agent-hitch 0.2.9 → 0.2.10

package/docs/schemas/remote-worker-execution-admission.schema.json

@@ -0,0 +1,214 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://agent-hitch.local/schemas/remote-worker-execution-admission.schema.json",
+  "title": "Hitch authenticated worker execution admission V2",
+  "description": "Independent authenticated original-generation ownership and launch identity. This is not a physical release receipt. Offer binding, ownership digest and original acceptance identity must also be verified by the consumer. Ownership V3 binds a stable host identity and a separate boot identity; legacy ownership V2 cannot prove a host reboot.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema_version",
+    "offer_id",
+    "worker_id",
+    "generation",
+    "lease_id",
+    "execution_epoch",
+    "accepted_at",
+    "ownership",
+    "ownership_digest",
+    "execution_process"
+  ],
+  "properties": {
+    "schema_version": {
+      "const": "2"
+    },
+    "offer_id": {
+      "type": "string",
+      "pattern": "^offer_[a-f0-9]{32}$"
+    },
+    "worker_id": {
+      "type": "string",
+      "pattern": "^worker_[a-z0-9][a-z0-9_-]{0,62}$"
+    },
+    "generation": {
+      "type": "integer",
+      "minimum": 1
+    },
+    "lease_id": {
+      "type": "string",
+      "pattern": "^lease_[a-f0-9]{32}$"
+    },
+    "execution_epoch": {
+      "type": "integer",
+      "minimum": 1
+    },
+    "accepted_at": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "ownership": {
+      "$ref": "#/$defs/ownership"
+    },
+    "ownership_digest": {
+      "$ref": "#/$defs/digest"
+    },
+    "execution_process": {
+      "oneOf": [
+        {
+          "type": "null"
+        },
+        {
+          "$ref": "#/$defs/process"
+        }
+      ]
+    }
+  },
+  "$defs": {
+    "digest": {
+      "type": "string",
+      "pattern": "^sha256:[a-f0-9]{64}$"
+    },
+    "process": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "pid",
+        "start_identity",
+        "observed_at"
+      ],
+      "properties": {
+        "pid": {
+          "type": "integer",
+          "minimum": 1
+        },
+        "start_identity": {
+          "$ref": "#/$defs/digest"
+        },
+        "observed_at": {
+          "type": "string",
+          "format": "date-time"
+        }
+      }
+    },
+    "ownership": {
+      "oneOf": [
+        {
+          "$ref": "#/$defs/ownershipV2"
+        },
+        {
+          "$ref": "#/$defs/ownershipV3"
+        }
+      ]
+    },
+    "hostIdentity": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "schema_version",
+        "platform",
+        "host_id",
+        "boot_id"
+      ],
+      "properties": {
+        "schema_version": {
+          "const": "1"
+        },
+        "platform": {
+          "enum": [
+            "linux",
+            "darwin"
+          ]
+        },
+        "host_id": {
+          "$ref": "#/$defs/digest"
+        },
+        "boot_id": {
+          "$ref": "#/$defs/digest"
+        }
+      }
+    },
+    "ownershipV2": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "schema_version",
+        "binding_digest",
+        "root_id",
+        "root_digest",
+        "boot_digest",
+        "docker_engine_id",
+        "worker_process"
+      ],
+      "properties": {
+        "schema_version": {
+          "const": "2"
+        },
+        "binding_digest": {
+          "$ref": "#/$defs/digest"
+        },
+        "root_id": {
+          "type": "string",
+          "pattern": "^[a-f0-9]{24}$"
+        },
+        "root_digest": {
+          "$ref": "#/$defs/digest"
+        },
+        "boot_digest": {
+          "$ref": "#/$defs/digest"
+        },
+        "docker_engine_id": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 256,
+          "pattern": "^[^\\s\\u0000-\\u001f]+$"
+        },
+        "worker_process": {
+          "$ref": "#/$defs/process"
+        }
+      }
+    },
+    "ownershipV3": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "schema_version",
+        "binding_digest",
+        "root_id",
+        "root_digest",
+        "boot_digest",
+        "docker_engine_id",
+        "worker_process",
+        "host_identity"
+      ],
+      "properties": {
+        "schema_version": {
+          "const": "3"
+        },
+        "binding_digest": {
