@serve.zone/interfaces 23.2.0 → 24.1.0

package/ts/runtime.ts

@@ -1,6 +1,8 @@
 import * as plugins from './plugins.js';
 import type {
   IActiveSecretRecipientMetadata,
+  IClusterRuntimeTargetSetReadyV1,
+  IClusterRuntimeTargetV1,
   IClusterSecretDeploymentState,
   ICoreflowRuntimeCapabilities,
   IIdentityCredential,
@@ -21,7 +23,22 @@ import {
   verifySecretEnvelopeContext,
   verifyResolvedSecretManifestDigest,
 } from './data/secret.js';
+import {
+  isClusterRuntimeTargetSetFresh,
+  validateClusterRuntimeTargetSet,
+} from './data/clusternode.js';
 import { isSha256Digest } from './data/immutableimage.js';
+import type {
+  IWorkloadInitActiveApprovalAuthorityV1,
+  IWorkloadInitApprovalAuthorityReferenceV1,
+  IWorkloadInitApprovedArtifactV1,
+} from './runtime.workloadinit.js';
+import {
+  validateWorkloadInitActiveApprovalAuthority,
+  validateWorkloadInitApprovalAuthorityReference,
+} from './runtime.workloadinit.js';
+
+export * from './runtime.workloadinit.js';
 
 export interface ISealedResolvedSecretMaterialEntry {
   secretVersionId: string;
@@ -402,6 +419,130 @@ const computeRuntimeSha256 = async (inputArg: string): Promise<TSha256Digest> =>
     .join('')}` as TSha256Digest;
 };
 
+const computeRuntimeSha256Bytes = async (
+  inputArg: Uint8Array,
+): Promise<TSha256Digest> => {
+  const digest = new Uint8Array(await globalThis.crypto.subtle.digest(
+    'SHA-256',
+    new Uint8Array(inputArg),
+  ));
+  return `sha256:${[...digest]
+    .map((byteArg) => byteArg.toString(16).padStart(2, '0'))
+    .join('')}` as TSha256Digest;
+};
+
+/**
+ * Reproducible binding persisted inside a trusted Cloudly mutation receipt.
+ * This value alone does not prove that Cloudly admitted the envelope.
+ */
+export interface ISecretEnvelopeAdmissionBindingV1 {
+  schemaVersion: 1;
+  recipientKeyId: string;
+  recipientGeneration: number;
+  envelopeDigest: TSha256Digest;
+  requestContextDigest: TSha256Digest;
+}
+
+export const createSecretEnvelopeDigestInput = (
+  envelopeArg: unknown,
+): string => {
+  const envelope = plugins.smartcrypto.parseX25519Envelope(envelopeArg);
+  return JSON.stringify({
+    schemaVersion: envelope.schemaVersion,
+    profile: envelope.profile,
+    recipientKeyId: envelope.recipientKeyId,
+    ephemeralPublicKey: envelope.ephemeralPublicKey,
+    nonce: envelope.nonce,
+    ciphertext: envelope.ciphertext,
+    tag: envelope.tag,
+    contextDigest: envelope.contextDigest,
+  });
+};
+
+export const computeSecretEnvelopeDigest = async (
+  envelopeArg: unknown,
+): Promise<TSha256Digest> => computeRuntimeSha256(createSecretEnvelopeDigestInput(envelopeArg));
+
+export const computeSecretRequestContextDigest = async (
+  contextArg: Uint8Array,
+): Promise<TSha256Digest> => {
+  if (!(contextArg instanceof Uint8Array)) {
+    throw new Error('secret request context must be bytes');
+  }
+  return computeRuntimeSha256Bytes(contextArg);
+};
+
+export const validateSecretEnvelopeAdmissionBinding = (
+  bindingArg: unknown,
+): string[] => {
+  if (!isRuntimeRecord(bindingArg)
+    || !hasExactRuntimeKeys(bindingArg, [
+      'schemaVersion',
+      'recipientKeyId',
+      'recipientGeneration',
+      'envelopeDigest',
+      'requestContextDigest',
+    ])) {
+    return ['secret envelope admission binding must use its exact schema'];
+  }
+  const errors: string[] = [];
+  if (bindingArg.schemaVersion !== 1) {
+    errors.push('secret envelope admission binding schemaVersion must be 1');
+  }
+  if (!isRuntimeIdentifier(bindingArg.recipientKeyId)
+    || !isPositiveSafeInteger(bindingArg.recipientGeneration)) {
+    errors.push('secret envelope admission binding recipient must be canonical');
+  }
+  if (typeof bindingArg.envelopeDigest !== 'string'
+    || !isSha256Digest(bindingArg.envelopeDigest)
+    || typeof bindingArg.requestContextDigest !== 'string'
+    || !isSha256Digest(bindingArg.requestContextDigest)) {
+    errors.push('secret envelope admission binding digests must be canonical');
+  }
+  return errors;
+};
+
+export const createSecretEnvelopeAdmissionBinding = async (
+  recipientArg: IActiveSecretRecipientMetadata,
+  envelopeArg: unknown,
+  requestContextArg: Uint8Array,
+): Promise<ISecretEnvelopeAdmissionBindingV1> => {
+  if (validateSecretRecipientMetadata(recipientArg).length > 0
+    || recipientArg.lifecycleState !== 'active') {
+    throw new Error('secret envelope admission requires the active recipient');
+  }
+  const envelope = plugins.smartcrypto.parseX25519Envelope(envelopeArg);
+  if (envelope.recipientKeyId !== recipientArg.recipientKeyId
+    || !await verifySecretEnvelopeContext(envelope, requestContextArg)) {
+    throw new Error('secret envelope admission binding does not match recipient and context');
+  }
+  return {
+    schemaVersion: 1,
+    recipientKeyId: recipientArg.recipientKeyId,
+    recipientGeneration: recipientArg.generation,
+    envelopeDigest: await computeSecretEnvelopeDigest(envelope),
+    requestContextDigest: await computeSecretRequestContextDigest(requestContextArg),
+  };
+};
+
+export const verifySecretEnvelopeAdmissionBinding = async (
+  bindingArg: unknown,
+  envelopeArg: unknown,
+  requestContextArg: Uint8Array,
+): Promise<boolean> => {
+  try {
+    if (validateSecretEnvelopeAdmissionBinding(bindingArg).length > 0) return false;
+    const binding = bindingArg as ISecretEnvelopeAdmissionBindingV1;
+    const envelope = plugins.smartcrypto.parseX25519Envelope(envelopeArg);
+    return envelope.recipientKeyId === binding.recipientKeyId
+      && await verifySecretEnvelopeContext(envelope, requestContextArg)
+      && binding.envelopeDigest === await computeSecretEnvelopeDigest(envelope)
+      && binding.requestContextDigest === await computeSecretRequestContextDigest(requestContextArg);
+  } catch {
+    return false;
+  }
+};
+
 export type TSecretRecipientEnrollmentStateV1 =
   | {
     schemaVersion: 1;
@@ -481,37 +622,42 @@ export const validateSecretRecipientEnrollmentState = (
   }
 };
 
