ace-assign 0.57.1 → 0.60.0

data/lib/ace/assign/molecules/lifecycle_exclusion.rb

@@ -0,0 +1,209 @@
+# frozen_string_literal: true
+
+require "digest"
+require "fileutils"
+require "json"
+require "open3"
+require "time"
+
+module Ace
+  module Assign
+    module Molecules
+      # Durable start/prune exclusion for assignment and worktree identities.
+      #
+      # Lock files live OUTSIDE every deletion target — under the shared Git
+      # common dir — so they survive removal of the assignment cache, the
+      # worktree, or a recreated lock pathname. Prune holds the exclusive
+      # side from its final evidence reads through completion of removal;
+      # every supported start path (attempt registration, fork/driver
+      # session launch, worktree provisioning) holds the shared side while
+      # registering a writer.
+      #
+      # A `removed` marker recorded by prune makes post-deletion starts fail
+      # closed instead of recreating the deleted identity: acquiring the
+      # shared side raises {AttemptErrors::Conflict} when the marker is
+      # present. Legitimate fresh provisioning (a new worktree for a task)
+      # clears the marker explicitly via `reset_removed`.
+      class LifecycleExclusion
+        # @param repo_root [String, nil] Repository used to resolve the
+        #   shared Git common dir (default: project root)
+        # @param root [String, nil] Explicit exclusion root (tests)
+        def initialize(repo_root: nil, root: nil)
+          @root = root || self.class.default_root(repo_root)
+        end
+
+        # The exclusion root shared by every writer and prune for this repo.
+        # Sandboxed environments (CACHE_BASE) scope it under the cache base,
+        # which itself is never a deletion target; otherwise it lives under
+        # the shared Git common dir, which survives worktree removal.
+        def self.default_root(_repo_root = nil)
+          cache_base = ENV["CACHE_BASE"]
+          if cache_base && !cache_base.empty?
+            return File.join(File.expand_path(cache_base), ".exclusion")
+          end
+
+          repo_root = Ace::Support::Fs::Molecules::ProjectRootFinder.find_or_current
+          common_dir, _stderr, status = Open3.capture3(
+            "git", "-C", repo_root, "rev-parse", "--path-format=absolute", "--git-common-dir"
+          )
+          base = status.success? && !common_dir.to_s.strip.empty? ? common_dir.strip : File.join(repo_root, ".git")
+          File.join(base, "ace", "lifecycle-exclusion")
+        end
+
+        def assignment_key(assignment_id)
+          "assignment:#{assignment_id}"
+        end
+
+        # Task identity is the canonical worktree identity: work-on derives
+        # the worktree path from the task ref, and prune candidates carry
+        # the same task id.
+        def task_key(task_id)
+          "task:#{task_id}"
+        end
+
+        def worktree_key(worktree_path)
+          canonical = begin
+            File.realpath(worktree_path.to_s)
+          rescue Errno::ENOENT, Errno::EACCES
+            File.expand_path(worktree_path.to_s)
+          end
+          "worktree:#{canonical}"
+        end
+
+        # Hold the exclusive side while recomputing proofs and removing the
+        # target. Start paths block for the whole block.
+        #
+        # @param key [String] Identity key
+        # @yield Required block executed under exclusive exclusion
+        def with_exclusive(key)
+          raise ArgumentError, "exclusion key is required" if key.to_s.empty?
+
+          lock = open_lock(key)
+          lock.flock(File::LOCK_EX)
+          begin
+            yield
+          ensure
+            lock.flock(File::LOCK_UN)
+            lock.close
+          end
+        end
+
+        # Hold the shared side while registering a writer or creating a
+        # resource. Fails closed when the identity was pruned.
+        #
+        # @param key [String] Identity key
+        # @param reset_removed [Boolean] Clear a stale removed marker instead
+        #   of raising (legitimate fresh provisioning of the same pathname)
+        def with_shared(key, reset_removed: false)
+          raise ArgumentError, "exclusion key is required" if key.to_s.empty?
