@serve.zone/interfaces 31.9.0 → 32.0.0

package/ts/data/runtimesession.ts

@@ -1,15 +1,16 @@
 import type { IIdentityCredential } from './user.js';
 import { isSha256Digest } from './immutableimage.js';
 import type {
-  IRuntimeAssignmentObservationV1, IRuntimeAssignmentReferenceV1, IRuntimeAssignmentV1,
-  IRuntimeControllerV1,
+  IRuntimeAssignmentObservation, IRuntimeAssignmentReference, IRuntimeAssignment,
+  IRuntimeController, TRuntimeWorkloadAuthority,
 } from './runtimeassignment.js';
 import {
-  getRuntimeAssignmentV1Reference, snapshotRuntimeAssignmentObservationV1,
-  snapshotRuntimeAssignmentV1, validateRuntimeAssignmentObservationV1, validateRuntimeAssignmentV1,
+  getRuntimeAssignmentReference, isResolvedWorkloadAuthorities, snapshotRuntimeAssignmentObservation,
+  snapshotRuntimeAssignment, validateRuntimeAssignmentObservation, validateRuntimeAssignment,
 } from './runtimeassignment.js';
-import type { IRuntimeConfigV1 } from './runtimeconfig.js';
-import { bindRuntimeConfigV1ToAssignment, snapshotRuntimeConfigV1 } from './runtimeconfig.js';
+import { negotiateProtocol, readProtocolOffer, type IProtocolOffer } from '../protocol.js';
+import type { IRuntimeConfig } from './runtimeconfig.js';
+import { bindRuntimeConfigToAssignment, snapshotRuntimeConfig } from './runtimeconfig.js';
 import { canonicalizeStrictJson } from '../private/canonicaljson.js';
 
 /**
@@ -18,20 +19,18 @@ import { canonicalizeStrictJson } from '../private/canonicaljson.js';
  * is not authentication: every receiver must compare it with its live peer context.
  * Onebox local execution uses the same shape with its own authenticated IPC owner.
  */
-export interface IRuntimeSessionBindingV1 {
-  schemaVersion: 1;
+export interface IRuntimeSessionBinding {
   reporterSessionId: string;
   nodeId: string;
   credentialGeneration: number;
   sessionEpoch: number;
   controllerInstanceId: string;
-  controller: IRuntimeControllerV1;
+  controller: IRuntimeController;
   runtimeNamespace: string;
 }
 
 /** Pallet-initiated WSS on its configured Cloudly HTTPS origin; never HTTP RPC. */
-export interface IRegisterPalletRuntimeSessionRequestV1 {
-  schemaVersion: 1;
+export interface IRegisterPalletRuntimeSessionRequest {
   nodeId: string;
   credentialGeneration: number;
   /** Sensitive ephemeral input; exclude the complete request from hooks and logs. */
@@ -41,80 +40,115 @@ export interface IRegisterPalletRuntimeSessionRequestV1 {
    * registration. It proves which node process is registering when the transport cannot:
    * one relay socket carries many nodes, so the physical peer no longer distinguishes a
    * node restart from a replay. It is not a secret and it grants no authority; the bearer
-   * still authenticates. Absent only from legacy senders, which a controller may accept
-   * exclusively from a directly connected node.
+   * still authenticates.
    */
-  nodeInstanceNonce?: string;
+  nodeInstanceNonce: string;
+  /**
+   * What this node can resolve for a workload, sorted and duplicate-free.
+   *
+   * It states a capability of the build that is registering, not a permission: the controller
+   * refuses an assignment whose `requiredWorkloadAuthorities` this list does not cover, instead
+   * of a node accepting work it cannot carry out. It is not part of the registration identity —
+   * a changed build is a new process and therefore a new `nodeInstanceNonce` — so a replay of one
+   * registration with different authorities is a conflict rather than an update.
+   */
+  resolvedAuthorities: TRuntimeWorkloadAuthority[];
+  /** Read and negotiated before anything else on this body; see `runtimeSessionContract`. */
+  protocol: IProtocolOffer;
 }
 