-export interface ICoreflowSecretRuntimeNodeTargetV1 {
-  nodeId: string;
-  nodeName: string;
-  platform: TImmutableContainerPlatform;
-}
-
-export interface ICoreflowSecretRuntimeNodeEvidenceV1
-extends ICoreflowSecretRuntimeNodeTargetV1 {
-  workloadInitPlatformManifestDigest: TSha256Digest;
-  workloadInitExecutableDigest: TSha256Digest;
-}
+export interface ICoreflowSecretRuntimeNodeTargetV2
+extends IClusterRuntimeTargetV1 {}
 
-export interface ICoreflowSecretRuntimeArtifactV1 {
-  platform: TImmutableContainerPlatform;
+export interface ICoreflowSecretRuntimeNodeEvidenceV2
+extends ICoreflowSecretRuntimeNodeTargetV2 {
   workloadInitPlatformManifestDigest: TSha256Digest;
   workloadInitExecutableDigest: TSha256Digest;
 }
 
-export interface ICoreflowSecretRuntimeRegistrationExpectationV1 {
-  expectationVersion: 1;
+export interface ICoreflowSecretRuntimeRegistrationExpectationV2 {
+  expectationVersion: 2;
+  expectationDigest: TSha256Digest;
   reporterSessionId: string;
-  targets: ICoreflowSecretRuntimeNodeTargetV1[];
-  workloadInitImageIndexDigest: TSha256Digest;
-  workloadInitArtifacts: ICoreflowSecretRuntimeArtifactV1[];
+  targetAuthority: IClusterRuntimeTargetSetReadyV1;
+  workloadInitAuthority: IWorkloadInitActiveApprovalAuthorityV1;
   activeRecipient: IActiveSecretRecipientMetadata;
 }
 
