Add authenticated internal worker API

docs/api/openapi.yaml

@@ -551,7 +551,7 @@ paths:
           content:
             application/json:
               schema:
-                $ref: '#/components/schemas/Job'
+                $ref: '#/components/schemas/JobPhaseProjection'
         '409':
           $ref: '#/components/responses/PreconditionFailed'
         default:
@@ -1109,6 +1109,13 @@ components:
     JobPhase:
       type: string
       enum: [Queued, Running, RetryWait, Cancelling, Succeeded, Failed, Cancelled]
+    JobPhaseProjection:
+      type: object
+      additionalProperties: false
+      required: [phase]
+      properties:
+        phase:
+          $ref: '#/components/schemas/JobPhase'
     TerminalJobPhase:
       type: string
       enum: [Succeeded, Failed, Cancelled]
@@ -1247,10 +1254,15 @@ components:
     ResultDescriptor:
       type: object
       additionalProperties: false
-      required: [kind, manifest, member_count, total_bytes]
+      required: [kind, manifest_id, schema_version, manifest, member_count, total_bytes]
       properties:
         kind:
           const: manifest
+        manifest_id:
+          $ref: '#/components/schemas/OpaqueId'
+        schema_version:
+          type: integer
+          minimum: 1
         manifest:
           $ref: '#/components/schemas/ObjectIdentity'
         member_count:
@@ -1262,7 +1274,7 @@ components:
     ObjectIdentity:
       type: object
       additionalProperties: false
-      required: [store, bucket, key, checksum]
+      required: [store, bucket, key, checksum, size]
       properties:
         store:
           type: string
@@ -1274,6 +1286,9 @@ components:
           type: string
         checksum:
           $ref: '#/components/schemas/Sha256Digest'
+        size:
+          type: integer
+          minimum: 0
     Sha256Digest:
       type: string
       pattern: '^sha256:[a-f0-9]{64}$'
@@ -1657,7 +1672,7 @@ components:
       allOf:
         - $ref: '#/components/schemas/AttemptMutation'
         - type: object
-          required: [checkpoint_ref]
+          required: [checkpoint_ref, resolved_source_id, validated_bytes, validated_members]
           properties:
             checkpoint_ref:
               allOf:
@@ -1666,6 +1681,14 @@ components:
                   properties:
                     kind:
                       const: checkpoint
+            resolved_source_id:
+              $ref: '#/components/schemas/OpaqueId'
+            validated_bytes:
+              type: integer
+              minimum: 0
+            validated_members:
+              type: integer
+              minimum: 0
     AttemptProgressRequest:
       unevaluatedProperties: false
       allOf: