ace-assign 0.63.0 → 0.64.0

data/lib/ace/assign/authority/endcap_services.rb

@@ -0,0 +1,395 @@
+# frozen_string_literal: true
+
+module Ace
+  module Assign
+    module Authority
+      class Endcap
+        SERVICE_IDENTITY = %w[request_id assignment_id attempt_id project_id operation input_digest target
+          authorization service_id caller_uid candidate_head candidate_generation executor_uid transport policy_digest
+          worker_process_binding launch_ticket reservation_generation mapping_id].freeze
+
+        # Source-owned terminal admission. Caller already owns lifecycle/journal
+        # exclusion; the immutable commit is the current CAS input, never a
+        # caller-selected alternate evidence ref.
+        def service_settlement_complete!(journal:, events:, params:, map:, commit:)
+          protected_journal!(journal)
+          references = events.select { |event| %w[service_claim service_transition].include?(event["type"]) }
+            .map { |event| event.fetch("payload").fetch("request_id") }.uniq.sort
+          records = journal.service_request_records(commit: commit).select do |record|
+            record["assignment_id"] == params.fetch("assignment_id") && record["attempt_id"] == params.fetch("attempt_id")
+          end
+          unless records.map { |record| record.fetch("request_id") }.uniq.sort == references
+            raise AttemptErrors::EvidenceUnavailable, "canonical service request set is incomplete"
+          end
+          records.each do |record|
+            unless record["project_id"] == map.fetch("project_id") && record["mapping_id"] == params.fetch("mapping_id") &&
+                %w[succeeded failed-settled].include?(record["state"])
+              raise AttemptErrors::EvidenceUnavailable, "canonical service request is not settled for this scope"
+            end
+            # This existing reader verifies the accepted record digest and all
+            # imported terminal/no-effect evidence against this exact commit.
+            journal.service_request(record.fetch("request_id"), commit: commit)
+          end
+          true
+        rescue KeyError, TypeError, ArgumentError, AttemptErrors::ReceiptRejected
+          raise AttemptErrors::EvidenceUnavailable, "canonical service settlement is unverifiable"
+        end
+
+        # Called only by the installed journal composition, including lower
+        # service writers. It never reacquires lifecycle/authority locks.
+        def authorize_service_update!(journal:, existing:, replacement:, pending:)
+          protected_journal!(journal)
+          initial = existing.nil? && %w[accepted uncertain].include?(replacement["state"])
+          begin_dispatch = existing && existing["dispatch_phase"] == "issued" && replacement["dispatch_phase"] == "dispatch_started"
+          if existing && existing["dispatch_phase"] != replacement["dispatch_phase"] && !begin_dispatch
+            raise AttemptErrors::InvalidState, "invalid protected dispatch phase change"
+          end
+          return true unless initial || begin_dispatch
+          unless replacement["state"] == "uncertain" && (initial ? replacement["dispatch_phase"] == "issued" : true)
+            raise AttemptErrors::InvalidState, "fresh protected effect requires an uncertain dispatch ticket"
+          end
+          bytes = pending && pending.fetch(:service_inputs, {})[replacement.fetch("request_id")]
+          raise AttemptErrors::UnauthorizedIdentity, "fresh service effect requires its exact original input" unless bytes.is_a?(String)
+          map = @deployment.mapping(replacement.fetch("mapping_id"))
+          unless replacement["project_id"] == map["project_id"] && replacement["caller_uid"] == map["worker_uid"]
+            raise AttemptErrors::UnauthorizedIdentity, "protected service mapping differs"
+          end
+          params = replacement.slice("mapping_id", "assignment_id", "attempt_id", "candidate_generation").merge("head" => replacement.fetch("candidate_head"))
+          events = pending.fetch(:current_events)
+          @launch.scope_open_for_effect!(events: events, params: params, map: map)
+          origin = active_origin(events, params)
+          unless replacement["worker_process_binding"] == origin.fetch("process_binding").fetch("process_identity") &&
+              replacement["launch_ticket"] == origin.fetch("launch_ticket") && replacement["reservation_generation"] == origin.fetch("reservation_generation")
+            raise AttemptErrors::UnauthorizedIdentity, "protected service origin differs"
+          end
+          receiver = @deployment.project(map.fetch("project_id")).fetch("service_receivers").fetch(replacement.fetch("service_id"))
+          raise AttemptErrors::UnauthorizedIdentity, "protected service executor differs" unless receiver.fetch("executor_uid") == replacement.fetch("executor_uid")
+          current = exact_candidate!(candidate(events), params)
+          approved_review!(journal, events, params, map, current)
+          service_policy!.prepare!(replacement, input_bytes: bytes)
+          true
+        rescue KeyError
+          raise AttemptErrors::UnauthorizedIdentity, "protected service admission context is incomplete"
+        end
+
+        private
+
+        def authorize_service_transfer!(request, params, map, peer, role)
+          service_policy!
