ace-assign 0.63.0 → 0.64.0

data/docs/usage.md

@@ -101,7 +101,7 @@ ace-assign attempt reconcile --attempt ATTEMPT --receipt receipt.json
 - `attempt start` returns a JSON projection of the attempt (ID, state, binding facts, evidence references, digests). A repeated identical start returns the same attempt; a conflicting start exits 5 without launching a second writer.
 - `attempt status` exposes only state, binding, references, and digests -- never credentials or receipt bytes.
 - `attempt finish` accepts a structured receipt: operation, attributed producer, exact tested/reviewed head, verdict, artifact paths with SHA-256 digests, executed checks, and -- for review operations -- an executed independent reviewer verdict for that head.
-- `attempt reconcile` classifies interrupted attempts (`stopped` before process start, `uncertain` when an effect cannot be proven either way, still `running` only for verifiably live processes) and resolves uncertainty only against a verified receipt attributed to the recorded execution boundary. Merge, publish, and deploy effects are never replayed automatically.
+- `attempt reconcile` classifies interrupted attempts (`uncertain` when launch or effect completion cannot be proven either way, still `running` only for verifiably live processes) and resolves uncertainty only against a verified receipt attributed to the recorded execution boundary. Merge, publish, and deploy effects are never replayed automatically.
 
 ### State machine
 
@@ -138,7 +138,14 @@ External service operations (driven through `ace-lab service request`) claim the
 
 - Task-attached (managed) attempts journal accepted evidence to the configured evidence Git ref (default `refs/ace/execution`) through an isolated, disposable audit checkout, outside the deliverable candidate branch. Journal commits never advance or exempt the reviewed candidate.
 - Taskless assignments persist attempts under `.ace-local/assign` with `recovery_mode: local_only`. This path never claims Git-backed recovery and cannot record external effects (`merge`, `publish`, `deploy`, `release`); attach the assignment to a source task before managed delivery.
-- Actor identity always comes from the execution boundary (OS login for local use, or the trusted service executor's identity). Unknown identity fails closed; flags never grant identity or authority.
+- Actor identity always comes from the execution boundary (the kernel process account for local use, or the trusted service executor's identity). Local execution requires equal real and effective UIDs and resolves the effective UID's OS account; terminal login, `USER`, and `LOGNAME` do not select the actor. Unknown accounts, changing credentials, and unsupported privilege transitions fail closed; flags never grant identity or authority. Historical attempt ownership is never rewritten.
+
+For developer callers, `Ace::Assign::Molecules::ExecutionIdentityResolver.new(adapter: "local").resolve.actor`
+returns `Etc.getpwuid(Process.euid).name` for an ordinary process, including one without a terminal login.
+If the OS account cannot be established or real/effective UIDs differ, it raises
+`Ace::Assign::AttemptErrors::UnauthorizedIdentity` (CLI exit code 5). Correct the process launch/account;
+setting `USER` or `LOGNAME` cannot authorize it. A previously recorded foreign owner still requires the
+existing recovery process; this change does not transfer ownership.
 
