ace-assign 0.63.0 → 0.64.0

data/lib/ace/assign/authority/launch_scope_abort.rb

@@ -0,0 +1,88 @@
+# frozen_string_literal: true
+
+module Ace
+  module Assign
+    module Authority
+      class LaunchLifecycle
+        SCOPE_ABORT_FIELDS = %w[kind scope_generation scope_binding_event_id seal_event_id proof_id].freeze
+
+        # Also used by the shared final release-before-reuse predicate. Calls
+        # existing owners at the same immutable CAS input, without impersonating
+        # a public evidence-fetch peer or inventing an alternate verifier.
+        def scope_settlement_complete!(journal:, events:, params:, map:, commit:)
+          if @result_owner
+            @result_owner.service_settlement_complete!(journal: journal, events: events, params: params, map: map, commit: commit)
+          else
+            service_events = events.any? { |event| %w[service_claim service_transition].include?(event["type"]) }
+            service_records = journal.service_request_records(commit: commit).any? do |record|
+              record["assignment_id"] == params.fetch("assignment_id") && record["attempt_id"] == params.fetch("attempt_id")
+            end
+            if service_events || service_records
+              raise AttemptErrors::EvidenceUnavailable, "canonical service settlement owner is unavailable"
+            end
+          end
+          contexts = @deployment.project(map.fetch("project_id")).fetch("inbox_contexts", {})
+          if contexts.any? || events.any? { |event| event["type"].start_with?("inbox_") }
+            unless @result_owner && @result_owner.respond_to?(:inbox_settlement_complete!)
+              raise AttemptErrors::EvidenceUnavailable, "canonical inbox settlement owner is unavailable"
+            end
+            @result_owner.inbox_settlement_complete!(journal: journal, events: events, params: params, map: map, commit: commit)
+          end
+          true
+        end
+
+        private
+
+        def scope_abort_plan(params, map, events, peer, journal:, commit:, supervisor:)
+          bytes = params.fetch("failure_evidence").dup.force_encoding(Encoding::UTF_8)
+          raise ArgumentError, "scope failure must be UTF-8 JSON" unless bytes.valid_encoding?
+          failure = JSON.parse(bytes, create_additions: false, max_nesting: 8, allow_duplicate_key: false, allow_comments: false)
+          strict!(failure, SCOPE_ABORT_FIELDS)
+          unless failure["kind"] == "protected_scope_before_release" && failure["scope_generation"].is_a?(Integer) && failure["scope_generation"].positive?
+            raise ArgumentError, "scope failure selectors differ"
+          end
+          %w[scope_binding_event_id seal_event_id proof_id].each do |key|
+            value = failure.fetch(key)
+            raise ArgumentError, "invalid scope failure selector" unless value.is_a?(String) && value.match?(/\A[0-9a-f]{64}\z/)
+          end
+          state = states(events)[params.fetch("attempt_id")]
+          unless state && state["mapping_id"] == params.fetch("mapping_id") && state["launch_ticket"] == params.fetch("launch_ticket") &&
+              (supervisor || @kernel.same?(state.fetch("launcher_identity"), peer))
+            raise AttemptErrors::UnauthorizedIdentity, "scope failure is not owned by this launcher"
+          end
+          chain = events.select { |event| event["attempt_id"] == params.fetch("attempt_id") }
+          lineage = Molecules::ExecutionScopeLineage.new(events: chain, project_id: map.fetch("project_id"),
+            assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"), mapping_id: params.fetch("mapping_id"))
+          lineage.require_positive!(**failure.reject { |key, _| key == "kind" }.transform_keys(&:to_sym))
+          scope_observer_for(params.fetch("mapping_id")).verify_closed!(lineage)
+          if chain.any? { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "release_launch" } ||
+              state["phase"] == "issued" || state["execution"] == "potentially_executed"
+            raise AttemptErrors::Conflict, "scope failure cannot undo issued launch permission"
+          end
+          scope_settlement_complete!(journal: journal, events: chain, params: params, map: map, commit: commit)
+          current = journal.canonical_attempt_state(chain)
+          unless %w[reserved running uncertain].include?(current)
+            raise AttemptErrors::Conflict, "scope failure cannot change a terminal attempt"
+          end
+          proof = failure.merge("release" => "not_issued")
+          reason = "protected_scope_closed_before_release"
+          event = if current == "uncertain"
+            {type: "reconciliation", payload: {"resolution" => "failed", "reason" => reason,
+              "failure_digest" => params.fetch("failure_digest"), "abort_observation" => proof}}
+          else
+            # This is the sole reserved -> failed admission. The generic state
+            # machine remains unchanged; no synthetic process_start is written.