+          service_policy!.visible!(project: map.fetch("project_id"), uid: map.fetch("worker_uid")) unless request.fetch("operation") == "complete_service"
+          @launch.with_assignment(params: params, map: map) do |journal, _registration|
+            protected_journal!(journal)
+            if request.fetch("operation") == "request_service"
+              existing = journal.service_request(params.fetch("request_id"))
+              if existing
+                service_executor!(peer, role, existing)
+                service_replay_binding!(existing, params, map)
+              else
+                events = attempt_events(journal, params)
+                origin = active_origin(events, params)
+                worker_or_launcher!(params.fetch("worker_process_binding"), :worker, map, origin)
+                service_receiver!(peer, role, map, params.fetch("service_id"))
+              end
+            else
+              record = journal.service_request(params.fetch("request_id"))
+              raise AttemptErrors::NotFound, "service request is unavailable" unless record
+              service_executor!(peer, role, record)
+              service_ticket!(record, params, map, peer)
+            end
+          end
+          true
+        end
+
+        def service_status(_request, params, map, peer, role)
+          @launch.with_assignment(params: params, map: map) do |journal, _registration|
+            protected_journal!(journal)
+            record = journal.service_request(params.fetch("request_id"))
+            unless record && record["assignment_id"] == params["assignment_id"] && record["attempt_id"] == params["attempt_id"] &&
+                record["project_id"] == map["project_id"] && record["candidate_head"] == params["head"] &&
+                record["candidate_generation"] == params["candidate_generation"]
+              raise AttemptErrors::UnauthorizedIdentity, "service status binding differs"
+            end
+            events = attempt_events(journal, params)
+            @kernel.live!(peer)
+            service_policy!.visible!(project: map.fetch("project_id"), uid: peer.fetch("uid"))
+            if role == :executor
+              service_executor!(peer, role, record)
+            else
+              authorized = case role
+              when :worker
+                peer["uid"] == record["caller_uid"] && @kernel.descendant?(peer, record.fetch("worker_process_binding"))
+              when :reviewer
+                review = assigned_review(events)
+                review && review["reviewer_uid"] == peer["uid"] && review["head"] == params["head"] &&
+                  review["candidate_generation"] == params["candidate_generation"] && @kernel.descendant?(peer, review.fetch("reviewer_process_binding"))
+              when :supervisor
+                @deployment.project(map.fetch("project_id")).fetch("supervisor_uids").include?(peer["uid"])
+              else
+                false
+              end
+              raise AttemptErrors::UnauthorizedIdentity, "service status purpose differs" unless authorized
+            end
+            {data: service_projection(record).merge("generation" => journal.authority_generation(events),
+              "journal_commit" => journal.ref_value), replayed: false}
+          end
+        end
+
+        def service_authorization(request, params, map, peer, role, transfer)
+          authorize_service_transfer!(request, params, map, peer, role)
+          raise ArgumentError, "structured service input transfer is missing" unless transfer && transfer.count == 1
+          bytes = transfer.bytes.dup.freeze
+          @launch.with_assignment(params: params, map: map) do |journal, _registration|
+            protected_journal!(journal)
+            record = journal.service_request(params.fetch("request_id"))
+            service_executor!(peer, role, record)
+            service_ticket!(record, params, map, peer)
+            unless record.fetch("input_digest") == params.fetch("input_digest")
+              raise AttemptErrors::Conflict, "authorization input binding differs"
+            end
+            events = attempt_events(journal, params)
+            @launch.scope_open_for_effect!(events: events, params: params, map: map)
+            origin = active_origin(events, params)
+            unless record["worker_process_binding"] == origin.fetch("process_binding").fetch("process_identity") &&
+                record["launch_ticket"] == origin.fetch("launch_ticket") && record["reservation_generation"] == origin.fetch("reservation_generation")
+              raise AttemptErrors::UnauthorizedIdentity, "authorization launch origin differs"
+            end
+            current = exact_candidate!(candidate(events), params)
+            unless record["candidate_head"] == current["head"] && record["candidate_generation"] == current["candidate_generation"]
+              raise AttemptErrors::Conflict, "authorization candidate changed"
+            end
