ace-assign 0.63.1 → 0.66.0

data/lib/ace/assign/authority/launch_prepared_work.rb

@@ -0,0 +1,122 @@
+# frozen_string_literal: true
+require_relative "../atoms/evidence_digest"
+
+module Ace
+  module Assign
+    module Authority
+      class LaunchLifecycle
+        # One authenticated immutable prefix; never the latest registration.
+        def original_prepared_registration!(journal:, params:, commit:)
+          original_prepared_registration_for_phase!(journal: journal, params: params, commit: commit, phase: :issued) do |map, state|
+            yield(map, state) if block_given?
+          end
+        end
+
+        private
+
+        def original_bound_prepared_registration!(journal:, params:, commit:)
+          original_prepared_registration_for_phase!(journal: journal, params: params, commit: commit, phase: :bound)
+        end
+
+        def original_prepared_registration_for_phase!(journal:, params:, commit:, phase:)
+          inventory = journal.canonical_event_inventory!(commit: commit)
+          raise AttemptErrors::EvidenceUnavailable, "prepared canonical snapshot differs" unless inventory.fetch("commit") == commit
+          assignment = params.fetch("assignment_id")
+          events = inventory.fetch("events").fetch(assignment)
+          chain = events.select { |event| event["attempt_id"] == params.fetch("attempt_id") }
+          state = origin(chain, **params.slice("assignment_id", "attempt_id", "mapping_id").transform_keys(&:to_sym))
+          reserves = chain.select { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "reserve_attempt" }
+          releases = chain.select { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "release_launch" }
+          provisioning = chain.select { |event| event["type"] == "scope_provisioning" }
+          admitted_phase = if phase == :issued
+            releases.one? && releases.first.dig("payload", "data", "phase") == "issued"
+          else
+            releases.empty? && state.fetch("phase") == "bound"
+          end
+          unless reserves.one? && admitted_phase && provisioning.one? &&
+              !terminal_events?(chain) && !chain.any? { |event| %w[scope_sealed input_inhibited attempt_stopped].include?(event["type"]) }
+            raise AttemptErrors::EvidenceUnavailable, "original prepared attempt is not #{phase} and open"
+          end
+          identity = provisioning.first.fetch("payload")
+          sha = identity.fetch("descriptor_sha256")
+          selected = if @deployment.artifact_reference.fetch("sha256") == sha
+            @deployment
+          else
+            raise AttemptErrors::EvidenceUnavailable, "original prepared deployment is unavailable" unless @deployment_history
+            @deployment_history.descriptor!(sha256: sha)
+          end
+          map = selected.mapping(params.fetch("mapping_id"))
+          original_project = selected.project(map.fetch("project_id"))
+          unless identity.fetch("deployment_digest") == Digest::SHA256.hexdigest(JSON.generate(canonical(map))) &&
+              identity.fetch("slot_id") == map.fetch("execution_scope").fetch("slot_id") && state.fetch("project_id") == map.fetch("project_id") &&
+              selected.project(map.fetch("project_id")).values_at("journal_repository", "evidence_git_ref", "evidence_checkout_root") ==
+                [journal.repo_root, journal.ref, journal.checkout_root]
+            raise AttemptErrors::EvidenceUnavailable, "original prepared deployment association differs"
+          end
+          lineage = Molecules::ExecutionScopeLineage.new(events: chain, project_id: state.fetch("project_id"),
+            assignment_id: assignment, attempt_id: params.fetch("attempt_id"), mapping_id: params.fetch("mapping_id"))
+          unless lineage.require_launch_bound! == state.fetch("process_binding")
+            raise AttemptErrors::EvidenceUnavailable, "original prepared child binding differs"
+          end
+          original = original_prompt_record!(chain, state, params: params)
+          # Authenticate the actual original worker/descendant before reading artifacts.
+          yield(map, state) if block_given?
