capabilities/v2/actions/confidentialrelay: Add applicationRequestID to ComputeRequest and hashing

Introduce the `ApplicationRequestID` field to the `ComputeRequest`
struct. For non-legacy versions, this field is included in the
computed hash to bind the application-specific request identity. For
legacy versions, the field is excluded from the hash, maintaining
compatibility with existing behavior.

Author: cfal

pkg/capabilities/v2/actions/confidentialrelay/computerequest.go

@@ -48,6 +48,7 @@ func SignedComputeRequestSignaturePayload(computeRequestHash [32]byte) []byte {
 // authorized identity.
 type ComputeRequest struct {
 	RequestID                    [32]byte   `json:"requestID"`
+	ApplicationRequestID         string     `json:"applicationRequestID"`
 	PublicData                   []byte     `json:"publicData"`
 	Ciphertexts                  [][]byte   `json:"ciphertexts"`
 	CiphertextNames              []string   `json:"CiphertextNames"`
@@ -62,7 +63,8 @@ type ComputeRequest struct {
 // reuses this package's length-prefix helpers (writeBytes/writeString/
 // writeLengthPrefix), which are identical to the source's writeWithLength/
 // writeLengthPrefix. EncryptedDecryptionKeyShares is intentionally excluded, and
-// Version is included only for the legacy version, both matching the source.
+// Version is included only for the legacy version, and ApplicationRequestID is
+// included only for non-legacy versions, both matching the source.
 func (cr ComputeRequest) Hash() [32]byte {
 	h := sha256.New()
 
@@ -88,9 +90,12 @@ func (cr ComputeRequest) Hash() [32]byte {
 
 	writeString(h, cr.AppID)
 	// Version is included in the hash only for the legacy version, matching
-	// confidential-compute (which is migrating Version out of the hash).
+	// confidential-compute (which is migrating Version out of the hash). Newer
+	// versions bind the application-specific request ID instead.
 	if cr.Version == computeRequestLegacyVersion {
 		writeString(h, cr.Version)
+	} else {
+		writeString(h, cr.ApplicationRequestID)
 	}
 
 	var result [32]byte

pkg/capabilities/v2/actions/confidentialrelay/computerequest_test.go

@@ -13,6 +13,7 @@ func sampleComputeRequest() ComputeRequest {
 	}
 	return ComputeRequest{
 		RequestID:                 rid,
+		ApplicationRequestID:      "application-request-id",
 		PublicData:                []byte("public-data"),
 		Ciphertexts:               [][]byte{[]byte("ct-a"), []byte("ct-b")},
 		CiphertextNames:           []string{"name-a", "name-b"},
@@ -74,3 +75,21 @@ func TestComputeRequestHash_VersionOnlyHashedForLegacy(t *testing.T) {
 	legacy.Version = computeRequestLegacyVersion
 	require.NotEqual(t, legacy.Hash(), nonLegacyA.Hash(), "legacy Version must be bound into the hash")
 }
+
+// ApplicationRequestID is the post-legacy replacement for binding application-level
+// request identity without constraining RequestID's 32-byte protocol shape.
+func TestComputeRequestHash_ApplicationRequestIDOnlyHashedForNonLegacy(t *testing.T) {
+	legacyA := sampleComputeRequest()
+	legacyA.ApplicationRequestID = "exec-a"
+	legacyB := sampleComputeRequest()
+	legacyB.ApplicationRequestID = "exec-b"
+	require.Equal(t, legacyA.Hash(), legacyB.Hash(), "legacy ApplicationRequestID must not affect the hash")
+
+	nonLegacyA := sampleComputeRequest()
+	nonLegacyA.Version = "0.0.7"
+	nonLegacyA.ApplicationRequestID = "exec-a"
+	nonLegacyB := sampleComputeRequest()
+	nonLegacyB.Version = "0.0.7"
+	nonLegacyB.ApplicationRequestID = "exec-b"
+	require.NotEqual(t, nonLegacyA.Hash(), nonLegacyB.Hash(), "non-legacy ApplicationRequestID must be bound into the hash")
+}