+            service_receiver!(peer, role, map, record.fetch("service_id"))
+            approved_review!(journal, events, params, map, current)
+            prepared = service_policy!.prepare!(record, input_bytes: bytes)
+            data = params.slice("request_id", "claim_binding", "head", "candidate_generation").merge(
+              "policy_digest" => prepared.fetch(:policy_digest), "operation_digest" => prepared.fetch(:operation_digest))
+            {data: data, replayed: false}
+          end
+        end
+
+        def dispatch_service(request, params, map, peer, role, transfer)
+          return service_authorization(request, params, map, peer, role, transfer) if request.fetch("operation") == "service_authorization"
+          authorize_service_transfer!(request, params, map, peer, role)
+          admitted = if request.fetch("operation") == "complete_service"
+            ReceiptTransfer.decode(input: transfer, receipt_sha256: params.fetch("receipt_sha256"), artifact_field: "evidence", reference_key: "ref")
+          else
+            raise ArgumentError, "structured service input transfer is missing" unless transfer && transfer.count == 1
+            transfer.bytes.dup.freeze
+          end
+          @launch.with_assignment(params: params, map: map) do |journal, _registration|
+            protected_journal!(journal)
+            unless request.fetch("operation") == "complete_service"
+              input_record = request.fetch("operation") == "request_service" ? params : journal.service_request(params.fetch("request_id"))
+              # Replay bypasses the mutation callback, never input validation.
+              # Only body binding is checked here; current effect policy stays
+              # inside each fresh CAS callback.
+              service_policy!.input_binding(admitted, expected_digest: input_record.fetch("input_digest"),
+                expected_target: input_record.fetch("target"))
+            end
+            # Admission also runs outside mutate: an exact mutation replay
+            # skips its callback and cannot bypass the authenticated ticket.
+            service_policy!.visible!(project: map.fetch("project_id"), uid: map.fetch("worker_uid")) unless request.fetch("operation") == "complete_service"
+            retained = request.fetch("operation") == "request_service" && journal.service_request(params.fetch("request_id"))
+            if retained
+              service_executor!(peer, role, retained)
+              service_replay_binding!(retained, params, map)
+            end
+            if !retained && request.fetch("operation") != "request_service"
+              record = journal.service_request(params.fetch("request_id"))
+              service_executor!(peer, role, record)
+              service_ticket!(record, params, map, peer)
+              completion_binding!(record, params, admitted) if request.fetch("operation") == "complete_service"
+            elsif !retained
+              origin = active_origin(attempt_events(journal, params), params)
+              worker_or_launcher!(params.fetch("worker_process_binding"), :worker, map, origin)
+              service_receiver!(peer, role, map, params.fetch("service_id"))
+            end
+            result = journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
+              mutation_id: request.fetch("mutation_id"), operation: request.fetch("operation"),
+              parameters_digest: Atoms::EvidenceDigest.digest(params),
+              expected_generation: request.fetch("operation") == "complete_service" ? nil : params.fetch("expected_generation"),
+              generation_mode: request.fetch("operation") == "complete_service" ? :recorded_completion : :expected, with_replay: true) do |events, _commit, _generation|
+              if request.fetch("operation") == "request_service"
+                existing = journal.service_request(params.fetch("request_id"))
+                if existing
+                  service_executor!(peer, role, existing)
+                  service_replay_binding!(existing, params, map)
+                  {data: service_projection(existing).merge("claim" => "retained")}
+                else
+                  service_claim_plan(journal, events, params, map, peer, role, admitted)
+                end
+              elsif request.fetch("operation") == "begin_dispatch"
+                service_begin_plan(journal, events, params, map, peer, role, admitted)
+              else
+                service_completion_plan(journal, events, params, map, peer, role, admitted)
+              end
+            end
+            if request.fetch("operation") == "begin_dispatch" && result.fetch(:replayed)
+              result = result.merge(data: result.fetch(:data).merge("invocation" => "already_started"))
+            end
+            if request.fetch("operation") == "request_service"
+              # Acceptance metadata belongs to this exact mutation, while
+              # retained service state may have advanced since acceptance.
