ace-assign 0.63.1 → 0.66.0

data/lib/ace/assign/authority/transfer_codec.rb

@@ -0,0 +1,187 @@
+# frozen_string_literal: true
+
+require "digest"
+require "tempfile"
+require "timeout"
+require "ace/runtime/molecules/protected_socket"
+require_relative "private_directory"
+
+module Ace
+  module Assign
+    module Authority
+      # Binary framing after the existing authenticated control header. The
+      # Server selects purpose from a source handler's fixed operation table,
+      # admits a transfer slot before calling, and holds no journal lock here.
+      class TransferCodec
+        LIMITS = {prompt_text: [16_384, 1, 16_384], scope_boundary_observation: [65_536, 1, 65_536], candidate: [64 * 1024 * 1024, 1, 64 * 1024 * 1024],
+                  artifacts: [256 * 1024, 16, 64 * 1024],
+                  receipt_artifacts: [272 * 1024, 17, 64 * 1024],
+                  service_input: [64 * 1024, 1, 64 * 1024]}.freeze
+        SHA256 = /\A[0-9a-f]{64}\z/
+
+        class Input
+          def initialize(file, descriptor)
+            @file, @descriptor = file, descriptor
+          end
+
+          def bytes(index: 0)
+            unless index.is_a?(Integer) && index.between?(0, count - 1)
+              raise ArgumentError, "Invalid transferred part index"
+            end
+            part = @descriptor.fetch("parts").fetch(index)
+            offset = @descriptor.fetch("parts").take(index).sum { |entry| entry.fetch("bytes") }
+            @file.seek(offset)
+            bytes = (@file.read(part.fetch("bytes")) || "").b
+            unless bytes.bytesize == part["bytes"] && Digest::SHA256.hexdigest(bytes) == part["sha256"]
+              raise AttemptErrors::ReceiptRejected, "Transferred bytes no longer match accepted binding"
+            end
+            bytes
+          end
+
+          def count
+            @descriptor.fetch("parts").length
+          end
+        end
+
+        def initialize(root: nil)
+          @root = root && PrivateDirectory.verify!(root)
+        end
+
+        # Upload write-EOF is required before invoking the mutation consumer.
+        # Persistent launch prompt streams use their fixed framed entry point below.
+        def receive(socket, descriptor:, purpose:, deadline:)
+          receive_parts(socket, descriptor: descriptor, purpose: purpose, deadline: deadline, eof: true) { |input| yield input }
+        end
+
+        # Fixed authenticated launch_control stream only. A declared exact
+        # prompt body is followed by the next bounded control frame; unlike
+        # public uploads, this private duplex connection remains writable.
+        def receive_launch_prompt(socket, descriptor:, transfer_id:, deadline:)
+          deadline = [deadline, Process.clock_gettime(Process::CLOCK_MONOTONIC) + 30].min
+          marker = launch_prompt_marker(transfer_id)
+          receive_parts(socket, descriptor: descriptor, purpose: :prompt_text, deadline: deadline, eof: false) do |input|
+            boundary = Ace::Runtime::Molecules::ProtectedSocket.read(socket, deadline: deadline, limit: 16_384, with_size: true)
+            unless boundary.fetch(:data) == marker && boundary.fetch(:bytesize) == (JSON.generate(marker) + "\n").bytesize
+              reject!("Private prompt boundary differs")
+            end
+            yield input
+          end
+        end
+
+        def send_launch_prompt(socket, bytes:, descriptor:, transfer_id:, deadline:)
+          deadline = [deadline, Process.clock_gettime(Process::CLOCK_MONOTONIC) + 30].min
+          marker = launch_prompt_marker(transfer_id)
+          send(socket, parts: [bytes], descriptor: descriptor, purpose: :prompt_text, deadline: deadline)
+          Ace::Runtime::Molecules::ProtectedSocket.write(socket, marker, deadline: deadline, limit: 16_384)
+        end
+
+        def launch_prompt_marker(transfer_id)
+          unless transfer_id.is_a?(String) && transfer_id.match?(/\A[0-9a-f]{32}\z/)
+            raise ArgumentError, "invalid private prompt transfer identity"
+          end
+          {"type" => "launch_prompt_end", "transfer_id" => transfer_id}
+        end
+        private :launch_prompt_marker
+
+        def receive_parts(socket, descriptor:, purpose:, deadline:, eof:)
+          validate!(descriptor, purpose)
+          descriptor = descriptor.merge("parts" => descriptor.fetch("parts").map { |part| part.dup.freeze }.freeze).freeze
+          deadline = [deadline, Process.clock_gettime(Process::CLOCK_MONOTONIC) + 30].min
+          raise ArgumentError, "receive requires protected source scratch" unless @root
+          PrivateDirectory.verify!(@root)
+          Tempfile.create(["transfer-", ".bytes"], @root, binmode: true) do |file|
+            digest = Digest::SHA256.new
+            descriptor.fetch("parts").each do |part|