+
+          lock = open_lock(key)
+          lock.flock(File::LOCK_SH)
+          begin
+            if removed?(key)
+              unless reset_removed
+                raise AttemptErrors::Conflict, removed_message(key)
+              end
+
+              clear_removed!(key)
+            end
+            yield
+          ensure
+            lock.flock(File::LOCK_UN)
+            lock.close
+          end
+        end
+
+        # Hold the shared side on several identities at once (acquired in the
+        # given order, released in reverse — callers must use one consistent
+        # global order, task before assignment, to avoid deadlock). Fails
+        # closed when any identity was pruned.
+        def with_shared_multi(keys, reset_removed: false)
+          ordered = Array(keys).compact.reject { |key| key.to_s.empty? }.uniq
+          raise ArgumentError, "exclusion keys are required" if ordered.empty?
+
+          locks = ordered.map { |key| open_lock(key) }
+          begin
+            locks.each { |lock| lock.flock(File::LOCK_SH) }
+            ordered.each do |key|
+              if removed?(key)
+                unless reset_removed
+                  raise AttemptErrors::Conflict, removed_message(key)
+                end
+
+                clear_removed!(key)
+              end
+            end
+            yield
+          ensure
+            locks.reverse_each do |lock|
+              lock.flock(File::LOCK_UN)
+              lock.close
+            end
+          end
+        end
+
+        # Record that the identity was removed. Call while holding the
+        # exclusive side, BEFORE deleting the target.
+        def record_removed!(key)
+          atomic_write(
+            state_path(key),
+            JSON.generate({"removed" => true, "removed_at" => Time.now.utc.iso8601, "key" => key})
+          )
+        end
+
+        def removed?(key)
+          state = JSON.parse(File.read(state_path(key)))
+          state["removed"] == true
+        rescue Errno::ENOENT, JSON::ParserError, TypeError
+          false
+        end
+
+        def clear_removed!(key)
+          File.delete(state_path(key))
+        rescue Errno::ENOENT
+          nil
+        end
+
+        private
+
+        attr_reader :root
+
+        def open_lock(key)
+          FileUtils.mkdir_p(root)
+          File.open(lock_path(key), File::RDWR | File::CREAT)
+        end
+
+        def lock_path(key)
+          File.join(root, "#{Digest::SHA256.hexdigest(key)}.lock")
+        end
+
+        def state_path(key)
+          File.join(root, "#{Digest::SHA256.hexdigest(key)}.state.json")
+        end
+
+        def removed_message(key)
+          identity = key.to_s.sub(/\A[^:]+:/, "")
+          case key
+          when /\Aassignment:/
+            "Assignment #{identity} was pruned; refusing to start a writer on a removed identity"
+          when /\Atask:/
+            "Task #{identity} worktree was pruned; refusing to start a writer on a removed identity"
+          else
+            "Worktree #{identity} was pruned; refusing to start a writer on a removed identity"
+          end
+        end
+
+        def atomic_write(path, content)
+          dir = File.dirname(path)
+          FileUtils.mkdir_p(dir)
+          temp = File.join(dir, ".tmp-#{Process.pid}-#{rand(1_000_000)}")
+          File.write(temp, content)
+          File.rename(temp, path)
+        ensure
+          File.delete(temp) if temp && File.exist?(temp)
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/molecules/receipt_verifier.rb

@@ -0,0 +1,272 @@
+# frozen_string_literal: true
+
+require "digest"
+require "json"
+
+module Ace
+  module Assign
+    module Molecules
+      # Canonical receipt validation for accepted execution evidence.
+      #
+      # Verifies schema and field hygiene, attempt binding, producer
+      # attribution, transition authority, current-head candidate binding,
+      # artifact digests, executed checks, and independent review verdicts.
+      # Every failure is a rejection with an actionable reason; a receipt is
+      # never partially accepted.
+      class ReceiptVerifier
+        # Operations that act outside the local repository once executed.
+        EXTERNAL_EFFECT_OPERATIONS = %w[merge publish deploy release].freeze
+
+        REVIEW_OPERATION = "review"
+        HEAD_PATTERN = /\A[0-9a-f]{7,64}\z/.freeze
+        APPROVED_VERDICT = "approved"
+
+        # @param identity_resolver [ExecutionIdentityResolver] Trust boundary
+        def initialize(identity_resolver: nil)
+          @identity_resolver = identity_resolver || ExecutionIdentityResolver.new
+        end
+
+        # Validate a submitted receipt against an attempt.