+              current = journal.service_request(params.fetch("request_id"))
+              data = service_projection(current).merge(result.fetch(:data).slice("generation", "journal_commit"))
+              data["claim"] = retained || result.fetch(:replayed) || result.dig(:data, "claim") == "retained" ? "retained" : "created"
+              result = result.merge(data: data)
+            end
+            result
+          end
+        end
+
+        def service_policy!
+          @service_policy || raise(ArgumentError, "full-service authority requires its installed policy owner")
+        end
+
+        def service_executor!(peer, role, record)
+          unless record && role == :executor && peer["uid"] == record.fetch("executor_uid")
+            raise AttemptErrors::UnauthorizedIdentity, "completion requires the recorded executor"
+          end
+          @kernel.live!(peer)
+          true
+        end
+
+        def service_receiver!(peer, role, map, service_id)
+          project = @deployment.project(map.fetch("project_id"))
+          receiver = project.fetch("service_receivers").fetch(service_id)
+          unless role == :executor && peer["uid"] == receiver.fetch("executor_uid") &&
+              project.fetch("service_executor_uids").include?(peer["uid"]) &&
+              !project.fetch("worker_uids").include?(peer["uid"])
+            raise AttemptErrors::UnauthorizedIdentity, "service requires its fixed independent receiver"
+          end
+          @kernel.live!(peer)
+          receiver
+        rescue KeyError
+          raise AttemptErrors::UnauthorizedIdentity, "fixed service receiver is unavailable"
+        end
+
+        def service_claim_plan(journal, events, params, map, peer, role, input_bytes)
+          origin = active_origin(events, params)
+          worker = params.fetch("worker_process_binding")
+          worker_or_launcher!(worker, :worker, map, origin)
+          current = exact_candidate!(candidate(events), params)
+          approved_review!(journal, events, params, map, current)
+          receiver = service_receiver!(peer, role, map, params.fetch("service_id"))
+          binding = params.slice("request_id", "assignment_id", "attempt_id", "operation", "input_digest", "target",
+            "authorization", "service_id").merge("project_id" => map.fetch("project_id"),
+              "caller_uid" => map.fetch("worker_uid"), "mapping_id" => params.fetch("mapping_id"), "candidate_head" => current.fetch("head"),
+              "candidate_generation" => current.fetch("candidate_generation"),
+              "worker_process_binding" => origin.fetch("process_binding").fetch("process_identity"),
+              "launch_ticket" => origin.fetch("launch_ticket"), "reservation_generation" => origin.fetch("reservation_generation"))
+          prepared = service_policy!.prepare!(binding, input_bytes: input_bytes)
+          binding = prepared.fetch(:binding).merge("policy_digest" => prepared.fetch(:policy_digest))
+          unless binding["executor_uid"] == receiver.fetch("executor_uid")
+            raise AttemptErrors::UnauthorizedIdentity, "policy and fixed receiver disagree"
+          end
+          existing = journal.service_request(binding.fetch("request_id"))
+          if existing
+            unless existing.slice(*SERVICE_IDENTITY) == binding.slice(*SERVICE_IDENTITY)
+              raise AttemptErrors::Conflict, "service request immutable identity differs"
+            end
+            return {data: service_projection(existing).merge("claim" => "retained")}
+          end
+          ticket = SecureRandom.hex(16)
+          record = binding.merge("dispatch_ticket_id" => ticket,
+            "claim_binding" => Atoms::EvidenceDigest.digest(binding.merge("dispatch_ticket_id" => ticket)),
+            "claim_generation" => 1, "dispatch_phase" => "issued", "state" => "uncertain",
+            "claimed_at" => Time.now.utc.iso8601(9))
+          {data: service_projection(record).merge("claim" => "created"), service_inputs: {record.fetch("request_id") => input_bytes}, service_updates: [{request_id: record.fetch("request_id"),
+            expected: nil, replacement: record, event_type: "service_claim"}]}
+        end
+
+        def service_begin_plan(journal, events, params, map, peer, role, input_bytes)
+          record = journal.service_request(params.fetch("request_id"))
+          raise AttemptErrors::NotFound, "service request is unavailable" unless record
+          service_receiver!(peer, role, map, record.fetch("service_id"))
+          service_ticket!(record, params, map, peer)
+          # A repeated begin never grants a second invocation, including after
+          # lease expiry or terminality. It reports only retained ticket truth.
