ace-assign 0.63.1 → 0.66.0

data/lib/ace/assign/authority/endcap_services.rb

@@ -0,0 +1,598 @@
+# frozen_string_literal: true
+
+module Ace
+  module Assign
+    module Authority
+      class Endcap
+        SERVICE_IDENTITY = %w[request_id assignment_id attempt_id project_id operation input_digest target
+          authorization service_id caller_uid candidate_head candidate_generation executor_uid transport policy_digest
+          worker_process_binding launch_ticket reservation_generation mapping_id].freeze
+
+        # Source-owned terminal admission. Caller already owns lifecycle/journal
+        # exclusion; the immutable commit is the current CAS input, never a
+        # caller-selected alternate evidence ref.
+        def service_settlement_complete!(journal:, events:, params:, map:, commit:)
+          service_settlement_evidence!(journal: journal, events: events, params: params, map: map, commit: commit)
+          true
+        end
+
+        def service_settlement_evidence!(journal:, events:, params:, map:, commit:)
+          protected_journal!(journal)
+          journal.verify_commit!(commit)
+          retained = journal.read_events(params.fetch("assignment_id"), commit: commit)
+            .select { |event| event["attempt_id"] == params.fetch("attempt_id") }
+          unless retained == events && Models::EvidenceEvent.chain_valid?(events)
+            raise AttemptErrors::EvidenceUnavailable, "service settlement requires exact canonical commit"
+          end
+          references = events.select { |event| %w[service_claim service_transition].include?(event["type"]) }
+            .map { |event| event.fetch("payload").fetch("request_id") }.uniq.sort
+          records = journal.service_request_records(commit: commit).select do |record|
+            record["assignment_id"] == params.fetch("assignment_id") && record["attempt_id"] == params.fetch("attempt_id")
+          end
+          unless records.map { |record| record.fetch("request_id") }.uniq.sort == references
+            raise AttemptErrors::EvidenceUnavailable, "canonical service request set is incomplete"
+          end
+          pending = false
+          projected = records.sort_by { |record| record.fetch("request_id") }.map do |record|
+            unless record["project_id"] == map.fetch("project_id") && record["mapping_id"] == params.fetch("mapping_id")
+              raise AttemptErrors::EvidenceUnavailable, "canonical service request is not settled for this scope"
+            end
+            # This existing reader verifies the accepted record digest and all
+            # imported terminal/no-effect evidence against this exact commit.
+            verified = journal.service_request(record.fetch("request_id"), commit: commit)
+            unless verified == record && %w[accepted uncertain rejected succeeded failed failed-settled].include?(verified.fetch("state"))
+              raise AttemptErrors::EvidenceUnavailable, "canonical service record differs"
+            end
+            if %w[no_effect_challenge challenge_generation challenge_event_digest].any? { |key| verified.key?(key) }
+              ServiceEvidence.new(journal: journal).challenge!(verified, pending: {commit: commit}, current: false)
+            end
+            unless %w[succeeded failed-settled].include?(verified.fetch("state"))
+              pending = true
+              next
+            end
+            transition = events.reverse.find { |event| %w[service_claim service_transition].include?(event["type"]) &&
+              event.dig("payload", "request_id") == record.fetch("request_id") }
+            receipt = verified.fetch("receipt")
+            unless transition && transition["type"] == "service_transition" &&
+                transition.dig("payload", "state") == verified.fetch("state") &&
+                transition.dig("payload", "record_digest") == Atoms::EvidenceDigest.digest(verified) &&
+                transition.dig("payload", "receipt_digest") == Atoms::EvidenceDigest.digest(receipt)
+              raise AttemptErrors::EvidenceUnavailable, "accepted service terminal transition differs"
+            end
+            {"request_id" => verified.fetch("request_id"), "state" => verified.fetch("state"),
+              "event_digest" => transition.fetch("digest"), "record_digest" => transition.dig("payload", "record_digest"),
+              "receipt_digest" => transition.dig("payload", "receipt_digest"),
+              "evidence_refs" => receipt.fetch("evidence").sort_by { |ref| ref.values_at("ref", "sha256") }}
+          end
+          projected.compact!
+          unless projected.empty?
+            journal.event_commits!(assignment_id: params.fetch("assignment_id"),
+              event_digests: projected.map { |row| row.fetch("event_digest") }, commit: commit)
+          end
+          if pending
+            raise AttemptErrors::ServiceSettlementPending, "authenticated canonical service requests remain unsettled"
+          end
+          settlement_immutable({"commit" => commit, "services" => projected})
+        rescue KeyError, TypeError, ArgumentError, NoMethodError, AttemptErrors::ReceiptRejected
+          raise AttemptErrors::EvidenceUnavailable, "canonical service settlement is unverifiable"
+        end
+
+        # Called only by the installed journal composition, including lower
+        # service writers. It never reacquires lifecycle/authority locks.