-/** Dedicated TypedSocket tag carrying ICoreflowSecretRuntimeRegistrationV1. */
+/** Dedicated TypedSocket tag carrying ICoreflowSecretRuntimeRegistrationV2. */
 export const coreflowSecretRuntimeRegistrationTagId =
   'coreflowSecretRuntimeRegistration' as const;
 
+export type TCoreflowSecretRuntimeRegistrationExpectationResponseV2 =
+  | {
+      status: 'available';
+      expectation: ICoreflowSecretRuntimeRegistrationExpectationV2;
+    }
+  | {
+      status: 'unavailable';
+      reason:
+        | 'recipient-unavailable'
+        | 'workloadinit-unconfigured'
+        | 'workloadinit-revoked'
+        | 'targets-unavailable';
+    };
+
 /** Cluster scope is derived exclusively from the verified cluster JWT. */
 export interface IReq_GetCoreflowSecretRuntimeRegistrationExpectation
 extends plugins.typedrequestInterfaces.implementsTR<
@@ -522,9 +668,7 @@ extends plugins.typedrequestInterfaces.implementsTR<
   request: {
     identity: IIdentityCredential;
   };
-  response: {
-    expectation: ICoreflowSecretRuntimeRegistrationExpectationV1;
-  };
+  response: TCoreflowSecretRuntimeRegistrationExpectationResponseV2;
 }
 
 export const validateGetCoreflowSecretRuntimeRegistrationExpectationRequest = (
@@ -545,25 +689,29 @@ export const validateGetCoreflowSecretRuntimeRegistrationExpectationRequest = (
   }
 };
 
-export interface ICoreflowSecretRuntimeRegistrationV1 {
-  registrationVersion: 1;
+export interface ICoreflowSecretRuntimeRegistrationV2 {
+  registrationVersion: 2;
+  expectationDigest: TSha256Digest;
   reporterSessionId: string;
   registeredAt: number;
-  targets: ICoreflowSecretRuntimeNodeTargetV1[];
-  nodeSetDigest: TSha256Digest;
-  nodeEvidence: ICoreflowSecretRuntimeNodeEvidenceV1[];
+  targetGeneration: number;
+  targetSetDigest: TSha256Digest;
+  targets: ICoreflowSecretRuntimeNodeTargetV2[];
+  nodeEvidence: ICoreflowSecretRuntimeNodeEvidenceV2[];
   capabilities: ICoreflowRuntimeCapabilities;
   activeRecipient: IActiveSecretRecipientMetadata;
+  workloadInitAuthority: IWorkloadInitApprovalAuthorityReferenceV1;
   workloadInitImageIndexDigest: TSha256Digest;
-  workloadInitApprovedAt: number;
 }
 
 const compareRuntimeTargets = (
-  leftArg: ICoreflowSecretRuntimeNodeTargetV1,
-  rightArg: ICoreflowSecretRuntimeNodeTargetV1,
+  leftArg: ICoreflowSecretRuntimeNodeTargetV2,
+  rightArg: ICoreflowSecretRuntimeNodeTargetV2,
 ): number => {
   for (const [left, right] of [
-    [leftArg.nodeId, rightArg.nodeId],
+    [leftArg.cloudlyNodeId, rightArg.cloudlyNodeId],
+    [leftArg.swarmClusterId, rightArg.swarmClusterId],
+    [leftArg.swarmNodeId, rightArg.swarmNodeId],
     [leftArg.nodeName, rightArg.nodeName],
     [leftArg.platform, rightArg.platform],
   ]) {
@@ -574,24 +722,50 @@ const compareRuntimeTargets = (
 };
 
 const canonicalRuntimeTarget = (
-  targetArg: ICoreflowSecretRuntimeNodeTargetV1,
-): ICoreflowSecretRuntimeNodeTargetV1 => ({
-  nodeId: targetArg.nodeId,
+  targetArg: ICoreflowSecretRuntimeNodeTargetV2,
+): ICoreflowSecretRuntimeNodeTargetV2 => ({
+  cloudlyNodeId: targetArg.cloudlyNodeId,
+  swarmClusterId: targetArg.swarmClusterId,
+  swarmNodeId: targetArg.swarmNodeId,
   nodeName: targetArg.nodeName,
   platform: targetArg.platform,
 });
 