+          return {data: service_projection(record).merge("invocation" => "already_started")} unless record["dispatch_phase"] == "issued"
+          origin = active_origin(events, params)
+          unless record["worker_process_binding"] == origin.fetch("process_binding").fetch("process_identity") &&
+              record["launch_ticket"] == origin.fetch("launch_ticket") && record["reservation_generation"] == origin.fetch("reservation_generation")
+            raise AttemptErrors::UnauthorizedIdentity, "dispatch launch origin differs"
+          end
+          current = exact_candidate!(candidate(events), params)
+          unless record["candidate_head"] == current["head"] && record["candidate_generation"] == current["candidate_generation"]
+            raise AttemptErrors::Conflict, "dispatch candidate changed"
+          end
+          approved_review!(journal, events, params, map, current)
+          service_policy!.prepare!(record, input_bytes: input_bytes)
+          replacement = record.merge("dispatch_phase" => "dispatch_started")
+          {data: service_projection(replacement).merge("invocation" => "permitted"),
+            service_inputs: {record.fetch("request_id") => input_bytes},
+            service_updates: [{request_id: record.fetch("request_id"), expected: record,
+              replacement: replacement, event_type: "service_transition"}]}
+        end
+
+        def service_ticket!(record, params, map, peer)
+          unless record["assignment_id"] == params["assignment_id"] && record["attempt_id"] == params["attempt_id"] &&
+              record["project_id"] == map["project_id"] && record["executor_uid"] == peer["uid"] &&
+              record["claim_binding"] == params["claim_binding"]
+            raise AttemptErrors::UnauthorizedIdentity, "dispatch ticket binding differs"
+          end
+          true
+        end
+
+        def service_replay_binding!(record, params, map)
+          fields = %w[request_id assignment_id attempt_id operation input_digest target authorization service_id mapping_id]
+          unless fields.all? { |field| record[field] == params[field] } && record["project_id"] == map["project_id"] &&
+              record["caller_uid"] == map["worker_uid"] && params.dig("worker_process_binding", "uid") == map["worker_uid"]
+            raise AttemptErrors::Conflict, "service replay immutable identity differs"
+          end
+          @kernel.live!(params.fetch("worker_process_binding"))
+          unless @kernel.descendant?(params.fetch("worker_process_binding"), record.fetch("worker_process_binding"))
+            raise AttemptErrors::UnauthorizedIdentity, "service replay requires recorded native worker ownership"
+          end
+          true
+        end
+
+        def service_completion_plan(journal, events, params, map, peer, role, admitted)
+          record = journal.service_request(params.fetch("request_id"))
+          service_executor!(peer, role, record)
+          service_ticket!(record, params, map, peer)
+          digest = completion_binding!(record, params, admitted)
+          if record["completion_digest"]
+            return {data: service_projection(record)}
+          end
+          receipt = admitted.fetch(:receipt)
+          owner = ServiceEvidence.new(journal: journal)
+          canonical = Molecules::CanonicalEvidence.new(journal: journal)
+          plan = canonical.import_plan(**owner.context(record), artifacts: admitted.fetch(:artifacts),
+            admitted_after_event_digest: events.last.fetch("digest"))
+          normalized = JSON.parse(JSON.generate(receipt)).merge("evidence" => plan.fetch(:references))
+          replacement = record.merge("state" => receipt.fetch("outcome"), "receipt" => normalized, "completion_digest" => digest)
+          replacement["failed_at"] = Time.now.utc.iso8601(9) if receipt["outcome"] == "failed"
+          plan.merge(data: service_projection(replacement), service_updates: [{request_id: record.fetch("request_id"),
+            expected: record, replacement: replacement, event_type: "service_transition"}])
+        end
+
+        def completion_binding!(record, params, admitted)
+          unless record["candidate_head"] == params["head"] && record["candidate_generation"] == params["candidate_generation"]
+            raise AttemptErrors::Conflict, "completion candidate binding differs"