 ### status integration
 
@@ -409,3 +416,85 @@ ace-assign select --clear
 | 130 | Interrupted (SIGINT) |
 
 See [exit-codes.md](exit-codes.md) for complete descriptions.
+
+## Resume accepted assignment state
+
+```bash
+ace-assign resume --assignment ID --dry-run
+ace-assign resume --assignment ID
+ace-assign inbox-reconcile --attempt ID --event ID --receipt proof.json
+```
+
+Both commands return JSON with task goal, checkpoint, attempts, pending HITL references and unresolved effect/inbox references. Each attempt reports `adopt`, `restart-required` or `reconcile-required`, liveness, recovery reason and its last verified observation. Dry-run writes nothing. Actual resume journals a bounded observation; unproven running attempts become uncertain and keep their writer slot. Intent-only reservations remain `reserved` with `reconcile-required`: absent process-start history never proves that a child did not launch. `attempt start` refuses to reuse an unbound reservation, and `attempt reconcile` reports that protected launch reconciliation requires positive no-execution/no-surviving-writer proof before abort. The protected launch authority owns that proof and abort path; these source primitives do not implement it. Finish also rejects an unbound reservation before accepting any receipt, even if a stale local cache says running. Imported canonical evidence stores the exact submitted bytes without Git clean filters or line-ending conversions; immutable reuse compares the accepted Git blob. It never launches a new process or resends a payload. Restart goes through a new `attempt start` only after the previous attempt ends with accepted evidence.
+
+Managed agents invoking attempt start inside tmux/Herdr obtain a runtime-owned process binding. Recovery compares PID, UID, OS start time, host, exact pane/native session and Herdr terminal/native thread. A surviving shell is not the agent. Missing, unreadable or reused identity remains unknown. A plain local CLI establishes its actor through its effective UID's OS account, requiring equal real/effective UIDs, but supplies no durable agent identity; trusted service executors may supply `process_pid` in their configured identity JSON. Process observation never grants service privilege or effect authority.
+
+Pending HITL references retain their exact scope/attempt and are not rebound by resume. Uncertain external claims require existing effect receipt reconciliation. Delivery consumption is separate from business success. Herdr owns signed inbox verification (`ace-herdr inbox reconcile --event ID --receipt FILE`); the assignment `inbox-reconcile` command uses that same configured verifier and additionally records the accepted observation references. `AttemptCoordinator#bind_inbox` records only the event reference, and `#reconcile_inbox` delegates that same verifier and journals only the verified proof digest/path and native observation reference. A consumed receipt settles transport once. A superseded receipt requeues the same event for an explicit retry, without succeeding the attempt. Exact signed replay recovers a crash between Herdr settlement and the assignment journal write; changed key, target, payload or generation fails closed. Retain the matching protected key pair for unresolved events or postpone rotation.
+
+Installed Herdr/Pi compaction and writing-child stop/close acceptance must be recorded separately from deterministic fixture coverage before Lab cutover.
+
+### Attempt-bound forge delivery
+
+`ace-assign create --task TASK --preset work-on-task --delivery-parameters delivery.json`
+accepts an explicit delivery mapping. A local-only preset rejects that mapping.
+The same mapping is retained as `delivery` in the assignment job:
+
+```json
+{"forge_server":"lab-forge","pr_provenance":{"mode":"fork","head_repository_url":"https://forge.example/worker/project","head_ref":"task-branch","base_repository_url":"https://forge.example/team/project","base_ref":"main"}}
+```
+
+Use either `forge_server` or boolean `forge_default: true`. With neither,
+the first remote delivery resolves the repository remote and journals the selected
+forge. Subsequent mutations retain that identity. Canonical mode requires equal
+head and base repository URLs; fork mode names both repositories explicitly.
+The source ref must already contain the exact local candidate commit.
+
+`ace-assign delivery --assignment ID --attempt ATTEMPT --operation create --title TITLE`
+creates a draft. Operations `update`, `review` and `status` reuse that attempt;
+status and review do not append evidence. `ready --tests TEST-REF.json --review
+REVIEW-REF.json` requires references containing `attempt_id` and `receipt_digest`
+to coordinator-accepted, executed tests and independent approval at the current
+candidate. Remote CI remains visible and advisory. An unresolved mutation is
+reconciled by exact provider identity; absence or conflicting matches remain
+unresolved and never trigger an automatic second write. Retrying readiness uses
+the original intent's evidence references, revalidated against the current head.
+
+Merge runs in the authorized qjx executor, which calls the neutral provider merge
+primitive under its existing scoped policy. The worker only consumes completion:
+`delivery --operation merge --service-request REQUEST --tests TEST-REF.json
+--review REVIEW-REF.json`. A completed, verified receipt must bind this assignment,
+attempt, candidate and exact PR resource; credentials do not grant authority.
+Version and changelog preparation do not authorize publication.
+
+The neutral `git/pr/create` and `git/pr/update` workflow and skill assets require
+qkb.1 companion adoption across installed consumers. Their source tests do not
+claim fresh installed workflow acceptance or authorized live merge acceptance.
+
+Delivery context belongs to the assignment's existing evidence journal, while each
+operation belongs to its own scoped attempt. Closing create step `030` and starting
+update `147` or readiness `148` retains the exact PR and forge. An unresolved intent
+from any earlier scoped attempt prevents a second mutation: reconciliation records
+a result under the current attempt and links the original intent digest and attempt.
+Status history includes each event's owning `attempt_id` and `event_digest`. No
+single delivery attempt needs to remain active throughout the recipe.
+If reconciliation recovers a different operation than the requested step (for
+example, create while invoking readiness), the command reports that the requested
+step still needs execution. It does not return success for an unperformed step.
+Retry that requested operation with its current evidence after recovery settles.
+
+Recovery compares the exact requested effect, not only its operation name. An
+uncertain update of one title/body cannot complete a later update with different
+content. Creation also checks the requested title/body against the observed draft,
+including adoption of an already known draft. A mismatched request receives
+`AttemptErrors::CurrentEffectRequired` after the old intent is settled; the new
+effect remains unperformed until explicitly retried. Explicit readiness references
+must match the recovered intent; omitting them during retry retains and revalidates
+its original references. Merge always consumes the exact named qjx service request,
+its candidate/target binding and verified receipt, never an older PR result.
+
+
+## Protected cross-user native launch
+
+The fixed installed authority exposes `ace-assign authority serve`, `launch`,
+`status` and `terminate`. See [protected authority](protected-authority.md) for
+OS policy, native artifact installation, canonical launch stages and safe replay.

