Implement workspace evolution, migrations, and runtime continuity

Enable evolution by default for source-backed workspaces. Add stable
conformance ownership, semantic-major review, candidate typechecking,
and durable fenced cutover with explicit migrations and forward recovery.

Independently supervise package runtimes so unchanged resource owners keep
their processes and connections across cutover. Add scoped invocation
authority, resource sessions, and typed callback rebinding.

Wire opaque object references through generated bindings and RPCs. Add
canonical relationship sets, keyed maps, and ordered lists with scoped
transactional mutations, revision checks, and inverse consistency. Support
planned cascade deletion, protection, tombstones, and lifecycle foundations.

Add journaled structural edits, package/function/migration scaffolding,
managed repository creation, and resumable bottom-up dependency pin
publication. Document lifetime boundaries, revision pinning, prototype
compatibility policy, commands, and deferred work.

Validate with 210 tests, user-systemd process/connection continuity,
generated-package TypeScript checks, and Nix host/protocol checks.
TTL handoff, physical reclamation, general multi-step migrations, and
root-systemd migration isolation acceptance remain deferred.

proto/camino/api.proto

@@ -15,6 +15,8 @@ service CaminoService {
   rpc ConnectEdge(ConnectEdgeRequest) returns (ConnectEdgeResponse);
   rpc ResolveEdge(ResolveEdgeRequest) returns (ResolveEdgeResponse);
   rpc DisconnectEdge(DisconnectEdgeRequest) returns (DisconnectEdgeResponse);
+  rpc ReadCollection(ResolveEdgeRequest) returns (ReadCollectionResponse);
+  rpc ReplaceCollection(ReplaceCollectionRequest) returns (ReadCollectionResponse);
   rpc ListOps(ListOpsRequest) returns (ListOpsResponse);
   rpc WatchObject(WatchObjectRequest) returns (stream WatchObjectEvent);
 }
@@ -108,12 +110,32 @@ message ResolveEdgeResponse { repeated CaminoEdge edges = 1; }
 message DisconnectEdgeRequest { string edge_id = 1; }
 message DisconnectEdgeResponse { string edge_id = 1; }
 
+message CollectionEntry {
+  // Existing entry identity to preserve; empty allocates a new canonical edge.
+  string edge_id = 1;
+  string target_object_id = 2;
+  Value key = 3;
+}
+message ReadCollectionResponse {
+  uint64 revision = 1;
+  repeated CollectionEntry entries = 2;
+}
+message ReplaceCollectionRequest {
+  string object_id = 1;
+  string edge_type_id = 2;
+  string projection_id = 3;
+  uint64 expected_revision = 4;
+  repeated CollectionEntry entries = 5;
+}
+
 message ListOpsRequest { string object_id = 1; }
 message ListOpsResponse { repeated CaminoOp ops = 1; }
 message WatchObjectRequest {
   string object_id = 1;
   string after_op_id = 2;
   bool include_snapshot = 3;
+  // Managed runtimes must watch only their injected attachments.
+  repeated string attachment_ids = 4;
 }
 message WatchObjectEvent {
   string object_id = 1;
@@ -141,6 +163,8 @@ message CaminoEdge {
   optional int32 first_ordinal = 7;
   optional int32 second_ordinal = 8;
   string created_at = 9;
+  string first_key_json = 10;
+  string second_key_json = 11;
 }
 
 message CaminoOp {

proto/camino/schema.proto

@@ -18,6 +18,7 @@ message AtomDefinition {
 message AtomConformance {
   string atom_id = 1;
   string interface_revision_id = 2;
+  string conformance_id = 3;
 }
 
 message StateAttachment {
@@ -27,6 +28,7 @@ message StateAttachment {
   string value_type_json = 4;
   string storage_policy_json = 5;
   string default_value_json = 6;
+  string owner_conformance_id = 7;
 }
 
 message EndpointConstraint {
@@ -42,6 +44,13 @@ message EdgeEndpoint {
   EndpointConstraint constraint = 3;
   Cardinality cardinality = 4;
   bool ordered = 5;
+  // Empty means restrict. Direction is the endpoint being deleted.
+  string on_delete = 6;
+  bool retain_other = 7;
+  // Empty for sets/lists, otherwise string, boolean, or int64 map keys.
+  string key_type = 8;
+  // Explicit read-only dependency injection traversal, not mutation authority.
+  bool public_traversal = 9;
 }
 
 message EdgeAttachment {
@@ -49,6 +58,7 @@ message EdgeAttachment {
   string display_name = 2;
   EdgeEndpoint first = 3;
   EdgeEndpoint second = 4;
+  string owner_conformance_id = 5;
 }
 
 // Camino consumes this persistence-only projection of a checked workspace.

proto/quixos/runtime.proto

@@ -9,13 +9,37 @@ service PackageRuntime {
   rpc Handshake(HandshakeRequest) returns (HandshakeResponse);
   rpc Invoke(InvokeRequest) returns (InvokeResponse);
   rpc Watch(WatchRequest) returns (stream WatchEvent);
+  rpc GetInvocationStatus(InvocationControlRequest) returns (InvocationStatus);
+  rpc CancelInvocation(InvocationControlRequest) returns (InvocationStatus);
 }
 
-message HandshakeRequest { string orch_protocol_version = 1; }
+message HandshakeRequest {
+  string orch_protocol_version = 1;
+  string nonce = 2;
+}
 message HandshakeResponse {
   string package_revision_id = 1;
   string runtime_protocol_version = 2;
   repeated string export_ids = 3;
+  string instance_id = 4;
+  string authentication_proof = 5;
+  repeated string capabilities = 6;
+}
+
+message InvocationContext {
+  string workspace_epoch = 1;
+  string instance_id = 2;
+  string binding_digest = 3;
+  string grant = 4;
+  string session_id = 5;
+  // Host-selected owner; packages must not invent workspace-local ownership.
+  string owner_conformance_id = 6;
+}
+message InvocationControlRequest { string invocation_id = 1; }
+message InvocationStatus {
+  string invocation_id = 1;
+  // unknown, running, cancellation-requested, completed, failed
+  string state = 2;
 }
 
 message InvokeRequest {
@@ -24,6 +48,7 @@ message InvokeRequest {
   string object_id = 3;
   map<string, camino.Value> input = 4;
   repeated quixos.InjectedDependency dependencies = 5;
+  InvocationContext context = 6;
 }
 message InvokeResponse {
   bool ok = 1;
@@ -38,6 +63,7 @@ message WatchRequest {
   string object_id = 3;
   map<string, camino.Value> input = 4;
   repeated quixos.InjectedDependency dependencies = 5;
+  InvocationContext context = 6;
 }
 
 message DerivedDependency {