+          introductions = inventory.fetch("introductions").fetch(assignment)
+          reservation_commit = introductions.fetch(reserves.first.fetch("digest"))
+          registration = definition(journal, assignment, commit: reservation_commit)
+          original_events = journal.read_events(assignment, commit: reservation_commit)
+          authenticate_inventory_registration!(journal, assignment, original_events, registration, params.fetch("mapping_id"), map, reservation_commit, introductions)
+          registered = original_events.find { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "register_assignment" && event.dig("payload", "data") == registration }
+          registration_commit = introductions.fetch(registered.fetch("digest"))
+          TaskContextEntry.validate!(registration.fetch("task_context_entry"))
+          unless registration.fetch("task_context_entry") == map.fetch("task_context_entry")
+            raise AttemptErrors::EvidenceUnavailable, "original prepared task context entry differs"
+          end
+          prepared = registration.fetch("prepared_work")
+          unless prepared.fetch("scope") == state.fetch("scope") && prepared.fetch("task_id") == state.fetch("task_id")
+            raise AttemptErrors::EvidenceUnavailable, "original prepared selection differs"
+          end
+          bytes = journal.bounded_blob(registration.fetch("definition_ref"), commit: registration_commit, max_bytes: PreparedWork::MAX_MANIFEST)
+          unless bytes.is_a?(String) && bytes.bytesize.between?(1, PreparedWork::MAX_MANIFEST) &&
+              Digest::SHA256.hexdigest(bytes) == registration.fetch("definition_digest") && JSON.parse(bytes).fetch("prepared_work") == prepared
+            raise AttemptErrors::EvidenceUnavailable, "original prepared definition differs"
+          end
+          projection = immutable_maintenance_projection(registration: registration, registration_commit: registration_commit, state: state, map: map, events: chain,
+            workspace_exclusion: maintenance_scope_observer_for(selected, params.fetch("mapping_id")).workspace_exclusion_projection!(lineage),
+            original_worker_scratch_root: original_project.fetch("peer_credentials").fetch(map.fetch("worker_uid").to_s).fetch("scratch_root"),
+            original_binding_digest: original.fetch("binding_digest"), commit: commit)
+          pin = compact_prepared_input(projection)
+          if phase == :issued
+            unless Atoms::EvidenceDigest.digest(releases.first.dig("payload", "data", "prepared_input")) == Atoms::EvidenceDigest.digest(pin)
+              raise AttemptErrors::EvidenceUnavailable, "accepted prepared release differs"
+            end
+          else
+            bundle = journal.bounded_blob(registration.fetch("prepared_bundle_ref"), commit: registration_commit, max_bytes: CandidateTransfer::MAX_BYTES)
+            unless bundle.is_a?(String) && bundle.bytesize == registration.fetch("prepared_bundle_bytes") &&
+                bundle.bytesize.between?(1, CandidateTransfer::MAX_BYTES) && Digest::SHA256.hexdigest(bundle) == registration.fetch("prepared_bundle_sha256")
+              raise AttemptErrors::EvidenceUnavailable, "original prepared bundle differs"
+            end
+          end
+          projection
+        rescue KeyError, TypeError, NoMethodError, JSON::ParserError
+          raise AttemptErrors::EvidenceUnavailable, "original prepared registration is unavailable"
+        end
+
+        def compact_prepared_input(projection)
+          registration = projection.fetch(:registration)
+          immutable_maintenance_projection(
+            "registration_generation" => registration.fetch("generation"),
+            "registration_commit" => projection.fetch(:registration_commit),
+            "definition_digest" => registration.fetch("definition_digest"),
+            "original_binding_digest" => projection.fetch(:original_binding_digest),
+            "prepared_work" => registration.fetch("prepared_work"),
+            "worker_entry" => Ace::Runtime::Molecules::ProtectedWorkerEntry.validate!(projection.fetch(:map).fetch("worker_entry")),
+            "workspace_exclusion" => projection.fetch(:workspace_exclusion),
+            "bundle_ref" => registration.fetch("prepared_bundle_ref"),
+            "bundle_bytes" => registration.fetch("prepared_bundle_bytes"),
+            "bundle_sha256" => registration.fetch("prepared_bundle_sha256"))
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/launch_review.rb

@@ -0,0 +1,91 @@
+# frozen_string_literal: true
+
+module Ace
+  module Assign
+    module Authority
+      class LaunchLifecycle
+        # Called by Endcap only while holding the existing assignment/slot
+        # exclusion and shared authority mutex. Returned channel capacity is
+        # released after the caller leaves those locks and waits on the stream.
