core intersects
+fetched document grants with this ceiling before persisting documents and chunks.
+Omission defaults to the stable knowledge-base owner; an explicitly empty private
+scope grants nobody. Public returned ACLs cannot exceed a finite ceiling. Finite
+grants intersect within the same identity category, without inferring membership
+across users, roles, teams or projects. Inline source behavior is unchanged.
+
+Older external configurations that relied on returned public/shared ACLs must
+be reviewed and given an explicit trusted policy before reingestion. Existing
+indexed documents are not retroactively rewritten by this change; source-policy
+editing, revocation of existing indexed data and a migration/backfill remain
+separate acceptance work. Upgrade every Core replica before relying on the new
+ceiling. No independent SDK release or deployment is established by a sibling
+consumer matrix.
+
+Connector credential references use the existing Gateway `secretRefs` channel
+with alias `SOURCE`, instead of ordinary fetch input. Executable references use
+`soha://secrets/<id>` with an optional `/versions/<n>`, matching the existing
+secret service. Legacy `secret:` references remain valid stored configuration,
+but fetching rejects them until an authorized source edit selects a canonical
+reference; names and paths are not automatically mapped to a secret identity.
+A runtime without a
+versioned per-call credential delivery protocol must reject a nonempty resolved
+secret context before sending an action. Static runtime credentials do not
+substitute for the caller-selected source credential.
+
+`connectors/connector-action.schema.json` adds credential-bearing action v1.
+Only actions explicitly declaring `credentialProtocol=opensoha.dev/connector-action/v1`
+and bounded `credentialAliases` may receive it. The caller sends the same action
+in the path and envelope, invocation-local values with exact pinned references,
+and a bounded expiry. The runtime authenticates Core, validates declarations,
+rejects unknown/expired frames, signals cooperative cancellation and rejects late
+responses on expiry or disconnect. This does not prove an external effect stopped. Core remains
+the authority for identity, reference versions and scope; wire metadata does not
+authorize a caller. Credentials require authenticated HTTPS or loopback transport,
+and must not follow redirects, enter persistent retry queues, logs, events or results.
+Unversioned requests without credentials remain compatible; old runtimes continue
+to be rejected before credential-bearing actions are sent. New runtimes must not
+silently substitute globally configured credentials. Connectors SDK and Core
+receive dedicated HTTP boundary tests in addition to the existing consumer matrix.
+
+The v1 runtime also bounds canonical UTF-8 JSON frames to 1 MiB, each value to
+64 KiB, and structured material to depth 16 and 64 distinct nonempty strings,
+including keys and the opaque value. The declaration advertises support; calls
+without credentials retain the legacy envelope. An action requiring credentials
+must explicitly reject their absence. Known raw and structured string material
+is masked in SDK results/errors and Core outputs; conservative masking may also
+mask matching business keys. A trusted connector must honor cancellation and
+never persist credentials; masking is not a universal encoded-exfiltration guard.
+
+
+## 0.1.24 adoption inputs
+
+The 0.1.24 package publishes the personal-workspace and managed-VM contracts
+already committed after the 0.1.23 tag. The release does not replace the bytes
+of the previously published 0.1.23 package.
+
+The fixed source-consumer matrix intentionally advances two revisions:
+
+- Core: `e022021d9f8da8917c135671f92248ef19f2b5b4` to
+  `c29cc6294dd4b7cb69db1187d728c227475fdf7c`, which implements the newly
+  documented VM access, SSH and capacity routes. The earlier revision fails
+  its live-route conformance test against the new operations.
+- Web: `816ec0fb82e6e804f0f66d47d3446a7b5baeabc1` to
+  `447cbe5358802ef40d86ac67b7b59c5afe9c846a`, which handles the additional
+  `vm` and `vm_create` secret-scope enum members. The earlier exhaustive
+  TypeScript record does not compile against those additive enum members.
+
+The other four fixed revisions and all six checks remain in place. These are
+reviewed adoption inputs, not a claim that the earlier source revisions pass
+against the expanded SDK. The OpenAPI compatibility snapshot and all JSON
+Schema and loose-boundary expectations remain unchanged; the latter two files
+only synchronize their release-version metadata to satisfy their existing
+guards. Candidate matrices use the packed/local contracts source. Consumers
+must still pin the published version and validate the registry/proxy package
+before claiming released-version acceptance.

