Implement verified OCI prepared-lower lifecycle

crates/lazaret-core/src/records/registry.rs

@@ -10,14 +10,14 @@ use super::{
     NetworkReadinessEvidence, NetworkReadinessIdentity, Participant, ParticipantOwnership,
     ParticipantState, PermittedDestinationObservation, PersistedHostProcessOwnership,
     PidfsProcessAuthorityV1, PidfsProcessIdentityV1, PolicyAction, PolicyDelivery, PrefixRule,
-    PrepareOperation, PreparedArtifact, PreparedLowerOwnership, ProcessOwnershipCommitAck,
-    ProcessOwnershipMessageVersion, ProtocolCredential, ProtocolCredentialRole,
-    ProtocolPublicationIdentity, PtyIdentity, PublicationOwnership, ResolvedAutoApprovalRule,
-    ResolvedVolume, Resolver, ResultStream, SandboxCredentialBundle, SandboxOwnership, Session,
-    SessionBinding, SessionClose, SessionExit, SessionExitOutcome, SessionRequestCapability,
-    SessionTerminal, SessionTerminalEvent, SessionTerminalMessage, SessionTerminalState,
-    SignedProtocolRecord, StagedProcessOwnership, StateAnchorOwnership, StorageCatalog,
-    StoreMetadata, TerminalInput, TerminalOutput, TerminalResize, TerminalSignal,
+    PrepareOperation, PrepareStageState, PreparedArtifact, PreparedLowerOwnership,
+    ProcessOwnershipCommitAck, ProcessOwnershipMessageVersion, ProtocolCredential,
+    ProtocolCredentialRole, ProtocolPublicationIdentity, PtyIdentity, PublicationOwnership,
+    ResolvedAutoApprovalRule, ResolvedVolume, Resolver, ResultStream, SandboxCredentialBundle,
+    SandboxOwnership, Session, SessionBinding, SessionClose, SessionExit, SessionExitOutcome,
+    SessionRequestCapability, SessionTerminal, SessionTerminalEvent, SessionTerminalMessage,
+    SessionTerminalState, SignedProtocolRecord, StagedProcessOwnership, StateAnchorOwnership,
+    StorageCatalog, StoreMetadata, TerminalInput, TerminalOutput, TerminalResize, TerminalSignal,
     TerminalSignalKind, TlsCredential, TlsRole, TrustManifest, TrustedHostConfigurationV1,
 };
 
@@ -127,7 +127,8 @@ schema_types!(
     "ResolvedVolume" => ResolvedVolume,
     "ResolvedAutoApprovalRule" => ResolvedAutoApprovalRule,
     "DomainStore" => DomainStore,
-    "StorageCatalog" => StorageCatalog;
+    "StorageCatalog" => StorageCatalog,
+    "PrepareStageState" => PrepareStageState;
 );
 
 pub const DECLARED_RUNTIME_SCHEMA_TYPE_NAMES: &[&str] = &[

crates/lazaret-core/src/records/storage.rs

@@ -35,9 +35,29 @@ pub struct PrepareOperation {
     pub operation_id: PrepareOperationId,
     pub expected_artifact_id: PreparedArtifactId,
     pub source_identity: SourceIdentity,
+    pub selected_manifest_digest: SelectedManifestDigest,
+    pub policy_id: PolicyId,
+    pub id_map_digest: IdMapDigest,
     pub stage_path: HostPath,
-    pub device: DeviceId,
-    pub inode: InodeId,
+    pub stage_state: PrepareStageState,
+    pub device: Option<DeviceId>,
+    pub inode: Option<InodeId>,
+}
+
+#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+pub enum PrepareStageState {
+    Intent,
+    Owned,
+}
+
+impl PrepareOperation {
+    #[must_use]
+    pub const fn has_valid_evidence_shape(&self) -> bool {
+        matches!(
+            (self.stage_state, self.device, self.inode),
+            (PrepareStageState::Intent, None, None) | (PrepareStageState::Owned, Some(_), Some(_))
+        )
+    }
 }
 
 #[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]

crates/lazaret-core/tests/schema_records/encoding.rs

@@ -347,12 +347,17 @@ fn every_schema_shape_round_trips_and_rejects_malformed_or_unknown_versions() {
             operation_id: PrepareOperationId::new(opaque(68)),
             expected_artifact_id: PreparedArtifactId::new(opaque(24)),
             source_identity: SourceIdentity::new(vec![25, 26]),
+            selected_manifest_digest: SelectedManifestDigest::new(opaque(27)),
+            policy_id: PolicyId::new(opaque(28)),
+            id_map_digest: IdMapDigest::new(opaque(29)),
             stage_path: HostPath::new(b"stage".to_vec()),
-            device: DeviceId::new(69),
-            inode: InodeId::new(70),
+            stage_state: PrepareStageState::Owned,
+            device: Some(DeviceId::new(69)),
+            inode: Some(InodeId::new(70)),
         },
         &mut seen,
     );
+    verify_shape(PrepareStageState::Owned, &mut seen);
     verify_shape(
         AddressFamilyDisposition {
             family: AddressFamily::Ipv6,