+        def reserve_review_dispatch!(events:, params:, map:)
+          state = origin(events, **params.slice("mapping_id", "assignment_id", "attempt_id").transform_keys(&:to_sym))
+          unless state["phase"] == "issued" && !terminal_events?(events)
+            raise AttemptErrors::Conflict, "review delegation requires an issued original launcher"
+          end
+          scope_open_for_effect!(events: events, params: params, map: map)
+          original = original_prompt_record!(events, state, params: params)
+          @kernel.live!(state.fetch("launcher_identity"))
+          channel = @control_channels[steering_key(params, map)]
+          raise AttemptErrors::EvidenceUnavailable, "original review channel is unavailable" unless channel
+          [channel, channel.reserve_dispatch!, original]
+        end
+
+        def review_original_reference!(events:, params:)
+          state = origin(events, **params.slice("mapping_id", "assignment_id", "attempt_id").transform_keys(&:to_sym))
+          original_prompt_record!(events, state, params: params)
+        end
+
+        # Read-only original-launcher projection at the exact request commit.
+        # Permission to assign still belongs to Endcap's fresh/replay checks.
+        def launch_review_intent!(request:, peer:, role:)
+          params = request.fetch("params")
+          strict!(params, %w[mapping_id assignment_id attempt_id mutation_id request_event_id journal_commit original_binding_digest])
+          raise ArgumentError, "Review intent lookup is read-only" unless request.fetch("mutation_id").nil?
+          raise AttemptErrors::UnauthorizedIdentity, "Review intent requires original launcher" unless role == :launcher
+          %w[mapping_id assignment_id attempt_id mutation_id].each { |key| token!(params.fetch(key)) }
+          unless %w[request_event_id original_binding_digest].all? { |key| params[key].is_a?(String) && params[key].match?(/\A[0-9a-f]{64}\z/) } &&
+              params["journal_commit"].is_a?(String) && params["journal_commit"].match?(/\A(?:[0-9a-f]{40}|[0-9a-f]{64})\z/)
+            raise ArgumentError, "Review intent selectors differ"
+          end
+          map = steering_principal!(params, peer, role)
+          raise AttemptErrors::UnauthorizedIdentity, "Review project differs" unless request.fetch("project_id") == map.fetch("project_id")
+          journal = journal_for(map)
+          commit = params.fetch("journal_commit")
+          journal.verify_canonical_prefix!(commit: commit)
+          events = journal.read_events(params.fetch("assignment_id"), commit: commit).select { |event| event["attempt_id"] == params.fetch("attempt_id") }
+          state = origin(events, **params.slice("mapping_id", "assignment_id", "attempt_id").transform_keys(&:to_sym))
+          unless @kernel.same?(state.fetch("launcher_identity"), peer)
+            raise AttemptErrors::UnauthorizedIdentity, "Review intent requires exact original launcher birth"
+          end
+          original = original_prompt_record!(events, state, params: params)
+          event = events.find { |item| item["digest"] == params.fetch("request_event_id") }
+          accepted = journal.mutation_result(params.fetch("mutation_id"), commit: commit)
+          unless event && event["type"] == "authority_mutation" && event.dig("payload", "operation") == "request_review" &&
+              event.dig("payload", "mutation_id") == params.fetch("mutation_id") && accepted &&
+              accepted == event.fetch("payload").merge("journal_commit" => commit) &&
+              original.fetch("binding_digest") == params.fetch("original_binding_digest")
+            raise AttemptErrors::EvidenceUnavailable, "Canonical review request introduction differs"
+          end
+          data = event.fetch("payload").fetch("data")
+          fields = %w[candidate_generation generation head original_binding_digest requester reviewer_process_binding reviewer_uid]
+          unless data.is_a?(Hash) && data.keys.sort == fields && data["original_binding_digest"] == original.fetch("binding_digest") &&
+              data["head"].is_a?(String) && data["head"].match?(/\A(?:[0-9a-f]{40}|[0-9a-f]{64})\z/) &&
+              %w[candidate_generation generation reviewer_uid].all? { |key| data[key].is_a?(Integer) && data[key].positive? }
+            raise AttemptErrors::EvidenceUnavailable, "Canonical review request data differs"
+          end
+          identity = data.fetch("reviewer_process_binding")
+          boot = identity.is_a?(Hash) && identity["started_at"].is_a?(String) && identity["started_at"].split(":", -1)[1]
+          Molecules::ExecutionScopeLineage.validate_process_identity!(identity, boot_id: boot)
+          requester = data["requester"]
+          unless requester.is_a?(Hash) && requester.keys.sort == %w[gid groups role uid] &&
+              %w[uid gid].all? { |key| requester[key].is_a?(Integer) } && requester["groups"].is_a?(Array) &&
+              requester["groups"].all? { |group| group.is_a?(Integer) } &&
+              requester == identity.slice("uid", "gid", "groups").merge("role" => "reviewer") &&
+              data["reviewer_uid"] == identity["uid"] && identity["uid"] != map.fetch("worker_uid")
+            raise AttemptErrors::EvidenceUnavailable, "Canonical reviewer attribution differs"
+          end
+          candidate = events.reverse.find { |item| item["type"] == "authority_mutation" && item.dig("payload", "operation") == "submit_candidate" }&.dig("payload", "data")
+          unless candidate && candidate.values_at("head", "candidate_generation") == data.values_at("head", "candidate_generation")
+            raise AttemptErrors::EvidenceUnavailable, "Canonical request candidate differs"
+          end
+          assignment = params.slice("mapping_id", "assignment_id", "attempt_id").merge(
+            data.slice("head", "candidate_generation", "reviewer_uid", "reviewer_process_binding"),
+            "expected_generation" => data.fetch("generation"))
+          {data: params.slice("request_event_id", "original_binding_digest").merge("assignment_params" => assignment), replayed: false}
+        rescue KeyError, TypeError
+          raise AttemptErrors::EvidenceUnavailable, "Canonical review intent is incomplete"
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/launch_scope_abort.rb

@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+
+module Ace
+  module Assign
+    module Authority
+      class LaunchLifecycle
+        SCOPE_ABORT_FIELDS = %w[kind scope_generation scope_binding_event_id seal_event_id proof_id].freeze
+
+        # Also used by the shared final release-before-reuse predicate. Calls
+        # existing owners at the same immutable CAS input, without impersonating
+        # a public evidence-fetch peer or inventing an alternate verifier.
+        def scope_settlement_complete!(journal:, events:, params:, map:, commit:)
+          if @result_owner
+            @result_owner.service_settlement_complete!(journal: journal, events: events, params: params, map: map, commit: commit)
+          else
+            service_events = events.any? { |event| %w[service_claim service_transition].include?(event["type"]) }
+            service_records = journal.service_request_records(commit: commit).any? do |record|
+              record["assignment_id"] == params.fetch("assignment_id") && record["attempt_id"] == params.fetch("attempt_id")
+            end
+            if service_events || service_records
+              raise AttemptErrors::EvidenceUnavailable, "canonical service settlement owner is unavailable"
+            end
+          end
+          true
+        end
+
+        private
+
+        def scope_abort_plan(params, map, events, peer, journal:, commit:, supervisor:)
+          bytes = params.fetch("failure_evidence").dup.force_encoding(Encoding::UTF_8)
+          raise ArgumentError, "scope failure must be UTF-8 JSON" unless bytes.valid_encoding?