package/README.md

@@ -3,7 +3,7 @@
 Shared public contracts for OpenSoha.
 
 This repository is the source of truth for schemas consumed across Soha core,
-Soha CLI, Soha Agent, Soha Web, official skills, connectors, and Soha
+Soha CLI, Soha Agent, Soha Web, Soha App, official skills, connectors, and Soha
 Cloud services. Product repositories should depend on generated SDKs, HTTP
 APIs, JSON Schemas, or released artifacts from this repository instead of
 copying business logic between repos.
@@ -23,6 +23,8 @@ presets/mcp-preset.schema.json        MCP preset manifest
 governance/approval-request.schema.json  Approval request and trace contract
 governance/audit-log.schema.json      Audit log contract
 agent/agent-protocol.schema.json      Runner and agent control-plane protocol
+agent/personal-guest-*.schema.json   Personal VM guest binding, enrollment and heartbeat
+agent/guest                          Hand-maintained Go guest protocol validators
 runner/operation-lifecycle.schema.json  Long-running operation lifecycle events
 mcp/gateway-manifest.schema.json      AI Gateway / MCP capability manifest
 skills/skill-manifest.schema.json     Official skill front matter contract
@@ -49,6 +51,15 @@ gen/ts/sohaapi                        TypeScript SDK types for stable Web contra
 - Public behavior changes should update this repository first, then update
   generated SDKs and consumers.
 
+Personal VM guest messages are an independent protocol. Docker v1 and Network
+Control credentials do not authorize it. Enrollment requires a guest-specific
+mTLS identity and a short one-time challenge; Core must derive the frozen owner,
+assistant, compute generation, data identity and policy. Heartbeats carry no task
+execution or readiness grant. Certificate pinning, current authorization, atomic
+challenge consumption and sequence persistence belong to the consuming service.
+The contracts package alone does not implement guest enrollment or enable VM
+personal environments.
+
 ## SDK Consumers
 
 Current SDK entry points:
@@ -107,7 +118,7 @@ calling code in the consumer until those APIs are promoted into the supported
 client surface. Redirect-oriented flows such as OIDC provider redirects should
 not use the JSON-only `doJSON` helper until a non-JSON client mode is added.
 
-The Go generator and generated DTO checks run with Go 1.26.6 in CI.
+The Go generator and generated DTO checks run with Go 1.27.2 in CI.
 
 ## Validation
 
@@ -124,6 +135,10 @@ operation ID uniqueness, version synchronization, OpenAPI lint rules,
 breaking-change compatibility against the checked-in baseline, TypeScript
 type declarations, and Go compilation for the generated SDK package.
 
+OpenAPI fixture directories are discovered automatically; registered required directories
+must still exist. Put every JSON fixture in `valid/` or `invalid/`, with at least
+one of each. The validation gate rejects misplaced or unrecognized entries.
+
 Useful focused checks:
 
 ```sh
@@ -151,7 +166,7 @@ failure.
 
 Network runtime schemas and network-access DTOs require `0.1.17` or later;
 they are absent from npm `0.1.16` and Go `v0.1.15`. For unpublished changes,
-use the local consumer matrix below: it packs this checkout for Web and
+use the local consumer matrix below: it packs this checkout for Web/App and
 supplies an isolated Go workspace. After publishing, update consumer versions
 and lockfiles and verify them without the local override.
 
@@ -167,15 +182,18 @@ and skips any missing consumer. CI uses the strict form:
 ```sh
 npm run check:consumers -- --consumer soha --require-all
 npm run check:consumers -- --consumer soha-web --require-all
+npm run check:consumers -- --consumer soha-app --require-all
 npm run check:consumers -- --consumer soha-cli --require-all
 npm run check:consumers -- --consumer soha-agent --require-all
 npm run check:consumers -- --consumer soha-skills --require-all
 ```
 
 Go consumers run in a temporary `go.work` that replaces the contracts module
-with this checkout. `soha-web` runs `npm ci`, installs a packed copy of this
-checkout without changing its dependency manifest or lockfile, and builds
-against that package.
