feat(protocol): freeze M4 native session RC6 contract

tools/validate.py

@@ -39,6 +39,20 @@ def main() -> int:
     feature_registry = json.loads((ROOT / "registries/features.json").read_text(encoding="utf-8"))
     registered_features = {entry["id"] for entry in feature_registry["features"]}
     assert {"control.v1", "control.v2", "display.request.v1", "input.absolute.v1", "input.scroll.v1"}.issubset(registered_features)
+    assert {"video.profile.v1", "session.quality.v1", "session.stop.v1", "controller.arrival.v1"}.issubset(registered_features)
+
+    assert defs["VideoProfile"]["required"] == ["codec", "bit_depth", "chroma_subsampling", "color_space", "transfer_function"]
+    assert defs["AudioProfile"]["required"] == ["codec", "sample_rate_hz", "channels", "channel_layout", "packet_duration_ms"]
+    assert defs["CapabilityProfile"]["required"] == ["transport", "framing", "media", "source_rate_control", "video_profiles", "audio_profiles"]
+    assert defs["CapabilityProfile"]["properties"]["video_profiles"] == {"type": "array", "minItems": 1, "maxItems": 12, "uniqueItems": True, "items": {"$ref": "#/$defs/VideoProfile"}}
+    assert defs["CapabilityProfile"]["properties"]["audio_profiles"] == {"type": "array", "minItems": 1, "maxItems": 1, "uniqueItems": True, "items": {"$ref": "#/$defs/AudioProfile"}}
+    assert defs["SessionRequest"]["required"][-2:] == ["video_profiles", "bitrate_preference"]
+    assert defs["ReconnectRequest"]["required"][-1] == "display_relaunch_confirmed"
+    assert defs["AssignedDesktop"]["required"][-1] == "quality_limits"
+    assert defs["EntitledPool"]["required"][-1] == "quality_limits"
+    for owner in ("SessionAuthority", "ClientSessionAuthority"):
+        assert defs[owner]["required"][-1] == "selected_descriptor"
+    assert defs["ConnectionManifest"]["required"][-1] == "selected_descriptor"
 
     display_mode = defs["DisplayMode"]
     assert display_mode["required"] == ["resolution_width", "resolution_height", "fps"]
@@ -113,6 +127,17 @@ def main() -> int:
     assert "native_identity" not in native_missing_fixture
     tunnel_credential_fixture = json.loads((ROOT / "fixtures/valid/native-tunnel-credential.json").read_text(encoding="utf-8"))
     assert set(tunnel_credential_fixture) == set(tunnel_credential["required"])
+    valid_fixture_contracts = {
+        "fixtures/valid/session-request.json": "SessionRequest",
+        "fixtures/valid/selected-session-descriptor.json": "SelectedSessionDescriptor",
+        "fixtures/valid/session-quality-limits.json": "SessionQualityLimits",
+    }
+    for relative, definition in valid_fixture_contracts.items():
+        fixture = json.loads((ROOT / relative).read_text(encoding="utf-8"))
+        assert set(fixture) == set(defs[definition]["required"]), (relative, definition)
+    assert set(json.loads((ROOT / "fixtures/invalid/capability-rc5-opaque.json").read_text())) & {"audio", "client_decode"} == {"audio", "client_decode"}
+    assert "video_profiles" not in json.loads((ROOT / "fixtures/invalid/session-request-rc5.json").read_text())
+    assert set(json.loads((ROOT / "fixtures/invalid/provider-stream-policy-rc5.json").read_text())) == {"resolution_width", "resolution_height", "fps", "codec", "bitrate_kbps", "audio_enabled"}
 
     expected_header = "id\tversion\tkind\tinput\texpected"
     ids = set()
@@ -139,10 +164,49 @@ def main() -> int:
         fixture_hash.update((ROOT / relative).read_bytes())
         fixture_hash.update(b"\0")
     assert fixture_manifest["corpus_sha256"] == fixture_hash.hexdigest()
+    json_fixture_paths = sorted(
+        path.relative_to(ROOT).as_posix()
+        for directory in (ROOT / "fixtures/valid", ROOT / "fixtures/invalid")
+        for path in directory.glob("*.json")
+    )
+    assert fixture_manifest["json_files"] == json_fixture_paths
+    json_fixture_hash = hashlib.sha256()
+    for relative in json_fixture_paths:
+        json_fixture_hash.update(relative.encode("utf-8"))
+        json_fixture_hash.update(b"\0")
+        json_fixture_hash.update((ROOT / relative).read_bytes())
+        json_fixture_hash.update(b"\0")
+    assert fixture_manifest["json_corpus_sha256"] == json_fixture_hash.hexdigest()
 
     openapi = (ROOT / "openapi/control-v1.yaml").read_text(encoding="utf-8")
     assert "openapi: 3.1.0" in openapi
     assert "/api/v1/auth/refresh:" in openapi and "/api/v1/resources:" in openapi and "/api/v1/events:" in openapi
+    for route in (
+        "/api/v1/session-quality-limits:",
+        "/api/v1/session-quality-limits/assignments/{assignment_id}:",
+        "/api/v1/session-quality-limits/pools/{pool_id}:",
+        "/api/v1/admin/entitlements/{entitlement_id}/display-limit-override:",
+        "/api/v1/broker/sessions/{session_id}/quality-changes:",
+        "/api/v1/broker/sessions/{session_id}/quality-changes/{operation_id}:",
+        "/api/v1/broker/sessions/{session_id}/stop-operations:",
+        "/api/v1/broker/sessions/{session_id}/stop-operations/{operation_id}:",
+        "/api/v1/gateway/quality-work:",
+        "/api/v1/gateway/quality-ack:",
+        "/api/v1/gateway/stop-work:",
+        "/api/v1/gateway/stop-ack:",
+    ):
+        assert route in openapi, route
+    for operation_id in (
+        "getSessionQualityLimits", "getAssignmentSessionQualityLimits", "getPoolSessionQualityLimits",
+        "createSessionQualityChange", "getSessionQualityChange", "createSessionStopOperation", "getSessionStopOperation",
+    ):
+        operation = openapi.split(f"      operationId: {operation_id}\n", 1)[1].split("      responses:\n", 1)[0]
+        assert "nativeBearer: []" in operation and "browserSession" not in operation, operation_id
+    for operation_id in (
+        "acquireGatewayQualityWork", "acknowledgeGatewayQualityWork", "acquireGatewayStopWork", "acknowledgeGatewayStopWork",
+    ):
+        operation = openapi.split(f"      operationId: {operation_id}\n", 1)[1].split("      responses:\n", 1)[0]
+        assert "gatewayMutualTLS: []" in operation and "nativeBearer" not in operation and "browserSession" not in operation, operation_id
     assert "provider_url" not in openapi and "vm_address" not in openapi
     session_endpoint = openapi.split("  /api/v1/auth/session:", 1)[1].split("\n  /api/", 1)[0]
     assert "$defs/BrowserAuthenticatedSession" in session_endpoint
@@ -172,6 +236,8 @@ def main() -> int:
           browserCsrfCookie: []
           browserCsrfHeader: []
 """
+    admin_override = openapi.split("      operationId: updateEntitlementDisplayLimitOverride\n", 1)[1].split("      responses:\n", 1)[0]
+    assert browser_requirement.removeprefix("      ") in admin_override
     for operation_id in (
         "issueReauthenticationGrant", "logoutSession", "registerDevice", "proveDevice", "revokeDevice",
         "requestBrokerSession", "allocateBrokerSession", "reconnectBrokerSession", "cancelBrokerSession",