+            {type: "transition", payload: {"from" => current, "to" => "failed", "reason" => reason,
+              "abort_observation" => proof}}
+          end
+          reference = "evidence/imports/launch-failure-#{params.fetch('attempt_id')}-#{params.fetch('failure_digest')}"
+          {events: [event], blobs: {reference => params.fetch("failure_evidence")}, data: state.merge(
+            "phase" => "failed", "failure_digest" => params.fetch("failure_digest"), "failure_ref" => reference,
+            "abort_observation" => proof, "required_action" => nil)}
+        rescue JSON::ParserError
+          raise ArgumentError, "scope failure JSON is invalid"
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/launch_scope_admission.rb

@@ -0,0 +1,84 @@
+# frozen_string_literal: true
+
+module Ace
+  module Assign
+    module Authority
+      class LaunchLifecycle
+        # Internal owner call, deliberately absent from the public operation
+        # allowlist. The durable winner alone may call the fixed manager. A
+        # lost StartUnit reply retains admission uncertainty; replay never starts.
+        def admit_native_service!(params:, peer:, role:)
+          strict!(params, %w[mapping_id assignment_id attempt_id launch_ticket mutation_id expected_generation])
+          unless %i[launcher supervisor].include?(role)
+            raise AttemptErrors::UnauthorizedIdentity, "native admission requires an exact launch owner"
+          end
+          %w[assignment_id attempt_id launch_ticket mutation_id].each { |key| token!(params.fetch(key)) }
+          generation!(params.fetch("expected_generation"))
+          @kernel.live!(peer)
+          map = @deployment.mapping(params.fetch("mapping_id"))
+          journal = journal_for(map)
+          input = params.reject { |key, _| key == "mutation_id" }
+          digest = Digest::SHA256.hexdigest(JSON.generate(canonical(input)))
+          with_exclusion(params, map, journal) do
+            admit_native_service_held!(params, map, journal, peer, role, digest)
+          end
+        end
+
+        private
+
+        def admit_native_service_held!(params, map, journal, peer, role, digest)
+            result = @mutex.synchronize do
+              # Visibility is current even on a historical mutation replay.
+              current = journal.read_events(params.fetch("assignment_id")).select { |event| event["attempt_id"] == params.fetch("attempt_id") }
+              scope_admission_owner!(params, map, current, peer, role)
+              journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
+                mutation_id: params.fetch("mutation_id"), operation: "scope_service_admission", parameters_digest: digest,
+                expected_generation: params.fetch("expected_generation"), with_replay: true) do |events, _commit, generation|
+                state, lineage = scope_admission_owner!(params, map, events, peer, role)
+                lineage.require_open!
+                unless state["phase"] == "reserved" && !lineage.native_event && !lineage.child_event &&
+                    events.none? { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "scope_service_admission" }
+                  raise AttemptErrors::Conflict, "native activation was already admitted or launch advanced"
+                end
+                observer = scope_observer_for(params.fetch("mapping_id"))
+                installation = observer.native_admission_ready!(lineage)
+                binding = lineage.binding
+                data = state.merge("scope_generation" => binding.fetch("scope_generation"),
+                  "scope_binding_event_id" => lineage.binding_event.fetch("digest"),
+                  "service_unit" => map.fetch("execution_scope").fetch("service_unit"), "native_admission" => "issued_uncertain",
+                  "network_installation" => installation)
+                unless installation.is_a?(Hash) && installation["namespace_path"] == map.fetch("execution_scope").fetch("network_namespace_path")
+                  raise AttemptErrors::EvidenceUnavailable, "network verifier output names another fixed namespace path"
+                end
+                candidate = Models::EvidenceEvent.build(type: "authority_mutation", attempt_id: params.fetch("attempt_id"),
+                  payload: {"operation" => "scope_service_admission", "data" => data.merge("generation" => generation + 1)},
+                  previous_digest: events.last&.fetch("digest"))
+                Molecules::ExecutionScopeLineage.new(events: events + [candidate], project_id: map.fetch("project_id"),
+                  assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"), mapping_id: params.fetch("mapping_id"))
+                {events: [], blobs: {}, data: data}
+              end
+            end
+            # No authority mutex or journal ref lock is held while systemd waits
+            # for its private readiness callback. Slot exclusion still prevents
+            # another generation, seal or maintenance from racing this start.