+with this checkout. `soha-web` and `soha-app/frontend` run `npm ci`, install a packed copy of this
+checkout without changing their dependency manifests or lockfiles, and build
+against that package. The App pin represents its recorded committed source;
+local uncommitted Native adaptations need separate worktree evidence and a new
+reviewed pin after they are committed.
 
 Use `--dry-run` to inspect the discovered commands without executing consumer
 builds.

package/agent/environment/README.md

@@ -0,0 +1,55 @@
+# Personal environment Agent protocol
+
+The source schemas are `agent/personal-environment-request.schema.json` and
+`agent/personal-environment-result.schema.json`, reusing the existing lease and
+snapshot schemas. This small Go package carries the same wire types without
+exposing Docker container IDs, volume names, host paths, or provider errors.
+
+The Agent accepts `POST /api/v1/runtime/personal-environments` from the trusted
+Core connection. Its normal `{ "data": ... }` envelope contains `Result`.
+Authentication is required even on loopback; each action also requires its
+explicit `runtime.personal_environments.<action>` allowlist entry. This feature
+is disabled by default. Existing Agents without this endpoint cannot execute it.
+
+Core derives the owner from its authenticated user and persistent assistant
+identity. It selects the registered execution node, quotas, scope hash, run ID
+and original lease timestamps. These must not come from model-selected identity,
+user-entered endpoints, or provider credentials. Each request is limited to
+512 KiB; dispatch/observation has a 30 second deadline, and cleanup has an
+independent 30 second deadline. Slow cleanup can outlast the HTTP receipt window
+and must be reconciled as an unknown outcome. Leases last at most 24 hours.
+This Docker backend requires pinned images, cgroup v2 and already-enabled,
+consistent Btrfs subvolume quotas. Unsupported enforcement fails acquisition.
+
+- `acquire`: recover the same immutable original lease, or start its task sandbox.
+  `createData=true` is permitted only during initial provisioning before Core has
+  a ready receipt or allows any task execution. Later acquisition uses false:
+  missing volumes or data subvolumes are errors, never replacements with empty data.
+- `inspect`: observe this lease, without creating a container. Expired containers
+  are stopped before an expired receipt is returned. Missing containers report missing.
+- `execute`: bounded absolute argv inside this lease's sandbox. It cannot be
+  retried automatically: network loss, timeout or lost receipts mean an unknown
+  outcome. Core must persist dispatch state and require reconciliation rather
+  than replaying a write. The Agent fences concurrent commands and retains data
+  when cancellation or failure stops the task sandbox.
+- `release`: stop only this original lease. Persistent data is retained. If its
+  container is absent, return missing rather than inventing a release receipt.
+- `delete_data`: Core requires the current owner's exact assistant name/version,
+  sleeping data and no active task. The Agent takes the physical volume lock,
+  removes only that owner's data and retains a non-recreation tombstone. A
+  partial deletion is unknown; only a `deleted` receipt confirms it.
+- `export_data`: use the dedicated `POST /runtime/personal-environments/export`
+  endpoint, with the same server-derived original lease and no argv/task/create
+  fields. Ordinary JSON `Result` is never a valid export response. The binary
+  stream has big-endian uint32 chunk lengths (maximum 32 KiB), then zero, a
+  uint32 JSON-receipt length (maximum 4 KiB), and the export receipt. The TAR
+  payload is bounded to 256 MiB. Receivers reject truncation, trailing bytes,
+  changed identity, size or SHA-256 before exposing any file. The producer sends
+  the final receipt only after its archive command and owned cleanup complete.
+
+Active results include actual quota/cgroup observations. Inactive results omit
+observations rather than manufacturing zero usage. `ValidateFor` checks receipt
+identity, action completion, bounded command output, and observation identity.
+Core must also reject stale receipts. Data export and deletion are separate
+explicit owner operations; their allowlist entries remain opt-in. TAR preserves
+link entries without following their targets and is never extracted by export.

package/agent/environment/export.go

@@ -0,0 +1,139 @@
+package environment
+
+import (
+	"bytes"
+	"crypto/sha256"
+	"encoding/binary"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"hash"
+	"io"
+	"time"
+)
+
+const ExportResultVersion = "opensoha.dev/personal-environment-export/v1"
+
+// ponytail: bounded synchronous downloads; use the artifact store for archives
+// above 256 MiB rather than silently truncating or buffering them in memory.