+              part_digest = Digest::SHA256.new
+              remaining = part.fetch("bytes")
+              while remaining.positive?
+                chunk = read(socket, [remaining, 65_536].min, deadline)
+                reject!("Transferred bytes ended early") if chunk.nil?
+                file.write(chunk)
+                digest.update(chunk)
+                part_digest.update(chunk)
+                remaining -= chunk.bytesize
+              end
+              reject!("Transferred part digest differs") unless part_digest.hexdigest == part["sha256"]
+            end
+            reject!("Transferred aggregate digest differs") unless digest.hexdigest == descriptor["sha256"]
+            reject!("Transferred bytes exceed declared size") if eof && !read(socket, 1, deadline).nil?
+            file.flush
+            file.rewind
+            yield Input.new(file, descriptor)
+          end
+        end
+        private :receive_parts
+
+        def descriptor(parts, purpose:)
+          reject!("Invalid transfer parts") unless parts.is_a?(Array) && parts.all? { |part| part.is_a?(String) }
+          digest = Digest::SHA256.new
+          parts.each { |part| digest.update(part.b) }
+          result = {"version" => 1, "bytes" => parts.sum(&:bytesize), "sha256" => digest.hexdigest,
+                    "parts" => parts.map { |part| {"bytes" => part.bytesize, "sha256" => Digest::SHA256.hexdigest(part.b)} }}
+          validate!(result, purpose)
+          result
+        end
+
+        # The caller writes the bounded JSON descriptor first, then these raw
+        # bytes. Both directions share the Server's original monotonic deadline.
+        def send(socket, parts:, descriptor:, purpose:, deadline:)
+          expected = self.descriptor(parts, purpose: purpose)
+          reject!("Export descriptor differs from bytes") unless expected == descriptor
+          deadline = [deadline, Process.clock_gettime(Process::CLOCK_MONOTONIC) + 30].min
+          parts.each do |part|
+            offset = 0
+            while offset < part.bytesize
+              wait(socket, deadline, write: true)
+              written = socket.write_nonblock(part.byteslice(offset, [65_536, part.bytesize - offset].min), exception: false)
+              offset += written unless written == :wait_writable
+            end
+          end
+        end
+
+        def validate!(descriptor, purpose)
+          total, count, each = LIMITS.fetch(purpose) { reject!("Unknown source transfer purpose") }
+          unless descriptor.is_a?(Hash) && descriptor.keys.sort == %w[bytes parts sha256 version] &&
+              descriptor["version"] == 1 && descriptor["bytes"].is_a?(Integer) &&
+              descriptor["bytes"].between?(0, total) && descriptor["sha256"].is_a?(String) && descriptor["sha256"].match?(SHA256) &&
+              descriptor["parts"].is_a?(Array) && descriptor["parts"].length.between?(1, count) &&
+              descriptor["parts"].all? { |part| part.is_a?(Hash) && part.keys.sort == %w[bytes sha256] &&
+                part["bytes"].is_a?(Integer) && part["bytes"].between?(0, each) &&
+                part["sha256"].is_a?(String) && part["sha256"].match?(SHA256) } &&
+              descriptor["bytes"] == descriptor["parts"].sum { |part| part["bytes"] } &&
+              (!%i[candidate service_input prompt_text].include?(purpose) || descriptor["bytes"].positive?)
+            reject!("Invalid or oversized transfer descriptor")
+          end
+          if purpose == :receipt_artifacts
+            receipt, *evidence = descriptor.fetch("parts")
+            unless receipt.fetch("bytes").between?(1, 16 * 1024) && evidence.sum { |part| part.fetch("bytes") } <= 256 * 1024
+              reject!("Receipt or evidence exceeds its fixed transfer limit")
+            end
+          end
+          true
+        end
+
+        private
+
+        def read(socket, count, deadline)
+          loop do
+            wait(socket, deadline)
+            bytes = socket.read_nonblock(count, exception: false)
+            return bytes unless bytes == :wait_readable
+          end
+        end
+
+        def wait(socket, deadline, write: false)
+          remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+          raise Timeout::Error, "Transfer deadline exceeded" unless remaining.positive?
+          ready = IO.select(write ? nil : [socket], write ? [socket] : nil, nil, remaining)
+          raise Timeout::Error, "Transfer deadline exceeded" unless ready
+        end
+
+        def reject!(message)
+          raise AttemptErrors::MalformedTransfer, message
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/cli/commands/assignment_target.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+require_relative "../../authority/protected_assignment_context"
 