+          "$ref": "#/$defs/digest"
+        },
+        "root_id": {
+          "type": "string",
+          "pattern": "^[a-f0-9]{24}$"
+        },
+        "root_digest": {
+          "$ref": "#/$defs/digest"
+        },
+        "boot_digest": {
+          "$ref": "#/$defs/digest"
+        },
+        "docker_engine_id": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 256,
+          "pattern": "^[^\\s\\u0000-\\u001f]+$"
+        },
+        "worker_process": {
+          "$ref": "#/$defs/process"
+        },
+        "host_identity": {
+          "$ref": "#/$defs/hostIdentity"
+        }
+      }
+    }
+  }
+}

package/docs/schemas/remote-worker-generation-cleanup.schema.json

@@ -0,0 +1,199 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://agent-hitch.local/schemas/remote-worker-generation-cleanup.schema.json",
+  "title": "Hitch independently authenticated worker generation cleanup V2/V3",
+  "description": "A current worker proves physical cleanup of its original admitted execution. Challenge/admission digests, original offer identity, generation ordering, freshness and process identities require semantic validation. This record never rewrites the old v1 offer. V3 requires original ownership V3 on the same stable host with a different boot; no old PID or process-group claim is made.",
+  "$defs": {
+    "challenge": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "schema_version",
+        "cleanup_id",
+        "nonce",
+        "worker_id",
+        "generation",
+        "issued_at",
+        "expires_at",
+        "admission"
+      ],
+      "properties": {
+        "schema_version": {
+          "const": "2"
+        },
+        "cleanup_id": {
+          "type": "string",
+          "pattern": "^cleanup_[a-f0-9]{32}$"
+        },
+        "nonce": {
+          "type": "string",
+          "pattern": "^[a-f0-9]{32}$"
+        },
+        "worker_id": {
+          "type": "string",
+          "pattern": "^worker_[a-z0-9][a-z0-9_-]{0,62}$"
+        },
+        "generation": {
+          "type": "integer",
+          "minimum": 2
+        },
+        "issued_at": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "expires_at": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "admission": {
+          "$ref": "remote-worker-execution-admission.schema.json"
+        }
+      }
+    },
+    "receiptV2": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "schema_version",
+        "challenge",
+        "observed_at",
+        "observation"
+      ],
+      "properties": {
+        "schema_version": {
+          "const": "2"
+        },
+        "challenge": {
+          "$ref": "#/$defs/challenge"
+        },
+        "observed_at": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "observation": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "ownership",
+            "execution_process",
+            "worker_status",
+            "process_group_empty",
+            "docker_resources_empty"
+          ],
+          "properties": {
+            "ownership": {
+              "$ref": "remote-worker-execution-admission.schema.json#/$defs/ownership"
+            },
+            "execution_process": {
+              "oneOf": [
+                {
+                  "type": "null"
+                },
+                {
+                  "$ref": "remote-worker-execution-admission.schema.json#/$defs/process"
+                }
+              ]
+            },
+            "worker_status": {
+              "enum": [
+                "terminal",
+                "identity-mismatch"
+              ]
+            },
+            "process_group_empty": {
+              "const": true
+            },
+            "docker_resources_empty": {
+              "const": true
+            }
+          }
+        }
+      }
+    },
+    "receiptV3": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "schema_version",
+        "challenge",
+        "observed_at",
+        "observation"
+      ],
+      "properties": {
+        "schema_version": {
+          "const": "3"
+        },
+        "challenge": {
+          "$ref": "#/$defs/rebootChallenge"
+        },
+        "observed_at": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "observation": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "ownership",
+            "execution_process",
+            "worker_status",