-export interface IApplyRuntimeAssignmentRequestV1 {
-  session: IRuntimeSessionBindingV1;
-  assignment: IRuntimeAssignmentV1;
-  config: IRuntimeConfigV1;
+/**
+ * What the controller answers an accepted registration with.
+ *
+ * The offer travels beside the binding rather than inside it: the binding is embedded in every
+ * session-scoped request and compared as a whole, so an offer in it would make two builds of one
+ * controller produce two bindings for one session.
+ */
+export interface IRegisterPalletRuntimeSessionResponse {
+  session: IRuntimeSessionBinding;
+  protocol: IProtocolOffer;
+}
+
+export interface IApplyRuntimeAssignmentRequest {
+  session: IRuntimeSessionBinding;
+  assignment: IRuntimeAssignment;
+  config: IRuntimeConfig;
   /** Exact removed incumbent for a new attempt; not assignment.previous. */
-  predecessor: IRuntimeAssignmentReferenceV1 | null;
+  predecessor: IRuntimeAssignmentReference | null;
 }
 
 /** Durable admission acknowledgement only; it asserts neither effects nor readiness. */
-export interface IApplyRuntimeAssignmentResponseV1 {
+export interface IApplyRuntimeAssignmentResponse {
   status: 'accepted' | 'replay' | 'historical';
-  assignment: IRuntimeAssignmentReferenceV1;
+  assignment: IRuntimeAssignmentReference;
 }
 
-export interface IReportRuntimeAssignmentObservationRequestV1 {
+export interface IReportRuntimeAssignmentObservationRequest {
   /** Always the CURRENT authenticated connection, including after credential rotation. */
-  session: IRuntimeSessionBindingV1;
+  session: IRuntimeSessionBinding;
   /** Exact durable outbox body. Never rewrite reporterSessionId, digest or sequence. */
-  observation: IRuntimeAssignmentObservationV1;
+  observation: IRuntimeAssignmentObservation;
 }
 
-export type TRuntimeObservationAuthorityUseV1 = 'current-session' | 'historical-recovery';
+export type TRuntimeObservationAuthorityUse = 'current-session' | 'historical-recovery';
 
 /** Content comparison result only; all supplied authority must come from its trusted owner. */
-export interface IRuntimeReporterSessionBindingV1 {
-  session: IRuntimeSessionBindingV1;
-  assignment: IRuntimeAssignmentV1;
-  reporterHistory: IRuntimeSessionBindingV1;
-  authorityUse: TRuntimeObservationAuthorityUseV1;
+export interface IRuntimeReporterSessionBinding {
+  session: IRuntimeSessionBinding;
+  assignment: IRuntimeAssignment;
+  reporterHistory: IRuntimeSessionBinding;
+  authorityUse: TRuntimeObservationAuthorityUse;
 }
 
-export interface IReportRuntimeAssignmentObservationResponseV1 {
+export interface IReportRuntimeAssignmentObservationResponse {
   /** Exact request body after a durable sequence/receipt transaction. */
-  observation: IRuntimeAssignmentObservationV1;
+  observation: IRuntimeAssignmentObservation;
   /**
    * Historical recovery can advance the durable counter and ACK only. It must not
    * update active readiness, routing or liveness; those require a fresh report
    * from the current session. Neither classification is proof of writer fencing.
    */
-  authorityUse: TRuntimeObservationAuthorityUseV1;
+  authorityUse: TRuntimeObservationAuthorityUse;
 }
 
-export interface IGetRuntimeRegistryCredentialRequestV1 {
-  session: IRuntimeSessionBindingV1;
+export interface IGetRuntimeRegistryCredentialRequest {
+  session: IRuntimeSessionBinding;
   /** The server must authorize this exact CURRENT assignment, including its node. */
-  assignment: IRuntimeAssignmentReferenceV1;
+  assignment: IRuntimeAssignmentReference;
 }
 
 /** Sensitive ephemeral material; never persist, hash, log or include in diagnostics. */
-export interface IGetRuntimeRegistryCredentialResponseV1 {
+export interface IGetRuntimeRegistryCredentialResponse {
   username: string;
   password: string;
   expiresAt: number;
 }
 
 /** Cloudly human/machine JWT registration on a physical TypedSocket; reject HTTP. */
-export interface IRegisterCloudlyClientSessionRequestV1 {
-  schemaVersion: 1;
+export interface IRegisterCloudlyClientSessionRequest {
   /** Authenticate the current JWT server-side; do not accept client identity claims. */
   identity: IIdentityCredential;
+  /** Read and negotiated before the identity is authenticated; see `runtimeSessionContract`. */
+  protocol: IProtocolOffer;
 }
 
