feat(worker): enforce durable trust state

internal/wire/types.go

@@ -25,6 +25,17 @@ type RegisterResponse struct {
 	WorkerID  string `json:"worker_id"`
 }
 
+type BootstrapRequest struct {
+	WorkerID       string `json:"worker_id"`
+	BootstrapToken string `json:"bootstrap_token"`
+}
+type BootstrapResponse struct {
+	AuthToken             string `json:"auth_token"`
+	WorkerID              string `json:"worker_id"`
+	ConfigVerificationKey string `json:"config_verification_key"`
+	SigningKeyID          string `json:"signing_key_id"`
+}
+
 // HeartbeatRequest is sent periodically by workers to indicate liveness.
 type HeartbeatRequest struct {
 	ActiveChecks           int `json:"active_checks"`
@@ -44,6 +55,7 @@ type CheckJob struct {
 	URL        *string         `json:"url"`
 	Interval   int             `json:"interval"`
 	Settings   json.RawMessage `json:"settings"` // CheckSettings JSON
+	AccountID  int64           `json:"account_id,omitempty"`
 }
 
 // JobsResponse contains a batch of check jobs for a worker
@@ -230,7 +242,16 @@ type WorkerInit struct {
 	// the master API selfcheck. The current worker is excluded by
 	// the control plane; a worker that receives an empty list treats
 	// the selfcheck as a single-node decision (no peer polling).
-	Peers []PeerInfo `json:"peers,omitempty"`
+	Peers             []PeerInfo `json:"peers,omitempty"`
+	AccountID         *int64     `json:"account_id,omitempty"`
+	ConfigVersion     int64      `json:"config_version,omitempty"`
+	IssuedAt          string     `json:"issued_at,omitempty"`
+	ExpiresAt         string     `json:"expires_at,omitempty"`
+	CredentialSetHash string     `json:"credential_set_hash,omitempty"`
+	Signature         string     `json:"signature,omitempty"`
+	SigningKeyID      string     `json:"signing_key_id,omitempty"`
+	RotateToken       string     `json:"rotate_token,omitempty"`
+	RotationID        string     `json:"rotation_id,omitempty"`
 }
 
 // TaskEnvelope is the task frame the control plane sends on the worker
@@ -324,5 +345,20 @@ type WorkerMessage struct {
 	NotificationResult *NotificationResultReport `json:"notification_result,omitempty"`
 	ServerMetric       *ServerMetricReport       `json:"server_metric,omitempty"`
 	Heartbeat          *HeartbeatRequest         `json:"heartbeat,omitempty"`
+	RotationAck        *RotationAck              `json:"rotation_ack,omitempty"`
+	StaleLease         *StaleLeaseReport         `json:"stale_lease,omitempty"`
+	StaleLeaseAck      *StaleLeaseAck            `json:"stale_lease_ack,omitempty"`
 	Error              string                    `json:"error,omitempty"`
 }
+
+type RotationAck struct {
+	RotationID string `json:"rotation_id"`
+}
+type StaleLeaseReport struct {
+	JobID      string `json:"job_id"`
+	LeaseToken string `json:"lease_token"`
+}
+type StaleLeaseAck struct {
+	JobID      string `json:"job_id"`
+	LeaseToken string `json:"lease_token"`
+}