+        def authorize_service_update!(journal:, existing:, replacement:, pending:)
+          protected_journal!(journal)
+          if existing && existing.key?("executor_process_binding") &&
+              Atoms::EvidenceDigest.digest(existing.fetch("executor_process_binding")) != Atoms::EvidenceDigest.digest(replacement["executor_process_binding"])
+            raise AttemptErrors::InvalidState, "original cleanup executor cannot change"
+          end
+          if existing && existing.key?("operation_owner_binding") &&
+              Atoms::EvidenceDigest.digest(existing.fetch("operation_owner_binding")) != Atoms::EvidenceDigest.digest(replacement["operation_owner_binding"])
+            raise AttemptErrors::InvalidState, "original cleanup dispatch owner cannot change"
+          end
+          if existing && %w[no_effect_challenge challenge_generation challenge_event_digest].any? { |key| existing[key] != replacement[key] }
+            unless pending && pending[:operation] == "claim_service_settlement" &&
+                existing["state"] == replacement["state"] && existing["receipt"] == replacement["receipt"] &&
+                existing["dispatch_phase"] == replacement["dispatch_phase"]
+              raise AttemptErrors::InvalidState, "no-effect challenge requires its fixed source owner"
+            end
+            ServiceEvidence.new(journal: journal).challenge!(replacement, pending: pending)
+          end
+          initial = existing.nil? && %w[accepted uncertain].include?(replacement["state"])
+          if initial && (replacement.key?("operation_owner_binding") || replacement.key?("executor_process_binding"))
+            raise AttemptErrors::InvalidState, "cleanup owner identity requires fresh dispatch admission"
+          end
+          begin_dispatch = existing && existing["dispatch_phase"] == "issued" && replacement["dispatch_phase"] == "dispatch_started"
+          if existing && existing["operation"] == "publish" && pending && %w[publication_challenge publication_continue].include?(pending[:operation])
+            return authorize_publication_update!(journal: journal, existing: existing, replacement: replacement, pending: pending)
+          end
+          if existing && existing["dispatch_phase"] != replacement["dispatch_phase"] && !begin_dispatch
+            raise AttemptErrors::InvalidState, "invalid protected dispatch phase change"
+          end
+          return true unless initial || begin_dispatch
+          unless replacement["state"] == "uncertain" && (initial ? replacement["dispatch_phase"] == "issued" : true)
+            raise AttemptErrors::InvalidState, "fresh protected effect requires an uncertain dispatch ticket"
+          end
+          bytes = pending && pending.fetch(:service_inputs, {})[replacement.fetch("request_id")]
+          raise AttemptErrors::UnauthorizedIdentity, "fresh service effect requires its exact original input" unless bytes.is_a?(String)
+          map = @deployment.mapping(replacement.fetch("mapping_id"))
+          unless replacement["project_id"] == map["project_id"] && replacement["caller_uid"] == map["worker_uid"]
+            raise AttemptErrors::UnauthorizedIdentity, "protected service mapping differs"
+          end
+          params = replacement.slice("mapping_id", "assignment_id", "attempt_id", "candidate_generation").merge("head" => replacement.fetch("candidate_head"))
+          events = pending.fetch(:current_events)
+          @launch.scope_open_for_effect!(events: events, params: params, map: map)
+          origin = active_origin(events, params)
+          unless replacement["worker_process_binding"] == origin.fetch("process_binding").fetch("process_identity") &&
+              replacement["launch_ticket"] == origin.fetch("launch_ticket") && replacement["reservation_generation"] == origin.fetch("reservation_generation")
+            raise AttemptErrors::UnauthorizedIdentity, "protected service origin differs"
+          end
+          receiver = @deployment.project(map.fetch("project_id")).fetch("service_receivers").fetch(replacement.fetch("service_id"))
+          raise AttemptErrors::UnauthorizedIdentity, "protected service executor differs" unless receiver.fetch("executor_uid") == replacement.fetch("executor_uid")
+          current = exact_candidate!(candidate(events), params)
+          approved_review!(journal, events, params, map, current, service_operation: replacement.fetch("operation")) unless %w[create update].include?(replacement.fetch("operation"))
+          service_policy!.prepare!(replacement, input_bytes: bytes)
+          if begin_dispatch && %w[prune-preserved-workspace publish].include?(replacement.fetch("operation"))
+            executor = replacement.fetch("executor_process_binding")
+            boot = replacement.fetch("worker_process_binding").fetch("started_at").split(":").fetch(1)
+            Molecules::ExecutionScopeLineage.validate_process_identity!(executor, boot_id: boot)
+            credentials = @deployment.project(map.fetch("project_id")).fetch("peer_credentials").fetch(receiver.fetch("executor_uid").to_s)
+            unless executor.slice("uid", "gid", "groups") == credentials.slice("gid", "groups").merge("uid" => receiver.fetch("executor_uid"))
+              raise AttemptErrors::UnauthorizedIdentity, "original cleanup executor credentials differ"
+            end
+            @kernel.live!(executor)
+            unless replacement["operation"] != "prune-preserved-workspace" || Atoms::EvidenceDigest.digest(service_policy!.dispatch_owner_binding!(replacement)) ==
+                Atoms::EvidenceDigest.digest(replacement.fetch("operation_owner_binding"))
+              raise AttemptErrors::UnauthorizedIdentity, "fixed cleanup owner changed before dispatch acceptance"
+            end
+          end
+          true
+        rescue KeyError
+          raise AttemptErrors::UnauthorizedIdentity, "protected service admission context is incomplete"
+        end
+
+        private
+
+        def settlement_immutable(value)
+          case value
+          when Hash then value.each_with_object({}) { |(key, item), result| result[key.dup.freeze] = settlement_immutable(item) }.freeze
+          when Array then value.map { |item| settlement_immutable(item) }.freeze
+          when String then value.dup.freeze
+          else value.freeze
+          end
+        end
+
+        def authorize_service_transfer!(request, params, map, peer, role)
+          service_policy!
+          service_policy!.visible!(project: map.fetch("project_id"), uid: map.fetch("worker_uid")) unless request.fetch("operation") == "complete_service"
+          @launch.with_assignment(params: params, map: map) do |journal, _registration|
+            protected_journal!(journal)
+            if request.fetch("operation") == "request_service"
+              existing = journal.service_request(params.fetch("request_id"))
+              if existing
+                service_executor!(peer, role, existing)
+                service_replay_binding!(existing, params, map)
+              else
+                events = attempt_events(journal, params)
+                origin = active_origin(events, params)
+                worker_or_launcher!(params.fetch("worker_process_binding"), :worker, map, origin)
+                service_receiver!(peer, role, map, params.fetch("service_id"))
+              end
+            else
+              record = journal.service_request(params.fetch("request_id"))
+              raise AttemptErrors::NotFound, "service request is unavailable" unless record
+              service_executor!(peer, role, record)
+              service_ticket!(record, params, map, peer)
+            end
+          end
+          true
+        end
+
+        # Receiver identity and forwarded worker identity are independent checks.
+        # This immutable observation grants no service claim or dispatch permit.
+        def workspace_prune_preview_context(_request, params, map, peer, role, transfer)
+          raise ArgumentError, "preview context forbids upload" unless transfer.nil?
+          @launch.with_assignment(params: params, map: map) do |journal, _registration|
+            {data: workspace_prune_preview_context_at!(journal: journal, params: params, map: map, peer: peer, role: role), replayed: false}
+          end
+        end
+
+        # Only source composition supplies this fixed journal/snapshot owner.
+        # Both ordinary admission and the root read-only view use the same
+        # original registration, process and candidate proof implementation.
+        public
+
+        def workspace_prune_preview_context_at!(journal:, params:, map:, peer:, role:)
+          service_policy!.visible!(project: map.fetch("project_id"), uid: map.fetch("worker_uid"))
+          protected_journal!(journal)
+          commit = journal.ref_value
+          events = @launch.preview_attempt_events!(journal: journal, commit: commit, params: params, map: map)
+          origin = active_origin(events, params)
+          worker_or_launcher!(params.fetch("worker_process_binding"), :worker, map, origin)
+          receiver = service_receiver!(peer, role, map, params.fetch("service_id"))
+          service_policy!.workspace_prune_receiver!(project: map.fetch("project_id"), uid: map.fetch("worker_uid"),
+            service_id: params.fetch("service_id"), executor_uid: receiver.fetch("executor_uid"))
+          selected = candidate(events)
+          unless selected && selected["head"].is_a?(String) && selected["head"].match?(CandidateTransfer::SHA) &&
+              selected["candidate_generation"].is_a?(Integer) && selected["candidate_generation"].positive?
+            raise AttemptErrors::EvidenceUnavailable, "preview candidate is unavailable"
+          end
+          data = {
+            "journal_commit" => commit,
+            "maintenance" => params.slice("mapping_id", "assignment_id", "attempt_id").merge("project_id" => map.fetch("project_id")),
+            "head" => selected.fetch("head"), "candidate_generation" => selected.fetch("candidate_generation"),
+            "worker_process_binding" => origin.fetch("process_binding").fetch("process_identity"),
+            "caller_process_binding" => params.fetch("worker_process_binding")
+          }
+          raise AttemptErrors::Conflict, "preview canonical selection changed" unless journal.ref_value == commit
+          raise AttemptErrors::EvidenceUnavailable, "preview context exceeds bound" if JSON.generate(data).bytesize > 16_384
+          Atoms::EvidenceDigest.digest(data) # Reject unsupported transport values before copying.
+          JSON.parse(JSON.generate(data))
+        end
+
+        private
+
+        def service_status(_request, params, map, peer, role)
+          @launch.with_assignment(params: params, map: map) do |journal, _registration|
+            protected_journal!(journal)
+            commit = journal.ref_value
+            read = role == :executor && journal.service_settlement_read(params.fetch("request_id"), commit: commit)
+            record = read ? read.fetch(:record) : journal.service_request(params.fetch("request_id"), commit: commit)
+            unless record && record["assignment_id"] == params["assignment_id"] && record["attempt_id"] == params["attempt_id"] &&
+                record["project_id"] == map["project_id"] && record["candidate_head"] == params["head"] &&
+                record["candidate_generation"] == params["candidate_generation"]
+              raise AttemptErrors::UnauthorizedIdentity, "service status binding differs"
+            end
+            if role != :executor && %w[no_effect_challenge challenge_generation challenge_event_digest].any? { |key| record.key?(key) }
+              ServiceEvidence.new(journal: journal).challenge!(record, pending: {commit: commit}, current: false)
+            end
+            selected = read ? read.fetch(:read_view).inventory.fetch("events").fetch(params.fetch("assignment_id")) :
+              journal.read_events(params.fetch("assignment_id"), commit: commit)
+            events = selected.select { |event| event.fetch("attempt_id") == params.fetch("attempt_id") }
+            @kernel.live!(peer)
+            service_policy!.visible!(project: map.fetch("project_id"), uid: peer.fetch("uid"))
+            if role == :executor
+              record = service_settlement_record!(journal, params, map, peer, role, record: record)
+            else
+              authorized = case role
+              when :worker
+                peer["uid"] == record["caller_uid"] && @kernel.descendant?(peer, record.fetch("worker_process_binding"))
+              when :reviewer
+                review = assigned_review(events)
+                review && review["reviewer_uid"] == peer["uid"] && review["head"] == params["head"] &&
+                  review["candidate_generation"] == params["candidate_generation"] && @kernel.descendant?(peer, review.fetch("reviewer_process_binding"))
+              when :supervisor
+                @deployment.project(map.fetch("project_id")).fetch("supervisor_uids").include?(peer["uid"])
+              else
+                false
+              end
+              raise AttemptErrors::UnauthorizedIdentity, "service status purpose differs" unless authorized
+            end
+            data = service_projection(record).merge("generation" => journal.authority_generation(events),
+              "journal_commit" => commit)
+            data["input_digest"] = record.fetch("input_digest") if %w[create update ready merge].include?(record["operation"])
+            if %w[create update ready merge].include?(record["operation"]) && record["state"] == "succeeded"
+              event = ServiceDeliveryEvidence.new(journal: journal).verified(record: record, events: events, commit: commit)
+              data.merge!(record.slice("input_digest", "authorization", "executor_uid", "completion_digest", "receipt"))
+              data["delivery_event"] = event
+            end
+            if role == :executor
+              data["settlement_context"] = read.fetch(:settlement_context) ||
+                ServiceEvidence.new(journal: journal).settlement_context(record, commit: commit, read_view: read.fetch(:read_view))
+            end
+            {data: data, replayed: false}
+          end
+        end
+
+        def service_authorization(request, params, map, peer, role, transfer)
+          authorize_service_transfer!(request, params, map, peer, role)
+          raise ArgumentError, "structured service input transfer is missing" unless transfer && transfer.count == 1
+          bytes = transfer.bytes.dup.freeze
+          @launch.with_assignment(params: params, map: map) do |journal, _registration|
+            protected_journal!(journal)
+            record = journal.service_request(params.fetch("request_id"))
+            service_executor!(peer, role, record)
+            service_ticket!(record, params, map, peer)
+            unless record.fetch("input_digest") == params.fetch("input_digest")
+              raise AttemptErrors::Conflict, "authorization input binding differs"
+            end
+            events = attempt_events(journal, params)
+            @launch.scope_open_for_effect!(events: events, params: params, map: map)
+            origin = active_origin(events, params)
+            unless record["worker_process_binding"] == origin.fetch("process_binding").fetch("process_identity") &&