+const ExportMaxBytes int64 = 256 << 20
+const exportChunkBytes = 32 << 10
+
+type ExportResult struct {
+	SchemaVersion string    `json:"schemaVersion"`
+	LeaseID       string    `json:"leaseId"`
+	RunID         string    `json:"runId"`
+	OwnerID       string    `json:"ownerId"`
+	ScopeHash     string    `json:"scopeHash"`
+	SizeBytes     int64     `json:"sizeBytes"`
+	SHA256        string    `json:"sha256"`
+	ObservedAt    time.Time `json:"observedAt"`
+}
+
+func (r ExportResult) ValidateFor(request Request) error {
+	if request.Validate() != nil || request.Action != "export_data" || r.SchemaVersion != ExportResultVersion || r.LeaseID != request.Lease.ID || r.RunID != request.Lease.RunID || r.OwnerID != request.Lease.OwnerID || r.ScopeHash != request.Lease.ScopeHash || r.SizeBytes < 1 || r.SizeBytes > ExportMaxBytes || !scopePattern.MatchString(r.SHA256) || r.ObservedAt.IsZero() {
+		return errors.New("invalid personal data export receipt")
+	}
+	return nil
+}
+
+// Each archive chunk has a four-byte big-endian length. Zero ends the archive;
+// a length-prefixed JSON receipt follows only after Docker and cleanup succeed.
+// EOF, a partial archive or a failed producer cannot become a confirmed export.
+type ExportWriter struct {
+	Writer io.Writer
+	size   int64
+	digest hash.Hash
+}
+
+func (w *ExportWriter) Write(data []byte) (int, error) {
+	if w.size+int64(len(data)) > ExportMaxBytes {
+		return 0, errors.New("personal data archive exceeds 256 MiB")
+	}
+	if w.digest == nil {
+		w.digest = sha256.New()
+	}
+	written := 0
+	for len(data) > 0 {
+		n := min(len(data), exportChunkBytes)
+		if err := binary.Write(w.Writer, binary.BigEndian, uint32(n)); err != nil {
+			return written, err
+		}
+		if count, err := w.Writer.Write(data[:n]); err != nil || count != n {
+			return written, errors.Join(err, io.ErrShortWrite)
+		}
+		_, _ = w.digest.Write(data[:n])
+		w.size += int64(n)
+		written += n
+		data = data[n:]
+	}
+	return written, nil
+}
+
+func (w *ExportWriter) Finish(request Request) (ExportResult, error) {
+	if w.digest == nil {
+		return ExportResult{}, errors.New("empty personal data archive")
+	}
+	l := request.Lease
+	r := ExportResult{SchemaVersion: ExportResultVersion, LeaseID: l.ID, RunID: l.RunID, OwnerID: l.OwnerID, ScopeHash: l.ScopeHash, SizeBytes: w.size, SHA256: "sha256:" + hex.EncodeToString(w.digest.Sum(nil)), ObservedAt: time.Now().UTC()}
+	if err := r.ValidateFor(request); err != nil {
+		return ExportResult{}, err
+	}
+	data, err := json.Marshal(r)
+	if err != nil {
+		return ExportResult{}, err
+	}
+	if err := binary.Write(w.Writer, binary.BigEndian, uint32(0)); err != nil {
+		return ExportResult{}, err
+	}
+	if err := binary.Write(w.Writer, binary.BigEndian, uint32(len(data))); err != nil {
+		return ExportResult{}, err
+	}
+	if n, err := w.Writer.Write(data); err != nil || n != len(data) {
+		return ExportResult{}, errors.Join(err, io.ErrShortWrite)
+	}
+	return r, nil
+}
+
+func ReadExport(reader io.Reader, target io.Writer, request Request) (ExportResult, error) {
+	var size int64
+	digest := sha256.New()
+	buffer := make([]byte, exportChunkBytes)
+	for {
+		var n uint32
+		if err := binary.Read(reader, binary.BigEndian, &n); err != nil {
+			return ExportResult{}, err
+		}
+		if n == 0 {
+			break
+		}
+		if n > exportChunkBytes || size+int64(n) > ExportMaxBytes {
+			return ExportResult{}, errors.New("personal data export exceeds its bound")
+		}
+		if _, err := io.ReadFull(reader, buffer[:n]); err != nil {
+			return ExportResult{}, err
+		}
+		if _, err := io.Copy(io.MultiWriter(target, digest), bytes.NewReader(buffer[:n])); err != nil {