data/handbook/workflow-instructions/assign/drive.wf.md

@@ -924,10 +924,10 @@ When executing a step with a `skill:` field:
 |-------|-----------|---------|
 | `onboard` | `/as-onboard` | Load project context |
 | `ace:task-work` | `/as-task-work <taskref>` | Implement task changes |
-| `ace:github-pr-create` | `/as-github-pr-create` | Create pull request |
+| `ace:git-pr-create` | `/as-git-pr-create` | Create pull request |
 | `ace:review-pr` | `/as-review-pr [pr#]` | Review code changes |
 | `ace:git-commit` | `/as-git-commit` | Generate commit message |
-| `ace:github-pr-update` | `/as-github-pr-update` | Update PR description |
+| `ace:git-pr-update` | `/as-git-pr-update` | Update PR description |
 
 ## Error Handling
 

data/handbook/workflow-instructions/assign/prepare.wf.md

@@ -168,7 +168,7 @@ When parsing informal instructions, identify:
 1. **Task References**: "task 123", "task-123", "#123"
 2. **Skill Keywords**: Map to known skills
    - "work on task" → `ace:task-work`
-   - "create pr", "make pr" → `ace:github-pr-create`
+   - "create pr", "make pr" → `ace:git-pr-create`
    - "review", "review pr" → `ace:review-pr`
    - "commit" → `ace:git-commit`
    - "onboard" → `onboard`
@@ -379,7 +379,7 @@ steps:
       - Implement the required changes following project conventions.
 
   - name: create-pr
-    source: skill://as-github-pr-create
+    source: skill://as-git-pr-create
     instructions:
       - Create a pull request for the changes.
       - Capture the PR number for subsequent review steps.