+          failure = JSON.parse(bytes, create_additions: false, max_nesting: 8, allow_duplicate_key: false, allow_comments: false)
+          strict!(failure, SCOPE_ABORT_FIELDS)
+          unless failure["kind"] == "protected_scope_before_release" && failure["scope_generation"].is_a?(Integer) && failure["scope_generation"].positive?
+            raise ArgumentError, "scope failure selectors differ"
+          end
+          %w[scope_binding_event_id seal_event_id proof_id].each do |key|
+            value = failure.fetch(key)
+            raise ArgumentError, "invalid scope failure selector" unless value.is_a?(String) && value.match?(/\A[0-9a-f]{64}\z/)
+          end
+          state = states(events)[params.fetch("attempt_id")]
+          unless state && state["mapping_id"] == params.fetch("mapping_id") && state["launch_ticket"] == params.fetch("launch_ticket") &&
+              (supervisor || @kernel.same?(state.fetch("launcher_identity"), peer))
+            raise AttemptErrors::UnauthorizedIdentity, "scope failure is not owned by this launcher"
+          end
+          chain = events.select { |event| event["attempt_id"] == params.fetch("attempt_id") }
+          lineage = Molecules::ExecutionScopeLineage.new(events: chain, project_id: map.fetch("project_id"),
+            assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"), mapping_id: params.fetch("mapping_id"))
+          lineage.require_positive!(**failure.reject { |key, _| key == "kind" }.transform_keys(&:to_sym))
+          scope_observer_for(params.fetch("mapping_id")).verify_closed!(lineage)
+          if chain.any? { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "release_launch" } ||
+              state["phase"] == "issued" || state["execution"] == "potentially_executed"
+            raise AttemptErrors::Conflict, "scope failure cannot undo issued launch permission"
+          end
+          scope_settlement_complete!(journal: journal, events: chain, params: params, map: map, commit: commit)
+          current = journal.canonical_attempt_state(chain)
+          unless %w[reserved running uncertain].include?(current)
+            raise AttemptErrors::Conflict, "scope failure cannot change a terminal attempt"
+          end
+          proof = failure.merge("release" => "not_issued")
+          reason = "protected_scope_closed_before_release"
+          event = if current == "uncertain"
+            {type: "reconciliation", payload: {"resolution" => "failed", "reason" => reason,
+              "failure_digest" => params.fetch("failure_digest"), "abort_observation" => proof}}
+          else
+            # This is the sole reserved -> failed admission. The generic state
+            # machine remains unchanged; no synthetic process_start is written.
+            {type: "transition", payload: {"from" => current, "to" => "failed", "reason" => reason,
+              "abort_observation" => proof}}
+          end
+          reference = "evidence/imports/launch-failure-#{params.fetch('attempt_id')}-#{params.fetch('failure_digest')}"
+          {events: [event], blobs: {reference => params.fetch("failure_evidence")}, data: state.merge(
+            "phase" => "failed", "failure_digest" => params.fetch("failure_digest"), "failure_ref" => reference,
+            "abort_observation" => proof, "required_action" => nil)}
+        rescue JSON::ParserError
+          raise ArgumentError, "scope failure JSON is invalid"
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/launch_scope_admission.rb

@@ -0,0 +1,215 @@
+# frozen_string_literal: true
+
+module Ace
+  module Assign
+    module Authority
+      class LaunchLifecycle
+        # Internal owner call, deliberately absent from the public operation
+        # allowlist. The durable winner alone may call the fixed manager. A
+        # lost StartUnit reply retains admission uncertainty; replay never starts.
