feat: bind each node to the binary it runs at its first handshake; refuse changes that are not in a CI-signed manifest [CI]

web/shared/api/schema.ts

@@ -988,6 +988,23 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/admin/nodes/{id}/binary": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /** Accept the node's current binary: clear its binding so the next handshake binds it again */
+        delete: operations["nodes_binary_clear"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/admin/backend/update": {
         parameters: {
             query?: never;
@@ -1680,6 +1697,17 @@ export interface components {
             version: number | string;
             needs: string[];
         };
+        NodeBinaryDto: {
+            sha256: string;
+            signed: boolean;
+            /** Format: int64 */
+            seq: number | string;
+            /** Format: date-time */
+            bound_at: unknown;
+            violation: null | string;
+            /** Format: date-time */
+            violation_at: unknown;
+        };
         NodeBuildDto: {
             id: string;
             kind: string;
@@ -1691,6 +1719,7 @@ export interface components {
             commit: null | string;
             built_at: null | string;
             update?: null | components["schemas"]["NodeUpdateDto"];
+            binary?: null | components["schemas"]["NodeBinaryDto"];
         };
         NodeInfoDto: {
             id: string;
@@ -5593,6 +5622,46 @@ export interface operations {
             };
         };
     };
+    nodes_binary_clear: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description No Content */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": unknown;
+                };
+            };
+            /** @description Unauthorized */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ProblemDto"];
+                };
+            };
+            /** @description Forbidden */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ProblemDto"];
+                };
+            };
+        };
+    };
     backend_update_get: {
         parameters: {
             query?: never;

web/shared/api/types.ts

@@ -19,6 +19,7 @@ export type BuildInfoDto = Narrow<S['BuildInfoDto']>
 export type BackendUpdateDto = Narrow<S['BackendUpdateDto']>
 export type NodeBuildDto = Narrow<S['NodeBuildDto']>
 export type NodeUpdateDto = Narrow<S['NodeUpdateDto']>
+export type NodeBinaryDto = Narrow<S['NodeBinaryDto']>
 export type ReleaseDto = Narrow<S['ReleaseDto']>
 export type LinkDto = Narrow<S['LinkDto']>
 export type LinkMatrixDto = Narrow<S['LinkMatrixDto']>