-export interface IRegisterCloudlyClientSessionResponseV1 {
+export interface IRegisterCloudlyClientSessionResponse {
   /** Server-owned identity tagging completed; never trust a client-authored tag. */
   registered: true;
+  /** The controller's offer, so an accepted client can judge the session it just opened. */
+  protocol: IProtocolOffer;
 }
 
-export const runtimeSessionV1Contract = Object.freeze({
+/**
+ * The rules every runtime session registration is judged by.
+ *
+ * Every carrier here is judged in the one server order `protocol.readProtocolOffer` states,
+ * against this session kind's own offer, so the snapshots below see a body whose offer this
+ * controller already accepted. For a node that order is also what keeps a refused registration
+ * from touching its packet access: the refusal is named before `networkVpn` is asked to mutate
+ * anything.
+ */
+export const runtimeSessionContract = Object.freeze({
   maximumWireCanonicalBytes: 327_680,
   maximumCredentialBytes: 16_384,
   maximumRegistryPasswordBytes: 8192,
@@ -123,12 +157,10 @@ export const runtimeSessionV1Contract = Object.freeze({
   nodeInstanceNonceFormat: 'canonical-lowercase-uuid-per-node-process',
   /** The registration a controller must treat as one: a change in any part is a new session. */
   registrationIdentity: 'node-id-and-credential-generation-and-node-instance-nonce',
-  /** A relay socket carries many nodes, so its transport cannot prove a node process. */
-  relayRegistrationRequiresNodeInstanceNonce: true,
   error: 'Runtime session contract rejected.',
 } as const);
 
-const fail = (): never => { throw new Error(runtimeSessionV1Contract.error); };
+const fail = (): never => { throw new Error(runtimeSessionContract.error); };
 function requireValue(conditionArg: unknown): asserts conditionArg {
   if (!conditionArg) fail();
 }
@@ -163,9 +195,9 @@ const capture = (valueArg: unknown): unknown => safe(() => {
   let stringBytes = 0;
   const ancestors = new Set<object>();
   const account = (value: string): void => {
-    requireValue(value.length <= runtimeSessionV1Contract.maximumWireCanonicalBytes);
+    requireValue(value.length <= runtimeSessionContract.maximumWireCanonicalBytes);
     stringBytes += encoder.encode(value).byteLength;
-    requireValue(stringBytes <= runtimeSessionV1Contract.maximumWireCanonicalBytes);
+    requireValue(stringBytes <= runtimeSessionContract.maximumWireCanonicalBytes);
   };
   const copy = (value: unknown, depth: number): unknown => {
     requireValue(++nodes <= 10_240 && depth <= 16);
@@ -202,7 +234,7 @@ const capture = (valueArg: unknown): unknown => safe(() => {
     } finally { ancestors.delete(value); }
   };
   const serialized = canonical(copy(valueArg, 0));
-  requireValue(encoder.encode(serialized).byteLength <= runtimeSessionV1Contract.maximumWireCanonicalBytes);
+  requireValue(encoder.encode(serialized).byteLength <= runtimeSessionContract.maximumWireCanonicalBytes);
   return JSON.parse(serialized);
 });
 