+            unless result.fetch(:replayed)
+              scope_observer_for(params.fetch("mapping_id")).start_admitted_service!
+            end
+            result
+        end
+
+        def scope_admission_owner!(params, map, events, peer, role)
+          state = states(events)[params.fetch("attempt_id")]
+          unless state && state["mapping_id"] == params.fetch("mapping_id") &&
+              state["launch_ticket"] == params.fetch("launch_ticket") &&
+              (role == :supervisor || @kernel.same?(state.fetch("launcher_identity"), peer))
+            raise AttemptErrors::UnauthorizedIdentity, "native admission launch origin differs"
+          end
+          lineage = Molecules::ExecutionScopeLineage.new(events: events, project_id: map.fetch("project_id"),
+            assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"), mapping_id: params.fetch("mapping_id"))
+          [state, lineage]
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/launch_scope_close.rb

@@ -0,0 +1,115 @@
+# frozen_string_literal: true
+
+module Ace
+  module Assign
+    module Authority
+      class LaunchLifecycle
+        # Source-owned close core. Its first accepted mutation seals admission
+        # and caches the retained running reply before any manager stop. A
+        # subsequent fresh mutation may record positive observation; replay of
+        # the first mutation always keeps its original reply and performs no I/O.
+        def close_execution_scope!(params:, peer:, role:)
+          strict!(params, %w[mapping_id assignment_id attempt_id mutation_id expected_generation])
+          %w[assignment_id attempt_id mutation_id].each { |key| token!(params.fetch(key)) }
+          generation!(params.fetch("expected_generation"))
+          @kernel.live!(peer)
+          map = @deployment.mapping(params.fetch("mapping_id"))
+          journal = journal_for(map)
+          input = params.reject { |key, _| key == "mutation_id" }
+          digest = Digest::SHA256.hexdigest(JSON.generate(canonical(input)))
+          with_exclusion(params, map, journal) do
+            stop_after_commit = false
+            result = @mutex.synchronize do
+              current = journal.read_events(params.fetch("assignment_id")).select { |event| event["attempt_id"] == params.fetch("attempt_id") }
+              scope_close_owner!(params, map, current, peer, role)
+              journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
+                mutation_id: params.fetch("mutation_id"), operation: "close_execution_scope", parameters_digest: digest,
+                expected_generation: params.fetch("expected_generation"), with_replay: true) do |events, _commit, _generation|
+                lineage = scope_close_owner!(params, map, events, peer, role)
+                binding = lineage.binding
+                raise AttemptErrors::EvidenceUnavailable, "original parent binding is missing" unless binding
+                projection = {"attempt_id" => params.fetch("attempt_id"), "scope_generation" => binding.fetch("scope_generation"),
+                  "state" => "running", "proof_id" => nil, "required_action" => "close_scope"}
+                if !lineage.sealed?
+                  stop_after_commit = true
+                  payload = {"scope_generation" => binding.fetch("scope_generation"), "scope_binding_event_id" => lineage.binding_event.fetch("digest")}
+                  {events: [{type: "scope_sealed", payload: payload}], blobs: {}, data: projection}
+                elsif lineage.proof_event
+                  scope_observer_for(params.fetch("mapping_id")).verify_closed!(lineage)
+                  {events: [], blobs: {}, data: projection.merge("state" => "closed_no_writers", "proof_id" => lineage.proof_id, "required_action" => nil)}
+                elsif scope_observer_for(params.fetch("mapping_id")).sealed_service_stop_required?(lineage)
+                  # A fresh canonical close resumes a stop lost after the seal.
+                  # Replaying either mutation performs no manager I/O.
+                  stop_after_commit = true
+                  {events: [], blobs: {}, data: projection}
+                else
+                  # This call must return a fresh validated observation, never
+                  # a cached population, caller JSON or a manifest boolean.