+        def admit_native_service!(params:, peer:, role:)
+          strict!(params, %w[mapping_id assignment_id attempt_id launch_ticket mutation_id expected_generation])
+          unless %i[launcher supervisor].include?(role)
+            raise AttemptErrors::UnauthorizedIdentity, "native admission requires an exact launch owner"
+          end
+          %w[assignment_id attempt_id launch_ticket mutation_id].each { |key| token!(params.fetch(key)) }
+          generation!(params.fetch("expected_generation"))
+          @kernel.live!(peer)
+          map = @deployment.mapping(params.fetch("mapping_id"))
+          journal = journal_for(map)
+          input = params.reject { |key, _| key == "mutation_id" }
+          digest = Digest::SHA256.hexdigest(JSON.generate(canonical(input)))
+          result = with_exclusion(params, map, journal) do
+            admit_native_service_held!(params, map, journal, peer, role, digest)
+          end
+          complete_native_start!(params, map, journal, peer, role, result) unless result.fetch(:replayed)
+          result
+        ensure
+          settle_native_issuer!(params, map) if map
+        end
+
+        # Private transport owner. Exact manager hook attribution precedes
+        # challenge issuance; this never enters the ordinary worker dispatcher.
+        def native_readiness!(mapping_id:, peer:, socket:, codec:, deadline:)
+          map = @deployment.mapping(mapping_id)
+          journal = journal_for(map)
+          pending, key = @mutex.synchronize do
+            selected = @native_issuers.select { |identity, _| identity[0] == map.fetch("project_id") && identity[1] == mapping_id }
+            raise AttemptErrors::EvidenceUnavailable, "no unique live admitted issuer" unless selected.size == 1
+            identity, entry = selected.first
+            raise AttemptErrors::Conflict, "readiness already supplied" if entry[:report] || entry[:challenge]
+            entry[:challenge] = SecureRandom.hex(32)
+            [entry, identity]
+          end
+          params = pending.fetch(:params)
+          observer = scope_observer_for(mapping_id)
+          challenge = with_exclusion(params, map, journal) do
+            @mutex.synchronize do
+              events = journal.read_events(params.fetch("assignment_id")).select { |event| event["attempt_id"] == params.fetch("attempt_id") }
+              lineage = Molecules::ExecutionScopeLineage.new(events: events, project_id: map.fetch("project_id"),
+                assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"), mapping_id: mapping_id)
+              lineage.require_open!
+              server = observer.readiness_peer!(lineage, peer)
+              {"version" => 1, "challenge_id" => pending.fetch(:challenge), "server_identity" => server}
+            end
+          end
+          wire.write(socket, challenge, deadline: deadline, limit: 16_384)
+          envelope = wire.read(socket, deadline: deadline, limit: 16_384)
+          unless envelope.is_a?(Hash) && envelope.keys.sort == %w[challenge_id transfer version] &&
+              envelope["version"] == 1 && envelope["challenge_id"] == challenge.fetch("challenge_id")
+            raise ArgumentError, "private readiness upload envelope differs"
+          end
+          codec.receive(socket, descriptor: envelope.fetch("transfer"), purpose: :scope_boundary_observation,
+            deadline: deadline) do |input|
+            bytes = input.bytes.force_encoding(Encoding::UTF_8)
+            raise ArgumentError, "readiness observation is not UTF-8" unless bytes.valid_encoding?
+            report = JSON.parse(bytes, create_additions: false, max_nesting: 12, allow_duplicate_key: false, allow_comments: false)
+            with_exclusion(params, map, journal) do
+              @mutex.synchronize do
+                unless @native_issuers[key].equal?(pending) && !pending[:report]
+                  raise AttemptErrors::EvidenceUnavailable, "readiness issuer lifetime ended"
+                end
+                events = journal.read_events(params.fetch("assignment_id")).select { |event| event["attempt_id"] == params.fetch("attempt_id") }
+                lineage = Molecules::ExecutionScopeLineage.new(events: events, project_id: map.fetch("project_id"),
+                  assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"), mapping_id: mapping_id)
+                lineage.require_open!