 module Ace
   module Assign
@@ -11,11 +12,16 @@ module Ace
         # - <assignment-id>@<step-number>
         module AssignmentTarget
           DEFAULT_TARGET_ENV = "ACE_ASSIGN_DEFAULT_TARGET"
-          Target = Struct.new(:assignment_id, :scope, keyword_init: true)
+          Target = Struct.new(:assignment_id, :scope, :prepared_input, keyword_init: true)
           View = Struct.new(:assignment, :state, :scoped_state, :active_steps, :next_step, :focus_step, :scope_root, keyword_init: true)
 
           private
 
+          def refuse_protected_graph_mutation!(options)
+            context = @protected_assignment_context ||= Ace::Assign::Authority::ProtectedAssignmentContext.load
+            context.refuse_graph_mutation!(options: options)
+          end
+
           def resolve_assignment_target(options)
             assignment_raw = options[:assignment]
             explicit_target = unless assignment_raw.nil? || assignment_raw.to_s.strip.empty?
@@ -29,7 +35,13 @@ module Ace
                 "does not match #{DEFAULT_TARGET_ENV}=#{target_identity(env_target)}"
             end
 
-            explicit_target || env_target || Target.new(assignment_id: nil, scope: nil)
+            target = explicit_target || env_target || Target.new(assignment_id: nil, scope: nil)
+            context = @protected_assignment_context ||= Ace::Assign::Authority::ProtectedAssignmentContext.load
+            target.prepared_input = context.resolve(options: options, assignment_id: target.assignment_id, scope: target.scope)
+            if target.prepared_input && ![Status, Step, Start, Finish, Fail, Resume].any? { |command| is_a?(command) }
+              raise AttemptErrors::EvidenceUnavailable, "protected queue command requires a reviewed new prepared version and attempt"
+            end
+            target
           end
 
           def parse_assignment_target(raw)
@@ -63,6 +75,7 @@ module Ace
           end
 
           def build_executor_for_target(target)
+            return Ace::Assign::Authority::PreparedExecutor.new(target.prepared_input) if target.prepared_input
             return Organisms::AssignmentExecutor.new unless target.assignment_id
 
             manager = Molecules::AssignmentManager.new

data/lib/ace/assign/cli/commands/attempt/base.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "json"
+require_relative "../../../authority/protected_assignment_context"
 
 module Ace
   module Assign
@@ -13,6 +14,54 @@ module Ace
           module Base
             private
 