+                  payload = scope_observer_for(params.fetch("mapping_id")).closed_observation_for_proof!(lineage, events: events)
+                  expected = binding.slice("scope_generation", "boot_id", "slice_invocation_id", "cgroup_identity").merge(
+                    "scope_binding_event_id" => lineage.binding_event.fetch("digest"), "seal_event_id" => lineage.seal_event.fetch("digest"), "populated" => 0)
+                  unless payload == expected
+                    raise AttemptErrors::EvidenceUnavailable, "fresh observation does not name the retained sealed parent"
+                  end
+                  at = Time.now.utc
+                  event = Models::EvidenceEvent.build(type: "scope_closed_no_writers", attempt_id: params.fetch("attempt_id"),
+                    payload: payload, previous_digest: events.last&.fetch("digest"), recorded_at: at)
+                  {events: [{type: "scope_closed_no_writers", payload: payload, recorded_at: at}], blobs: {},
+                    data: projection.merge("state" => "closed_no_writers", "proof_id" => event.fetch("digest"), "required_action" => nil)}
+                end
+              end
+            end
+            if !result.fetch(:replayed) && stop_after_commit
+              scope_observer_for(params.fetch("mapping_id")).stop_sealed_service!
+            end
+            result
+          end
+        end
+
+        def observe_execution_scope!(params:, peer:, role:)
+          strict!(params, %w[mapping_id assignment_id attempt_id])
+          %w[assignment_id attempt_id].each { |key| token!(params.fetch(key)) }
+          @kernel.live!(peer)
+          map = @deployment.mapping(params.fetch("mapping_id"))
+          journal = journal_for(map)
+          with_exclusion(params, map, journal) do
+            @mutex.synchronize do
+              commit = journal.ref_value
+              events = journal.read_events(params.fetch("assignment_id"), commit: commit).select { |event| event["attempt_id"] == params.fetch("attempt_id") }
+              lineage = scope_close_owner!(params, map, events, peer, role)
+              projection = {"attempt_id" => params.fetch("attempt_id"), "scope_generation" => lineage.binding&.fetch("scope_generation"),
+                "state" => "unverifiable", "proof_id" => nil, "required_action" => "inspect_exact_scope",
+                "generation" => journal.authority_generation(events), "journal_commit" => commit}
+              return projection unless lineage.binding
+              begin
+                observation = scope_observer_for(params.fetch("mapping_id")).observe(lineage)
+                if lineage.proof_event
+                  scope_observer_for(params.fetch("mapping_id")).verify_closed!(lineage)
+                  projection.merge("state" => "closed_no_writers", "proof_id" => lineage.proof_id, "required_action" => nil)
+                elsif lineage.sealed? && observation.fetch("populated").zero?
+                  projection.merge("required_action" => "close_scope")
+                else
+                  projection.merge("state" => "running", "required_action" => "close_scope")
+                end
+              rescue Ace::Runtime::RuntimeUnavailableError, AttemptErrors::EvidenceUnavailable
+                projection
+              end
+            end
+          end
+        end
+
+        private
+
+        def scope_close_owner!(params, map, events, peer, role)
+          state = states(events)[params.fetch("attempt_id")]
+          unless state && state["mapping_id"] == params.fetch("mapping_id") &&
+              (role == :supervisor || role == :launcher && @kernel.same?(state.fetch("launcher_identity"), peer))
+            raise AttemptErrors::UnauthorizedIdentity, "scope closure requires the original launch owner"
+          end
+          Molecules::ExecutionScopeLineage.new(events: events, project_id: map.fetch("project_id"),
+            assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"), mapping_id: params.fetch("mapping_id"))
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/launch_scope_parent.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+module Ace
+  module Assign
+    module Authority
+      class LaunchLifecycle
+        private
+
+        # Called inside the existing slot/assignment exclusion, after the fresh
+        # reservation CAS and outside its authority mutex/journal ref lock.
+        # Mutation replay and restart never call this activation path.