+                record["launch_ticket"] == origin.fetch("launch_ticket") && record["reservation_generation"] == origin.fetch("reservation_generation")
+              raise AttemptErrors::UnauthorizedIdentity, "authorization launch origin differs"
+            end
+            current = exact_candidate!(candidate(events), params)
+            unless record["candidate_head"] == current["head"] && record["candidate_generation"] == current["candidate_generation"]
+              raise AttemptErrors::Conflict, "authorization candidate changed"
+            end
+            service_receiver!(peer, role, map, record.fetch("service_id"))
+            approved_review!(journal, events, params, map, current, service_operation: record.fetch("operation")) unless %w[create update].include?(record.fetch("operation"))
+            prepared = service_policy!.prepare!(record, input_bytes: bytes)
+            data = params.slice("request_id", "claim_binding", "head", "candidate_generation").merge(
+              "policy_digest" => prepared.fetch(:policy_digest), "operation_digest" => prepared.fetch(:operation_digest))
+            {data: data, replayed: false}
+          end
+        end
+
+        def dispatch_service(request, params, map, peer, role, transfer)
+          return service_authorization(request, params, map, peer, role, transfer) if request.fetch("operation") == "service_authorization"
+          authorize_service_transfer!(request, params, map, peer, role)
+          admitted = if request.fetch("operation") == "complete_service"
+            ReceiptTransfer.decode(input: transfer, receipt_sha256: params.fetch("receipt_sha256"), artifact_field: "evidence", reference_key: "ref")
+          else
+            raise ArgumentError, "structured service input transfer is missing" unless transfer && transfer.count == 1
+            transfer.bytes.dup.freeze
+          end
+          @launch.with_assignment(params: params, map: map) do |journal, _registration|
+            protected_journal!(journal)
+            unless request.fetch("operation") == "complete_service"
+              input_record = request.fetch("operation") == "request_service" ? params : journal.service_request(params.fetch("request_id"))
+              # Replay bypasses the mutation callback, never input validation.
+              # Only body binding is checked here; current effect policy stays
+              # inside each fresh CAS callback.
+              service_policy!.input_binding(admitted, expected_digest: input_record.fetch("input_digest"),
+                expected_target: input_record.fetch("target"), operation: input_record.fetch("operation"))
+            end
+            # Admission also runs outside mutate: an exact mutation replay
+            # skips its callback and cannot bypass the authenticated ticket.
+            service_policy!.visible!(project: map.fetch("project_id"), uid: map.fetch("worker_uid")) unless request.fetch("operation") == "complete_service"
+            retained = request.fetch("operation") == "request_service" && journal.service_request(params.fetch("request_id"))
+            if retained
+              service_executor!(peer, role, retained)
+              service_replay_binding!(retained, params, map)
+            end
+            if !retained && request.fetch("operation") != "request_service"
+              record = journal.service_request(params.fetch("request_id"))
+              service_executor!(peer, role, record)
+              service_ticket!(record, params, map, peer)
+              completion_binding!(record, params, admitted) if request.fetch("operation") == "complete_service"
+            elsif !retained
+              origin = active_origin(attempt_events(journal, params), params)
+              worker_or_launcher!(params.fetch("worker_process_binding"), :worker, map, origin)
+              service_receiver!(peer, role, map, params.fetch("service_id"))
+            end
+            result = journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
+              mutation_id: request.fetch("mutation_id"), operation: request.fetch("operation"),
+              parameters_digest: Atoms::EvidenceDigest.digest(params),
+              expected_generation: request.fetch("operation") == "complete_service" ? nil : params.fetch("expected_generation"),
+              generation_mode: request.fetch("operation") == "complete_service" ? :recorded_completion : :expected, with_replay: true) do |events, _commit, _generation|
+              if request.fetch("operation") == "request_service"
+                existing = journal.service_request(params.fetch("request_id"))
+                if existing
+                  service_executor!(peer, role, existing)
+                  service_replay_binding!(existing, params, map)
+                  {data: service_projection(existing).merge("claim" => "retained")}
+                else
+                  service_claim_plan(journal, events, params, map, peer, role, admitted)
+                end
+              elsif request.fetch("operation") == "begin_dispatch"
+                service_begin_plan(journal, events, params, map, peer, role, admitted)
+              else
+                service_completion_plan(journal, events, params, map, peer, role, admitted)
+              end
+            end
+            if request.fetch("operation") == "begin_dispatch" && result.fetch(:replayed)
+              result = result.merge(data: result.fetch(:data).merge("invocation" => "already_started"))
+            end
+            if request.fetch("operation") == "request_service"
+              # Acceptance metadata belongs to this exact mutation, while
+              # retained service state may have advanced since acceptance.