+            def protected_context(options)
+              keys = %i[mapping assignment result head candidate_generation mutation expected_generation inbox_context registration signature]
+              keys.each do |key|
+                if options.key?(key) && options[key].to_s.strip.empty?
+                  raise Ace::Support::Cli::Error, "Empty protected --#{key.to_s.tr('_', '-')} selector"
+                end
+              end
+              context = @protected_assignment_context ||= Ace::Assign::Authority::ProtectedAssignmentContext.load
+              selected = keys.any? do |key|
+                options.key?(key)
+              end
+              context if context.protected_participant? || selected || context.mapping_hint?
+            rescue SecurityError, Ace::Runtime::RuntimeUnavailableError
+              protected_transport_unavailable!
+            end
+
+            def protected_attempt_request(context, options, usage)
+              params = {"assignment_id" => require_option(options, :assignment, usage),
+                "attempt_id" => require_option(options, :attempt, usage),
+                "expected_generation" => integer_option(options, :expected_generation, usage)}
+              context.verify_attempt_hints!(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"))
+              [context.client(options: options), params, require_option(options, :mutation, usage)]
+            rescue SecurityError, Ace::Runtime::RuntimeUnavailableError
+              protected_transport_unavailable!
+            end
+
+            def protected_call(client, operation, params, mutation)
+              client.call(operation, params, mutation_id: mutation, timeout: 30).data
+            rescue SecurityError, Ace::Runtime::RuntimeUnavailableError
+              protected_transport_unavailable!
+            end
+
+            def protected_transport_unavailable!
+              raise AttemptErrors::EvidenceUnavailable, "Protected authority outcome unavailable; retain original selectors and mutation for reconciliation"
+            end
+
+            def integer_option(options, key, usage, positive: false)
+              value = options[key]
+              unless value.is_a?(Integer) || (value.is_a?(String) && value.match?(/\A(?:0|[1-9][0-9]*)\z/))
+                raise Ace::Support::Cli::Error, "--#{key.to_s.tr('_', '-')} requires an exact integer: #{usage}"
+              end
+              number = value.is_a?(Integer) ? value : Integer(value, 10)
+              unless positive ? number.positive? : number >= 0
+                raise Ace::Support::Cli::Error, "--#{key.to_s.tr('_', '-')} is out of range"
+              end
+              number
+            end
+
             def build_coordinator
               Organisms::AttemptCoordinator.new
             end

data/lib/ace/assign/cli/commands/attempt/finish.rb

@@ -8,18 +8,34 @@ module Ace
     module CLI
       module Commands
         module Attempt
-          # Accept a structured execution receipt and record the outcome.
-          # Terminal and uncertain attempts refuse new receipts.
+          # Protected completion selects an already submitted canonical result.
+          # Ordinary local completion accepts its structured receipt file.
           class Finish < Ace::Support::Cli::Command
             include Ace::Support::Cli::Base
             include Attempt::Base
 
-            desc "Finish an attempt with a structured execution receipt"
+            desc "Finish a protected canonical result or an ordinary local receipt"
 
             option :attempt, desc: "Attempt ID"
-            option :receipt, desc: "Path to the receipt JSON file"
+            option :mapping, desc: "Exact installed protected mapping ID"
+            option :assignment, desc: "Exact protected assignment ID"
+            option :mutation, desc: "Stable original authority mutation ID"
+            option :expected_generation, desc: "Original authority mutation generation"
+            option :receipt, desc: "Path to the ordinary local receipt JSON file"
+            option :result, desc: "Already submitted canonical protected result ID"
+            option :head, desc: "Exact canonical candidate head"
+            option :candidate_generation, desc: "Original canonical candidate generation"
 
             def call(**options)
+              if (context = protected_context(options))
+                raise Ace::Support::Cli::Error, "Protected finish forbids --receipt" unless options[:receipt].to_s.empty?
+                usage = "finish --mapping MAP --assignment ID --attempt ID --result ID --head SHA --candidate-generation N --mutation ID --expected-generation N"
+                client, params, mutation = protected_attempt_request(context, options, usage)
+                params.merge!("result_id" => require_option(options, :result, usage), "head" => require_option(options, :head, usage),
+                  "candidate_generation" => integer_option(options, :candidate_generation, usage, positive: true))
+                emit_json(protected_call(client, "finish", params, mutation))
+                return
+              end
               attempt_id = require_option(options, :attempt, "finish --attempt ID --receipt FILE")
               receipt = require_option(options, :receipt, "finish --attempt ID --receipt FILE")
 

data/lib/ace/assign/cli/commands/attempt/reconcile.rb

@@ -17,9 +17,20 @@ module Ace
             desc "Reconcile an interrupted or uncertain attempt"
 