+        def provision_reserved_parent_held!(reservation, map, journal)
+          params = reservation.slice("mapping_id", "assignment_id", "attempt_id")
+          context = params.merge("project_id" => map.fetch("project_id"),
+            "reservation_generation" => reservation.fetch("reservation_generation"),
+            "scope_generation" => reservation.fetch("generation") + 1)
+          observer = scope_observer_for(params.fetch("mapping_id"))
+          binding = observer.activate_parent!(context)
+          @mutex.synchronize do
+            journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
+              mutation_id: "scope-parent-#{Digest::SHA256.hexdigest(params.fetch('attempt_id'))[0, 48]}",
+              operation: "scope_parent_binding", parameters_digest: Digest::SHA256.hexdigest(JSON.generate(canonical(context))),
+              expected_generation: reservation.fetch("generation"), with_replay: true) do |events, _commit, _generation|
+              state = states(events)[params.fetch("attempt_id")]
+              unless state && state["phase"] == "reserved" && state["launch_ticket"] == reservation.fetch("launch_ticket") &&
+                  events.none? { |event| %w[scope_bound scope_native_bound scope_child_bound scope_sealed].include?(event["type"]) ||
+                    event["type"] == "authority_mutation" && event.dig("payload", "operation") == "scope_service_admission" }
+                raise AttemptErrors::Conflict, "parent activation cannot replace or reopen an existing generation"
+              end
+              at = Time.now.utc
+              event = Models::EvidenceEvent.build(type: "scope_bound", attempt_id: params.fetch("attempt_id"),
+                payload: binding, previous_digest: events.last&.fetch("digest"), recorded_at: at)
+              lineage = Molecules::ExecutionScopeLineage.new(events: events + [event], project_id: map.fetch("project_id"),
+                assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"), mapping_id: params.fetch("mapping_id"))
+              observer.observe(lineage)
+              {events: [{type: "scope_bound", payload: binding, recorded_at: at}], blobs: {}, data: state.merge(
+                "scope_generation" => binding.fetch("scope_generation"), "scope_binding_event_id" => event.fetch("digest"))}
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/launch_scope_release.rb

@@ -0,0 +1,180 @@
+# frozen_string_literal: true
+
+module Ace
+  module Assign
+    module Authority
+      class LaunchLifecycle
+        # Source-only maintenance entry. Transport stop/drain/inhibition belongs
+        # to the trusted installer; this method supplies the exact same locks
+        # and canonical owner query, without a live endpoint or another ledger.
+        def with_execution_slots(mapping_ids:, &block)
+          unless mapping_ids.is_a?(Array) && mapping_ids.size.between?(1, 64) && mapping_ids.uniq == mapping_ids
+            raise ArgumentError, "fixed execution slot selections must be unique and bounded"
+          end
+          maps = mapping_ids.map { |id| token!(id); [id, @deployment.mapping(id)] }
+            .sort_by { |_id, map| [map.fetch("authority_id"), map.fetch("execution_scope").fetch("slot_id")] }
+          enter = lambda do |offset|
+            if offset < maps.size
+              with_slot(maps.fetch(offset).last) { enter.call(offset + 1) }
+            else
+              @mutex.synchronize do
+                commits = {}
+                contexts = maps.map do |id, map|
+                  journal = journal_for(map)
+                  commit = commits.fetch(map.fetch("project_id")) { commits[map.fetch("project_id")] = journal.ref_value }
+                  {mapping_id: id.freeze, journal: journal, commit: commit&.freeze}.freeze
+                end.freeze
+                block.call(contexts)
+              end
+            end
+          end
+          enter.call(0)
+        end
+
+        def slot_reusable!(mapping_id:, journal:, commit:)
+          map = @deployment.mapping(mapping_id)
+          require_slot_snapshot!(map, journal, commit)
+          ensure_slot_available!(map, journal, commit: commit)
+          require_slot_snapshot!(map, journal, commit)
+          true
+        end
+
+        def retire_released_parent!(mapping_id:, journal:, commit:)
+          slot_reusable!(mapping_id: mapping_id, journal: journal, commit: commit)
+          map = @deployment.mapping(mapping_id)
+          slot = map.fetch("execution_scope").fetch("slot_id")
+          lineages = journal.assignment_ids(commit: commit).flat_map do |assignment_id|
+            journal.read_events(assignment_id, commit: commit).group_by { |event| event.fetch("attempt_id") }.filter_map do |attempt_id, events|
+              reservation = events.find { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "reserve_attempt" }
+              next unless reservation
+              prior_id = reservation.dig("payload", "data", "mapping_id")
+              next unless @deployment.mapping(prior_id).fetch("execution_scope").fetch("slot_id") == slot
+              Molecules::ExecutionScopeLineage.new(events: events, project_id: map.fetch("project_id"),
+                assignment_id: assignment_id, attempt_id: attempt_id, mapping_id: prior_id)
+            end
+          end
+          result = scope_observer_for(mapping_id).retire_released_parent!(lineages)
+          require_slot_snapshot!(map, journal, commit)
+          result
+        end
+
+        # Current connected release producer is the guarded pre-release abort.
+        # Finish/stop owners will call the same settlement/proof core in their
+        # terminal CAS; those consumer handlers are not this task's ownership.
+        def release_scope_reservation!(params:, peer:, role:)
+          strict!(params, %w[mapping_id assignment_id attempt_id mutation_id expected_generation])
+          %w[assignment_id attempt_id mutation_id].each { |key| token!(params.fetch(key)) }
+          generation!(params.fetch("expected_generation"))
+          @kernel.live!(peer)
+          map = @deployment.mapping(params.fetch("mapping_id"))
+          journal = journal_for(map)
+          digest = Digest::SHA256.hexdigest(JSON.generate(canonical(params.reject { |key, _| key == "mutation_id" })))
+          with_exclusion(params, map, journal) do
+            release_scope_reservation_held!(params, map, journal, peer, role, digest)
+          end
+        end
+
+        private
+
+        def release_scope_reservation_held!(params, map, journal, peer, role, digest)
+            @mutex.synchronize do
+              current = journal.read_events(params.fetch("assignment_id")).select { |event| event["attempt_id"] == params.fetch("attempt_id") }
+              scope_close_owner!(params, map, current, peer, role)
+              journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
+                mutation_id: params.fetch("mutation_id"), operation: "scope_reservation_release", parameters_digest: digest,
+                expected_generation: params.fetch("expected_generation"), with_replay: true) do |events, commit, _generation|
+                lineage = scope_close_owner!(params, map, events, peer, role)
+                terminal = guarded_scope_abort_receipt!(events, lineage, journal, commit)
+                scope_observer_for(params.fetch("mapping_id")).verify_closed!(lineage)
+                scope_settlement_complete!(journal: journal, events: events, params: params, map: map, commit: commit)
+                if events.any? { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "scope_reservation_release" }
+                  raise AttemptErrors::Conflict, "reservation is already released"
+                end
+                {events: [], blobs: {}, data: {"assignment_id" => params.fetch("assignment_id"), "attempt_id" => params.fetch("attempt_id"),
+                  "mapping_id" => params.fetch("mapping_id"), "scope_generation" => lineage.binding.fetch("scope_generation"),
+                  "scope_binding_event_id" => lineage.binding_event.fetch("digest"), "proof_id" => lineage.proof_id,
+                  "terminal_event_id" => terminal.fetch("digest"), "reservation" => "released"}}
+              end
+            end
+        end
+
+        # A crash after guarded abort must not strand a known-clean reservation.
+        # Resume against the current canonical generation under the same slot
+        # exclusion; preserve the original immutable public abort reply.
+        def resume_scope_release_held!(response, map, journal, peer, role)
+          data = response.fetch(:data)
+          params = data.slice("mapping_id", "assignment_id", "attempt_id")
+          @mutex.synchronize do
+            commit = journal.ref_value
+            events = journal.read_events(params.fetch("assignment_id"), commit: commit).select { |event| event["attempt_id"] == params.fetch("attempt_id") }
+            lineage = scope_close_owner!(params, map, events, peer, role)
+            return if scope_reservation_released?(events, lineage, journal, commit)
+            params["expected_generation"] = journal.authority_generation(events)
+          end
+          params["mutation_id"] = "scope-release-#{Digest::SHA256.hexdigest(params.fetch('attempt_id'))[0, 48]}"
+          digest = Digest::SHA256.hexdigest(JSON.generate(canonical(params.reject { |key, _| key == "mutation_id" })))
+          release_scope_reservation_held!(params, map, journal, peer, role, digest)
+        end
+
+        def require_slot_snapshot!(map, journal, commit)
+          key = [object_id, map.fetch("authority_id"), map.fetch("execution_scope").fetch("slot_id")]
+          unless Thread.current[:ace_assign_scope_exclusions]&.fetch(key, false) && journal.equal?(journal_for(map)) && journal.ref_value == commit
+            raise AttemptErrors::EvidenceUnavailable, "slot query requires its held exclusion and exact current canonical ref"
+          end
+        end
+
+        def guarded_scope_abort_receipt!(events, lineage, journal, commit)
+          aborts = events.select { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "abort_launch" }
+          terminal = aborts.last
+          data = terminal&.dig("payload", "data")
+          observation = data&.fetch("abort_observation", nil)
+          unless data && data["phase"] == "failed" && observation.is_a?(Hash) && observation["release"] == "not_issued" &&
+              observation.keys.sort == (SCOPE_ABORT_FIELDS + ["release"]).sort &&
+              observation["kind"] == "protected_scope_before_release" && journal.canonical_attempt_state(events) == "failed" &&
+              events.none? { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "release_launch" }
+            raise AttemptErrors::EvidenceUnavailable, "verified guarded terminal release is unavailable"
+          end
+          selectors = observation.reject { |key, _| %w[kind release].include?(key) }
+          lineage.require_positive!(**selectors.transform_keys(&:to_sym))
+          bytes = journal.blob(data.fetch("failure_ref"), commit: commit)
+          unless bytes.is_a?(String) && bytes.bytesize.between?(1, 16_384) && Digest::SHA256.hexdigest(bytes) == data.fetch("failure_digest")
+            raise AttemptErrors::EvidenceUnavailable, "guarded terminal failure bytes changed"
+          end
+          failure = JSON.parse(bytes.dup.force_encoding(Encoding::UTF_8), create_additions: false, max_nesting: 8, allow_duplicate_key: false, allow_comments: false)
+          unless failure == observation.reject { |key, _| key == "release" }
+            raise AttemptErrors::EvidenceUnavailable, "guarded terminal failure selectors changed"
+          end
+          preceding = events.take_while { |event| event["digest"] != terminal.fetch("digest") }
+          transition = preceding.last
+          unless transition && %w[transition reconciliation].include?(transition["type"]) &&
+              transition.dig("payload", "reason") == "protected_scope_closed_before_release" &&
+              (transition.dig("payload", "to") || transition.dig("payload", "resolution")) == "failed" &&
+              transition.dig("payload", "abort_observation") == observation
+            raise AttemptErrors::EvidenceUnavailable, "guarded terminal transition differs"
+          end
+          terminal
+        rescue KeyError, JSON::ParserError, EncodingError
+          raise AttemptErrors::EvidenceUnavailable, "guarded terminal lineage is incomplete"
+        end
+
+        def scope_reservation_released?(events, lineage, journal, commit)
+          releases = events.select { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "scope_reservation_release" }
+          return false if releases.empty?
+          raise AttemptErrors::EvidenceUnavailable, "canonical reservation release is repeated" unless releases.size == 1
+          terminal = guarded_scope_abort_receipt!(events, lineage, journal, commit)
+          data = releases.first.dig("payload", "data")
+          expected = {"assignment_id" => lineage.binding.fetch("assignment_id"), "attempt_id" => lineage.binding.fetch("attempt_id"),
+            "mapping_id" => lineage.binding.fetch("mapping_id"), "scope_generation" => lineage.binding.fetch("scope_generation"),
+            "scope_binding_event_id" => lineage.binding_event.fetch("digest"), "proof_id" => lineage.proof_id,
+            "terminal_event_id" => terminal.fetch("digest"), "reservation" => "released"}
+          unless data.is_a?(Hash) && data.reject { |key, _| key == "generation" } == expected &&
+              events.index(releases.first) > events.index(terminal) &&
+              data["generation"] == events.take(events.index(releases.first) + 1).count { |event| event["type"] == "authority_mutation" }
+            raise AttemptErrors::EvidenceUnavailable, "canonical reservation release selectors differ"
+          end
+          true
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/posix_acl.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+require "fiddle"
+
+module Ace
+  module Assign
+    module Authority
+      # Linux POSIX access ACL evaluation for a fixed unprivileged principal.
+      # No credential switching; unsupported or unreadable policy refuses admission.
+      class PosixAcl
+        def entries(path)
+          raise Ace::Runtime::RuntimeUnavailableError, "receiver ACL inspection requires Linux" unless RUBY_PLATFORM.include?("linux")
+          function = Fiddle::Function.new(Fiddle::Handle::DEFAULT["lgetxattr"],
+            [Fiddle::TYPE_VOIDP, Fiddle::TYPE_VOIDP, Fiddle::TYPE_VOIDP, Fiddle::TYPE_SIZE_T], Fiddle::TYPE_SSIZE_T)
+          buffer = Fiddle::Pointer.malloc(8192, Fiddle::RUBY_FREE)
+          count = function.call(path, "system.posix_acl_access", buffer, 8192)
+          return nil if count == -1 && Fiddle.last_error == Errno::ENODATA::Errno
+          raise Ace::Runtime::RuntimeUnavailableError, "receiver access ACL is unreadable" if count < 4 || (count - 4) % 8 != 0
+          bytes = buffer[0, count]
+          raise Ace::Runtime::RuntimeUnavailableError, "unknown receiver ACL version" unless bytes.unpack1("L<") == 2
+          rows = bytes.byteslice(4..).unpack("S<S<L<" * ((count - 4) / 8)).each_slice(3).to_a
+          validate!(rows)
+          rows
+        rescue Fiddle::DLError
+          raise Ace::Runtime::RuntimeUnavailableError, "receiver ACL inspection is unavailable"
+        end
+
+        def searchable?(path, stat:, uid:, groups:)
+          rows = entries(path)
+          unless rows
+            shift = uid == stat.uid ? 6 : (groups.include?(stat.gid) ? 3 : 0)
+            return ((stat.mode >> shift) & 1) == 1
+          end
+          return (rows.find { |tag, _perm, _id| tag == 1 }[1] & 1) == 1 if uid == stat.uid
+          mask = rows.find { |tag, _perm, _id| tag == 16 }&.at(1) || 7
+          named = rows.find { |tag, _perm, id| tag == 2 && id == uid }
+          return (named[1] & mask & 1) == 1 if named
+          matched = rows.select { |tag, _perm, id| (tag == 4 && groups.include?(stat.gid)) || (tag == 8 && groups.include?(id)) }
+          return matched.any? { |_tag, perm, _id| (perm & mask & 1) == 1 } unless matched.empty?
+          (rows.find { |tag, _perm, _id| tag == 32 }[1] & 1) == 1
+        end
+
+        private
+
+        def validate!(rows)
+          valid = rows.all? { |tag, perm, id| [1, 2, 4, 8, 16, 32].include?(tag) && (0..7).cover?(perm) &&
+            ([2, 8].include?(tag) ? id != 0xffffffff : id == 0xffffffff) }
+          valid &&= [1, 4, 32].all? { |tag| rows.count { |row| row[0] == tag } == 1 }
+          valid &&= rows.count { |row| row[0] == 16 } <= 1
+          valid &&= [2, 8].all? { |tag| ids = rows.select { |row| row[0] == tag }.map(&:last); ids.uniq == ids }
+          valid &&= !rows.any? { |row| [2, 8].include?(row[0]) } || rows.count { |row| row[0] == 16 } == 1
+          raise Ace::Runtime::RuntimeUnavailableError, "invalid receiver access ACL" unless valid
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/private_directory.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+module Ace
+  module Assign
+    module Authority
+      module PrivateDirectory
+        module_function
+
+        # Source configuration chooses this path. Each ancestor must prevent
+        # another principal from replacing the private leaf or its contents.
+        def verify!(root)
+          path = File.expand_path(root)
+          cursor = path
+          loop do
+            stat = File.lstat(cursor)
+            unless stat.directory? && !stat.symlink? && [0, Process.uid].include?(stat.uid) && (stat.mode & 0022).zero?
+              raise AttemptErrors::ReceiptRejected, "Private directory ancestry is not protected"
+            end
+            break if cursor == "/"
+            cursor = File.dirname(cursor)
+          end
+          stat = File.stat(path)
+          unless stat.uid == Process.uid && (stat.mode & 0077).zero?
+            raise AttemptErrors::ReceiptRejected, "Private directory must be owned by this peer and private"
+          end
+          path
+        rescue SystemCallError, TypeError
+          raise AttemptErrors::ReceiptRejected, "Private directory is unavailable"
+        end
+      end
+    end
+  end
+end