+            "docker_resources_empty",
+            "host_identity"
+          ],
+          "properties": {
+            "ownership": {
+              "$ref": "remote-worker-execution-admission.schema.json#/$defs/ownershipV3"
+            },
+            "execution_process": {
+              "oneOf": [
+                {
+                  "type": "null"
+                },
+                {
+                  "$ref": "remote-worker-execution-admission.schema.json#/$defs/process"
+                }
+              ]
+            },
+            "worker_status": {
+              "const": "previous-boot"
+            },
+            "docker_resources_empty": {
+              "const": true
+            },
+            "host_identity": {
+              "$ref": "remote-worker-execution-admission.schema.json#/$defs/hostIdentity"
+            }
+          }
+        }
+      }
+    },
+    "rebootChallenge": {
+      "allOf": [
+        {
+          "$ref": "#/$defs/challenge"
+        },
+        {
+          "type": "object",
+          "properties": {
+            "admission": {
+              "type": "object",
+              "properties": {
+                "ownership": {
+                  "$ref": "remote-worker-execution-admission.schema.json#/$defs/ownershipV3"
+                }
+              }
+            }
+          }
+        }
+      ]
+    }
+  },
+  "oneOf": [
+    {
+      "$ref": "#/$defs/receiptV2"
+    },
+    {
+      "$ref": "#/$defs/receiptV3"
+    }
+  ]
+}

package/docs/schemas/remote-worker-registration.schema.json

@@ -4,48 +4,249 @@
   "title": "Hitch remote worker registration V1",
   "type": "object",
   "additionalProperties": false,
-  "required": ["schema_version", "worker_id", "provider", "collision_domain_id", "platforms", "backends", "features", "task_membership", "capacity"],
+  "required": [
+    "schema_version",
+    "worker_id",
+    "provider",
+    "collision_domain_id",
+    "platforms",
+    "backends",
+    "features",
+    "task_membership",
+    "capacity"
+  ],
   "properties": {
-    "schema_version": { "const": "1" },
-    "worker_id": { "$ref": "#/$defs/workerId" },
-    "provider": { "type": "string", "minLength": 1, "maxLength": 256 },
-    "collision_domain_id": { "type": "string", "minLength": 1, "maxLength": 256 },
-    "platforms": { "type": "array", "minItems": 1, "uniqueItems": true, "items": { "type": "string", "minLength": 1 } },
+    "schema_version": {
+      "const": "1"
+    },
+    "worker_id": {
+      "$ref": "#/$defs/workerId"
+    },
+    "provider": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 256
+    },
+    "collision_domain_id": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 256
+    },
+    "platforms": {
+      "type": "array",
+      "minItems": 1,
+      "uniqueItems": true,
+      "items": {
+        "type": "string",
+        "minLength": 1
+      }
+    },
     "backends": {
-      "type": "array", "minItems": 1,
+      "type": "array",
+      "minItems": 1,
       "items": {
-        "type": "object", "additionalProperties": false, "required": ["id", "version"],
-        "properties": { "id": { "type": "string", "minLength": 1 }, "version": { "type": "string", "minLength": 1 } }
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "id",
+          "version"
+        ],
+        "properties": {
+          "id": {
+            "type": "string",
+            "minLength": 1
+          },
+          "version": {
+            "type": "string",
+            "minLength": 1
+          }
+        }
       }
     },
     "features": {
-      "type": "object", "additionalProperties": false,
-      "required": ["docker", "buildkit", "model_proxy", "isolated_same_task_attempts"],
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "docker",
+        "buildkit",
+        "model_proxy",
+        "isolated_same_task_attempts"
+      ],
       "properties": {
-        "docker": { "type": "boolean" }, "buildkit": { "type": "boolean" },
-        "model_proxy": { "type": "boolean" }, "isolated_same_task_attempts": { "type": "boolean" }
+        "docker": {
+          "type": "boolean"
+        },
+        "buildkit": {
+          "type": "boolean"
+        },
+        "model_proxy": {
+          "type": "boolean"
+        },
+        "isolated_same_task_attempts": {
+          "type": "boolean"
+        },
