fix(protocol): fence gateway work recovery

tools/validate.py

@@ -53,6 +53,27 @@ def main() -> int:
     for owner in ("SessionAuthority", "ClientSessionAuthority"):
         assert defs[owner]["required"][-1] == "selected_descriptor"
     assert defs["ConnectionManifest"]["required"][-1] == "selected_descriptor"
+    quality_request = defs["GatewayQualityWorkRequest"]
+    assert quality_request["required"] == ["version", "session_id", "gateway_id", "reconnect_sequence", "acquisition"]
+    assert quality_request["properties"]["acquisition"]["enum"] == ["poll", "prompt", "observation"]
+    assert quality_request["properties"]["lease_generation"]["minimum"] == 1
+    assert defs["GatewayStopWorkRequest"]["required"] == ["version", "session_id", "gateway_id", "reconnect_sequence", "acquisition"]
+    assert defs["GatewayQualityWork"]["required"][-3:] == ["lease_generation", "lease_expires_at", "selected_descriptor"]
+    assert defs["GatewayQualityAck"]["required"][-3:] == ["revision", "lease_generation", "outcome"]
+    assert defs["GatewayQualityAck"]["properties"]["outcome"]["enum"] == ["applied", "proven_prior", "unknown"]
+
+    operation_id_pattern = r"^(?!00000000-0000-0000-0000-000000000000$)[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"
+    canonical_time_pattern = r"^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\.[0-9]{0,8}[1-9])?Z$"
+    for definition in ("QualityChangeOperation", "StopOperation", "GatewayQualityWorkRequest", "GatewayQualityWork", "GatewayQualityAck", "GatewayStopWorkRequest", "GatewayStopWork", "GatewayStopAck"):
+        assert defs[definition]["properties"]["operation_id"]["pattern"] == operation_id_pattern, definition
+        assert defs[definition]["x-max-bytes"] == 16384, definition
+    for definition, fields in {
+        "QualityChangeOperation": ("created_at", "deadline_at", "updated_at"),
+        "StopOperation": ("created_at", "deadline_at", "updated_at"),
+        "GatewayQualityWork": ("lease_expires_at",),
+    }.items():
+        for field in fields:
+            assert defs[definition]["properties"][field]["pattern"] == canonical_time_pattern, (definition, field)
 
     display_mode = defs["DisplayMode"]
     assert display_mode["required"] == ["resolution_width", "resolution_height", "fps"]
@@ -207,6 +228,18 @@ def main() -> int:
     ):
         operation = openapi.split(f"      operationId: {operation_id}\n", 1)[1].split("      responses:\n", 1)[0]
         assert "gatewayMutualTLS: []" in operation and "nativeBearer" not in operation and "browserSession" not in operation, operation_id
+        assert "certificate identity MUST match" in operation, operation_id
+        assert "Maximum JSON body: 16384 bytes." in operation, operation_id
+    quality_acquisition = openapi.split("      operationId: acquireGatewayQualityWork\n", 1)[1].split("      responses:\n", 1)[0]
+    assert "`poll` acquisition omits unknown operation coordinates" in quality_acquisition
+    assert "coordinates MUST match exactly" in quality_acquisition
+    quality_acknowledgement = openapi.split("      operationId: acknowledgeGatewayQualityWork\n", 1)[1].split("      responses:\n", 1)[0]
+    assert "Stale lease generations MUST be rejected" in quality_acknowledgement
+    for operation_id in ("createSessionQualityChange", "getSessionQualityChange", "createSessionStopOperation", "getSessionStopOperation"):
+        operation = openapi.split(f"      operationId: {operation_id}\n", 1)[1].split("      responses:\n", 1)[0]
+        assert "owning principal and active device/key" in operation, operation_id
+    assert openapi.count("Maximum JSON body: 16384 bytes.") >= 8
+    assert operation_id_pattern in openapi
     assert "provider_url" not in openapi and "vm_address" not in openapi
     session_endpoint = openapi.split("  /api/v1/auth/session:", 1)[1].split("\n  /api/", 1)[0]
     assert "$defs/BrowserAuthenticatedSession" in session_endpoint
@@ -238,6 +271,7 @@ def main() -> int:
 """
     admin_override = openapi.split("      operationId: updateEntitlementDisplayLimitOverride\n", 1)[1].split("      responses:\n", 1)[0]
     assert browser_requirement.removeprefix("      ") in admin_override
+    assert "Maximum JSON body: 16384 bytes." in admin_override
     for operation_id in (
         "issueReauthenticationGrant", "logoutSession", "registerDevice", "proveDevice", "revokeDevice",
         "requestBrokerSession", "allocateBrokerSession", "reconnectBrokerSession", "cancelBrokerSession",