+              current = journal.service_request(params.fetch("request_id"))
+              data = service_projection(current).merge(result.fetch(:data).slice("generation", "journal_commit"))
+              data["claim"] = retained || result.fetch(:replayed) || result.dig(:data, "claim") == "retained" ? "retained" : "created"
+              result = result.merge(data: data)
+            end
+            if %w[request_service begin_dispatch].include?(request.fetch("operation")) &&
+                %w[prune-preserved-workspace publish].include?(result.fetch(:data).fetch("operation"))
+              selector = request.fetch("operation") == "request_service" ? "request_event_digest" : "dispatch_event_digest"
+              digest = cleanup_service_mutation_event!(journal, request, params, result.fetch(:data).fetch("journal_commit"))
+              result = result.merge(data: result.fetch(:data).merge(selector => digest))
+            end
+            result
+          end
+        end
+
+        # Selectors refer to the actual accepted mutation, never a caller's
+        # pathname or the latest service record. They are derived after CAS,
+        # avoiding a self-reference in the persisted mutation reply.
+        def cleanup_service_mutation_event!(journal, request, params, commit)
+          events = journal.read_events(params.fetch("assignment_id"), commit: commit)
+            .select { |event| event["attempt_id"] == params.fetch("attempt_id") }
+          unless Models::EvidenceEvent.chain_valid?(events)
+            raise AttemptErrors::EvidenceUnavailable, "cleanup service mutation chain is unavailable"
+          end
+          selected = events.select do |event|
+            event["type"] == "authority_mutation" && event.dig("payload", "mutation_id") == request.fetch("mutation_id")
+          end
+          event = selected.one? && selected.first
+          unless event && event.dig("payload", "operation") == request.fetch("operation") &&
+              event.dig("payload", "parameters_digest") == Atoms::EvidenceDigest.digest(params) &&
+              event.dig("payload", "assignment_id") == params.fetch("assignment_id") &&
+              event.dig("payload", "attempt_id") == params.fetch("attempt_id") &&
+              event.dig("payload", "data", "request_id") == params.fetch("request_id") &&
+              journal.event_commit!(assignment_id: params.fetch("assignment_id"), event_digest: event.fetch("digest"), commit: commit) == commit
+            raise AttemptErrors::EvidenceUnavailable, "cleanup service mutation introduction is unavailable"
+          end
+          event.fetch("digest")
+        end
+
+        def service_policy!
+          @service_policy || raise(ArgumentError, "full-service authority requires its installed policy owner")
+        end
+
+        def service_executor!(peer, role, record)
+          unless record && role == :executor && peer["uid"] == record.fetch("executor_uid")
+            raise AttemptErrors::UnauthorizedIdentity, "completion requires the recorded executor"
+          end
+          if record["operation"] == "publish" && record["dispatch_phase"] != "issued" && peer != record["executor_process_binding"]
+            raise AttemptErrors::UnauthorizedIdentity, "publication requires its original receiver birth"
+          end
+          @kernel.live!(peer)
+          true
+        end
+
+        def service_receiver!(peer, role, map, service_id)
+          project = @deployment.project(map.fetch("project_id"))
+          receiver = project.fetch("service_receivers").fetch(service_id)
+          unless role == :executor && peer["uid"] == receiver.fetch("executor_uid") &&
+              project.fetch("service_executor_uids").include?(peer["uid"]) &&
+              !project.fetch("worker_uids").include?(peer["uid"])
+            raise AttemptErrors::UnauthorizedIdentity, "service requires its fixed independent receiver"
+          end
+          @kernel.live!(peer)
+          receiver
+        rescue KeyError
+          raise AttemptErrors::UnauthorizedIdentity, "fixed service receiver is unavailable"
+        end
+
+        def service_claim_plan(journal, events, params, map, peer, role, input_bytes)
+          origin = active_origin(events, params)
+          worker = params.fetch("worker_process_binding")
+          worker_or_launcher!(worker, :worker, map, origin)
+          current = exact_candidate!(candidate(events), params)
+          approved_review!(journal, events, params, map, current, service_operation: params.fetch("operation")) unless %w[create update].include?(params.fetch("operation"))
+          receiver = service_receiver!(peer, role, map, params.fetch("service_id"))
+          binding = params.slice("request_id", "assignment_id", "attempt_id", "operation", "input_digest", "target",
+            "authorization", "service_id").merge("project_id" => map.fetch("project_id"),