@@ -215,139 +247,154 @@ const record = (
     && keys.every((key) => keysArg.includes(key) || optionalKeysArg.includes(key)));
   return valueArg as Record<string, unknown>;
 };
-const reference = (valueArg: unknown): IRuntimeAssignmentReferenceV1 => {
+const reference = (valueArg: unknown): IRuntimeAssignmentReference => {
   const value = record(valueArg, ['assignmentId', 'generation', 'digest']);
   requireValue(typeof value.digest === 'string' && isSha256Digest(value.digest));
   return { assignmentId: identifier(value.assignmentId), generation: positive(value.generation), digest: value.digest };
 };
-const session = (valueArg: unknown): IRuntimeSessionBindingV1 => {
-  const value = record(valueArg, ['schemaVersion', 'reporterSessionId', 'nodeId', 'credentialGeneration',
+const session = (valueArg: unknown): IRuntimeSessionBinding => {
+  const value = record(valueArg, ['reporterSessionId', 'nodeId', 'credentialGeneration',
     'sessionEpoch', 'controllerInstanceId', 'controller', 'runtimeNamespace']);
   const controller = record(value.controller, ['kind', 'id', 'epoch']);
-  requireValue(value.schemaVersion === 1 && (controller.kind === 'cloudly' || controller.kind === 'onebox'));
+  requireValue(controller.kind === 'cloudly' || controller.kind === 'onebox');
   return {
-    schemaVersion: 1, reporterSessionId: identifier(value.reporterSessionId), nodeId: nodeId(value.nodeId),
+    reporterSessionId: identifier(value.reporterSessionId), nodeId: nodeId(value.nodeId),
     credentialGeneration: positive(value.credentialGeneration), sessionEpoch: positive(value.sessionEpoch),
     controllerInstanceId: identifier(value.controllerInstanceId),
     controller: { kind: controller.kind, id: identifier(controller.id), epoch: identifier(controller.epoch) },
     runtimeNamespace: identifier(value.runtimeNamespace),
   };
 };
-const sameSession = (leftArg: IRuntimeSessionBindingV1, rightArg: IRuntimeSessionBindingV1): boolean =>
+const sameSession = (leftArg: IRuntimeSessionBinding, rightArg: IRuntimeSessionBinding): boolean =>
   canonical(leftArg) === canonical(rightArg);
-const sameOwner = (leftArg: IRuntimeSessionBindingV1, rightArg: IRuntimeSessionBindingV1): boolean =>
+const sameOwner = (leftArg: IRuntimeSessionBinding, rightArg: IRuntimeSessionBinding): boolean =>
   leftArg.nodeId === rightArg.nodeId && leftArg.runtimeNamespace === rightArg.runtimeNamespace
   && canonical(leftArg.controller) === canonical(rightArg.controller);
-const matchesAssignment = (sessionArg: IRuntimeSessionBindingV1, assignmentArg: IRuntimeAssignmentV1): boolean =>
+const matchesAssignment = (sessionArg: IRuntimeSessionBinding, assignmentArg: IRuntimeAssignment): boolean =>
   sessionArg.nodeId === assignmentArg.nodeId && sessionArg.runtimeNamespace === assignmentArg.runtimeNamespace
   && canonical(sessionArg.controller) === canonical(assignmentArg.controller);
 
 /** Synchronous detached structural assertion only; never an authentication check. */
-export const snapshotRuntimeSessionBindingV1 = (valueArg: unknown): IRuntimeSessionBindingV1 =>
+export const snapshotRuntimeSessionBinding = (valueArg: unknown): IRuntimeSessionBinding =>
   safe(() => session(capture(valueArg)));
 
-export const snapshotRegisterPalletRuntimeSessionRequestV1 = (
+export const snapshotRegisterPalletRuntimeSessionRequest = (
   valueArg: unknown,
-): IRegisterPalletRuntimeSessionRequestV1 => safe(() => {
-  const value = record(capture(valueArg), ['schemaVersion', 'nodeId', 'credentialGeneration', 'bearer'],
-    ['nodeInstanceNonce']);
-  requireValue(value.schemaVersion === 1 && typeof value.bearer === 'string'
-    && /^palletToken[0-9a-f]{64}$/.test(value.bearer));
-  const request: IRegisterPalletRuntimeSessionRequestV1 = { schemaVersion: 1, nodeId: nodeId(value.nodeId),
-    credentialGeneration: positive(value.credentialGeneration), bearer: value.bearer };
-  // Absence stays absent: a controller distinguishes a legacy sender from a stated nonce.
-  if (Object.hasOwn(value, 'nodeInstanceNonce')) request.nodeInstanceNonce = nodeInstanceNonce(value.nodeInstanceNonce);
-  return request;
+): IRegisterPalletRuntimeSessionRequest => safe(() => {
+  const value = record(capture(valueArg),
+    ['nodeId', 'credentialGeneration', 'bearer', 'nodeInstanceNonce', 'resolvedAuthorities', 'protocol']);
+  requireValue(typeof value.bearer === 'string' && /^palletToken[0-9a-f]{64}$/.test(value.bearer));
+  requireValue(isResolvedWorkloadAuthorities(value.resolvedAuthorities));
+  return {
+    nodeId: nodeId(value.nodeId), credentialGeneration: positive(value.credentialGeneration),
+    bearer: value.bearer, nodeInstanceNonce: nodeInstanceNonce(value.nodeInstanceNonce),
+    resolvedAuthorities: [...value.resolvedAuthorities], protocol: readProtocolOffer(value),
+  };
 });
 