-export const createCoreflowSecretRuntimeNodeSetDigestInput = (
-  targetsArg: ICoreflowSecretRuntimeNodeTargetV1[],
+const canonicalActiveRecipient = (
+  recipientArg: IActiveSecretRecipientMetadata,
+): IActiveSecretRecipientMetadata => ({
+  schemaVersion: recipientArg.schemaVersion,
+  recipientKeyId: recipientArg.recipientKeyId,
+  publicKey: recipientArg.publicKey,
+  generation: recipientArg.generation,
+  activatedAt: recipientArg.activatedAt,
+  lifecycleState: recipientArg.lifecycleState,
+});
+
+export const createCoreflowSecretRuntimeRegistrationExpectationDigestInput = (
+  expectationArg: ICoreflowSecretRuntimeRegistrationExpectationV2,
 ): string => JSON.stringify({
-  schemaVersion: 1,
-  targets: targetsArg.map(canonicalRuntimeTarget),
+  schemaVersion: 2,
+  purpose: 'serve.zone/coreflow-secret-runtime-expectation',
+  reporterSessionId: expectationArg.reporterSessionId,
+  targetAuthority: {
+    cloudlyClusterId: expectationArg.targetAuthority.cloudlyClusterId,
+    swarmClusterId: expectationArg.targetAuthority.swarmClusterId,
+    generation: expectationArg.targetAuthority.generation,
+    targetSetDigest: expectationArg.targetAuthority.targetSetDigest,
+  },
+  workloadInitAuthority: {
+    authorityVersion: expectationArg.workloadInitAuthority.authorityVersion,
+    authorityGeneration: expectationArg.workloadInitAuthority.authorityGeneration,
+    approvalDigest: expectationArg.workloadInitAuthority.approvalDigest,
+  },
+  activeRecipient: canonicalActiveRecipient(expectationArg.activeRecipient),
 });
 
-export const computeCoreflowSecretRuntimeNodeSetDigest = async (
-  targetsArg: ICoreflowSecretRuntimeNodeTargetV1[],
+export const computeCoreflowSecretRuntimeRegistrationExpectationDigest = async (
+  expectationArg: ICoreflowSecretRuntimeRegistrationExpectationV2,
 ): Promise<TSha256Digest> => computeRuntimeSha256(
-  createCoreflowSecretRuntimeNodeSetDigestInput(targetsArg),
+  createCoreflowSecretRuntimeRegistrationExpectationDigestInput(expectationArg),
 );
 
 const validateRuntimeTargets = (
@@ -604,178 +778,219 @@ const validateRuntimeTargets = (
     return [`${pathArg} must be a non-empty bounded array`];
   }
   const errors: string[] = [];
-  let previous: ICoreflowSecretRuntimeNodeTargetV1 | undefined;
-  const nodeIds = new Set<string>();
+  let previous: ICoreflowSecretRuntimeNodeTargetV2 | undefined;
+  const cloudlyNodeIds = new Set<string>();
+  const swarmNodeScopes = new Set<string>();
   const nodeNames = new Set<string>();
   for (const [index, targetArg] of targetsArg.entries()) {
     if (!isRuntimeRecord(targetArg)
-      || !hasExactRuntimeKeys(targetArg, ['nodeId', 'nodeName', 'platform'])) {
+      || !hasExactRuntimeKeys(targetArg, [
+        'cloudlyNodeId',
+        'swarmClusterId',
+        'swarmNodeId',
+        'nodeName',
+        'platform',
+      ])) {
       errors.push(`${pathArg}[${index}] must use its exact schema`);
       continue;
     }
-    if (!isRuntimeIdentifier(targetArg.nodeId) || !isRuntimeIdentifier(targetArg.nodeName)) {
+    if (!isRuntimeIdentifier(targetArg.cloudlyNodeId)
+      || !isRuntimeIdentifier(targetArg.swarmClusterId)
+      || !isRuntimeIdentifier(targetArg.swarmNodeId)
+      || !isRuntimeIdentifier(targetArg.nodeName)) {
       errors.push(`${pathArg}[${index}] node identity must be canonical`);
     }
     if (!runtimePlatforms.has(targetArg.platform as TImmutableContainerPlatform)) {
       errors.push(`${pathArg}[${index}].platform must be supported`);
     }
-    if (isRuntimeIdentifier(targetArg.nodeId)
+    if (isRuntimeIdentifier(targetArg.cloudlyNodeId)
+      && isRuntimeIdentifier(targetArg.swarmClusterId)
+      && isRuntimeIdentifier(targetArg.swarmNodeId)
       && isRuntimeIdentifier(targetArg.nodeName)
       && runtimePlatforms.has(targetArg.platform as TImmutableContainerPlatform)) {
-      const target = targetArg as unknown as ICoreflowSecretRuntimeNodeTargetV1;
+      const target = targetArg as unknown as ICoreflowSecretRuntimeNodeTargetV2;
       if (previous && compareRuntimeTargets(previous, target) >= 0) {
-        errors.push(`${pathArg} must be uniquely sorted by nodeId, nodeName, and platform`);
+        errors.push(`${pathArg} must be uniquely sorted by runtime identity`);
       }
       previous = target;
-      if (nodeIds.has(target.nodeId)) errors.push(`${pathArg} nodeIds must be unique`);
+      const swarmNodeScope = `${target.swarmClusterId}\0${target.swarmNodeId}`;
+      if (cloudlyNodeIds.has(target.cloudlyNodeId)) {
+        errors.push(`${pathArg} cloudlyNodeIds must be unique`);
+      }
+      if (swarmNodeScopes.has(swarmNodeScope)) {
+        errors.push(`${pathArg} scoped swarmNodeIds must be unique`);
+      }
       if (nodeNames.has(target.nodeName)) errors.push(`${pathArg} nodeNames must be unique`);
-      nodeIds.add(target.nodeId);
+      cloudlyNodeIds.add(target.cloudlyNodeId);
+      swarmNodeScopes.add(swarmNodeScope);
       nodeNames.add(target.nodeName);
     }
   }
   return errors;
 };
 
