fix: authenticate Runtime requests without persisted verification

Use the current Workspace signing identity for each request and remove binding key copies and verification handshake gates. Preserve explicit trust and revocation, migrate historical evidence, and align Runtime settings and connection tests. Retain request scope and durable replay protection with regression coverage.

openapi/server-api.json

@@ -1530,15 +1530,10 @@
           },
           "public_bundle": {
             "$ref": "#/components/schemas/RuntimePublicIdentityBundle"
-          },
-          "workspace_trust_id": {
-            "description": "Exact Runtime-issued enrollment identity from `trust-workspace add/show`.\nA key fingerprint alone cannot distinguish revocation and re-enrollment.",
-            "type": "string"
           }
         },
         "required": [
           "public_bundle",
-          "workspace_trust_id",
           "endpoint"
         ],
         "type": "object"
@@ -7840,15 +7835,6 @@
         ],
         "type": "object"
       },
-      "RuntimeConnectionDisplayState": {
-        "enum": [
-          "configured",
-          "verified",
-          "unavailable",
-          "revoked"
-        ],
-        "type": "string"
-      },
       "RuntimeConnectionTestFailureKind": {
         "enum": [
           "authentication",
@@ -7865,6 +7851,7 @@
       },
       "RuntimeConnectionTestResponse": {
         "additionalProperties": false,
+        "description": "Observation of an actual signed ping, not a grant or cached approval.",
         "properties": {
           "actual_protocol_version": {
             "format": "uint32",
@@ -7881,9 +7868,6 @@
           "checked_at": {
             "type": "string"
           },
-          "connection_state": {
-            "$ref": "#/components/schemas/RuntimeConnectionDisplayState"
-          },
           "diagnostics": {
             "default": [],
             "items": {
@@ -7913,16 +7897,6 @@
           "status": {
             "$ref": "#/components/schemas/RuntimeConnectionTestStatus"
           },
-          "verification": {
-            "anyOf": [
-              {
-                "$ref": "#/components/schemas/RuntimeVerificationEvidenceSummary"
-              },
-              {
-                "type": "null"
-              }
-            ]
-          },
           "workspace_id": {
             "type": "string"
           }
@@ -7931,7 +7905,6 @@
           "workspace_id",
           "runtime_id",
           "binding_id",
-          "connection_state",
           "checked_at",
           "status",
           "expected_protocol_version"
@@ -8385,57 +8358,6 @@
         ],
         "type": "string"
       },
-      "RuntimeVerificationEvidenceSummary": {
-        "additionalProperties": false,
-        "properties": {
-          "binding_id": {
-            "type": "string"
-          },
-          "last_checked_at": {
-            "type": "string"
-          },
-          "last_outcome": {
-            "$ref": "#/components/schemas/RuntimeVerificationOutcome"
-          },
-          "runtime_public_key_fingerprint": {
-            "type": "string"
-          },
-          "verified_at": {
-            "type": [
-              "string",
-              "null"
-            ]
-          },
-          "workspace_key_id": {
-            "type": "string"
-          },
-          "workspace_public_key_fingerprint": {
-            "type": "string"
-          },
-          "workspace_trust_id": {
-            "type": "string"
-          }
-        },
-        "required": [
-          "last_checked_at",
-          "last_outcome",
-          "binding_id",
-          "workspace_key_id",
-          "workspace_public_key_fingerprint",
-          "workspace_trust_id",
-          "runtime_public_key_fingerprint"
-        ],
-        "type": "object"
-      },
-      "RuntimeVerificationOutcome": {
-        "enum": [
-          "verified",
-          "challenge_issued",
-          "verification_failed",
-          "connectivity_failed"
-        ],
-        "type": "string"
-      },
       "RuntimeWorkerCompletionsRequest": {
         "additionalProperties": false,
         "properties": {
@@ -15335,43 +15257,14 @@
         ],
         "type": "object"
       },
-      "WorkspaceRuntimeBindingState": {
-        "enum": [
-          "configured",
-          "verified",
-          "revoked"
-        ],
-        "type": "string"
-      },
       "WorkspaceRuntimeBindingSummary": {
         "additionalProperties": false,
+        "description": "Binding identity and explicit revocation only. Each signed request authenticates\nusing the current Workspace signing identity, not a stored approval.",
         "properties": {
           "binding_id": {
             "type": "string"
           },
-          "connection_state": {
-            "$ref": "#/components/schemas/RuntimeConnectionDisplayState"
-          },
-          "state": {
-            "$ref": "#/components/schemas/WorkspaceRuntimeBindingState"
-          },
-          "verification": {
-            "anyOf": [
-              {
-                "$ref": "#/components/schemas/RuntimeVerificationEvidenceSummary"
-              },
-              {
-                "type": "null"
-              }
-            ]
-          },
-          "workspace_key_id": {
-            "type": [
-              "string",
-              "null"
-            ]
-          },
-          "workspace_trust_id": {
+          "revoked_at": {
             "type": [
               "string",
               "null"
@@ -15379,8 +15272,6 @@
           }
         },
         "required": [
-          "state",
-          "connection_state",
           "binding_id"
         ],
         "type": "object"
@@ -16135,7 +16026,7 @@
   "info": {
     "title": "Yoi Server API",
     "version": "0.1.0",
-    "x-yoi-source-digest": "sha256:fc25104c077ab8c5c43f77611f505171585d2d40fd54c6538774ac17aae6cce3"
+    "x-yoi-source-digest": "sha256:a23a7b9989d37fd08459929a4e726396a33334489207799e02d45302e8d4c238"
   },
   "openapi": "3.1.0",
   "paths": {