@serve.zone/interfaces 32.35.0 → 32.36.1

package/readme.md

@@ -1227,6 +1227,104 @@ only the named Pallet attempt. They do not authorize storage relocation, prove
 whole-host or Docker/Coreflow absence, grant another controller or organization
 authority, or replace independently qualified readiness and routing evidence.
 
+### Runtime Workload Logs, Stats, Exec And Volume Archives
+
+These requests ride on a node's authenticated runtime session (`requests.runtimesession`). Every
+request carries `session`, and the receiver compares it with its own current session and with the
+connection the request arrived on: a serialized session is never authentication. Exec and volume
+archives belong to a controller on the node's own host alone (`controller.kind: 'onebox'`, which
+only a local controller binding carries), because the local socket's root-only permissions are
+what authenticate that controller.
+
+**Logs.** `IReq_Pallet_Controller_ReportRuntimeAssignmentLogs` (`reportRuntimeAssignmentLogs`)
+pushes one `IRuntimeAssignmentLogBatch { assignmentId, attemptId, captureId, sequence, entries,
+final }` from the node to its controller. Logs are the controller's to keep
+(`IRuntimeConfig.logs`); the node's capture files are disposable transport artifacts, so the node
+pushes and the controller persists. The node discards a batch only after the controller
+acknowledged it, and sends the next one only then.
+
+- `entries` are in capture order. A `line` entry `{ stream, timestampNs, text, partial }` is one
+  piece of one line: `text` holds no `\n`, invalid UTF-8 becomes U+FFFD, and a line longer than
+  one entry (`maximumEntryTextBytes`, 64 KiB) travels as pieces that state `partial: true` up to
+  the last. The joined line is at most the config's `logs.maximumLineBytes`.
+- A `lost` entry `{ reason, stream, timestampNs, bytes, lines }` is evidence of output that did not
+  arrive, placed where it was lost: `buffer-overflow` (the node's buffer reached
+  `logs.maximumBufferedBytes` and it dropped the oldest bytes), `line-cut` (the rest of a line
+  beyond `maximumLineBytes`, right after that line's last piece), `capture-restart` and
+  `not-captured` (a container started without capture). The last two cannot know how much was
+  lost and state `bytes` and `lines` as `null`; the others count exactly.
+- `captureId` names one capture of the attempt. `sequence` counts that capture's batches from 1.
+  `final` states that the container is gone and its output drained; only a final batch may be
+  empty. A report is at most 1 024 entries and one mebibyte of canonical JSON, and timestamps are
+  nanoseconds since the Unix epoch as decimal digits.
+
+The answer `{ status, assignmentId, captureId, sequence }` is `accepted`, or `replay` for a batch
+the controller already holds. The controller never refuses a batch for a gap in `sequence`: the
+node only discards what was acknowledged, so a gap is the controller's own loss, which it records.
+`bindReportRuntimeAssignmentLogsRequest(request, assignment, logPolicy, trustedSession)` checks the
+session, that the assignment is this node's and carries the batch's attempt, and every line's
+joined length against the policy. `bindReportRuntimeAssignmentLogsResponse(response, request)`
+binds the acknowledgement to the batch.
+
+**Stats.** `IReq_Controller_Pallet_ReadRuntimeAssignmentStats` (`readRuntimeAssignmentStats`)
+reads one sample of one attempt: `{ session, assignment }` names the exact current revision, and
+the answer is `{ status: 'sampled', assignment, sample }` or `{ status: 'not-running', assignment,
+sample: null }`. An `IRuntimeAssignmentStatsSample` states `timestampNs`, the cumulative
+`cpuUsageCoreNanoseconds` (decimal digits: it outgrows a JSON number; utilisation comes from two
+samples), `memoryWorkingSetBytes`, `memoryLimitBytes` (the limit the node enforces, the config's
+`memoryBytes`), `network { receivedBytes, transmittedBytes }` of the sandbox, or `null`, and
+`writableLayerBytes`, or `null`. Any controller may read stats; a node answers one read per
+assignment at a time. `bindReadRuntimeAssignmentStatsRequest(request, assignment, trustedSession)`
+and `bindReadRuntimeAssignmentStatsResponse(response, request)` bind both sides.