+        #
+        # @param data [Hash] Parsed receipt payload
+        # @param attempt [Models::Attempt] Target attempt (loaded by coordinator)
+        # @param identity [ExecutionIdentityResolver::Identity] Finishing boundary identity
+        # @param live_head [String] Current candidate revision (git rev-parse HEAD)
+        # @param repo_root [String] Project root for artifact resolution
+        # @return [Models::ExecutionReceipt] Normalized receipt with digest
+        # @raise [AttemptErrors::ReceiptRejected] on any validation failure
+        def verify!(data, attempt:, identity:, live_head:, repo_root:)
+          reject_unless(data.is_a?(Hash), "receipt must be a JSON object")
+
+          if Models::ExecutionReceipt.forbidden_field?(data)
+            reject("receipt carries forbidden fields (credentials, environment, or terminal output)")
+          end
+
+          required = %w[attempt_id assignment_id project_id scope operation producer head verdict]
+          missing = required.select { |key| data[key].nil? || data[key].to_s.strip.empty? }
+          reject("missing required fields: #{missing.join(', ')}") unless missing.empty?
+          unless Models::ExecutionReceipt::VERDICTS.include?(data["verdict"].to_s)
+            reject("unsupported verdict '#{data['verdict']}': must be one of #{Models::ExecutionReceipt::VERDICTS.join(', ')}")
+          end
+
+          verify_binding(data, attempt)
+          verify_producer(data)
+          verify_authority(data, identity)
+          verify_head(data, live_head)
+          verify_artifacts(data, repo_root) if data["verdict"] == "succeeded"
+          verify_checks(data)
+          verify_review(data)
+          verify_campaign(data, repo_root: repo_root, live_head: live_head)
+
+          receipt = Models::ExecutionReceipt.from_h(data.merge("recorded_at" => Time.now.utc))
+          verify_digest(receipt)
+
+          receipt
+        end
+        # Recheck the source artifacts/checks of an already accepted receipt.
+        def verify_accepted_evidence!(data, live_head:, repo_root:)
+          verify_head(data, live_head)
+          verify_artifacts(data, repo_root)
+          verify_checks(data)
+          verify_review(data)
+        end
+
+        # @param operation [String] Receipt operation
+        # @return [Boolean] True when the operation acts outside the repository
+        def external_effect?(operation)
+          EXTERNAL_EFFECT_OPERATIONS.include?(operation.to_s)
+        end
+
+        private
+
+        def verify_binding(data, attempt)
+          binding = attempt.binding
+          unless data["attempt_id"] == attempt.attempt_id
+            reject("receipt attempt_id #{data['attempt_id']} does not match attempt #{attempt.attempt_id}")
+          end
+          unless data["assignment_id"] == binding.assignment_id
+            reject("receipt assignment #{data['assignment_id']} does not match attempt assignment #{binding.assignment_id}")
+          end
+          unless data["project_id"] == binding.project_id
+            reject("receipt project #{data['project_id']} does not match attempt project #{binding.project_id}")
+          end
+          unless Atoms::AssignmentScope.equal?(data["scope"], binding.scope)
+            reject("receipt scope #{data['scope']} does not match attempt scope #{binding.scope}")
+          end
+        end
+
+        def verify_producer(data)
+          producer = data["producer"]
+          reject_unless(producer.is_a?(Hash), "producer must be an object with actor, role, runtime")
+
+          actor = producer["actor"].to_s.strip
+          role = producer["role"].to_s.strip
+          runtime = producer["runtime"].to_s.strip
+          if actor.empty? || runtime.empty? || !ExecutionIdentityResolver::ROLES.include?(role)
+            reject("producer attribution incomplete: actor, runtime, and a known role are required")
+          end
+        end
+
+        # Workers submit attributable results but cannot self-approve
+        # succeeded outcomes; only coordinator/service authority accepts them.
+        def verify_authority(data, identity)
+          return if data["verdict"] != "succeeded"
+          return if @identity_resolver.trusted?(identity)
+
+          reject("identity #{identity.actor}/#{identity.role} may not accept a succeeded verdict")
+        end
+
+        # The tested/reviewed head must be the live candidate revision; stale
+        # heads are rejected (candidate invalidation is recorded by the
+        # coordinator).