+          end
+          digest = Atoms::EvidenceDigest.digest("receipt_sha256" => admitted.fetch(:receipt_sha256),
+            "artifacts" => admitted.fetch(:artifacts).map { |bytes| Digest::SHA256.hexdigest(bytes) })
+          if record["completion_digest"] && record["completion_digest"] != digest
+            raise AttemptErrors::Conflict, "service completion content differs"
+          end
+          receipt = admitted.fetch(:receipt)
+          unless receipt.keys.sort == Molecules::EvidenceJournal::TERMINAL_RECEIPT_FIELDS.sort &&
+              Molecules::EvidenceJournal::TERMINAL_BINDING_FIELDS.all? { |field| receipt[field] == record[field] } &&
+              %w[succeeded failed].include?(receipt["outcome"]) &&
+              (receipt["outcome"] != "succeeded" || record["dispatch_phase"] == "dispatch_started")
+            raise AttemptErrors::ReceiptRejected, "completion must attest the exact dispatched request"
+          end
+          digest
+        end
+
+        def service_projection(record)
+          record.slice("request_id", "assignment_id", "attempt_id", "project_id", "operation", "service_id", "target",
+            "candidate_head", "candidate_generation", "state", "dispatch_ticket_id", "claim_binding", "claim_generation", "dispatch_phase", "policy_digest")
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/evidence_transfer.rb

@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+
+require "digest"
+require_relative "private_directory"
+require_relative "../molecules/canonical_evidence"
+
+module Ace
+  module Assign
+    module Authority
+      # Receiver-side collection from its own fixed private handler staging.
+      # These bytes are transport input, not accepted evidence. The authority
+      # must import them through CanonicalEvidence in its terminal mutation.
+      module EvidenceTransfer
+        module_function
+
+        def read_staged(root:, evidence:)
+          root = PrivateDirectory.verify!(root)
+          limits = Molecules::CanonicalEvidence
+          unless evidence.is_a?(Array) && evidence.length.between?(1, limits::MAX_ARTIFACTS)
+            reject!("Invalid staged evidence count")
+          end
+          total = 0
+          evidence.map do |reference|
+            unless reference.is_a?(Hash) && reference.keys.sort == %w[ref sha256] &&
+                reference["ref"].is_a?(String) && reference["ref"].match?(%r{\A[a-zA-Z0-9_.-]+(?:/[a-zA-Z0-9_.-]+)*\z}) &&
+                reference["ref"].bytesize <= 256 &&
+                reference["ref"].split("/").none? { |part| %w[. ..].include?(part) } &&
+                reference["sha256"].is_a?(String) && reference["sha256"].match?(/\A[0-9a-f]{64}\z/)
+              reject!("Invalid staged evidence binding")
+            end
+            path = root
+            parts = reference.fetch("ref").split("/")
+            parts[0...-1].each do |part|
+              path = File.join(path, part)
+              stat = File.lstat(path)
+              unless stat.directory? && !stat.symlink? && stat.uid == Process.uid && (stat.mode & 0022).zero?
+                reject!("Staged evidence ancestry is not private")
+              end
+            end
+            path = File.join(path, parts.last)
+            File.open(path, File::RDONLY | File::NOFOLLOW | File::NONBLOCK) do |file|
+              stat = file.stat
+              unless stat.file? && stat.uid == Process.uid && stat.nlink == 1 &&
+                  (stat.mode & 0022).zero? && stat.size <= limits::MAX_ARTIFACT_BYTES
+                reject!("Staged evidence is not a bounded private regular file")
+              end
+              bytes = (file.read(limits::MAX_ARTIFACT_BYTES + 1) || "").b
+              total += bytes.bytesize
+              unless bytes.bytesize <= limits::MAX_ARTIFACT_BYTES && total <= limits::MAX_TOTAL_BYTES &&
+                  Digest::SHA256.hexdigest(bytes) == reference["sha256"]
+                reject!("Staged evidence bytes differ or exceed limits")
+              end
+              bytes
+            end
+          end
+        rescue SystemCallError
+          reject!("Staged evidence is unavailable or substituted")
+        end
+
+        def reject!(message)
+          raise AttemptErrors::ReceiptRejected, message
+        end
+        private_class_method :reject!
+      end
+    end
+  end
+end