+
+**Exec.** `IReq_Onebox_Pallet_OpenRuntimeAssignmentExec` (`openRuntimeAssignmentExec`) runs one
+command in the container of a `run` assignment's running attempt. The request is `{ exec: { session,
+assignment, command, tty, terminalSize }, stdin }`: `command` is the argument vector the runtime
+executes directly (at most 256 arguments and 64 KiB, no NUL, a non-empty first element),
+`terminalSize { columns, rows }` is stated exactly for `tty`, and `stdin` is a sending
+VirtualStream or `null`, whose end is the process's end of input. The answer `{ exec: { execId,
+assignment, tty, idleTimeoutMs }, stdout, stderr }` returns receiving streams that outlive the
+request; a `tty` session's whole output is on `stdout` and its `stderr` is `null`.
+`resizeRuntimeAssignmentExec` changes a `tty` session's terminal size, and
+`closeRuntimeAssignmentExec` ends a session, releases its slot and answers how it ended: `exited`
+with `exitCode` (128 plus the signal number for a signalled process) or `terminated` with the
+`termination` that ended it first, `closed`, `idle-timeout` or `container-stopped`.
+`runtimeAssignmentExecContract` fixes the bounds: four sessions per node, counting ended ones not
+yet closed, and 15 minutes without a byte in either direction before the node ends one. A session
+also ends with the controller session it was opened under, and its `execId` is gone with it.
+`bindOpenRuntimeAssignmentExecRequest`, `bindResizeRuntimeAssignmentExecRequest` and
+`bindCloseRuntimeAssignmentExecRequest` take the node's trusted session and refuse any controller
+but a local one; the response binders match the answer to its request.
+
+**Volume archives.** A local controller backs up and restores a node-local volume as one POSIX
+pax archive (`runtimeLocalVolumeArchiveContract`). The first entry is the volume root `./`, and
+entries are directories, regular files, symbolic links (stored, never followed), hard links to
+earlier entries and FIFOs, with numeric `uid`/`gid`, exact mode bits and modification times.
+Sockets are omitted; a device node is refused, and extended attributes and ACLs are not carried.
+An archive is a whole number of 512-byte blocks and at least 1 536 bytes. A node moves one archive
+per volume at a time.
+
+- `readRuntimeLocalVolumeArchive` (`IReq_Onebox_Pallet_ReadRuntimeLocalVolumeArchive`):
+  `{ session, claim }` names the node's current generation of a bound `directory` claim. The node
+  refuses while a running container holds the volume. It reads a volume nobody holds, or one whose
+  holder is stopped, which a node never restarts, and grants the volume to no container meanwhile.
+  The answer `{ volume: { claim, format: 'pax', holder }, archive }` streams the archive. It
+  carries no integrity, because the node learns the length and digest only while writing.
+- `writeRuntimeLocalVolumeArchive` (`IReq_Onebox_Pallet_WriteRuntimeLocalVolumeArchive`):
+  `{ volume: { session, claim, format, byteLength, digest }, archive }` writes an archive as the
+  bytes of an `import` claim that waits in `import-required`, the online form of the offline
+  import. The stream's integrity must be `getRuntimeLocalVolumeArchiveIntegrity(volume)`. The node
+  unpacks into a private staging tree and publishes it as the volume only after the whole archive
+  verified. The tree keeps the archive's ownership, as every imported tree does. The answer
+  `{ claim, status: 'receiving' }` permits sending; the stream's acceptance receipt confirms the
+  volume is `ready`, and a rejected or aborted stream publishes nothing.
+
+`bindReadRuntimeLocalVolumeArchiveRequest(request, claim, trustedSession)` and
+`bindWriteRuntimeLocalVolumeArchiveRequest` require a local controller's current session and the
+exact reference of a bound `directory` claim of its controller, cluster, node and runtime
+namespace, an `import` claim for a write. Whether the volume is `ready` or still
+`import-required`, and who holds it, are the node's ledger checks.
+
 ### Cluster Runtime Phase
 
 `data.IClusterRuntime { id, phase, generation, changedAt, changedBy }` records which runtime owns a
@@ -2996,6 +3094,13 @@ The immutable deployment workflow is:
 4. Observe exact rollout and runtime-digest evidence with `getServiceDeploymentStatus`.
 5. For a greenfield service, expose and verify its public route with `promoteServiceDeploymentRoute` only after the immutable rollout succeeds.