+              "caller_uid" => map.fetch("worker_uid"), "mapping_id" => params.fetch("mapping_id"), "candidate_head" => current.fetch("head"),
+              "candidate_generation" => current.fetch("candidate_generation"),
+              "worker_process_binding" => origin.fetch("process_binding").fetch("process_identity"),
+              "launch_ticket" => origin.fetch("launch_ticket"), "reservation_generation" => origin.fetch("reservation_generation"))
+          prepared = service_policy!.prepare!(binding, input_bytes: input_bytes)
+          binding = prepared.fetch(:binding).merge("policy_digest" => prepared.fetch(:policy_digest))
+          unless binding["executor_uid"] == receiver.fetch("executor_uid")
+            raise AttemptErrors::UnauthorizedIdentity, "policy and fixed receiver disagree"
+          end
+          existing = journal.service_request(binding.fetch("request_id"))
+          if existing
+            unless existing.slice(*SERVICE_IDENTITY) == binding.slice(*SERVICE_IDENTITY)
+              raise AttemptErrors::Conflict, "service request immutable identity differs"
+            end
+            return {data: service_projection(existing).merge("claim" => "retained")}
+          end
+          ticket = SecureRandom.hex(16)
+          record = binding.merge("dispatch_ticket_id" => ticket,
+            "claim_binding" => Atoms::EvidenceDigest.digest(binding.merge("dispatch_ticket_id" => ticket)),
+            "claim_generation" => 1, "dispatch_phase" => "issued", "state" => "uncertain",
+            "claimed_at" => Time.now.utc.iso8601(9))
+          {data: service_projection(record).merge("claim" => "created"), service_inputs: {record.fetch("request_id") => input_bytes}, service_updates: [{request_id: record.fetch("request_id"),
+            expected: nil, replacement: record, event_type: "service_claim"}]}
+        end
+
+        def service_begin_plan(journal, events, params, map, peer, role, input_bytes)
+          record = journal.service_request(params.fetch("request_id"))
+          raise AttemptErrors::NotFound, "service request is unavailable" unless record
+          service_receiver!(peer, role, map, record.fetch("service_id"))
+          service_ticket!(record, params, map, peer)
+          # A repeated begin never grants a second invocation, including after
+          # lease expiry or terminality. It reports only retained ticket truth.
+          return {data: service_projection(record).merge("invocation" => "already_started")} unless record["dispatch_phase"] == "issued"
+          origin = active_origin(events, params)
+          unless record["worker_process_binding"] == origin.fetch("process_binding").fetch("process_identity") &&
+              record["launch_ticket"] == origin.fetch("launch_ticket") && record["reservation_generation"] == origin.fetch("reservation_generation")
+            raise AttemptErrors::UnauthorizedIdentity, "dispatch launch origin differs"
+          end
+          current = exact_candidate!(candidate(events), params)
+          unless record["candidate_head"] == current["head"] && record["candidate_generation"] == current["candidate_generation"]
+            raise AttemptErrors::Conflict, "dispatch candidate changed"
+          end
+          approved_review!(journal, events, params, map, current, service_operation: record.fetch("operation")) unless %w[create update].include?(record.fetch("operation"))
+          service_policy!.prepare!(record, input_bytes: input_bytes)
+          replacement = record.merge("dispatch_phase" => "dispatch_started")
+          if record.fetch("operation") == "prune-preserved-workspace"
+            replacement["operation_owner_binding"] = service_policy!.dispatch_owner_binding!(record)
+          end
+          if %w[prune-preserved-workspace publish].include?(record.fetch("operation"))
+            replacement["executor_process_binding"] = JSON.parse(JSON.generate(peer))
+          end
+          {data: service_projection(replacement).merge("invocation" => "permitted"),
+            service_inputs: {record.fetch("request_id") => input_bytes},
+            service_updates: [{request_id: record.fetch("request_id"), expected: record,
+              replacement: replacement, event_type: "service_transition"}]}
+        end
+
+        def service_ticket!(record, params, map, peer)
+          unless record["assignment_id"] == params["assignment_id"] && record["attempt_id"] == params["attempt_id"] &&
+              record["project_id"] == map["project_id"] && record["executor_uid"] == peer["uid"] &&
+              record["claim_binding"] == params["claim_binding"]
+            raise AttemptErrors::UnauthorizedIdentity, "dispatch ticket binding differs"
+          end
+          true
+        end
+
+        def service_replay_binding!(record, params, map)
+          fields = %w[request_id assignment_id attempt_id operation input_digest target authorization service_id mapping_id]