+			return ExportResult{}, err
+		}
+		size += int64(n)
+	}
+	var receiptBytes uint32
+	if err := binary.Read(reader, binary.BigEndian, &receiptBytes); err != nil || receiptBytes == 0 || receiptBytes > 4096 {
+		return ExportResult{}, errors.New("personal data export has no bounded receipt")
+	}
+	data := make([]byte, receiptBytes)
+	if _, err := io.ReadFull(reader, data); err != nil {
+		return ExportResult{}, err
+	}
+	decoder := json.NewDecoder(bytes.NewReader(data))
+	decoder.DisallowUnknownFields()
+	var result ExportResult
+	if decoder.Decode(&result) != nil || decoder.Decode(new(any)) != io.EOF || result.ValidateFor(request) != nil || result.SizeBytes != size || result.SHA256 != "sha256:"+hex.EncodeToString(digest.Sum(nil)) {
+		return ExportResult{}, errors.New("personal data export integrity or identity mismatch")
+	}
+	if n, err := reader.Read(buffer[:1]); n != 0 || err != io.EOF {
+		return ExportResult{}, errors.New("personal data export contains trailing bytes")
+	}
+	return result, nil
+}

package/agent/environment/export_test.go

@@ -0,0 +1,62 @@
+package environment
+
+import (
+	"bytes"
+	"encoding/binary"
+	"encoding/json"
+	"os"
+	"testing"
+)
+
+func TestPersonalDataStreamRejectsIncompleteOrChangedArchive(t *testing.T) {
+	fixture, err := os.ReadFile("../../fixtures/json-schema/personal-environment-request/valid/export-data.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var request Request
+	if err := json.Unmarshal(fixture, &request); err != nil {
+		t.Fatal(err)
+	}
+	data := bytes.Repeat([]byte("archive fixture\x00"), 5000)
+	var stream bytes.Buffer
+	writer := ExportWriter{Writer: &stream}
+	if _, err := writer.Write(data); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := writer.Finish(request); err != nil {
+		t.Fatal(err)
+	}
+	var target bytes.Buffer
+	if _, err := ReadExport(bytes.NewReader(stream.Bytes()), &target, request); err != nil || !bytes.Equal(target.Bytes(), data) {
+		t.Fatalf("complete binary stream changed: %v", err)
+	}
+	for _, cut := range []int{0, 4, 500, stream.Len() - 1} {
+		if _, err := ReadExport(bytes.NewReader(stream.Bytes()[:cut]), &bytes.Buffer{}, request); err == nil {
+			t.Fatal("truncated producer became a completed export")
+		}
+	}
+	changed := bytes.Clone(stream.Bytes())
+	changed[5] ^= 1
+	if _, err := ReadExport(bytes.NewReader(changed), &bytes.Buffer{}, request); err == nil {
+		t.Fatal("corrupt archive bypassed final SHA-256")
+	}
+	other := request
+	other.Lease.OwnerID = "another-owner"
+	if _, err := ReadExport(bytes.NewReader(stream.Bytes()), &bytes.Buffer{}, other); err == nil {
+		t.Fatal("archive borrowed another owner's receipt")
+	}
+	if _, err := ReadExport(bytes.NewReader(append(bytes.Clone(stream.Bytes()), 'x')), &bytes.Buffer{}, request); err == nil {
+		t.Fatal("trailing stream accepted")
+	}
+	var invalid bytes.Buffer
+	if err := binary.Write(&invalid, binary.BigEndian, uint32(exportChunkBytes+1)); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := ReadExport(&invalid, &bytes.Buffer{}, request); err == nil {
+		t.Fatal("oversized frame accepted")
+	}
+	writer.size = ExportMaxBytes
+	if _, err := writer.Write([]byte("x")); err == nil {
+		t.Fatal("archive bound was silently truncated")
+	}
+}

package/agent/environment/preflight.go

@@ -0,0 +1,62 @@
+package environment
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"io"
+	"time"
+	"unicode/utf8"
+)
+
+const PreflightRequestVersion = "opensoha.dev/personal-environment-preflight-request/v1"
+const PreflightResultVersion = "opensoha.dev/personal-environment-preflight-result/v1"
+
+// A preflight may create only its disposable quota probe, never personal data.