 
+A legacy `deployOnPush` service without deployable source moves to a greenfield successor by a legacy import, which replaces step 2:
+
+- While the legacy replicas still run — before its runtime is frozen — an administrator captures the evidence with `captureLegacyServiceRuntimeAttestation` (`requests.service.IRequest_Any_Cloudly_CaptureLegacyServiceRuntimeAttestation`). The stored `data.ILegacyServiceRuntimeAttestation` records every required replica healthy on one digest, the registry root the legacy tag names, and that root's platform manifests; `data.validateLegacyServiceRuntimeAttestation` states its rules. Incomplete evidence is refused, never stored, and there is no substitute once the runtime is stopped. `getLegacyServiceRuntimeAttestations` lists what Cloudly holds for a legacy service; both requests are for administrators only.
+- The greenfield reservation, and every preflight of it, names `legacyImport` (`data.ILegacyImageImportReference`: legacy service, attestation, asserted source root digest) instead of `sourceRevision`, `sourceDirty` and release evidence. Refusals are the blockers `LEGACY_IMPORT_ATTESTATION_MISSING`, `LEGACY_IMPORT_SOURCE_MISMATCH` and `LEGACY_IMPORT_PLATFORM_MISMATCH`.
+- Instead of the registry push, the deployer calls `importServiceDeploymentLegacyImage`: Cloudly imports the attested image from its own registry into the reserved tag — an index root as it is, a single platform manifest under a one-descriptor index of the manifest's own family — and records release evidence of source `cloudly-legacy-import` naming the legacy source. Steps 3 to 5 follow unchanged; `selectTrustedImageReleaseEvidence` accepts that evidence only with `evidenceSource: 'cloudly-legacy-import'`.
+- The reservation and the import need the capability `deployment:import-legacy`, which only an organization-service-slot grant can carry.
+
 `data.IDeploymentRouteRequest.proxied` carries provider-specific DNS proxy intent as an optional boolean. New route declarations should set it explicitly; omission remains valid for persisted historical operations and legacy callers.
 
 `data.IServiceDeploymentOperation` is the durable revisioned compare-and-set fence for this workflow. Image promotion requires Cloudly-created trusted evidence that binds the operation, actor, repository, exact tag, root digest, and OCI index media type. The service request group also exposes deployment preflight, exact-digest rollback, retry, and cleanup contracts.

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/interfaces',
-  version: '32.35.0',
+  version: '32.36.1',
   description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 }

package/ts/data/backup.ts

@@ -134,8 +134,14 @@ export interface IArchiveRetentionPolicy {
 
 export interface IArchivePruneResult {
   removedSnapshots: number;
+  /** Packs holding no chunk of the committed index, removed whole. */
   removedPacks: number;
-  rewrittenPacks: number;
+  /**
+   * Packs a prune rewrote to drop unreferenced chunks. Only Corestore up to 33.x (containerarchive
+   * 0.3.2) reports it; containerarchive 0.10 and Corestore 34.0.0 remove unreferenced packs whole
+   * and never rewrite one, so they omit it. Absent means no pack was rewritten.
+   */
+  rewrittenPacks?: number;
   freedBytes: number;
   dryRun: boolean;
 }

package/ts/data/deploymentlegacyimport.ts

@@ -0,0 +1,371 @@
+import type {
+  TImmutableContainerPlatform,
+  TOciManifestMediaType,
+  TSha256Digest,
+} from './immutableimage.js';
+import { normalizeSha256Digest } from './immutableimage.js';
+import { hasExactKeys, isPlainRecord } from '../private/dataproperties.js';
+
+/**
+ * Legacy image import: a greenfield deployment whose image is the one a legacy `deployOnPush`
+ * service already runs, instead of one built from a source revision.
+ *
+ * A legacy service without deployable source still has an image in Cloudly's registry and, until
+ * its runtime is frozen, healthy replicas running it. An administrator captures that fact once as
+ * a {@link ILegacyServiceRuntimeAttestation} while the replicas still run. A greenfield successor
+ * reservation names the attestation in `legacyImport` instead of a `sourceRevision`, and Cloudly
+ * then imports the attested image into the successor's own repository and release tag itself:
+ * the bytes never leave the registry and the release records that it was imported, not built.