+                pending[:report] = observer.verify_readiness_report!(lineage, peer, report, challenge: challenge)
+              end
+            end
+          end
+          wire.write(socket, {"version" => 1, "challenge_id" => challenge.fetch("challenge_id"), "status" => "ready"},
+            deadline: deadline, limit: 16_384)
+        end
+
+        private
+
+        def admit_native_service_held!(params, map, journal, peer, role, digest)
+            result = @mutex.synchronize do
+              # Visibility is current even on a historical mutation replay.
+              current = journal.read_events(params.fetch("assignment_id")).select { |event| event["attempt_id"] == params.fetch("attempt_id") }
+              scope_admission_owner!(params, map, current, peer, role)
+              journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
+                mutation_id: params.fetch("mutation_id"), operation: "scope_service_admission", parameters_digest: digest,
+                expected_generation: params.fetch("expected_generation"), with_replay: true) do |events, _commit, generation|
+                state, lineage = scope_admission_owner!(params, map, events, peer, role)
+                lineage.require_open!
+                unless state["phase"] == "reserved" && !lineage.native_event && !lineage.child_event &&
+                    events.none? { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "scope_service_admission" }
+                  raise AttemptErrors::Conflict, "native activation was already admitted or launch advanced"
+                end
+                observer = scope_observer_for(params.fetch("mapping_id"))
+                installation = observer.native_admission_ready!(lineage)
+                binding = lineage.binding
+                data = state.merge("scope_generation" => binding.fetch("scope_generation"),
+                  "scope_binding_event_id" => lineage.binding_event.fetch("digest"),
+                  "service_unit" => map.fetch("execution_scope").fetch("service_unit"), "native_admission" => "issued_uncertain",
+                  "network_installation" => installation)
+                unless installation.is_a?(Hash) && installation["namespace_path"] == map.fetch("execution_scope").fetch("network_namespace_path")
+                  raise AttemptErrors::EvidenceUnavailable, "network verifier output names another fixed namespace path"
+                end
+                candidate = Models::EvidenceEvent.build(type: "authority_mutation", attempt_id: params.fetch("attempt_id"),
+                  payload: {"operation" => "scope_service_admission", "data" => data.merge("generation" => generation + 1)},
+                  previous_digest: events.last&.fetch("digest"))
+                Molecules::ExecutionScopeLineage.new(events: events + [candidate], project_id: map.fetch("project_id"),
+                  assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"), mapping_id: params.fetch("mapping_id"))
+                {events: [], blobs: {}, data: data}
+              end
+            end
+            unless result.fetch(:replayed)
+              @mutex.synchronize do
+                raise AttemptErrors::Conflict, "native issuer already active" if @native_issuers.key?(native_issuer_key(params, map))
+                @native_issuers[native_issuer_key(params, map)] = {params: params.dup.freeze, report: nil, owner: Thread.current}
+              end
+            end
+            result
+        end
+
+        def complete_native_start!(params, map, journal, peer, role, result)
+          attempt_id = params.fetch("attempt_id")
+          observer = scope_observer_for(params.fetch("mapping_id"))
+          issue = with_exclusion(params, map, journal) do
+            @mutex.synchronize do
+              events = journal.read_events(params.fetch("assignment_id")).select { |event| event["attempt_id"] == attempt_id }
+              _, lineage = scope_admission_owner!(params, map, events, peer, role)
+              !lineage.sealed?
+            end
+          end
+          observer.start_admitted_service! if issue
+          # The pending issuer lifetime remains live through this final check
+          # and cleanup. A seal cannot publish proof then permit a late start.