data/lib/ace/assign/atoms/delivery_parameters.rb

@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+require "ace/git/atoms/server_url"
+
+module Ace
+  module Assign
+    module Atoms
+      # Explicit non-secret remote delivery inputs; local recipes need not call this validator.
+      module DeliveryParameters
+        PROVENANCE_FIELDS = %w[mode head_repository_url head_ref base_repository_url base_ref].freeze
+        def self.validate(input)
+          raise ArgumentError, "Delivery parameters must be a mapping" unless input.is_a?(Hash)
+          unless (input.keys - %w[forge_server forge_default pr_provenance]).empty?
+            raise ArgumentError, "Unexpected delivery parameter fields"
+          end
+          default = input.fetch("forge_default", false)
+          raise ArgumentError, "forge_default must be boolean" unless [true, false].include?(default)
+          server = input["forge_server"]
+          if server && (!server.is_a?(String) || !server.match?(/\A[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}\z/))
+            raise ArgumentError, "Invalid forge_server"
+          end
+          raise ArgumentError, "forge_server and forge_default are mutually exclusive" if server && default
+          provenance = input["pr_provenance"]
+          unless provenance.is_a?(Hash) && provenance.keys.sort == PROVENANCE_FIELDS.sort &&
+              %w[fork canonical].include?(provenance["mode"])
+            raise ArgumentError, "Explicit complete fork or canonical PR provenance is required"
+          end
+          %w[head_repository_url base_repository_url].each { |key| validate_url!(provenance[key]) }
+          %w[head_ref base_ref].each do |key|
+            ref = provenance[key]
+            unless ref.is_a?(String) && ref.match?(/\A[a-zA-Z0-9][a-zA-Z0-9_\/.\-]{0,255}\z/) &&
+                !ref.include?("..") && !ref.include?("//") && !ref.end_with?("/", ".", ".lock")
+              raise ArgumentError, "Invalid PR ref"
+            end
+          end
+          if provenance["mode"] == "canonical" && !Ace::Git::Atoms::ServerUrl.match?(
+              provenance["head_repository_url"], provenance["base_repository_url"])
+            raise ArgumentError, "Canonical provenance requires matching head and base repositories"
+          end
+          {"forge_server" => server, "forge_default" => default,
+           "pr_provenance" => provenance.transform_values(&:dup)}
+        end
+
+        def self.validate_url!(url)
+          unless url.is_a?(String) && url.length <= 512 &&
+              (url.match?(%r{\Ahttps?://[a-zA-Z0-9.:-]+/[a-zA-Z0-9_./-]+\z}) ||
+               url.match?(%r{\Agit@[a-zA-Z0-9.-]+:[a-zA-Z0-9_./-]+\z}) ||
+               url.match?(%r{\Assh://git@[a-zA-Z0-9.:-]+/[a-zA-Z0-9_./-]+\z}))
+            raise ArgumentError, "PR repository URL must contain a repository and no credentials or query"
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/candidate_transfer.rb

