docs: plan HTTPS peers and source install

docs/control-plane-protocol.md

@@ -16,6 +16,9 @@ GET /worker?token=<RSMON_TOKEN>
 `/api/worker` and the HTTP jobs/results APIs remain compatibility paths. New
 workers use WebSocket task envelopes.
 
+Public endpoint and cluster identity requirements are defined in
+[public-endpoint-and-identity.md](public-endpoint-and-identity.md).
+
 ## Frame Model
 
 Every frame is a `wire.WorkerMessage` with `kind` and one active content
@@ -43,14 +46,20 @@ without execution or reporting.
 
 ## Initialization And Refresh
 
-`wire.WorkerInit` supplies runtime values owned by the control plane:
+The worker proposes `PUBLIC_URL` during registration. The control plane
+validates and canonicalizes it; `wire.WorkerInit` returns the accepted endpoint
+and supplies runtime values owned by the control plane:
 
 - worker ID, region, advertised URL, capabilities, and concurrency;
 - allowed notification methods and account IDs;
 - optional linked server ID for host metrics;
 - LLM endpoints;
 - scoped notification credentials and system contacts;
-- peer workers for selfcheck/cluster-adjacent behavior.
+- signed, cluster-scoped peer topology for selfcheck and Raft behavior.
+
+Worker ID, account, region, cluster, membership, role, topology generation, and
+certificate identity are control-plane authority. Local environment or a peer
+response cannot override them. Static peer environment remains lab-only.
 
 The worker clamps supplied concurrency to its local maximum. Credentials are
 replaced atomically in memory on refresh. Removed credentials must become