refactor: drop version field from v2 canonical JSON

The v2 canonical JSON previously included a "version":2 field to make
the hashed content self-describing. Per review feedback, version is
now carried out-of-band via RuntimeEvent.version (scale/serde) only,
and the hashed content is a clean {event, event_type, payload} JSON.

v2 canonical JSON is now:
    {"event":"<name>","event_type":134217729,"payload":"<hex>"}

Updates:
- canonical_event_json_v2: drop "version" key
- doc comments in runtime_events.rs / tdx.rs / dstack-types/lib.rs
  updated to reflect the new v2 format
- tests: expected canonical strings, the hash_input v2 assertion, and
  the key-order test no longer reference "version"

Note: RuntimeEvent serde still emits "version":2 when writing events
to /run/log/dstack/runtime_events.log (serde_roundtrip_preserves_version
test covers that) — that is the on-disk format, not the hashed content.

Author: kvinwang

cc-eventlog/src/runtime_events.rs

@@ -113,7 +113,7 @@ impl RuntimeEvent {
     /// Compute the digest of the event.
     ///
     /// - V1: `SHA(event_type_le || ":" || event_name || ":" || payload)`
-    /// - V2: `SHA(canonical_json({"event":"...","event_type":134217729,"payload":"hex...","version":2}))`
+    /// - V2: `SHA(canonical_json({"event":"...","event_type":134217729,"payload":"hex..."}))`
     pub fn digest<H: Hasher>(&self) -> H::Output {
         H::hash([self.hash_input().as_slice()])
     }
@@ -149,15 +149,14 @@ impl RuntimeEvent {
 
 /// Construct the JCS (RFC 8785) canonical JSON used as the v2 digest input.
 ///
-/// The JSON includes an explicit `version: 2` field so the content is
-/// self-describing for relying parties that don't know dstack's event schema.
 /// Keys and number/string formatting are handled by `serde_jcs` per RFC 8785.
+/// Version is carried out-of-band via `RuntimeEvent::version`, not in the
+/// hashed content.
 pub fn canonical_event_json_v2(event: &str, payload: &[u8]) -> String {
     let obj = serde_json::json!({
         "event": event,
         "event_type": DSTACK_RUNTIME_EVENT_TYPE,
         "payload": hex::encode(payload),
-        "version": 2,
     });
     serde_jcs::to_string(&obj).or_panic("canonical JSON serialization failed")
 }
@@ -208,7 +207,7 @@ mod tests {
         let canonical = canonical_event_json_v2(&event.event, &event.payload);
         assert_eq!(
             canonical,
-            r#"{"event":"compose-hash","event_type":134217729,"payload":"abcd","version":2}"#
+            r#"{"event":"compose-hash","event_type":134217729,"payload":"abcd"}"#
         );
         let digest = event.digest::<Sha384>();
         let expected = Sha384::hash([canonical.as_bytes()]);
@@ -269,7 +268,7 @@ mod tests {
         // Exact bytewise output — JCS must be deterministic
         assert_eq!(
             canonical,
-            r#"{"event":"event\"with\\special\nchars","event_type":134217729,"payload":"ff","version":2}"#
+            r#"{"event":"event\"with\\special\nchars","event_type":134217729,"payload":"ff"}"#
         );
     }
 
@@ -281,18 +280,16 @@ mod tests {
         let event_pos = canonical.find(r#""event":"#).unwrap();
         let event_type_pos = canonical.find(r#""event_type":"#).unwrap();
         let payload_pos = canonical.find(r#""payload":"#).unwrap();
-        let version_pos = canonical.find(r#""version":"#).unwrap();
         assert!(event_pos < event_type_pos);
         assert!(event_type_pos < payload_pos);
-        assert!(payload_pos < version_pos);
     }
 
     #[test]
     fn canonical_json_empty_event_and_payload() {
         let canonical = canonical_event_json_v2("", &[]);
         assert_eq!(
             canonical,
-            r#"{"event":"","event_type":134217729,"payload":"","version":2}"#
+            r#"{"event":"","event_type":134217729,"payload":""}"#
         );
     }
 

cc-eventlog/src/tdx.rs

@@ -19,7 +19,7 @@ use crate::{
 ///
 /// For dstack runtime events (`event_type == DSTACK_RUNTIME_EVENT_TYPE`), the digest is:
 /// - V1: `sha384(event_type_le || ":" || event || ":" || payload)`
-/// - V2: `sha384(canonical_json({"event":"...","event_type":134217729,"payload":"hex...","version":2}))`
+/// - V2: `sha384(canonical_json({"event":"...","event_type":134217729,"payload":"hex..."}))`
 #[derive(Clone, Debug, Serialize, Deserialize, Encode, Decode)]
 pub struct TdxEvent {
     /// IMR index, starts from 0
@@ -183,10 +183,11 @@ mod tests {
         let input_hex = tdx.hash_input.as_ref().expect("hash_input populated");
         let input = hex::decode(input_hex).unwrap();
         let input_str = std::str::from_utf8(&input).unwrap();
-        // V2 hash_input is the canonical JSON
+        // V2 hash_input is the canonical JSON (version is carried out-of-band)
         assert!(input_str.contains(r#""event":"compose-hash""#));
-        assert!(input_str.contains(r#""version":2"#));
+        assert!(input_str.contains(r#""event_type":134217729"#));
         assert!(input_str.contains(r#""payload":"abcd""#));
+        assert!(!input_str.contains(r#""version""#));
         // And hashing it reproduces the digest
         let actual = Sha384::hash([input.as_slice()]);
         assert_eq!(actual.as_slice(), &tdx.digest);

dstack-types/src/lib.rs

@@ -19,7 +19,7 @@ pub enum EventLogVersion {
     #[default]
     V1,
     /// JSON canonical digest (JCS RFC 8785):
-    /// `SHA({"event":"...","event_type":134217729,"payload":"hex...","version":2})`
+    /// `SHA({"event":"...","event_type":134217729,"payload":"hex..."})`
     V2,
 }