-const validateRuntimeArtifacts = (
-  artifactsArg: unknown,
-  pathArg: string,
-): string[] => {
-  if (!Array.isArray(artifactsArg)
-    || artifactsArg.length === 0
-    || artifactsArg.length > runtimePlatforms.size) {
-    return [`${pathArg} must be a non-empty bounded array`];
-  }
-  const errors: string[] = [];
-  const platforms: string[] = [];
-  for (const [index, artifactArg] of artifactsArg.entries()) {
-    if (!isRuntimeRecord(artifactArg)
-      || !hasExactRuntimeKeys(artifactArg, [
-        'platform',
-        'workloadInitPlatformManifestDigest',
-        'workloadInitExecutableDigest',
-      ])) {
-      errors.push(`${pathArg}[${index}] must use its exact schema`);
-      continue;
-    }
-    platforms.push(artifactArg.platform as string);
-    if (!runtimePlatforms.has(artifactArg.platform as TImmutableContainerPlatform)) {
-      errors.push(`${pathArg}[${index}].platform must be supported`);
-    }
-    if (typeof artifactArg.workloadInitPlatformManifestDigest !== 'string'
-      || !isSha256Digest(artifactArg.workloadInitPlatformManifestDigest)
-      || typeof artifactArg.workloadInitExecutableDigest !== 'string'
-      || !isSha256Digest(artifactArg.workloadInitExecutableDigest)) {
-      errors.push(`${pathArg}[${index}] digests must be canonical`);
-    }
-  }
-  if (new Set(platforms).size !== platforms.length
-    || JSON.stringify(platforms) !== JSON.stringify([...platforms].sort())) {
-    errors.push(`${pathArg} must be uniquely sorted by platform`);
-  }
-  return errors;
-};
-
 const activeRecipientFingerprint = (recipientArg: IActiveSecretRecipientMetadata): string => (
-  JSON.stringify({
-    schemaVersion: recipientArg.schemaVersion,
-    recipientKeyId: recipientArg.recipientKeyId,
-    publicKey: recipientArg.publicKey,
-    generation: recipientArg.generation,
-    activatedAt: recipientArg.activatedAt,
-    lifecycleState: recipientArg.lifecycleState,
-  })
+  JSON.stringify(canonicalActiveRecipient(recipientArg))
 );
 
 /**
- * Consumers discard this registration on transport disconnect, tag
- * removal/replacement, reporter-session change, or any expectation change.
+ * Validates only a Cloudly-created expectation. It does not establish the
+ * private DSSE trust decision or Spark manager consensus that produced it.
  */
-export const validateCoreflowSecretRuntimeRegistration = async (
-  registrationArg: unknown,
+export const validateCoreflowSecretRuntimeRegistrationExpectation = async (
   expectationArg: unknown,
+  trustedNowArg: number,
 ): Promise<string[]> => {
   try {
     const errors: string[] = [];
     if (!isRuntimeRecord(expectationArg)
       || !hasExactRuntimeKeys(expectationArg, [
         'expectationVersion',
+        'expectationDigest',
         'reporterSessionId',
-        'targets',
-        'workloadInitImageIndexDigest',
-        'workloadInitArtifacts',
+        'targetAuthority',
+        'workloadInitAuthority',
         'activeRecipient',
       ])) {
       return ['secret runtime registration expectation must use its exact schema'];
     }
-    if (expectationArg.expectationVersion !== 1) {
-      errors.push('secret runtime registration expectationVersion must be 1');
+    if (expectationArg.expectationVersion !== 2) {
+      errors.push('secret runtime registration expectationVersion must be 2');
     }
     if (!isRuntimeIdentifier(expectationArg.reporterSessionId)) {
       errors.push('expected secret runtime reporterSessionId must be canonical');
     }
-    const expectedTargetErrors = validateRuntimeTargets(expectationArg.targets, 'expected targets');
-    errors.push(...expectedTargetErrors);
-    errors.push(...validateRuntimeArtifacts(
-      expectationArg.workloadInitArtifacts,
-      'expected WorkloadInit artifacts',
-    ));
-    if (typeof expectationArg.workloadInitImageIndexDigest !== 'string'
-      || !isSha256Digest(expectationArg.workloadInitImageIndexDigest)) {
-      errors.push('expected WorkloadInit image index digest must be canonical');
+    const targetAuthorityErrors = await validateClusterRuntimeTargetSet(
+      expectationArg.targetAuthority,
+    );
+    errors.push(...targetAuthorityErrors.map((errorArg) => `expected ${errorArg}`));
+    if (targetAuthorityErrors.length === 0
+      && !isClusterRuntimeTargetSetFresh(
+        expectationArg.targetAuthority as IClusterRuntimeTargetSetReadyV1,
+        trustedNowArg,
+      )) {
+      errors.push('expected cluster runtime target authority must be fresh');
     }
+    if (isRuntimeRecord(expectationArg.targetAuthority)
+      && expectationArg.targetAuthority.state === 'ready') {
+      errors.push(...validateRuntimeTargets(
+        expectationArg.targetAuthority.targets,
+        'expected targets',
+      ));
+    }
+    errors.push(...await validateWorkloadInitActiveApprovalAuthority(
+      expectationArg.workloadInitAuthority,
+    ));
     const expectedRecipientErrors = validateSecretRecipientMetadata(expectationArg.activeRecipient);
     if (expectedRecipientErrors.length > 0
       || !isRuntimeRecord(expectationArg.activeRecipient)
       || expectationArg.activeRecipient.lifecycleState !== 'active') {
       errors.push('expected secret recipient must be canonical and active');
     }
+    if (isRuntimeRecord(expectationArg.workloadInitAuthority)
+      && isRuntimeRecord(expectationArg.workloadInitAuthority.approval)
+      && Array.isArray(expectationArg.workloadInitAuthority.approval.artifacts)
+      && isRuntimeRecord(expectationArg.targetAuthority)
+      && Array.isArray(expectationArg.targetAuthority.targets)) {
+      const approvedPlatforms = new Set(
+        expectationArg.workloadInitAuthority.approval.artifacts.map((artifactArg) => (
+          isRuntimeRecord(artifactArg) ? artifactArg.platform : undefined
+        )),
+      );
+      if (expectationArg.targetAuthority.targets.some((targetArg) => (
+        !isRuntimeRecord(targetArg) || !approvedPlatforms.has(targetArg.platform)
+      ))) {
+        errors.push('expected target platforms must all have approved WorkloadInit artifacts');
+      }
+    }
+    if (typeof expectationArg.expectationDigest !== 'string'
+      || !isSha256Digest(expectationArg.expectationDigest)) {
+      errors.push('secret runtime expectationDigest must be canonical');
+    } else if (errors.length === 0