@@ -0,0 +1,160 @@
+# frozen_string_literal: true
+
+require "digest"
+require "fileutils"
+require "tmpdir"
+require "ace/herdr"
+require_relative "private_directory"
+
+module Ace
+  module Assign
+    module Authority
+      # Untrusted bundles enter a clean bare quarantine. Only complete verified
+      # objects are retained; no uploader configuration or worktree is read.
+      class CandidateTransfer
+        MAX_BYTES = 64 * 1024 * 1024
+        DEADLINE = 30
+        SHA = /\A[0-9a-f]{40}\z/
+
+        def initialize(root:)
+          @root = File.expand_path(root)
+          verify_root!
+        end
+
+        def admit(bytes:, sha256:, size:, head:, &consumer)
+          unless bytes.is_a?(String) && size.is_a?(Integer) && size.positive? && size <= MAX_BYTES &&
+              size == bytes.bytesize && sha256.is_a?(String) &&
+              Digest::SHA256.hexdigest(bytes.b) == sha256 && head.is_a?(String) && head.match?(SHA)
+            reject!("Candidate bundle binding or size is invalid")
+          end
+          verify_root!
+          deadline = monotonic + DEADLINE
+          Dir.mktmpdir("quarantine-", @root) do |directory|
+            File.chmod(0700, directory)
+            bundle = File.join(directory, "candidate.bundle")
+            File.open(bundle, File::WRONLY | File::CREAT | File::EXCL | File::NOFOLLOW, 0600) { |f| f.write(bytes.b) }
+            repository = File.join(directory, "repository")
+            git(directory, deadline, "init", "--bare", "--template=", repository)
+            # Verification against an empty repository rejects incremental
+            # bundles requiring any caller-supplied prerequisites.
+            git(repository, deadline, "bundle", "verify", bundle)
+            advertised = git(repository, deadline, "bundle", "list-heads", bundle).lines.map { |line| line.split.first }
+            reject!("Candidate head is not advertised") unless advertised.include?(head)
+            git(repository, deadline, "fetch", "--no-tags", bundle, "#{head}:refs/heads/candidate")
+            actual = git(repository, deadline, "rev-parse", "refs/heads/candidate^{commit}").strip
+            reject!("Candidate commit differs from declared head") unless actual == head
+            git(repository, deadline, "fsck", "--full", "--strict", "--no-reflogs")
+            tree = git(repository, deadline, "rev-parse", "#{head}^{tree}").strip
+            exported = File.join(directory, "verified.bundle")
+            git(repository, deadline, "bundle", "create", exported, "refs/heads/candidate")
+            verified = read_bundle(exported)
+            # The journal owns candidate identity/generation. This object is
+            # only immutable transport bytes, not another authority ledger.
+            result = {"head" => head, "tree" => tree, "bundle" => verified,
+                      "sha256" => Digest::SHA256.hexdigest(verified), "bytes" => verified.bytesize}
+            consumer ? consumer.call(repository, deadline, result) : result
+          end
+        rescue Timeout::Error
+          reject!("Candidate transfer deadline exceeded")
+        rescue SystemCallError
+          reject!("Candidate transfer filesystem is unavailable")
+        end
+
+        # root is selected from installed peer credentials by the receiver,
+        # never a request field. Materialization reads objects rather than Git
+        # checkout, so .gitattributes, filters and uploader hooks cannot run.
+        def materialize(bytes:, sha256:, size:, head:, tree:, root:)
+          self.class.new(root: root)
+          admit(bytes: bytes, sha256: sha256, size: size, head: head) do |repository, deadline, result|
+            reject!("Candidate tree differs from accepted tree") unless result["tree"] == tree
+            destination = Dir.mktmpdir("candidate-", root)
+            File.chmod(0700, destination)
+            begin
+              entries = git(repository, deadline, "ls-tree", "-r", "-z", head, limit: MAX_BYTES).split("\0")
+              total = 0
+              links = []
+              entries.each do |entry|