+ *
+ * Deployment roots are indexes. An attested root that already is an index is imported as it is. A
+ * root that is one platform manifest is imported under an index whose only descriptor is that
+ * manifest, in the manifest's own family — a Docker manifest list around a Docker manifest, an OCI
+ * index around an OCI manifest — so the platform manifest stays byte-identical and its digest is
+ * still the one the legacy runtime ran. The attestation states everything that descriptor needs.
+ */
+
+/** The media types a legacy image's per-platform manifest can carry. */
+export type TLegacyImagePlatformManifestMediaType =
+  | 'application/vnd.oci.image.manifest.v1+json'
+  | 'application/vnd.docker.distribution.manifest.v2+json';
+
+/** The index media type of the family a platform manifest belongs to. */
+export type TLegacyImageImportIndexMediaType =
+  | 'application/vnd.oci.image.index.v1+json'
+  | 'application/vnd.docker.distribution.manifest.list.v2+json';
+
+/** One platform manifest of a legacy image, as Cloudly read it from its own registry. */
+export interface ILegacyImagePlatformManifest {
+  platform: TImmutableContainerPlatform;
+  manifestDigest: TSha256Digest;
+  manifestMediaType: TLegacyImagePlatformManifestMediaType;
+  /** Exact byte length of the platform manifest, which an index descriptor states. */
+  manifestSize: number;
+  imageConfigDigest: TSha256Digest;
+}
+
+/** The registry image a legacy service ran, under the mutable tag it was deployed from. */
+export interface ILegacyServiceImageSource {
+  registryHost: string;
+  repository: string;
+  /** The mutable tag the legacy service was deployed from, `latest` included. */
+  tag: string;
+  /** Digest of the root the tag named: a single platform manifest or an index. */
+  rootDigest: TSha256Digest;
+  rootMediaType: TOciManifestMediaType;
+  /**
+   * The runnable Linux platforms the root carries, sorted by platform. A single-manifest root
+   * carries exactly one, whose manifest is the root itself.
+   */
+  platforms: ILegacyImagePlatformManifest[];
+}
+
+/** One healthy replica of the legacy service, observed running the attested digest. */
+export interface ILegacyServiceRuntimeTaskAttestation {
+  deploymentId: string;
+  nodeName: string;
+  observedDigest: TSha256Digest;
+}
+
+/**
+ * Durable evidence, captured by an administrator while the legacy runtime still ran, that every
+ * required replica of a legacy service was healthy and ran exactly the registry root it names.
+ *
+ * Cloudly writes one and never changes it. A capture only succeeds on complete evidence, so a
+ * stored attestation is by construction one whose runtime digest is its source root digest.
+ */
+export interface ILegacyServiceRuntimeAttestation {
+  id: string;
+  data: {
+    legacyServiceId: string;
+    organizationId: string;
+    source: ILegacyServiceImageSource;
+    runtime: {
+      requiredReplicaCount: number;
+      healthyReplicaCount: number;
+      runtimeDigest: TSha256Digest;
+      /** Sorted by deploymentId, one per required replica. */
+      tasks: ILegacyServiceRuntimeTaskAttestation[];
+    };
+    capturedByUserId: string;
+    capturedAt: number;
+  };
+}
+
+/**
+ * What a legacy-import reservation names in place of a source revision: the legacy service, the
+ * attestation Cloudly holds for it, and the root digest the deployer asserts that attestation
+ * carries.