+      && expectationArg.expectationDigest
+        !== await computeCoreflowSecretRuntimeRegistrationExpectationDigest(
+          expectationArg as unknown as ICoreflowSecretRuntimeRegistrationExpectationV2,
+        )) {
+      errors.push('secret runtime expectationDigest does not match');
+    }
+    return errors;
+  } catch {
+    return ['secret runtime registration expectation must be safely inspectable'];
+  }
+};
+
+/**
+ * Consumers discard this registration on transport disconnect, tag
+ * removal/replacement, reporter-session change, or any expectation change.
+ */
+export const validateCoreflowSecretRuntimeRegistration = async (
+  registrationArg: unknown,
+  expectationArg: unknown,
+  trustedNowArg: number,
+): Promise<string[]> => {
+  try {
+    const errors = await validateCoreflowSecretRuntimeRegistrationExpectation(
+      expectationArg,
+      trustedNowArg,
+    );
+    if (errors.length > 0 || !isRuntimeRecord(expectationArg)) return errors;
     if (!isRuntimeRecord(registrationArg)
       || !hasExactRuntimeKeys(registrationArg, [
         'registrationVersion',
+        'expectationDigest',
         'reporterSessionId',
         'registeredAt',
+        'targetGeneration',
+        'targetSetDigest',
         'targets',
-        'nodeSetDigest',
         'nodeEvidence',
         'capabilities',
         'activeRecipient',
+        'workloadInitAuthority',
         'workloadInitImageIndexDigest',
-        'workloadInitApprovedAt',
       ])) {
       errors.push('secret runtime registration must use its exact schema');
       return errors;
     }
-    if (registrationArg.registrationVersion !== 1) {
-      errors.push('secret runtime registrationVersion must be 1');
+    if (registrationArg.registrationVersion !== 2) {
+      errors.push('secret runtime registrationVersion must be 2');
+    }
+    if (registrationArg.expectationDigest !== expectationArg.expectationDigest) {
+      errors.push('secret runtime registration expectationDigest does not match');
     }
     if (!isRuntimeIdentifier(registrationArg.reporterSessionId)) {
       errors.push('secret runtime reporterSessionId must be canonical');
     } else if (registrationArg.reporterSessionId !== expectationArg.reporterSessionId) {
       errors.push('secret runtime reporterSessionId does not match the live session');
     }
-    if (!isPositiveSafeInteger(registrationArg.registeredAt)
-      || !isPositiveSafeInteger(registrationArg.workloadInitApprovedAt)) {
-      errors.push('secret runtime registration timestamps must be positive integers');
+    if (!isPositiveSafeInteger(registrationArg.registeredAt)) {
+      errors.push('secret runtime registration timestamp must be positive');
     }
     const registrationTargetErrors = validateRuntimeTargets(
       registrationArg.targets,
       'registration targets',
     );
     errors.push(...registrationTargetErrors);
-    if (typeof registrationArg.nodeSetDigest !== 'string'
-      || !isSha256Digest(registrationArg.nodeSetDigest)) {
-      errors.push('secret runtime nodeSetDigest must be canonical');
+    const targetAuthority = expectationArg.targetAuthority as unknown as IClusterRuntimeTargetSetReadyV1;
+    if (registrationArg.targetGeneration !== targetAuthority.generation
+      || registrationArg.targetSetDigest !== targetAuthority.targetSetDigest) {
+      errors.push('secret runtime registration target authority does not match');
     }
     if (typeof registrationArg.workloadInitImageIndexDigest !== 'string'
       || !isSha256Digest(registrationArg.workloadInitImageIndexDigest)) {
       errors.push('secret runtime WorkloadInit image index digest must be canonical');
     }
     const registrationRecipientErrors = validateSecretRecipientMetadata(registrationArg.activeRecipient);
+    const expectedRecipientErrors = validateSecretRecipientMetadata(expectationArg.activeRecipient);
     if (registrationRecipientErrors.length > 0
       || !isRuntimeRecord(registrationArg.activeRecipient)
       || registrationArg.activeRecipient.lifecycleState !== 'active') {
       errors.push('secret runtime registration recipient must be canonical and active');
     }
+    const registrationAuthorityErrors = validateWorkloadInitApprovalAuthorityReference(
+      registrationArg.workloadInitAuthority,
+    );
