Expose committed result members and stable principals

docs/api/openapi.yaml

@@ -88,6 +88,60 @@ paths:
           $ref: '#/components/responses/PreconditionFailed'
         default:
           $ref: '#/components/responses/Error'
+  /v1/jobs/{job_id}/result/members:
+    parameters:
+      - $ref: '#/components/parameters/JobId'
+    get:
+      operationId: listJobResultMembers
+      description: Enumerates members only from the visible committed result.
+      parameters:
+        - $ref: '#/components/parameters/Cursor'
+        - $ref: '#/components/parameters/Limit'
+      responses:
+        '200':
+          description: Authorized page of committed result members ordered by normalized path.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ResultMemberPage'
+        '404':
+          $ref: '#/components/responses/NotFound'
+        '409':
+          $ref: '#/components/responses/PreconditionFailed'
+        default:
+          $ref: '#/components/responses/Error'
+  /v1/jobs/{job_id}/result/members/{member_id}/content:
+    parameters:
+      - $ref: '#/components/parameters/JobId'
+      - name: member_id
+        in: path
+        required: true
+        schema:
+          $ref: '#/components/schemas/OpaqueId'
+    get:
+      operationId: accessJobResultMember
+      description: Revalidates current authorization and redirects to a time-limited URL for the exact committed member identity.
+      responses:
+        '307':
+          description: Temporary redirect to the exact committed member. The URL is sensitive and must not be logged or cached.
+          headers:
+            Location:
+              description: Time-limited member URL.
+              required: true
+              schema:
+                type: string
+                format: uri
+            Cache-Control:
+              description: Prevents caching of the credential-bearing redirect response.
+              required: true
+              schema:
+                const: no-store
+        '404':
+          $ref: '#/components/responses/NotFound'
+        '409':
+          $ref: '#/components/responses/PreconditionFailed'
+        default:
+          $ref: '#/components/responses/Error'
   /v1/jobs/{job_id}/cancel:
     parameters:
       - $ref: '#/components/parameters/JobId'
@@ -403,6 +457,10 @@ components:
     OpaqueId:
       type: string
       pattern: '^[A-Za-z0-9][A-Za-z0-9_-]{7,127}$'
+    PrincipalId:
+      description: Internal stable principal identifier mapped to one exact OIDC issuer and subject pair.
+      allOf:
+        - $ref: '#/components/schemas/OpaqueId'
     Target:
       type: object
       additionalProperties: false
@@ -680,7 +738,7 @@ components:
     ObjectIdentity:
       type: object
       additionalProperties: false
-      required: [store, bucket, key]
+      required: [store, bucket, key, checksum]
       properties:
         store:
           type: string
@@ -691,7 +749,38 @@ components:
         version_id:
           type: string
         checksum:
+          $ref: '#/components/schemas/Sha256Digest'
+    Sha256Digest:
       type: string
+      pattern: '^sha256:[a-f0-9]{64}$'
+    ResultMember:
+      type: object
+      additionalProperties: false
+      required: [id, path, size, object]
+      properties:
+        id:
+          $ref: '#/components/schemas/OpaqueId'
+        path:
+          type: string
+          minLength: 1
+          maxLength: 4096
+          description: NFC-normalized relative POSIX path validated under architecture.md.
+        size:
+          type: integer
+          minimum: 0
+        object:
+          $ref: '#/components/schemas/ObjectIdentity'
+    ResultMemberPage:
+      type: object
+      additionalProperties: false
+      required: [items, next_cursor]
+      properties:
+        items:
+          type: array
+          items:
+            $ref: '#/components/schemas/ResultMember'
+        next_cursor:
+          type: [string, 'null']
     Job:
       type: object
       additionalProperties: false
@@ -700,7 +789,7 @@ components:
         id:
           $ref: '#/components/schemas/OpaqueId'
         owner:
-          $ref: '#/components/schemas/OpaqueId'
+          $ref: '#/components/schemas/PrincipalId'
         label:
           type: [string, 'null']
           minLength: 1
@@ -763,6 +852,20 @@ components:
       type: object
       additionalProperties: false
       required: [id, fence, worker_incarnation, state, progress, result, failure, created_at, updated_at]
+      allOf:
+        - if:
+            required: [state]
+            properties:
+              state:
+                const: AttemptCommitted
+          then:
+            properties:
+              result:
+                $ref: '#/components/schemas/ResultDescriptor'
+          else:
+            properties:
+              result:
+                type: 'null'
       properties:
         id:
           $ref: '#/components/schemas/OpaqueId'