Run non-interactive sessions through production coordination

crates/lazaret-core/src/records/credentials.rs

@@ -1,7 +1,8 @@
 use super::{
     CapabilityId, CertificateDigest, ClientId, ConfigurationFingerprint, CoordinatorId,
-    Deserialize, DomainId, GenerationId, ProtocolCredentialId, RequestDigest, RequestId, SandboxId,
-    Serialize, SessionId, StreamDigest, TrustManifestDigest, fmt,
+    Deserialize, DomainId, GenerationId, NonInteractiveSessionRequest, ProtocolCredentialId,
+    RequestDigest, RequestId, SandboxId, Serialize, SessionId, StreamDigest, TrustManifestDigest,
+    fmt,
 };
 
 #[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
@@ -227,6 +228,7 @@ pub struct SessionRegistrationResponse {
 pub enum ControlRequest {
     Enroll(ClientEnrollmentRequest),
     Register(SessionRegistrationRequest),
+    Execute(NonInteractiveSessionRequest),
 }
 
 #[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]

crates/lazaret-core/src/records/registry.rs

@@ -7,7 +7,8 @@ use super::{
     HelperOwnership, HostProcessIdentity, HostProcessOwnershipSlot, Mailbox, MailboxCancellation,
     MailboxRequest, MailboxResult, MailboxResultAck, MailboxResultChunk, MountIdentity,
     NamespaceIdentity, NetworkObservation, NetworkOwnership, NetworkReachabilityProbe,
-    NetworkReadinessAttestation, NetworkReadinessEvidence, NetworkReadinessIdentity, Participant,
+    NetworkReadinessAttestation, NetworkReadinessEvidence, NetworkReadinessIdentity,
+    NonInteractiveOutput, NonInteractiveSessionMessage, NonInteractiveSessionRequest, Participant,
     ParticipantOwnership, ParticipantState, PermittedDestinationObservation,
     PersistedHostProcessOwnership, PidfsProcessAuthorityV1, PidfsProcessIdentityV1, PolicyAction,
     PolicyDelivery, PrefixRule, PrepareOperation, PrepareStageState, PreparedArtifact,
@@ -71,6 +72,9 @@ schema_types!(
     "TerminalSignalKind" => TerminalSignalKind,
     "SessionClose" => SessionClose,
     "SessionTerminalMessage" => SessionTerminalMessage,
+    "NonInteractiveSessionRequest" => NonInteractiveSessionRequest,
+    "NonInteractiveOutput" => NonInteractiveOutput,
+    "NonInteractiveSessionMessage" => NonInteractiveSessionMessage,
     "TerminalOutput" => TerminalOutput,
     "SessionExit" => SessionExit,
     "SessionExitOutcome" => SessionExitOutcome,

crates/lazaret-core/src/records/terminal.rs

@@ -136,3 +136,23 @@ pub enum SessionTerminalMessage {
     Output(TerminalOutput),
     Exit(SessionExit),
 }
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+pub struct NonInteractiveSessionRequest {
+    pub protocol_version: super::ProtocolVersion,
+    pub session_id: SessionId,
+    pub argv: Vec<Vec<u8>>,
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+pub struct NonInteractiveOutput {
+    pub session_id: SessionId,
+    pub bytes: Vec<u8>,
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+pub enum NonInteractiveSessionMessage {
+    Stdout(NonInteractiveOutput),
+    Stderr(NonInteractiveOutput),
+    Exit(SessionExit),
+}

crates/lazaret-core/tests/schema_records/encoding.rs

@@ -177,6 +177,25 @@ fn every_schema_shape_round_trips_and_rejects_malformed_or_unknown_versions() {
     );
     verify_shape(SessionExit::exited(session_id(), 3), &mut seen);
     verify_shape(SessionExitOutcome::RuntimeLost, &mut seen);
+    verify_shape(
+        NonInteractiveSessionRequest {
+            protocol_version: ProtocolVersion::V1,
+            session_id: session_id(),
+            argv: vec![b"tool".to_vec()],
+        },
+        &mut seen,
+    );
+    verify_shape(
+        NonInteractiveOutput {
+            session_id: session_id(),
+            bytes: vec![53],
+        },
+        &mut seen,
+    );
+    verify_shape(
+        NonInteractiveSessionMessage::Exit(SessionExit::exited(session_id(), 4)),
+        &mut seen,
+    );
     verify_shape(generation_identity(), &mut seen);
     verify_shape(trust_manifest(), &mut seen);
     verify_shape(tls_credential.clone(), &mut seen);