Add generation-bound TLS control face

Create ephemeral trust anchors, publish an exact-profile Unix control socket, and persist generation-authorized mTLS session registration through the Domain Store.

crates/lazaret-core/src/records/credentials.rs

@@ -197,6 +197,44 @@ pub struct ProtocolPublicationIdentity {
     pub coordinator_tls_certificate_sha256: CertificateDigest,
 }
 
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+pub struct ClientEnrollmentRequest {
+    pub protocol_version: ProtocolVersion,
+    pub generation_identity: GenerationIdentity,
+    pub cli_id: ClientId,
+    pub certificate_signing_request_der: Vec<u8>,
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+pub struct ClientEnrollmentResponse {
+    pub protocol_version: ProtocolVersion,
+    pub credential: TlsCredential,
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+pub struct SessionRegistrationRequest {
+    pub protocol_version: ProtocolVersion,
+    pub session_binding: SessionBinding,
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+pub struct SessionRegistrationResponse {
+    pub protocol_version: ProtocolVersion,
+    pub session_capability: SessionRequestCapability,
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+pub enum ControlRequest {
+    Enroll(ClientEnrollmentRequest),
+    Register(SessionRegistrationRequest),
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+pub enum ControlResponse {
+    Enrolled(ClientEnrollmentResponse),
+    Registered(SessionRegistrationResponse),
+}
+
 #[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
 pub enum ProtocolCredentialRole {
     SessionCoordinator,

crates/lazaret-core/src/records/registry.rs

@@ -1,20 +1,21 @@
 use super::{
-    AddressFamily, AddressFamilyDisposition, ArtifactLease, ArtifactState,
-    ConfigurationFingerprintRecordV1, DefaultAction, DeniedDestinationObservation,
-    DerivedNetworkPolicy, DeveloperDecision, DeveloperDecisionKind, DnsObservation, Domain,
-    DomainStore, EnvironmentReference, EscalationOutcome, Generation, GenerationIdentity,
-    GitRoutingOwnership, GuestProcessIdentity, HelperOwnership, HostProcessIdentity,
-    HostProcessOwnershipSlot, Mailbox, MailboxCancellation, MailboxRequest, MailboxResult,
-    MailboxResultAck, MailboxResultChunk, MountIdentity, NamespaceIdentity, NetworkObservation,
-    NetworkOwnership, NetworkReachabilityProbe, NetworkReadinessAttestation,
-    NetworkReadinessEvidence, NetworkReadinessIdentity, Participant, ParticipantOwnership,
-    ParticipantState, PermittedDestinationObservation, PersistedHostProcessOwnership,
-    PidfsProcessAuthorityV1, PidfsProcessIdentityV1, PolicyAction, PolicyDelivery, PrefixRule,
-    PrepareOperation, PrepareStageState, PreparedArtifact, PreparedLowerOwnership,
-    ProcessOwnershipCommitAck, ProcessOwnershipMessageVersion, ProtocolCredential,
-    ProtocolCredentialRole, ProtocolPublicationIdentity, PtyIdentity, PublicationOwnership,
-    ResolvedAutoApprovalRule, ResolvedVolume, Resolver, ResultStream, SandboxCredentialBundle,
-    SandboxOwnership, Session, SessionBinding, SessionClose, SessionExit, SessionExitOutcome,
+    AddressFamily, AddressFamilyDisposition, ArtifactLease, ArtifactState, ClientEnrollmentRequest,
+    ClientEnrollmentResponse, ConfigurationFingerprintRecordV1, ControlRequest, ControlResponse,
+    DefaultAction, DeniedDestinationObservation, DerivedNetworkPolicy, DeveloperDecision,
+    DeveloperDecisionKind, DnsObservation, Domain, DomainStore, EnvironmentReference,
+    EscalationOutcome, Generation, GenerationIdentity, GitRoutingOwnership, GuestProcessIdentity,
+    HelperOwnership, HostProcessIdentity, HostProcessOwnershipSlot, Mailbox, MailboxCancellation,
+    MailboxRequest, MailboxResult, MailboxResultAck, MailboxResultChunk, MountIdentity,
+    NamespaceIdentity, NetworkObservation, NetworkOwnership, NetworkReachabilityProbe,
+    NetworkReadinessAttestation, NetworkReadinessEvidence, NetworkReadinessIdentity, Participant,
+    ParticipantOwnership, ParticipantState, PermittedDestinationObservation,
+    PersistedHostProcessOwnership, PidfsProcessAuthorityV1, PidfsProcessIdentityV1, PolicyAction,
+    PolicyDelivery, PrefixRule, PrepareOperation, PrepareStageState, PreparedArtifact,
+    PreparedLowerOwnership, ProcessOwnershipCommitAck, ProcessOwnershipMessageVersion,
+    ProtocolCredential, ProtocolCredentialRole, ProtocolPublicationIdentity, PtyIdentity,
+    PublicationOwnership, ResolvedAutoApprovalRule, ResolvedVolume, Resolver, ResultStream,
+    SandboxCredentialBundle, SandboxOwnership, Session, SessionBinding, SessionClose, SessionExit,
+    SessionExitOutcome, SessionRegistrationRequest, SessionRegistrationResponse,
     SessionRequestCapability, SessionTerminal, SessionTerminalEvent, SessionTerminalMessage,
     SessionTerminalState, SignedProtocolRecord, StagedProcessOwnership, StateAnchorOwnership,
     StorageCatalog, StoreMetadata, TerminalInput, TerminalOutput, TerminalResize, TerminalSignal,
@@ -76,6 +77,12 @@ schema_types!(
     "TrustManifest" => TrustManifest,
     "TlsCredential" => TlsCredential,
     "ProtocolPublicationIdentity" => ProtocolPublicationIdentity,
+    "ClientEnrollmentRequest" => ClientEnrollmentRequest,
+    "ClientEnrollmentResponse" => ClientEnrollmentResponse,
+    "SessionRegistrationRequest" => SessionRegistrationRequest,
+    "SessionRegistrationResponse" => SessionRegistrationResponse,
+    "ControlRequest" => ControlRequest,
+    "ControlResponse" => ControlResponse,
     "SandboxCredentialBundle" => SandboxCredentialBundle,
     "TlsRole" => TlsRole,
     "ProtocolCredential" => ProtocolCredential,