             option :attempt, desc: "Attempt ID"
+            option :mapping, desc: "Exact installed protected mapping ID"
+            option :assignment, desc: "Exact protected assignment ID"
+            option :mutation, desc: "Stable original authority mutation ID"
+            option :expected_generation, desc: "Original authority mutation generation"
             option :receipt, desc: "Path to the receipt JSON file (required to resolve uncertainty)"
 
             def call(**options)
+              if (context = protected_context(options))
+                raise Ace::Support::Cli::Error, "Protected recovery forbids --receipt" unless options[:receipt].to_s.empty?
+                usage = "reconcile --mapping MAP --assignment ID --attempt ID --mutation ID --expected-generation N"
+                client, params, mutation = protected_attempt_request(context, options, usage)
+                emit_json(protected_call(client, "recover", params, mutation))
+                return
+              end
               attempt_id = require_option(options, :attempt, "reconcile --attempt ID [--receipt FILE]")
               receipt = options[:receipt].to_s.strip
 

data/lib/ace/assign/cli/commands/authority/inbox_context_principal.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+require_relative "../../../authority/prepared_task_context"
+
+module Ace
+  module Assign
+    module CLI
+      module Commands
+        module Authority
+          class InboxContextPrincipal < Ace::Support::Cli::Command
+            desc "Classify the actual caller through every retained protected owner"
+
+            def call(**options)
+              raise ArgumentError, "fixed inbox context options differ" unless options.empty?
+              consumer = Ace::Assign::Authority::PreparedTaskContext.new(context: @protected_assignment_context)
+              $stdout.write(consumer.inbox_principal())
+              0
+            rescue ArgumentError, Ace::Runtime::Error, Ace::Assign::Error => error
+              raise Ace::Support::Cli::Error, error.message
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/cli/commands/authority/inbox_context_selection.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+require_relative "../../../authority/prepared_task_context"
+
+module Ace
+  module Assign
+    module CLI
+      module Commands
+        module Authority
+          class InboxContextSelection < Ace::Support::Cli::Command
+            desc "Read the fixed installed inbox context selection"
+            option :project, required: true, desc: "Installed project ID"
+            option :mapping, required: true, desc: "Installed mapping ID"
+            option :inbox_context, required: true, desc: "Installed inbox context ID"
+
+            def call(**options)
+              raise ArgumentError, "fixed inbox context options differ" unless options.keys.sort == %i[inbox_context mapping project]
+              consumer = Ace::Assign::Authority::PreparedTaskContext.new(context: @protected_assignment_context)
+              $stdout.write(consumer.inbox_selection(**options))
+              0
+            rescue ArgumentError, Ace::Runtime::Error, Ace::Assign::Error => error
+              raise Ace::Support::Cli::Error, error.message
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/cli/commands/authority/launch.rb