+        "training_external_binding": {
+          "const": "2"
+        },
+        "managed_model_node": {
+          "const": "2"
+        },
+        "physical_work": {
+          "const": "2"
+        },
+        "execution_observation": {
+          "const": "2"
+        },
+        "verifier_source": {
+          "const": "2"
+        },
+        "verifier_only": {
+          "const": "2"
+        }
+      },
+      "allOf": [
+        {
+          "if": {
+            "anyOf": [
+              {
+                "required": [
+                  "training_external_binding"
+                ]
+              },
+              {
+                "required": [
+                  "managed_model_node"
+                ]
+              }
+            ]
+          },
+          "then": {
+            "properties": {
+              "docker": {
+                "const": true
+              },
+              "model_proxy": {
+                "const": true
+              }
+            }
+          }
+        },
+        {
+          "if": {
+            "anyOf": [
+              {
+                "required": [
+                  "physical_work"
+                ]
+              },
+              {
+                "required": [
+                  "verifier_source"
+                ]
+              }
+            ]
+          },
+          "then": {
+            "properties": {
+              "docker": {
+                "const": true
+              }
+            }
+          }
+        },
+        {
+          "if": {
+            "required": [
+              "verifier_only"
+            ]
+          },
+          "then": {
+            "required": [
+              "physical_work"
+            ],
+            "properties": {
+              "docker": {
+                "const": true
+              },
+              "physical_work": {
+                "const": "2"
+              }
+            }
+          }
+        }
+      ]
+    },
+    "task_membership": {
+      "type": "array",
+      "minItems": 1,
+      "uniqueItems": true,
+      "items": {
+        "enum": [
+          "known",
+          "opaque"
+        ]
       }
     },
-    "task_membership": { "type": "array", "minItems": 1, "uniqueItems": true, "items": { "enum": ["known", "opaque"] } },
     "capacity": {
-      "type": "object", "additionalProperties": false,
-      "required": ["total", "reserved_for_system", "allocatable"],
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "total",
+        "reserved_for_system",
+        "allocatable"
+      ],
       "properties": {
-        "total": { "$ref": "#/$defs/resources" }, "reserved_for_system": { "$ref": "#/$defs/resources" },
-        "allocatable": { "$ref": "#/$defs/resources" }
+        "total": {
+          "$ref": "#/$defs/resources"
+        },
+        "reserved_for_system": {
+          "$ref": "#/$defs/resources"
+        },
+        "allocatable": {
+          "$ref": "#/$defs/resources"
+        }
       }
     }
   },
   "$defs": {
-    "workerId": { "type": "string", "pattern": "^worker_[a-z0-9][a-z0-9_-]{0,62}$" },
+    "workerId": {
+      "type": "string",
+      "pattern": "^worker_[a-z0-9][a-z0-9_-]{0,62}$"
+    },
     "resources": {
-      "type": "object", "additionalProperties": false,
-      "required": ["cpu_millis", "memory_bytes", "container_slots", "build_slots"],
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "cpu_millis",
+        "memory_bytes",
+        "container_slots",
+        "build_slots"
+      ],
       "properties": {
-        "cpu_millis": { "type": "integer", "minimum": 0 }, "memory_bytes": { "type": "integer", "minimum": 0 },
-        "container_slots": { "type": "integer", "minimum": 0 }, "build_slots": { "type": "integer", "minimum": 0 },
-        "gpu_count": { "type": "integer", "minimum": 0 },
-        "ephemeral_disk_bytes": { "type": "integer", "minimum": 0 }
+        "cpu_millis": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "memory_bytes": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "container_slots": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "build_slots": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "gpu_count": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "ephemeral_disk_bytes": {
+          "type": "integer",
+          "minimum": 0
+        }
       }
     }
   }