+        def verify_head(data, live_head)
+          reject("live candidate head unavailable") if live_head.nil? || live_head.to_s.strip.empty?
+          reject("receipt head '#{data['head']}' is not a git SHA") unless data["head"].match?(HEAD_PATTERN)
+
+          unless data["head"] == live_head
+            reject("receipt head #{data['head']} is stale; current candidate is #{live_head}")
+          end
+        end
+
+        # Succeeded outcomes need at least one artifact whose recorded digest
+        # matches the file on disk. Paths stay below the project root; symlink
+        # or traversal escapes are rejected.
+        def verify_artifacts(data, repo_root)
+          artifacts = data["artifacts"]
+          reject_unless(artifacts.is_a?(Array) && !artifacts.empty?, "succeeded verdict requires at least one artifact")
+
+          artifacts.each do |artifact|
+            reject_unless(artifact.is_a?(Hash), "artifact entries must be objects")
+            path = artifact["path"].to_s
+            recorded = artifact["sha256"].to_s
+            reject("artifact missing path or sha256") if path.empty? || recorded.empty?
+
+            expanded = begin
+              File.expand_path(path, File.realpath(repo_root))
+            rescue Errno::ENOENT, Errno::EACCES
+              nil
+            end
+            reject("artifact file not found: #{path}") if expanded.nil? || !File.exist?(expanded)
+
+            resolved = safe_resolve(repo_root, path)
+            reject("artifact path escapes project root: #{path}") if resolved.nil?
+
+            actual = Digest::SHA256.hexdigest(File.read(resolved))
+            reject("artifact digest mismatch for #{path}") unless actual == recorded
+          end
+        end
+
+        def verify_checks(data)
+          checks = data["checks"] || []
+          reject_unless(checks.is_a?(Array), "checks must be an array")
+          if data["verdict"] == "succeeded" && checks.empty?
+            reject("succeeded verdict requires at least one executed check")
+          end
+
+          checks.each do |check|
+            reject_unless(check.is_a?(Hash), "check entries must be objects")
+            reject("check missing name") if check["name"].to_s.strip.empty?
+            reject("check #{check['name']} did not pass") if check["verdict"].to_s != "passed" && data["verdict"] == "succeeded"
+          end
+        end
+
+        # A caller-supplied digest must equal the canonical digest of the
+        # receipt payload; arbitrary or all-zero digests are rejected.
+        def verify_digest(receipt)
+          return if receipt.digest == Atoms::EvidenceDigest.digest(receipt.digest_payload)
+
+          reject("receipt digest mismatch: supplied digest does not match the canonical payload")
+        end
+
+        # Review receipts need an executed, independent reviewer verdict for
+        # exactly the tested head — a report existing is not approval, and a
+        # review receipt without a reviewer verdict is not evidence.
+        def verify_review(data)
+          review = data["review"]
+          if review.nil?
+            if data["operation"] == REVIEW_OPERATION && data["verdict"] == "succeeded"
+              reject("review receipt requires an executed independent reviewer verdict")
+            end
+
+            return
+          end
+
+          reject_unless(review.is_a?(Hash), "review must be an object")
+          reviewer = review["reviewer"]
+          reject_unless(reviewer.is_a?(Hash) && !reviewer["actor"].to_s.strip.empty?, "review must name an executed reviewer")
+
+          producer_actor = data.dig("producer", "actor").to_s.strip
+          if reviewer["actor"].to_s.strip == producer_actor
+            reject("reviewer and producer must differ (self-approval rejected)")
+          end
+
+          reject("review verdict must be '#{APPROVED_VERDICT}' for a succeeded receipt") if review["verdict"] != APPROVED_VERDICT && data["verdict"] == "succeeded"
+          unless review["head"] == data["head"]
+            reject("review head #{review['head']} does not match receipt head #{data['head']}")
+          end
+        end
+
+        # Consume ace-review's single campaign authority through the existing
+        # receipt boundary; a worker-supplied local result grants no authority.