+                metadata, path = entry.split("\t", 2)
+                mode, kind, oid = metadata.to_s.split(" ")
+                parts = path.to_s.split("/", -1)
+                unless path && !path.start_with?("/") &&
+                    parts.none? { |part| part.empty? || %w[. .. .git].include?(part.downcase) } &&
+                    kind == "blob" && %w[100644 100755 120000].include?(mode) && oid.match?(SHA)
+                  reject!("Candidate contains unsafe filesystem entry")
+                end
+                content = git(repository, deadline, "cat-file", "blob", oid, limit: MAX_BYTES).b
+                total += content.bytesize
+                reject!("Candidate expanded content is oversized") if total > MAX_BYTES
+                target = File.join(destination, path)
+                FileUtils.mkdir_p(File.dirname(target), mode: 0700)
+                if mode == "120000"
+                  resolved = File.expand_path(content, File.dirname(target))
+                  unless !content.include?("\0") && !content.start_with?("/") &&
+                      resolved.start_with?(destination + "/")
+                    reject!("Candidate symlink escapes private checkout")
+                  end
+                  links << [target, content]
+                else
+                  File.open(target, File::WRONLY | File::CREAT | File::EXCL | File::NOFOLLOW,
+                    mode == "100755" ? 0700 : 0600) { |file| file.write(content) }
+                end
+              end
+              links.each { |target, content| File.symlink(content, target) }
+              links.each do |target, _content|
+                resolved = File.realpath(target)
+                reject!("Candidate symlink escapes private checkout") unless resolved.start_with?(destination + "/")
+              end
+              result.reject { |key, _value| key == "bundle" }.merge("directory" => destination)
+            rescue Exception
+              # Only this freshly created private disposable directory is
+              # removed. An existing peer scratch tree is never cleaned.
+              FileUtils.rm_rf(destination)
+              raise
+            end
+          end
+        rescue SystemCallError, ArgumentError
+          reject!("Candidate filesystem materialization is unverifiable")
+        end
+
+        private
+
+        def verify_root!
+          PrivateDirectory.verify!(@root)
+        end
+
+        def git(repository, deadline, *arguments, limit: 65_536)
+          remaining = deadline - monotonic
+          raise Timeout::Error if remaining <= 0
+          # Git variables may redirect object/config storage even in a clean
+          # repository. Strip every inherited Git setting and global config.
+          environment = ENV.keys.to_h { |key| [key, nil] }
+          environment.merge!("GIT_CONFIG_NOSYSTEM" => "1", "GIT_CONFIG_GLOBAL" => "/dev/null",
+            "GIT_TERMINAL_PROMPT" => "0", "GIT_ALLOW_PROTOCOL" => "file",
+            "GIT_NO_REPLACE_OBJECTS" => "1", "PATH" => "/usr/bin:/bin", "LC_ALL" => "C")
+          result = Herdr::Molecules::BoundedProcess.call([environment, "/usr/bin/git", "-C", repository,
+            "-c", "core.hooksPath=/dev/null", "-c", "protocol.file.allow=always", *arguments],
+            stdin_data: "", timeout_s: remaining, output_limit: limit)
+          reject!("Candidate Git verification failed") unless result.status.success? && !result.oversized
+          result.stdout
+        end
+
+        def read_bundle(path)
+          File.open(path, File::RDONLY | File::NOFOLLOW) do |file|
+            reject!("Verified bundle is oversized") unless file.stat.file? && file.stat.size <= MAX_BYTES
+            bytes = file.read(MAX_BYTES + 1).b
+            reject!("Verified bundle is oversized") if bytes.bytesize > MAX_BYTES
+            bytes
+          end
+        end
+
+        def monotonic
+          Process.clock_gettime(Process::CLOCK_MONOTONIC)
+        end
+
+        def reject!(message)
+          raise AttemptErrors::ReceiptRejected, message
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/client.rb