+    errors.push(...registrationAuthorityErrors);
     if (!isRuntimeRecord(registrationArg.capabilities)
       || !hasOnlyRuntimeKeys(registrationArg.capabilities, [
         'immutableImageDeploymentVersion',
@@ -801,12 +1016,14 @@ export const validateCoreflowSecretRuntimeRegistration = async (
       || registrationArg.nodeEvidence.length > maximumRuntimeNodes) {
       errors.push('secret runtime node evidence must be a non-empty bounded array');
     } else {
-      const evidenceTargets: ICoreflowSecretRuntimeNodeTargetV1[] = [];
-      const evidenceArtifacts: ICoreflowSecretRuntimeArtifactV1[] = [];
+      const evidenceTargets: ICoreflowSecretRuntimeNodeTargetV2[] = [];
+      const evidenceArtifacts: IWorkloadInitApprovedArtifactV1[] = [];
       for (const [index, evidenceArg] of registrationArg.nodeEvidence.entries()) {
         if (!isRuntimeRecord(evidenceArg)
           || !hasExactRuntimeKeys(evidenceArg, [
-            'nodeId',
+            'cloudlyNodeId',
+            'swarmClusterId',
+            'swarmNodeId',
             'nodeName',
             'platform',
             'workloadInitPlatformManifestDigest',
@@ -816,7 +1033,9 @@ export const validateCoreflowSecretRuntimeRegistration = async (
           continue;
         }
         evidenceTargets.push({
-          nodeId: evidenceArg.nodeId as string,
+          cloudlyNodeId: evidenceArg.cloudlyNodeId as string,
+          swarmClusterId: evidenceArg.swarmClusterId as string,
+          swarmNodeId: evidenceArg.swarmNodeId as string,
           nodeName: evidenceArg.nodeName as string,
           platform: evidenceArg.platform as TImmutableContainerPlatform,
         });
@@ -839,8 +1058,9 @@ export const validateCoreflowSecretRuntimeRegistration = async (
       }
       const expectedArtifacts = new Map<
         TImmutableContainerPlatform,
-        ICoreflowSecretRuntimeArtifactV1
-      >((expectationArg.workloadInitArtifacts as ICoreflowSecretRuntimeArtifactV1[])
+        IWorkloadInitApprovedArtifactV1
+      >(((expectationArg.workloadInitAuthority as unknown as IWorkloadInitActiveApprovalAuthorityV1)
+        .approval.artifacts)
         .map((artifactArg) => [artifactArg.platform, artifactArg]));
       for (const [index, artifactArg] of evidenceArtifacts.entries()) {
         const expectedArtifact = expectedArtifacts.get(artifactArg.platform);
@@ -853,21 +1073,26 @@ export const validateCoreflowSecretRuntimeRegistration = async (
         }
       }
     }
-    if (JSON.stringify(registrationArg.targets) !== JSON.stringify(expectationArg.targets)) {
+    if (JSON.stringify(registrationArg.targets) !== JSON.stringify(targetAuthority.targets)) {
       errors.push('secret runtime registration must exactly cover authoritative target nodes');
     }
-    if (expectedTargetErrors.length === 0 && registrationTargetErrors.length === 0) {
-      const expectedNodeSetDigest = await computeCoreflowSecretRuntimeNodeSetDigest(
-        expectationArg.targets as ICoreflowSecretRuntimeNodeTargetV1[],
-      );
-      if (registrationArg.nodeSetDigest !== expectedNodeSetDigest) {
-        errors.push('secret runtime nodeSetDigest does not match authoritative target nodes');
-      }
-    }
+    const workloadInitAuthority = expectationArg.workloadInitAuthority as
+      IWorkloadInitActiveApprovalAuthorityV1;
     if (registrationArg.workloadInitImageIndexDigest
-      !== expectationArg.workloadInitImageIndexDigest) {
+      !== workloadInitAuthority.approval.workloadInitImageIndexDigest) {
       errors.push('secret runtime WorkloadInit image index is not approved');
     }
+    if (isRuntimeRecord(registrationArg.workloadInitAuthority)
+      && (
+        registrationArg.workloadInitAuthority.authorityVersion
+          !== workloadInitAuthority.authorityVersion
+        || registrationArg.workloadInitAuthority.authorityGeneration
+          !== workloadInitAuthority.authorityGeneration
+        || registrationArg.workloadInitAuthority.approvalDigest
+          !== workloadInitAuthority.approvalDigest
+      )) {
+      errors.push('secret runtime WorkloadInit authority does not match');
+    }
     if (registrationRecipientErrors.length === 0 && expectedRecipientErrors.length === 0
       && activeRecipientFingerprint(
         registrationArg.activeRecipient as unknown as IActiveSecretRecipientMetadata,