-export const snapshotApplyRuntimeAssignmentRequestV1 = (
+export const snapshotRegisterPalletRuntimeSessionResponse = (
   valueArg: unknown,
-): IApplyRuntimeAssignmentRequestV1 => safe(() => {
+): IRegisterPalletRuntimeSessionResponse => safe(() => {
+  const value = record(capture(valueArg), ['session', 'protocol']);
+  return { session: session(value.session), protocol: readProtocolOffer(value) };
+});
+
+export const snapshotApplyRuntimeAssignmentRequest = (
+  valueArg: unknown,
+): IApplyRuntimeAssignmentRequest => safe(() => {
   const value = record(capture(valueArg), ['session', 'assignment', 'config', 'predecessor']);
-  const assignment = snapshotRuntimeAssignmentV1(value.assignment);
+  const assignment = snapshotRuntimeAssignment(value.assignment);
   const predecessor = value.predecessor === null ? null : reference(value.predecessor);
   // Assignment revisions use assignment.previous; a replacement names a different attempt.
   requireValue(predecessor === null || predecessor.assignmentId !== assignment.assignmentId);
-  return { session: session(value.session), assignment, config: snapshotRuntimeConfigV1(value.config), predecessor };
+  return { session: session(value.session), assignment, config: snapshotRuntimeConfig(value.config), predecessor };
 });
 
-export const snapshotApplyRuntimeAssignmentResponseV1 = (
+export const snapshotApplyRuntimeAssignmentResponse = (
   valueArg: unknown,
-): IApplyRuntimeAssignmentResponseV1 => safe(() => {
+): IApplyRuntimeAssignmentResponse => safe(() => {
   const value = record(capture(valueArg), ['status', 'assignment']);
   requireValue(value.status === 'accepted' || value.status === 'replay' || value.status === 'historical');
   return { status: value.status, assignment: reference(value.assignment) };
 });
 
-export const snapshotReportRuntimeAssignmentObservationRequestV1 = (
+export const snapshotReportRuntimeAssignmentObservationRequest = (
   valueArg: unknown,
-): IReportRuntimeAssignmentObservationRequestV1 => safe(() => {
+): IReportRuntimeAssignmentObservationRequest => safe(() => {
   const value = record(capture(valueArg), ['session', 'observation']);
-  return { session: session(value.session), observation: snapshotRuntimeAssignmentObservationV1(value.observation) };
+  return { session: session(value.session), observation: snapshotRuntimeAssignmentObservation(value.observation) };
 });
 
-export const snapshotReportRuntimeAssignmentObservationResponseV1 = (
+export const snapshotReportRuntimeAssignmentObservationResponse = (
   valueArg: unknown,
-): IReportRuntimeAssignmentObservationResponseV1 => safe(() => {
+): IReportRuntimeAssignmentObservationResponse => safe(() => {
   const value = record(capture(valueArg), ['observation', 'authorityUse']);
   requireValue(value.authorityUse === 'current-session' || value.authorityUse === 'historical-recovery');
-  return { observation: snapshotRuntimeAssignmentObservationV1(value.observation), authorityUse: value.authorityUse };
+  return { observation: snapshotRuntimeAssignmentObservation(value.observation), authorityUse: value.authorityUse };
 });
 
-export const snapshotGetRuntimeRegistryCredentialRequestV1 = (
+export const snapshotGetRuntimeRegistryCredentialRequest = (
   valueArg: unknown,
-): IGetRuntimeRegistryCredentialRequestV1 => safe(() => {
+): IGetRuntimeRegistryCredentialRequest => safe(() => {
   const value = record(capture(valueArg), ['session', 'assignment']);
   return { session: session(value.session), assignment: reference(value.assignment) };
 });
 
-export const snapshotGetRuntimeRegistryCredentialResponseV1 = (
+export const snapshotGetRuntimeRegistryCredentialResponse = (
   valueArg: unknown,
-): IGetRuntimeRegistryCredentialResponseV1 => safe(() => {
+): IGetRuntimeRegistryCredentialResponse => safe(() => {
   const value = record(capture(valueArg), ['username', 'password', 'expiresAt']);
   requireValue(typeof value.username === 'string' && value.username.length > 0
     && encoder.encode(value.username).byteLength <= 1024 && !/[\s:\u0000-\u001f\u007f]/.test(value.username));
   requireValue(typeof value.password === 'string' && value.password.length > 0
-    && encoder.encode(value.password).byteLength <= runtimeSessionV1Contract.maximumRegistryPasswordBytes
+    && encoder.encode(value.password).byteLength <= runtimeSessionContract.maximumRegistryPasswordBytes
     && !/[\u0000-\u001f\u007f]/.test(value.password));
   return { username: value.username, password: value.password, expiresAt: positive(value.expiresAt) };
 });
 
