Define protocol cryptography packaging

docs/schema.md

@@ -223,8 +223,226 @@ classDiagram
 
 `exit_code` is present only for `Exited` and is the status collected from the
 non-detached runsc exec client. Interactive PTY output is one merged byte stream;
-it does not preserve stdout and stderr as separate channels. Protocol
-cryptographic envelopes and wire encoding are outside this schema.
+it does not preserve stdout and stderr as separate channels.
+
+## Protocol cryptography
+
+```mermaid
+classDiagram
+    class GenerationIdentity {
+        agent_profile
+        domain_id
+        generation_id
+        configuration_fingerprint
+        coordinator_id
+        sandbox_id
+    }
+
+    class TrustManifest {
+        protocol_version
+        generation_identity
+        tls_ca_sha256
+        protocol_issuer_public_key
+        issuer_signature
+    }
+
+    class TlsCredential {
+        generation_identity
+        role
+        subject_id
+        certificate_der
+        certificate_sha256
+    }
+
+    class ProtocolPublicationIdentity {
+        protocol_version
+        generation_identity
+        tls_ca_certificate_der
+        trust_manifest_sha256
+        coordinator_tls_certificate_sha256
+    }
+
+    class SandboxCredentialBundle {
+        protocol_version
+        generation_identity
+        trust_manifest
+        coordinator_protocol_credential
+        sandbox_protocol_credential
+        sandbox_private_key
+    }
+
+    class TlsRole {
+        <<enumeration>>
+        SessionCoordinator
+        ClientCLI
+    }
+
+    class ProtocolCredential {
+        protocol_version
+        credential_id
+        generation_identity
+        role
+        subject_id
+        public_key
+        issuer_signature
+    }
+
+    class ProtocolCredentialRole {
+        <<enumeration>>
+        SessionCoordinator
+        AgentSandbox
+    }
+
+    class SessionBinding {
+        generation_identity
+        cli_id
+        session_id
+        session_anchor_public_key
+    }
+
+    class SessionRequestCapability {
+        protocol_version
+        capability_id
+        session_binding
+        coordinator_credential_id
+        sandbox_credential_id
+        coordinator_signature
+    }
+
+    TrustManifest --> GenerationIdentity
+    TlsCredential --> TlsRole
+    TlsCredential --> GenerationIdentity
+    ProtocolPublicationIdentity --> GenerationIdentity
+    ProtocolPublicationIdentity --> TrustManifest
+    ProtocolPublicationIdentity --> TlsCredential : coordinator TLS leaf
+    SandboxCredentialBundle --> GenerationIdentity
+    SandboxCredentialBundle --> TrustManifest
+    SandboxCredentialBundle --> ProtocolCredential : coordinator verifier
+    SandboxCredentialBundle --> ProtocolCredential : sandbox signer
+    ProtocolCredential --> GenerationIdentity
+    ProtocolCredential --> ProtocolCredentialRole
+    SessionBinding --> GenerationIdentity
+    SessionRequestCapability --> SessionBinding
+    SessionRequestCapability --> ProtocolCredential : coordinator signer
+    SessionRequestCapability --> ProtocolCredential : sandbox subject
+```
+
+Trust Manifests, credentials, capabilities, and private keys are ephemeral
+protocol material, not Domain Store records.
+
+```mermaid
+classDiagram
+    class SignedProtocolRecord {
+        <<union>>
+        payload_bytes
+        signature
+    }
+
+    class MailboxRequest {
+        protocol_version
+        session_binding
+        request_id
+        session_capability
+        sandbox_credential_id
+        command_argv
+        justification
+    }
+
+    class MailboxCancellation {
+        protocol_version
+        session_binding
+        request_id
+        session_capability
+        sandbox_credential_id
+    }
+
+    class MailboxResultAck {
+        protocol_version
+        session_binding
+        request_id
+        request_sha256
+        session_capability
+        sandbox_credential_id
+        highest_contiguous_sequence
+    }
+
+    class DeveloperDecision {
+        protocol_version
+        session_binding
+        request_id
+        request_sha256
+        decision
+        approved_command_argv
+    }
+
+    class DeveloperDecisionKind {
+        <<enumeration>>
+        Approve
+        Deny
+    }
+
+    class MailboxResult {
+        protocol_version
+        session_binding
+        request_id
+        request_sha256
+        coordinator_credential_id
+        outcome
+        exit_code
+        chunk_count
+        stdout_sha256
+        stderr_sha256
+    }
+
+    class MailboxResultChunk {
+        protocol_version
+        session_binding
+        request_id
+        request_sha256
+        coordinator_credential_id
+        sequence
+        stream
+        bytes
+    }
+
+    class ResultStream {
+        <<enumeration>>
+        Stdout
+        Stderr
+    }
+
+    class EscalationOutcome {
+        <<enumeration>>
+        Completed
+        Denied
+        TimedOut
+        Cancelled
+        Failed
+    }
+
+    SignedProtocolRecord --> MailboxRequest
+    SignedProtocolRecord --> MailboxCancellation
+    SignedProtocolRecord --> MailboxResultAck
+    SignedProtocolRecord --> DeveloperDecision
+    SignedProtocolRecord --> MailboxResult
+    SignedProtocolRecord --> MailboxResultChunk
+    MailboxRequest --> SessionBinding
+    MailboxRequest --> SessionRequestCapability
+    MailboxCancellation --> SessionBinding
+    MailboxCancellation --> SessionRequestCapability
+    MailboxResultAck --> SessionBinding
+    MailboxResultAck --> SessionRequestCapability
+    DeveloperDecision --> SessionBinding
+    DeveloperDecision --> DeveloperDecisionKind
+    MailboxResult --> SessionBinding
+    MailboxResult --> EscalationOutcome
+    MailboxResultChunk --> SessionBinding
+    MailboxResultChunk --> ResultStream
+```
+
+`SessionCoordinator` is the logical protocol identity served physically by the
+Host Coordinator. It is not a distinct Host Coordinator principal. Physical
+encoding, signing, size, and validation rules are defined by the specification.
 
 ### Participant ownership