@@ -0,0 +1,97 @@
+# frozen_string_literal: true
+require "json"
+require_relative "../../../authority/launch_driver"
+module Ace
+  module Assign
+    module CLI
+      module Commands
+        module Authority
+          class Launch < Ace::Support::Cli::Command
+            desc "Launch one mapped worker and retain its original foreground control channel"
+            READY_FIELDS = %w[assignment_id attempt_id generation journal_commit mapping_id original_binding_digest type version].freeze
+            READY_LIMIT = 16_384
+            option :mapping, required: true, desc: "Installed launch mapping ID"
+            option :assignment, desc: "Managed assignment ID"
+            option :definition, desc: "Retained final prepared assignment definition JSON file"
+            option :prepared_bundle, desc: "Retained original prepared input Git bundle"
+            option :step, desc: "Assignment subtree scope"
+            option :base_head, desc: "Exact base commit SHA"
+            option :mutation, desc: "Stable invocation ID for safe replay"
+            option :dry_run, type: :boolean, default: false, desc: "Verify installed boundary without mutation or creation"
+            def call(**options)
+              driver = build_driver(options.fetch(:mapping))
+              result = if options[:dry_run]
+                driver.preflight
+              else
+                %i[assignment definition prepared_bundle step base_head].each do |key|
+                  raise ArgumentError, "Missing --#{key.to_s.tr('_', '-')}" unless options[key].is_a?(String) && !options[key].empty?
+                end
+                definition = retained_input(options[:definition], 32_768).force_encoding(Encoding::UTF_8)
+                raise ArgumentError, "assignment definition is not UTF-8" unless definition.valid_encoding?
+                bundle = retained_input(options[:prepared_bundle], Ace::Assign::Authority::CandidateTransfer::MAX_BYTES)
+                args = {prepared_bundle: bundle, assignment_id: options[:assignment], definition_bytes: definition,
+                  scope: options[:step], base_head: options[:base_head]}
+                args[:mutation_id] = options[:mutation] if options[:mutation]
+                driver.launch(**args)
+              end
+              if !options[:dry_run] && result["phase"] == "issued"
+                retaining_control = true
+                announced = false
+                driver.serve_control!(state: result) do |ready|
+                  raise ArgumentError, "original launch readiness was already announced" if announced
+                  line = readiness_line(ready, result, options)
+                  $stdout.write(line)
+                  $stdout.flush
+                  announced = true
+                end
+                raise ArgumentError, "original control ended before authenticated readiness" unless announced
+              else
+                puts JSON.generate(result)
+              end
+            rescue ArgumentError, SystemCallError, Ace::Runtime::Error, Ace::Assign::Error => error
+              raise Ace::Support::Cli::Error, error.message
+            ensure
+              # Local foreground-loop cancellation is not a stopped/settled proof.
+              driver.request_control_cancel if retaining_control
+            end
+            private
+            def retained_input(path, limit)
+              File.open(path, File::RDONLY | File::NOFOLLOW | File::NONBLOCK) do |file|
+                before = file.stat
+                unless before.file? && before.size.between?(1, limit)
+                  raise ArgumentError, "retained launch input is not a bounded regular file"
+                end
+                bytes = (file.read(limit + 1) || "").b
+                after = file.stat
+                identity = ->(stat) { [stat.dev, stat.ino, stat.size, stat.mtime, stat.ctime] }
+                unless bytes.bytesize == before.size && bytes.bytesize <= limit && identity.call(before) == identity.call(after)
+                  raise ArgumentError, "retained launch input changed while reading"
+                end
+                bytes
+              end
+            end
+
+            def readiness_line(ready, result, options)
+              unless ready.is_a?(Hash) && ready.keys.all? { |key| key.is_a?(String) } && ready.keys.sort == READY_FIELDS &&
+                  ready["version"].is_a?(Integer) && ready["version"] == 1 && ready["type"] == "launch_ready" &&
+                  ready.values_at("mapping_id", "assignment_id", "attempt_id") ==
+                    [options.fetch(:mapping), options.fetch(:assignment), result.fetch("attempt_id")] &&
+                  ready["generation"].is_a?(Integer) && ready["generation"].positive? &&
+                  ready["journal_commit"].is_a?(String) && ready["journal_commit"].match?(/\A(?:[0-9a-f]{40}|[0-9a-f]{64})\z/) &&
+                  ready["original_binding_digest"].is_a?(String) && ready["original_binding_digest"].match?(/\A[0-9a-f]{64}\z/)
+                raise ArgumentError, "original launch readiness is malformed or mismatched"
+              end
+              line = JSON.generate(ready) + "\n"
+              raise ArgumentError, "original launch readiness is oversized" if line.bytesize > READY_LIMIT
+              line
+            end
+
+            def build_driver(mapping)
+              Ace::Assign::Authority::LaunchDriver.new(mapping_id: mapping)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/cli/commands/authority/serve.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+require_relative "../../../authority/server"
+require_relative "../../../authority/router"
+require_relative "../../../authority/launch_lifecycle"
+module Ace
+  module Assign
+    module CLI
+      module Commands
+        module Authority