-export const snapshotRegisterCloudlyClientSessionRequestV1 = (
+export const snapshotRegisterCloudlyClientSessionRequest = (
   valueArg: unknown,
-): IRegisterCloudlyClientSessionRequestV1 => safe(() => {
-  const value = record(capture(valueArg), ['schemaVersion', 'identity']);
+): IRegisterCloudlyClientSessionRequest => safe(() => {
+  const value = record(capture(valueArg), ['identity', 'protocol']);
   const identity = record(value.identity, ['jwt']);
-  requireValue(value.schemaVersion === 1 && typeof identity.jwt === 'string'
-    && identity.jwt.length <= runtimeSessionV1Contract.maximumCredentialBytes
+  requireValue(typeof identity.jwt === 'string'
+    && identity.jwt.length <= runtimeSessionContract.maximumCredentialBytes
     && /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(identity.jwt));
-  return { schemaVersion: 1, identity: { jwt: identity.jwt } };
+  return { identity: { jwt: identity.jwt }, protocol: readProtocolOffer(value) };
 });
 
-export const snapshotRegisterCloudlyClientSessionResponseV1 = (
+export const snapshotRegisterCloudlyClientSessionResponse = (
   valueArg: unknown,
-): IRegisterCloudlyClientSessionResponseV1 => safe(() => {
-  const value = record(capture(valueArg), ['registered']);
+): IRegisterCloudlyClientSessionResponse => safe(() => {
+  const value = record(capture(valueArg), ['registered', 'protocol']);
   requireValue(value.registered === true);
-  return { registered: true };
+  return { registered: true, protocol: readProtocolOffer(value) };
 });
 
-/** Bind the authenticated Cloudly registration reply to the node and credential sent. */
-export const bindRegisterPalletRuntimeSessionResponseV1 = (
+/**
+ * Bind the authenticated Cloudly registration reply to the node, credential and offer sent.
+ *
+ * The client negotiates the answered offer against the one it sent: acceptance by a controller is
+ * that controller's judgement, and a node that cannot serve the session it was given must not open
+ * it. Both offers were read from the two bodies, so this compares what was actually exchanged.
+ */
+export const bindRegisterPalletRuntimeSessionResponse = (
   valueArg: unknown, requestArg: unknown,
-): IRuntimeSessionBindingV1 => safe(() => {
-  const response = snapshotRuntimeSessionBindingV1(valueArg);
-  const request = snapshotRegisterPalletRuntimeSessionRequestV1(requestArg);
-  requireValue(response.controller.kind === 'cloudly' && response.nodeId === request.nodeId
-    && response.credentialGeneration === request.credentialGeneration);
+): IRegisterPalletRuntimeSessionResponse => safe(() => {
+  const response = snapshotRegisterPalletRuntimeSessionResponse(valueArg);
+  const request = snapshotRegisterPalletRuntimeSessionRequest(requestArg);
+  requireValue(response.session.controller.kind === 'cloudly'
+    && response.session.nodeId === request.nodeId
+    && response.session.credentialGeneration === request.credentialGeneration
+    && negotiateProtocol(request.protocol, response.protocol).compatible);
   return response;
 });
 