+type PreflightRequest struct {
+	SchemaVersion string `json:"schemaVersion"`
+	ID            string `json:"id"`
+	Quota         Quota  `json:"quota"`
+}
+
+type PreflightResult struct {
+	SchemaVersion string    `json:"schemaVersion"`
+	ID            string    `json:"id"`
+	Quota         Quota     `json:"quota"`
+	Ready         bool      `json:"ready"`
+	CgroupVersion string    `json:"cgroupVersion"`
+	DiskMechanism string    `json:"diskMechanism"`
+	ObservedAt    time.Time `json:"observedAt"`
+}
+
+func (r *PreflightRequest) UnmarshalJSON(data []byte) error {
+	if !utf8.Valid(data) {
+		return errors.New("preflight request must be UTF-8")
+	}
+	type wireRequest PreflightRequest
+	var decoded wireRequest
+	d := json.NewDecoder(bytes.NewReader(data))
+	d.DisallowUnknownFields()
+	if err := d.Decode(&decoded); err != nil {
+		return err
+	}
+	if d.Decode(&struct{}{}) != io.EOF {
+		return errors.New("invalid preflight request")
+	}
+	*r = PreflightRequest(decoded)
+	return r.Validate()
+}
+
+func (r PreflightRequest) Validate() error {
+	if r.SchemaVersion != PreflightRequestVersion || !canonicalUUIDPattern.MatchString(r.ID) {
+		return errors.New("invalid preflight identity")
+	}
+	return r.Quota.ValidatePersonalDocker()
+}
+
+func (r PreflightResult) ValidateFor(request PreflightRequest) error {
+	if r.SchemaVersion != PreflightResultVersion || r.ID != request.ID || r.Quota != request.Quota || !r.Ready || r.CgroupVersion != "2" || r.DiskMechanism != "btrfs-qgroup" || r.ObservedAt.IsZero() {
+		return errors.New("invalid personal environment preflight receipt")
+	}
+	return nil
+}

package/agent/environment/preflight_test.go

@@ -0,0 +1,41 @@
+package environment
+
+import (
+	"encoding/json"
+	"testing"
+	"time"
+)
+
+func TestPreflightRejectsCallerSelectedResourcesAndMismatchedQuotaReceipt(t *testing.T) {
+	request := PreflightRequest{SchemaVersion: PreflightRequestVersion, ID: "00000000-0000-4000-8000-000000000048", Quota: Quota{DiskBytes: 32 << 20, MemoryBytes: 64 << 20, CPUUnits: 250, MaxProcesses: 16}}
+	payload, err := json.Marshal(request)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var decoded PreflightRequest
+	if err := json.Unmarshal(payload, &decoded); err != nil {
+		t.Fatal(err)
+	}
+	for _, key := range []string{"ownerId", "nodeUrl", "command", "image"} {
+		var fields map[string]any
+		if err := json.Unmarshal(payload, &fields); err != nil {
+			t.Fatal(err)
+		}
+		fields[key] = "caller-selected"
+		invalid, err := json.Marshal(fields)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if json.Unmarshal(invalid, &decoded) == nil {
+			t.Fatalf("accepted %s", key)
+		}
+	}
+	result := PreflightResult{SchemaVersion: PreflightResultVersion, ID: request.ID, Quota: request.Quota, Ready: true, CgroupVersion: "2", DiskMechanism: "btrfs-qgroup", ObservedAt: time.Now().UTC()}
+	if err := result.ValidateFor(request); err != nil {
+		t.Fatal(err)
+	}
+	result.Quota.DiskBytes++
+	if result.ValidateFor(request) == nil {
+		t.Fatal("different quota acknowledged")
+	}
+}