+ */
+export interface ILegacyImageImportReference {
+  legacyServiceId: string;
+  attestationId: string;
+  sourceRootDigest: TSha256Digest;
+}
+
+const identifierRegex = /^[A-Za-z0-9][A-Za-z0-9:._-]{0,199}$/;
+/** An OCI tag, the mutable `latest` included: the source tag is whatever the legacy service ran. */
+const ociTagRegex = /^[A-Za-z0-9_][A-Za-z0-9._-]{0,127}$/;
+const registryHostRegex = /^[a-z0-9](?:[a-z0-9.-]{0,251}[a-z0-9])?(?::[0-9]{1,5})?$/;
+const repositoryRegex = /^[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*(?:\/[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*)*$/;
+const maximumManifestSize = 4 * 1024 * 1024;
+const maximumReplicaCount = 64;
+
+const legacyImagePlatformManifestMediaTypes: readonly TLegacyImagePlatformManifestMediaType[] = [
+  'application/vnd.oci.image.manifest.v1+json',
+  'application/vnd.docker.distribution.manifest.v2+json',
+];
+const legacyImageImportIndexMediaTypes: readonly TLegacyImageImportIndexMediaType[] = [
+  'application/vnd.oci.image.index.v1+json',
+  'application/vnd.docker.distribution.manifest.list.v2+json',
+];
+const legacyImagePlatforms: readonly TImmutableContainerPlatform[] = ['linux/amd64', 'linux/arm64'];
+
+const isIdentifier = (valueArg: unknown): valueArg is string => (
+  typeof valueArg === 'string' && identifierRegex.test(valueArg)
+);
+
+const isCanonicalDigest = (valueArg: unknown): valueArg is TSha256Digest => (
+  typeof valueArg === 'string' && normalizeSha256Digest(valueArg) === valueArg
+);
+
+const isPositiveSafeInteger = (valueArg: unknown, maximumArg: number): valueArg is number => (
+  typeof valueArg === 'number'
+  && Number.isSafeInteger(valueArg)
+  && valueArg >= 1
+  && valueArg <= maximumArg
+);
+
+/** True when a media type names a single platform manifest rather than an index. */
+export const isLegacyImagePlatformManifestMediaType = (
+  valueArg: unknown,
+): valueArg is TLegacyImagePlatformManifestMediaType => (
+  legacyImagePlatformManifestMediaTypes.some((mediaTypeArg) => mediaTypeArg === valueArg)
+);
+
+/** True when a media type names an index of either family. */
+export const isLegacyImageImportIndexMediaType = (
+  valueArg: unknown,
+): valueArg is TLegacyImageImportIndexMediaType => (
+  legacyImageImportIndexMediaTypes.some((mediaTypeArg) => mediaTypeArg === valueArg)
+);
+
+export const validateLegacyImageImportReference = (referenceArg: unknown): string[] => {
+  if (!isPlainRecord(referenceArg)) return ['legacyImport must be an object'];
+  const errors: string[] = [];
+  if (!hasExactKeys(referenceArg, ['legacyServiceId', 'attestationId', 'sourceRootDigest'])) {
+    errors.push('legacyImport must use its exact schema');
+  }
+  if (!isIdentifier(referenceArg.legacyServiceId)) {
+    errors.push('legacyImport.legacyServiceId must be a bounded canonical identifier');
+  }
+  if (!isIdentifier(referenceArg.attestationId)) {
+    errors.push('legacyImport.attestationId must be a bounded canonical identifier');
+  }
+  if (!isCanonicalDigest(referenceArg.sourceRootDigest)) {
+    errors.push('legacyImport.sourceRootDigest must be a canonical sha256 digest');
+  }
+  return errors;
+};
+
+const validatePlatformManifest = (
+  manifestArg: unknown,
+  indexArg: number,
+): string[] => {
+  const label = `source.platforms[${indexArg}]`;
+  if (!isPlainRecord(manifestArg)) return [`${label} must be an object`];
+  const errors: string[] = [];
+  if (!hasExactKeys(manifestArg, [
+    'platform',
+    'manifestDigest',
+    'manifestMediaType',
+    'manifestSize',
+    'imageConfigDigest',
+  ])) {
+    errors.push(`${label} must use its exact schema`);
+  }
+  if (!legacyImagePlatforms.some((platformArg) => platformArg === manifestArg.platform)) {
+    errors.push(`${label}.platform must be linux/amd64 or linux/arm64`);
+  }