+        def verify_campaign(data, repo_root:, live_head:)
+          campaign = data["campaign"]
+          return unless campaign
+          reject_unless(campaign.is_a?(Hash), "campaign must be an object")
+          reject("campaign result requires a succeeded review receipt") unless
+            data["operation"] == REVIEW_OPERATION && data["verdict"] == "succeeded"
+          reference = campaign["result"]
+          reject_unless(reference.is_a?(Hash), "campaign requires a result artifact reference")
+          unless Array(data["artifacts"]).include?(reference)
+            reject("campaign result must be included in verified receipt artifacts")
+          end
+          resolved = safe_resolve(repo_root, reference["path"].to_s)
+          reject("campaign result path escapes repository or is missing") unless resolved
+          result = JSON.parse(File.read(resolved))
+          reject_unless(result.is_a?(Hash), "campaign result must be an object")
+          require "ace/review"
+          current = Ace::Review::Organisms::CampaignManager.new(repo_root: repo_root).status(campaign["id"])
+          unless result["campaign_id"] == campaign["id"] && result["accepted"] == true &&
+              result["dry_run"] == false && current["accepted"] == true &&
+              result["result_identity"] == current["result_identity"] &&
+              result.dig("evidence", "current_head") == live_head && current.dig("evidence", "current_head") == live_head
+            reject("campaign result is stale, incomplete, blocked or does not match live authority")
+          end
+          approval = current["rounds"].last["approval"]
+          unless approval["producer"] == data.dig("producer", "actor") &&
+              approval["reviewer"] == data.dig("review", "reviewer", "actor") &&
+              approval["head"] == data["head"]
+            reject("campaign producer/reviewer attribution does not match independently validated receipt")
+          end
+        rescue JSON::ParserError, ArgumentError, TypeError, KeyError => e
+          reject("invalid campaign result: #{e.message}")
+        end
+
+        # Resolve a project-relative artifact path to its real location,
+        # rejecting traversal and symlink escapes (an in-repo symlink must
+        # not smuggle in an external file); returns nil when the path leaves
+        # the root.
+        def safe_resolve(repo_root, path)
+          root = File.realpath(repo_root)
+          candidate = File.expand_path(path, root)
+          return nil unless candidate == root || candidate.start_with?(root + File::SEPARATOR)
+          return nil unless File.exist?(candidate)
+
+          resolved = File.realpath(candidate)
+          return nil unless resolved == root || resolved.start_with?(root + File::SEPARATOR)
+
+          resolved
+        rescue Errno::ENOENT, Errno::EACCES
+          nil
+        end
+
+        def reject(message)
+          raise AttemptErrors::ReceiptRejected, message
+        end
+
+        def reject_unless(condition, message)
+          reject(message) unless condition
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/organisms/assignment_executor.rb

@@ -56,8 +56,12 @@ module Ace
         #
         # @param config_path [String] Path to job.yaml config
         # @param parent_id [String, nil] Parent assignment ID for hierarchy linking
+        # @param task_id [String, nil] Source task ID attaching this assignment
+        #   (also read from the job's assignment.task_id); nil = taskless
+        # @param project_id [String, nil] Project ID (also read from the job's
+        #   assignment.project_id)
         # @return [Hash] Result with assignment and first step
-        def start(config_path, parent_id: nil)
+        def start(config_path, parent_id: nil, task_id: nil, project_id: nil)
           raise ConfigErrors::NotFound, "Config file not found: #{config_path}" unless File.exist?(config_path)
 
           config = YAML.safe_load_file(config_path, permitted_classes: [Time, Date])
@@ -74,12 +78,14 @@ module Ace
           steps_config = expand_sub_steps(steps_config)
           steps_config = materialize_skill_backed_steps(steps_config)
 
-          # Create assignment
+          # Create assignment; explicit args win over job config keys
           assignment = assignment_manager.create(
             name: assignment_config["name"] || File.basename(config_path, ".yaml"),
             description: assignment_config["description"],
             source_config: config_path,
-            parent: parent_id
+            parent: parent_id,
+            task_id: task_id || assignment_config["task_id"],
+            project_id: project_id || assignment_config["project_id"]
           )
 
           # Create initial step files
@@ -108,7 +114,9 @@ module Ace
             updated_at: assignment.updated_at,
             source_config: archived_path,
             cache_dir: assignment.cache_dir,
-            parent: assignment.parent
+            parent: assignment.parent,
+            task_id: assignment.task_id,
+            project_id: assignment.project_id
           )
           assignment_manager.update(assignment)