+          class Serve < Ace::Support::Cli::Command
+            desc "Serve the installed protected assignment authority"
+            option :authority, required: true, desc: "Installed authority ID"
+            def call(**options)
+              deployment = Ace::Assign::Authority::Deployment.load
+              history = Ace::Assign::Authority::DeploymentHistory.load
+              launch = Ace::Assign::Authority::LaunchLifecycle.new(deployment: deployment, deployment_history: history)
+              router = Ace::Assign::Authority::Router.new(launch: launch)
+              server = Ace::Assign::Authority::Server.new(authority_id: options.fetch(:authority), deployment: deployment, lifecycle: router)
+              signals = %w[INT TERM].to_h { |signal| [signal, Signal.trap(signal) { server.request_stop }] }
+              server.serve
+            rescue ArgumentError, Ace::Runtime::Error, Ace::Assign::Error => error
+              raise Ace::Support::Cli::Error, error.message
+            ensure
+              signals&.each { |signal, handler| Signal.trap(signal, handler) }
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/cli/commands/authority/status.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+require "json"
+require_relative "../../../authority/client"
+module Ace
+  module Assign
+    module CLI
+      module Commands
+        module Authority
+          class Status < Ace::Support::Cli::Command
+            desc "Inspect canonical protected launch ownership"
+            option :mapping, required: true, desc: "Installed launch mapping ID"
+            option :assignment, required: true, desc: "Assignment ID"
+            option :attempt, required: true, desc: "Attempt ID"
+            def call(**options)
+              reply = Ace::Assign::Authority::Client.new(mapping_id: options.fetch(:mapping)).call("attempt_status",
+                {"assignment_id" => options.fetch(:assignment), "attempt_id" => options.fetch(:attempt), "result_candidate_generation" => nil})
+              puts JSON.generate(reply.data)
+            rescue ArgumentError, Ace::Runtime::Error, Ace::Assign::Error => error
+              raise Ace::Support::Cli::Error, error.message
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/cli/commands/authority/task_context.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+require_relative "../../../authority/prepared_task_context"
+
+module Ace
+  module Assign
+    module CLI
+      module Commands
+        module Authority
+          class TaskContext < Ace::Support::Cli::Command
+            desc "Return the captured original task context through the fixed selected entry"
+            option :mapping, required: true, desc: "Installed original mapping ID"
+            option :assignment, required: true, desc: "Original assignment ID@SCOPE"
+            option :attempt, required: true, desc: "Original protected attempt ID"
+            option :task, required: true, desc: "Captured canonical task ID"
+
+            def call(**options)
+              unless options.keys.sort == %i[assignment attempt mapping task]
+                raise ArgumentError, "fixed task-context accepts only its four selectors"
+              end
+              consumer = Ace::Assign::Authority::PreparedTaskContext.new(context: @protected_assignment_context)
+              $stdout.write(consumer.call(**options))
+              0
+            rescue ArgumentError, Ace::Runtime::Error, Ace::Assign::Error => error
+              raise Ace::Support::Cli::Error, error.message
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/cli/commands/authority/task_context_principal.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+require_relative "../../../authority/prepared_task_context"
+
+module Ace
+  module Assign
+    module CLI
+      module Commands
+        module Authority
+          class TaskContextPrincipal < Ace::Support::Cli::Command
+            desc "Classify this actual caller through the installed and retained protected owners"
+
+            def call(**options)
+              raise ArgumentError, "fixed task-context-principal accepts no options" unless options.empty?
+              consumer = Ace::Assign::Authority::PreparedTaskContext.new(context: @protected_assignment_context)
+              $stdout.write(consumer.principal)
+              0
+            rescue ArgumentError, Ace::Runtime::Error, Ace::Assign::Error => error
+              raise Ace::Support::Cli::Error, error.message
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/cli/commands/authority/task_context_selection.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+require_relative "../../../authority/prepared_task_context"
+
+module Ace
+  module Assign
+    module CLI
+      module Commands
+        module Authority
+          class TaskContextSelection < Ace::Support::Cli::Command
+            desc "Return the authenticated original task-context entry without captured text"
+            option :mapping, required: true, desc: "Installed original mapping ID"
+            option :assignment, required: true, desc: "Original assignment ID@SCOPE"
+            option :attempt, required: true, desc: "Original protected attempt ID"
+
+            def call(**options)
+              unless options.keys.sort == %i[assignment attempt mapping]
+                raise ArgumentError, "fixed task-context-selection accepts only its three selectors"
+              end
+              consumer = Ace::Assign::Authority::PreparedTaskContext.new(context: @protected_assignment_context)
+              $stdout.write(consumer.selection(**options))
+              0
+            rescue ArgumentError, Ace::Runtime::Error, Ace::Assign::Error => error
+              raise Ace::Support::Cli::Error, error.message
+            end
+          end
+        end
+      end
+    end
+  end
+end