 /** Reject already expired material; issuance policy and current assignment authority remain server-owned. */
-export const bindGetRuntimeRegistryCredentialResponseV1 = (
+export const bindGetRuntimeRegistryCredentialResponse = (
   valueArg: unknown, nowArg: number,
-): IGetRuntimeRegistryCredentialResponseV1 => safe(() => {
-  const response = snapshotGetRuntimeRegistryCredentialResponseV1(valueArg);
+): IGetRuntimeRegistryCredentialResponse => safe(() => {
+  const response = snapshotGetRuntimeRegistryCredentialResponse(valueArg);
   requireValue(response.expiresAt > positive(nowArg));
   return response;
 });
@@ -357,25 +404,25 @@ export const bindGetRuntimeRegistryCredentialResponseV1 = (
  * come from the receiving live connection, never from another request field.
  * This binds content only; durable CAS, slot admission and authority remain owners.
  */
-export const bindApplyRuntimeAssignmentRequestV1 = async (
+export const bindApplyRuntimeAssignmentRequest = async (
   valueArg: unknown, trustedSessionArg: unknown,
-): Promise<IApplyRuntimeAssignmentRequestV1> => {
+): Promise<IApplyRuntimeAssignmentRequest> => {
   try {
-    const request = snapshotApplyRuntimeAssignmentRequestV1(valueArg);
-    const trustedSession = snapshotRuntimeSessionBindingV1(trustedSessionArg);
+    const request = snapshotApplyRuntimeAssignmentRequest(valueArg);
+    const trustedSession = snapshotRuntimeSessionBinding(trustedSessionArg);
     requireValue(sameSession(request.session, trustedSession) && matchesAssignment(trustedSession, request.assignment));
-    await bindRuntimeConfigV1ToAssignment(request.config, request.assignment);
+    await bindRuntimeConfigToAssignment(request.config, request.assignment);
     return request;
   } catch { return fail(); }
 };
 
 /** Match an admission acknowledgement to the exact sent revision, including historical replies. */
-export const bindApplyRuntimeAssignmentResponseV1 = (
+export const bindApplyRuntimeAssignmentResponse = (
   valueArg: unknown, requestArg: unknown,
-): IApplyRuntimeAssignmentResponseV1 => safe(() => {
-  const response = snapshotApplyRuntimeAssignmentResponseV1(valueArg);
-  const request = snapshotApplyRuntimeAssignmentRequestV1(requestArg);
-  requireValue(canonical(response.assignment) === canonical(getRuntimeAssignmentV1Reference(request.assignment)));
+): IApplyRuntimeAssignmentResponse => safe(() => {
+  const response = snapshotApplyRuntimeAssignmentResponse(valueArg);
+  const request = snapshotApplyRuntimeAssignmentRequest(requestArg);
+  requireValue(canonical(response.assignment) === canonical(getRuntimeAssignmentReference(request.assignment)));
   return response;
 });
 
@@ -386,15 +433,15 @@ export const bindApplyRuntimeAssignmentResponseV1 = (
  * The owning transaction must recheck current credential/peer authority. Assignment
  * digest validation and report-specific authority remain the caller's responsibility.
  */
-export const bindRuntimeReporterSessionV1 = (
+export const bindRuntimeReporterSession = (
   sessionArg: unknown, reporterSessionIdArg: string, assignmentArg: unknown,
   trustedSessionArg: unknown, reporterHistoryArg: unknown,
-): IRuntimeReporterSessionBindingV1 => safe(() => {
-  const incomingSession = snapshotRuntimeSessionBindingV1(sessionArg);
+): IRuntimeReporterSessionBinding => safe(() => {
+  const incomingSession = snapshotRuntimeSessionBinding(sessionArg);
   const reporterSessionId = identifier(reporterSessionIdArg);
-  const assignment = snapshotRuntimeAssignmentV1(capture(assignmentArg));
-  const trustedSession = snapshotRuntimeSessionBindingV1(trustedSessionArg);
-  const reporterHistory = snapshotRuntimeSessionBindingV1(reporterHistoryArg);
+  const assignment = snapshotRuntimeAssignment(capture(assignmentArg));
+  const trustedSession = snapshotRuntimeSessionBinding(trustedSessionArg);
+  const reporterHistory = snapshotRuntimeSessionBinding(reporterHistoryArg);
   requireValue(sameSession(incomingSession, trustedSession) && matchesAssignment(trustedSession, assignment)
     && reporterSessionId === reporterHistory.reporterSessionId && sameOwner(trustedSession, reporterHistory));
   const current = sameSession(reporterHistory, trustedSession);
@@ -408,32 +455,32 @@ export const bindRuntimeReporterSessionV1 = (
 /**
  * trustedSessionArg is the CURRENT authenticated physical peer. reporterHistoryArg
  * must be server-indexed immutable session history, obtained by the original
- * observation's reporterSessionId; never accept caller-supplied history. All V1
- * runtime sessions are Pallet-purpose sessions, so Spark history cannot qualify.
+ * observation's reporterSessionId; never accept caller-supplied history. Every
+ * runtime session is a Pallet-purpose session, so Spark history cannot qualify.
  *
  * This verifies content and classifies recovery, not authentication, history
  * provenance, sequence admission or current authority. The server must transact
  * receipt/counter acceptance under current credential and peer authority. A
  * historical result MUST NOT restore active readiness, routes or liveness.
  */
-export const bindReportRuntimeAssignmentObservationRequestV1 = async (
+export const bindReportRuntimeAssignmentObservationRequest = async (
   valueArg: unknown, assignmentArg: unknown, trustedSessionArg: unknown, reporterHistoryArg: unknown,
-): Promise<{ request: IReportRuntimeAssignmentObservationRequestV1; authorityUse: TRuntimeObservationAuthorityUseV1 }> => {
+): Promise<{ request: IReportRuntimeAssignmentObservationRequest; authorityUse: TRuntimeObservationAuthorityUse }> => {
   try {
-    const request = snapshotReportRuntimeAssignmentObservationRequestV1(valueArg);
-    const binding = bindRuntimeReporterSessionV1(request.session, request.observation.reporterSessionId,
+    const request = snapshotReportRuntimeAssignmentObservationRequest(valueArg);
+    const binding = bindRuntimeReporterSession(request.session, request.observation.reporterSessionId,
       assignmentArg, trustedSessionArg, reporterHistoryArg);
-    requireValue((await validateRuntimeAssignmentObservationV1(request.observation, binding.assignment)).length === 0);
+    requireValue((await validateRuntimeAssignmentObservation(request.observation, binding.assignment)).length === 0);
     return { request, authorityUse: binding.authorityUse };
   } catch { return fail(); }
 };
 