@@ -0,0 +1,107 @@
+# frozen_string_literal: true
+require "securerandom"
+require_relative "deployment"
+require_relative "transfer_codec"
+require_relative "../molecules/canonical_evidence"
+
+module Ace
+  module Assign
+    module Authority
+      class Client
+        Reply = Struct.new(:data, :replayed, :parts, keyword_init: true)
+        attr_reader :mapping_id
+        def initialize(mapping_id:, deployment: Deployment.load, kernel: Ace::Runtime::Molecules::ProtectedLinux.new)
+          @mapping_id, @deployment, @kernel = mapping_id, deployment, kernel
+          @map = deployment.mapping(mapping_id)
+          @service = deployment.authority(@map.fetch("authority_id"))
+        end
+
+        def call(operation, params, mutation_id: nil, timeout: nil, upload_parts: nil, download: false, purpose: nil)
+          if operation == "evidence_fetch" && (!download || purpose != :artifacts || upload_parts)
+            raise ArgumentError, "evidence fetch requires fixed artifacts download"
+          end
+          if operation == "submit_result" && (!upload_parts || purpose != :receipt_artifacts || download)
+            raise ArgumentError, "result submission requires fixed receipt upload"
+          end
+          @deployment.verify!(mapping_id, kernel: @kernel)
+          wire = Ace::Runtime::Molecules::ProtectedSocket
+          path = @service.fetch("socket_path")
+          before = wire.socket_identity(path)
+          raise Ace::Runtime::RuntimeUnavailableError, "authority endpoint owner differs" unless before.last == @service.fetch("uid")
+          raise ArgumentError, "cannot upload and download on one request" if upload_parts && download
+          codec = transfer_codec if upload_parts || download
+          descriptor = codec.descriptor(upload_parts, purpose: purpose) if upload_parts
+          parameters = upload_parts ? params.merge("transfer" => descriptor) : params
+          cap = %w[reserve_attempt close_execution_scope].include?(operation) ? 90 : 30
+          duration = timeout || (cap == 90 ? 90 : 5)
+          unless duration.is_a?(Numeric) && duration.positive? && duration.finite?
+            raise ArgumentError, "authority timeout must be finite and positive"
+          end
+          deadline = wire.deadline([duration, cap].min)
+          wire.connect(path, deadline: deadline) do |socket|
+            peer = @kernel.peer(socket)
+            unless peer["uid"] == @service.fetch("uid") && peer["gid"] == @service.fetch("gid") &&
+                peer["groups"] == @service.fetch("groups") && wire.socket_identity(path) == before
+              raise AttemptErrors::UnauthorizedIdentity, "authority endpoint peer changed"
+            end
+            wire.write(socket, {"version" => 1, "operation" => operation,
+              "mutation_id" => mutation_id, "project_id" => @map.fetch("project_id"),
+              "params" => parameters.merge("mapping_id" => mapping_id)}, deadline: deadline, limit: upload_parts || download ? 16_384 : wire::LIMIT)
+            if %w[evidence_fetch observe_execution_scope close_execution_scope].include?(operation) || (operation == "attempt_status" && params.key?("result_candidate_generation"))
+              socket.shutdown(Socket::SHUT_WR)
+            end
+            if upload_parts
+              codec.send(socket, parts: upload_parts, descriptor: descriptor, purpose: purpose, deadline: deadline)
+              socket.shutdown(Socket::SHUT_WR)
+            end
+            result = wire.read(socket, deadline: deadline, limit: 16_384)
+            unless result.is_a?(Hash) && result["status"] == "ok" && result["data"].is_a?(Hash)
+              code = result.is_a?(Hash) ? result.dig("error", "code") : nil
+              raise AttemptErrors::EvidenceUnavailable, "protected authority refused (#{code || 'invalid_response'})"
+            end
+            transport = result.fetch("transport")
+            unless transport.is_a?(Hash) && transport.keys == ["replayed"] && [true, false].include?(transport["replayed"])
+              raise AttemptErrors::EvidenceUnavailable, "authority replay metadata is unavailable"
+            end
+            validate_evidence_download!(result.fetch("data"), params) if operation == "evidence_fetch"
+            parts = if download
+              codec.receive(socket, descriptor: result.fetch("data").fetch("transfer"), purpose: purpose, deadline: deadline) do |input|
+                Array.new(input.count) { |index| input.bytes(index: index) }
+              end
+            end
+            Reply.new(data: result.fetch("data"), replayed: transport.fetch("replayed"), parts: parts)
+          end
+        rescue SystemCallError, IOError
+          raise AttemptErrors::EvidenceUnavailable, "protected authority connection unavailable; no local fallback"
+        end
+        private
+
+        def validate_evidence_download!(data, params)
+          descriptor, transfer = data.values_at("descriptor", "transfer")
+          unless data.keys.sort == %w[descriptor generation journal_commit transfer] &&
+              Molecules::CanonicalEvidence.valid_descriptor?(descriptor) &&
+              descriptor["project_id"] == @map.fetch("project_id") &&
+              {"assignment_id" => "assignment_id", "attempt_id" => "attempt_id", "kind" => "kind",
+                "request_id_or_event_id" => "purpose_id", "artifact_id" => "artifact_id"}.all? { |field, key| descriptor[field] == params[key] } &&
+              data["generation"].is_a?(Integer) && data["generation"] >= 0 &&
+              data["journal_commit"].is_a?(String) && data["journal_commit"].match?(/\A[0-9a-f]{40,64}\z/) &&
+              transfer.is_a?(Hash) && transfer.keys.sort == %w[bytes parts sha256 version] && transfer["version"] == 1 &&
+              transfer["bytes"] == descriptor["bytes"] && transfer["sha256"] == descriptor["sha256"] &&
+              transfer["parts"] == [descriptor.slice("bytes", "sha256")]
+            raise AttemptErrors::EvidenceUnavailable, "canonical download descriptor differs"
+          end
+        end
+
+        def transfer_codec
+          peer = @kernel.capture(Process.pid)
+          project = @deployment.project(@map.fetch("project_id"))
+          installed = project.fetch("peer_credentials").fetch(peer.fetch("uid").to_s)
+          unless peer["gid"] == installed["gid"] && peer["groups"] == installed["groups"]
+            raise AttemptErrors::UnauthorizedIdentity, "transfer scratch principal differs"
+          end
+          TransferCodec.new(root: installed.fetch("scratch_root"))
+        end
+      end
+    end
+  end
+end