+          unless fields.all? { |field| record[field] == params[field] } && record["project_id"] == map["project_id"] &&
+              record["caller_uid"] == map["worker_uid"] && params.dig("worker_process_binding", "uid") == map["worker_uid"]
+            raise AttemptErrors::Conflict, "service replay immutable identity differs"
+          end
+          @kernel.live!(params.fetch("worker_process_binding"))
+          unless @kernel.descendant?(params.fetch("worker_process_binding"), record.fetch("worker_process_binding"))
+            raise AttemptErrors::UnauthorizedIdentity, "service replay requires recorded native worker ownership"
+          end
+          true
+        end
+
+        def service_completion_plan(journal, events, params, map, peer, role, admitted)
+          record = journal.service_request(params.fetch("request_id"))
+          service_executor!(peer, role, record)
+          service_ticket!(record, params, map, peer)
+          digest = completion_binding!(record, params, admitted)
+          if record["completion_digest"]
+            return {data: service_projection(record)}
+          end
+          receipt = admitted.fetch(:receipt)
+          if record["operation"] == "publish"
+            unless admitted.fetch(:artifacts).size == 1
+              raise AttemptErrors::ReceiptRejected, "publication requires its one exact result"
+            end
+            ServiceEvidence.new(journal: journal).publication_result!(admitted.fetch(:artifacts).first, record, state: receipt.fetch("outcome"))
+          end
+          owner = ServiceEvidence.new(journal: journal)
+          canonical = Molecules::CanonicalEvidence.new(journal: journal)
+          plan = canonical.import_plan(**owner.context(record), artifacts: admitted.fetch(:artifacts),
+            admitted_after_event_digest: events.last.fetch("digest"))
+          normalized = JSON.parse(JSON.generate(receipt)).merge("evidence" => plan.fetch(:references))
+          replacement = record.merge("state" => receipt.fetch("outcome"), "receipt" => normalized, "completion_digest" => digest)
+          replacement["failed_at"] = Time.now.utc.iso8601(9) if receipt["outcome"] == "failed"
+          if %w[create update ready merge].include?(replacement["operation"]) && replacement["state"] == "succeeded"
+            event = ServiceDeliveryEvidence.new(journal: journal).completion_event(record: replacement,
+              receipt: normalized, completion_digest: digest, artifacts: admitted.fetch(:artifacts))
+            plan = plan.merge(events: plan.fetch(:events) + [event])
+          end
+          plan.merge(data: service_projection(replacement), service_updates: [{request_id: record.fetch("request_id"),
+            expected: record, replacement: replacement, event_type: "service_transition"}])
+        end
+
+        def completion_binding!(record, params, admitted)
+          unless record["candidate_head"] == params["head"] && record["candidate_generation"] == params["candidate_generation"]
+            raise AttemptErrors::Conflict, "completion candidate binding differs"
+          end
+          digest = Atoms::EvidenceDigest.digest("receipt_sha256" => admitted.fetch(:receipt_sha256),
+            "artifacts" => admitted.fetch(:artifacts).map { |bytes| Digest::SHA256.hexdigest(bytes) })
+          if record["completion_digest"] && record["completion_digest"] != digest
+            raise AttemptErrors::Conflict, "service completion content differs"
+          end
+          receipt = admitted.fetch(:receipt)
+          unless receipt.keys.sort == Molecules::EvidenceJournal::TERMINAL_RECEIPT_FIELDS.sort &&
+              Molecules::EvidenceJournal::TERMINAL_BINDING_FIELDS.all? { |field| receipt[field] == record[field] } &&
+              %w[succeeded failed].include?(receipt["outcome"]) &&
+              (receipt["outcome"] != "succeeded" || record["dispatch_phase"] == "dispatch_started" || (record["operation"] == "publish" && record["dispatch_phase"] == "issuing"))
+            raise AttemptErrors::ReceiptRejected, "completion must attest the exact dispatched request"
+          end
+          digest
+        end
+
+        def service_projection(record)
+          record.slice("request_id", "assignment_id", "attempt_id", "project_id", "operation", "service_id", "target",
+            "candidate_head", "candidate_generation", "state", "dispatch_ticket_id", "claim_binding", "claim_generation", "dispatch_phase", "policy_digest", "operation_owner_binding", "executor_process_binding", *ServicePublicationEvidence::PUBLICATION_FIELDS).tap do |projection|
+              if record["operation"] == "publish" && %w[succeeded failed].include?(record["state"])
+                projection.merge!(record.slice("receipt", "completion_digest", "authorization", "input_digest"))
+              end
+            end
+        end
+      end
+    end
+  end
+end