 /** Reject body rewriting and a historical receipt mislabeled as current authority. */
-export const bindReportRuntimeAssignmentObservationResponseV1 = (
+export const bindReportRuntimeAssignmentObservationResponse = (
   valueArg: unknown, requestArg: unknown,
-): IReportRuntimeAssignmentObservationResponseV1 => safe(() => {
-  const response = snapshotReportRuntimeAssignmentObservationResponseV1(valueArg);
-  const request = snapshotReportRuntimeAssignmentObservationRequestV1(requestArg);
+): IReportRuntimeAssignmentObservationResponse => safe(() => {
+  const response = snapshotReportRuntimeAssignmentObservationResponse(valueArg);
+  const request = snapshotReportRuntimeAssignmentObservationRequest(requestArg);
   requireValue(canonical(response.observation) === canonical(request.observation)
     && response.authorityUse === (request.observation.reporterSessionId === request.session.reporterSessionId
       ? 'current-session' : 'historical-recovery'));
@@ -441,17 +488,17 @@ export const bindReportRuntimeAssignmentObservationResponseV1 = (
 });
 
 /** Current assignment lookup and live peer authorization remain mandatory server-owned inputs. */
-export const bindGetRuntimeRegistryCredentialRequestV1 = async (
+export const bindGetRuntimeRegistryCredentialRequest = async (
   valueArg: unknown, assignmentArg: unknown, trustedSessionArg: unknown,
-): Promise<IGetRuntimeRegistryCredentialRequestV1> => {
+): Promise<IGetRuntimeRegistryCredentialRequest> => {
   try {
-    const request = snapshotGetRuntimeRegistryCredentialRequestV1(valueArg);
-    const assignment = snapshotRuntimeAssignmentV1(capture(assignmentArg));
-    const trustedSession = snapshotRuntimeSessionBindingV1(trustedSessionArg);
+    const request = snapshotGetRuntimeRegistryCredentialRequest(valueArg);
+    const assignment = snapshotRuntimeAssignment(capture(assignmentArg));
+    const trustedSession = snapshotRuntimeSessionBinding(trustedSessionArg);
     requireValue(sameSession(request.session, trustedSession) && matchesAssignment(trustedSession, assignment)
       && assignment.disposition === 'run'
-      && canonical(request.assignment) === canonical(getRuntimeAssignmentV1Reference(assignment)));
-    requireValue((await validateRuntimeAssignmentV1(assignment)).length === 0);
+      && canonical(request.assignment) === canonical(getRuntimeAssignmentReference(assignment)));
+    requireValue((await validateRuntimeAssignment(assignment)).length === 0);
     return request;
   } catch { return fail(); }
 };