+  if (!isCanonicalDigest(manifestArg.manifestDigest)) {
+    errors.push(`${label}.manifestDigest must be a canonical sha256 digest`);
+  }
+  if (!isLegacyImagePlatformManifestMediaType(manifestArg.manifestMediaType)) {
+    errors.push(`${label}.manifestMediaType must name an OCI or Docker image manifest`);
+  }
+  if (!isPositiveSafeInteger(manifestArg.manifestSize, maximumManifestSize)) {
+    errors.push(`${label}.manifestSize must be a positive bounded byte length`);
+  }
+  if (!isCanonicalDigest(manifestArg.imageConfigDigest)) {
+    errors.push(`${label}.imageConfigDigest must be a canonical sha256 digest`);
+  }
+  return errors;
+};
+
+const validateImageSource = (sourceArg: unknown): string[] => {
+  if (!isPlainRecord(sourceArg)) return ['source must be an object'];
+  const errors: string[] = [];
+  if (!hasExactKeys(sourceArg, [
+    'registryHost',
+    'repository',
+    'tag',
+    'rootDigest',
+    'rootMediaType',
+    'platforms',
+  ])) {
+    errors.push('source must use its exact schema');
+  }
+  if (typeof sourceArg.registryHost !== 'string' || !registryHostRegex.test(sourceArg.registryHost)) {
+    errors.push('source.registryHost must be a canonical registry host');
+  }
+  if (typeof sourceArg.repository !== 'string'
+    || sourceArg.repository.length > 255
+    || !repositoryRegex.test(sourceArg.repository)) {
+    errors.push('source.repository must be a canonical OCI repository name');
+  }
+  if (typeof sourceArg.tag !== 'string' || !ociTagRegex.test(sourceArg.tag)) {
+    errors.push('source.tag must be an OCI tag');
+  }
+  if (!isCanonicalDigest(sourceArg.rootDigest)) {
+    errors.push('source.rootDigest must be a canonical sha256 digest');
+  }
+  const rootIsManifest = isLegacyImagePlatformManifestMediaType(sourceArg.rootMediaType);
+  const rootIsIndex = isLegacyImageImportIndexMediaType(sourceArg.rootMediaType);
+  if (!rootIsManifest && !rootIsIndex) {
+    errors.push('source.rootMediaType must name an OCI or Docker manifest or index');
+  }
+  if (!Array.isArray(sourceArg.platforms)
+    || sourceArg.platforms.length < 1
+    || sourceArg.platforms.length > legacyImagePlatforms.length) {
+    errors.push('source.platforms must carry one or two runnable Linux platforms');
+    return errors;
+  }
+  const platforms = sourceArg.platforms as unknown[];
+  platforms.forEach((manifestArg, indexArg) => {
+    errors.push(...validatePlatformManifest(manifestArg, indexArg));
+  });
+  const platformNames = platforms.map((manifestArg) => (
+    isPlainRecord(manifestArg) ? manifestArg.platform : undefined
+  ));
+  const sortedPlatformNames = legacyImagePlatforms.filter((platformArg) => (
+    platformNames.includes(platformArg)
+  ));
+  if (JSON.stringify(platformNames) !== JSON.stringify(sortedPlatformNames)) {
+    errors.push('source.platforms must be unique and sorted by platform');
+  }
+  if (rootIsManifest) {
+    const onlyPlatform = platforms[0];
+    if (platforms.length !== 1
+      || !isPlainRecord(onlyPlatform)
+      || onlyPlatform.manifestDigest !== sourceArg.rootDigest
+      || onlyPlatform.manifestMediaType !== sourceArg.rootMediaType) {
+      errors.push('a single-manifest source root must be its own one platform manifest');
+    }
+  }
+  if (rootIsIndex && platforms.some((manifestArg) => (
+    isPlainRecord(manifestArg) && manifestArg.manifestDigest === sourceArg.rootDigest
+  ))) {
+    errors.push('an index source root cannot also be one of its platform manifests');
+  }
+  return errors;
+};
+
+const validateRuntime = (runtimeArg: unknown, rootDigestArg: unknown): string[] => {
+  if (!isPlainRecord(runtimeArg)) return ['runtime must be an object'];
+  const errors: string[] = [];
+  if (!hasExactKeys(runtimeArg, [
+    'requiredReplicaCount',
+    'healthyReplicaCount',