+          with_exclusion(params, map, journal) do
+            events, lineage = @mutex.synchronize do
+              current = journal.read_events(params.fetch("assignment_id")).select { |event| event["attempt_id"] == attempt_id }
+              _, retained = scope_admission_owner!(params, map, current, peer, role)
+              [current, retained]
+            end
+            if lineage.sealed?
+              observer.stop_sealed_service!
+            elsif issue
+              payload = observer.complete_native_readiness!(lineage,
+                @mutex.synchronize { @native_issuers.fetch(native_issuer_key(params, map)).fetch(:report) })
+              @mutex.synchronize { commit_ready_native!(params, map, journal, events, lineage, payload) }
+            end
+          end
+        rescue StandardError
+          # Lost command completion is uncertain. Cleanup of the fixed service
+          # must finish before the live issuer can retire its pending lifetime.
+          observer.stop_sealed_service! if issue
+          raise
+        ensure
+          settle_native_issuer!(params, map) if attempt_id
+        end
+
+        def commit_ready_native!(params, map, journal, events, lineage, payload)
+          context = params.slice("mapping_id", "assignment_id", "attempt_id").merge(
+            "scope_binding_event_id" => lineage.binding_event.fetch("digest"))
+          journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
+            mutation_id: "scope-native-#{Digest::SHA256.hexdigest(lineage.binding_event.fetch('digest'))[0, 48]}",
+            operation: "scope_native_binding", parameters_digest: Digest::SHA256.hexdigest(JSON.generate(canonical(context))),
+            expected_generation: journal.authority_generation(events), with_replay: true) do |current, _commit, _generation|
+            fresh = Molecules::ExecutionScopeLineage.new(events: current, project_id: map.fetch("project_id"),
+              assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"), mapping_id: params.fetch("mapping_id"))
+            fresh.require_open!
+            raise AttemptErrors::Conflict, "native binding already exists" if fresh.native_event
+            at = Time.now.utc
+            event = Models::EvidenceEvent.build(type: "scope_native_bound", attempt_id: params.fetch("attempt_id"),
+              payload: payload, previous_digest: current.last&.fetch("digest"), recorded_at: at)
+            Molecules::ExecutionScopeLineage.new(events: current + [event], project_id: map.fetch("project_id"),
+              assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"), mapping_id: params.fetch("mapping_id"))
+            {events: [{type: "scope_native_bound", payload: payload, recorded_at: at}], blobs: {}, data: context}
+          end
+        end
+
+        def native_issuer_key(params, map)
+          [map.fetch("project_id"), params.fetch("mapping_id"), params.fetch("assignment_id"), params.fetch("attempt_id")].freeze
+        end
+
+        def settle_native_issuer!(params, map)
+          @mutex.synchronize do
+            key = native_issuer_key(params, map)
+            pending = @native_issuers[key]
+            @native_issuers.delete(key) if pending && pending[:owner].equal?(Thread.current)
+          end
+        end
+
+        def native_issuer_pending!(params, map)
+          if @native_issuers.key?(native_issuer_key(params, map))
+            raise AttemptErrors::EvidenceUnavailable, "native issuance is still pending"
+          end
+        end
+
+        def scope_admission_owner!(params, map, events, peer, role)
+          state = states(events)[params.fetch("attempt_id")]
+          unless state && state["mapping_id"] == params.fetch("mapping_id") &&
+              state["launch_ticket"] == params.fetch("launch_ticket") &&
+              (role == :supervisor || @kernel.same?(state.fetch("launcher_identity"), peer))
+            raise AttemptErrors::UnauthorizedIdentity, "native admission launch origin differs"
+          end
+          lineage = Molecules::ExecutionScopeLineage.new(events: events, project_id: map.fetch("project_id"),
+            assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"), mapping_id: params.fetch("mapping_id"))
+          [state, lineage]
+        end
+      end
+    end
+  end
+end