+    'runtimeDigest',
+    'tasks',
+  ])) {
+    errors.push('runtime must use its exact schema');
+  }
+  if (!isPositiveSafeInteger(runtimeArg.requiredReplicaCount, maximumReplicaCount)) {
+    errors.push('runtime.requiredReplicaCount must be a positive bounded replica count');
+  }
+  if (runtimeArg.healthyReplicaCount !== runtimeArg.requiredReplicaCount) {
+    errors.push('runtime.healthyReplicaCount must equal the required replica count');
+  }
+  if (!isCanonicalDigest(runtimeArg.runtimeDigest)) {
+    errors.push('runtime.runtimeDigest must be a canonical sha256 digest');
+  } else if (runtimeArg.runtimeDigest !== rootDigestArg) {
+    errors.push('runtime.runtimeDigest must be the attested source root digest');
+  }
+  if (!Array.isArray(runtimeArg.tasks) || runtimeArg.tasks.length !== runtimeArg.requiredReplicaCount) {
+    errors.push('runtime.tasks must hold exactly one task per required replica');
+    return errors;
+  }
+  const tasks = runtimeArg.tasks as unknown[];
+  tasks.forEach((taskArg, indexArg) => {
+    const label = `runtime.tasks[${indexArg}]`;
+    if (!isPlainRecord(taskArg)) {
+      errors.push(`${label} must be an object`);
+      return;
+    }
+    if (!hasExactKeys(taskArg, ['deploymentId', 'nodeName', 'observedDigest'])) {
+      errors.push(`${label} must use its exact schema`);
+    }
+    if (!isIdentifier(taskArg.deploymentId)) {
+      errors.push(`${label}.deploymentId must be a bounded canonical identifier`);
+    }
+    if (typeof taskArg.nodeName !== 'string' || !taskArg.nodeName || taskArg.nodeName.length > 253) {
+      errors.push(`${label}.nodeName must be a bounded non-empty name`);
+    }
+    if (taskArg.observedDigest !== runtimeArg.runtimeDigest) {
+      errors.push(`${label}.observedDigest must be the attested runtime digest`);
+    }
+  });
+  const deploymentIds = tasks.map((taskArg) => (
+    isPlainRecord(taskArg) ? taskArg.deploymentId : undefined
+  ));
+  const sortedDeploymentIds = deploymentIds
+    .filter((idArg): idArg is string => typeof idArg === 'string')
+    .sort();
+  if (new Set(deploymentIds).size !== deploymentIds.length
+    || JSON.stringify(deploymentIds) !== JSON.stringify(sortedDeploymentIds)) {
+    errors.push('runtime.tasks must be unique and sorted by deploymentId');
+  }
+  return errors;
+};
+
+export const validateLegacyServiceRuntimeAttestation = (attestationArg: unknown): string[] => {
+  if (!isPlainRecord(attestationArg)) return ['attestation must be an object'];
+  const errors: string[] = [];
+  if (!hasExactKeys(attestationArg, ['id', 'data'])) {
+    errors.push('attestation must use its exact schema');
+  }
+  if (!isIdentifier(attestationArg.id)) {
+    errors.push('id must be a bounded canonical identifier');
+  }
+  const data = attestationArg.data;
+  if (!isPlainRecord(data)) return [...errors, 'data must be an object'];
+  if (!hasExactKeys(data, [
+    'legacyServiceId',
+    'organizationId',
+    'source',
+    'runtime',
+    'capturedByUserId',
+    'capturedAt',
+  ])) {
+    errors.push('data must use its exact schema');
+  }
+  if (!isIdentifier(data.legacyServiceId)) {
+    errors.push('legacyServiceId must be a bounded canonical identifier');
+  }
+  if (!isIdentifier(data.organizationId)) {
+    errors.push('organizationId must be a bounded canonical identifier');
+  }
+  if (!isIdentifier(data.capturedByUserId)) {
+    errors.push('capturedByUserId must be a bounded canonical identifier');
+  }
+  if (!isPositiveSafeInteger(data.capturedAt, Number.MAX_SAFE_INTEGER)) {
+    errors.push('capturedAt must be a positive timestamp');
+  }
+  errors.push(...validateImageSource(data.source));
+  errors.push(...validateRuntime(
+    data.runtime,
+    isPlainRecord(data.source) ? data.source.rootDigest : undefined,
+  ));
+  return errors;
+};