ace-assign 0.63.1 → 0.66.0

data/lib/ace/assign/molecules/execution_identity_resolver.rb

@@ -13,7 +13,7 @@ module Ace
       # Actor identity is derived from the execution boundary, never granted
       # by command flags or receipt claims. Two adapters ship:
       # - `local` — the interactive operator is the coordinator; identity
-      #   comes from the OS login boundary.
+      #   comes from the kernel process account (equal real/effective UID).
       # - `service` — a trusted service executor supplies a structured
       #   identity through a configured environment variable; the executor
       #   owns OS/process enforcement.
@@ -25,14 +25,17 @@ module Ace
         TRUSTED_ROLES = %w[coordinator service].freeze
 
         # Resolved boundary identity.
-        Identity = Struct.new(:actor, :role, :runtime, :adapter, keyword_init: true)
+        Identity = Struct.new(:actor, :role, :runtime, :adapter, :process_pid, :runtime_binding, keyword_init: true)
 
         # @param adapter [String, nil] "local" or "service" (default from config)
         # @param service_env [String, nil] Env var carrying the service identity (default from config)
-        def initialize(adapter: nil, service_env: nil)
+        def initialize(adapter: nil, service_env: nil, runtime_resolver: Ace::Runtime, env: ENV, caller_pid: Process.ppid)
           section = Ace::Assign.config["attempt"] || {}
           @adapter = adapter || section["identity_adapter"] || "local"
           @service_env = service_env || section["service_identity_env"] || "ACE_ASSIGN_SERVICE_IDENTITY"
+          @runtime_resolver = runtime_resolver
+          @env = env
+          @caller_pid = caller_pid
         end
 
         # @return [Identity] Trusted boundary identity
@@ -55,19 +58,41 @@ module Ace
         private
 
         def from_local_boundary
-          actor = Etc.getlogin || ENV["USER"] || ENV["LOGNAME"]
-          if actor.nil? || actor.strip.empty?
-            raise AttemptErrors::UnauthorizedIdentity, "No OS login identity available at the execution boundary"
+          uid, euid = Process.uid, Process.euid
+          unless uid == euid
+            raise AttemptErrors::UnauthorizedIdentity, "Local execution requires equal real and effective UIDs"
           end
 
+          account = local_account(euid)
+          verify_local_credentials!(uid, euid)
+          binding = native_process_binding
+          verify_local_credentials!(uid, euid)
           Identity.new(
-            actor: actor.strip,
+            actor: account.name,
             role: "coordinator",
             runtime: "local:#{Socket.gethostname}",
-            adapter: "local"
+            adapter: "local",
+            process_pid: binding&.dig("process_identity", "pid"),
+            runtime_binding: binding
           )
         end
 
+        def local_account(euid)
+          account = Etc.getpwuid(euid)
+          unless account && account.uid == euid && account.name.is_a?(String) && !account.name.strip.empty?
+            raise AttemptErrors::UnauthorizedIdentity, "No valid kernel process account for effective UID #{euid}"
+          end
+          account
+        rescue ArgumentError, SystemCallError
+          raise AttemptErrors::UnauthorizedIdentity, "Cannot resolve kernel process account for effective UID #{euid}"
+        end
+
+        def verify_local_credentials!(uid, euid)
+          unless Process.uid == uid && Process.euid == euid
+            raise AttemptErrors::UnauthorizedIdentity, "Local execution credentials changed during identity resolution"
+          end
+        end
+
         def from_service_env
           raw = ENV[@service_env].to_s.strip
           if raw.empty?
@@ -89,7 +114,22 @@ module Ace
               "Service identity must supply actor, runtime, and a role in #{ROLES.join('/')}"
           end
 
-          Identity.new(actor: actor, role: role, runtime: runtime, adapter: "service")
+          pid = data["process_pid"]
+          if pid && (!pid.is_a?(Integer) || !pid.positive?)
+            raise AttemptErrors::UnauthorizedIdentity, "Service process_pid must be a positive integer"
+          end
+          Identity.new(actor: actor, role: role, runtime: runtime, adapter: "service", process_pid: pid)
+        end
+
+        def native_process_binding
+          adapter = Ace::Runtime::Molecules::RuntimeSelector.new(
+            config: Ace::Runtime.config, registry: @runtime_resolver, env: @env).resolve
+          context = adapter.context
+          return nil unless context[:in_runtime] && context[:pane]
+
+          adapter.process_binding(pane: context[:pane], caller_pid: @caller_pid)
+        rescue Ace::Runtime::Error
+          nil
         end
       end
     end

data/lib/ace/assign/molecules/execution_scope_lineage.rb

@@ -0,0 +1,345 @@
+# frozen_string_literal: true
+
+require_relative "../models/evidence_event"
+require "json"
+
+module Ace
+  module Assign
+    module Molecules
+      # Canonical lineage only. Live owner/boundary observation and lifecycle
+      # exclusion are mandatory before recording or consuming a fresh proof.
+      # This reader never promotes cached population into a proof event.
+      class ExecutionScopeLineage
+        BINDING_FIELDS = %w[project_id assignment_id attempt_id mapping_id slot_id reservation_generation
+          scope_generation deployment_digest boot_id slice_invocation_id cgroup_identity resource_mount_namespace_identity resource_identities network_installation_selection network_namespace_identity boot_baseline_selection].freeze
+        PROOF_FIELDS = %w[scope_generation scope_binding_event_id seal_event_id boot_id slice_invocation_id
+          cgroup_identity populated].freeze
+        PROCESS_FIELDS = %w[pid uid gid groups started_at host parent_pid].freeze
+        RESOURCE_FIELDS = %w[host_path view_path mount_id filesystem_type device inode uid gid].freeze
+        CGROUP_FIELDS = %w[path mount_id filesystem_type device inode].freeze
+        ID = /\A[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}\z/
+        DIGEST = /\A[0-9a-f]{64}\z/
+        INVOCATION = /\A[0-9a-f]{32}\z/
+        BOOT = /\A[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\z/
+
+        def self.validate_process_identity!(value, boot_id:)
+          unless boot_id.is_a?(String) && BOOT.match?(boot_id) && value.is_a?(Hash) && value.keys.sort == PROCESS_FIELDS.sort
+            raise AttemptErrors::EvidenceUnavailable, "scope process identity fields differ"
+          end
+          groups = value["groups"]
+          unless %w[pid uid gid parent_pid].all? { |key| value[key].is_a?(Integer) && value[key].positive? } &&
+              groups.is_a?(Array) && groups.all? { |id| id.is_a?(Integer) && id.positive? } && groups == groups.sort.uniq &&
+              value["started_at"].is_a?(String) && value["started_at"].match?(/\Alinux:#{Regexp.escape(boot_id)}:[0-9]+\z/) &&
+              value["host"].is_a?(String) && !value["host"].empty?
+            raise AttemptErrors::EvidenceUnavailable, "scope process birth/credentials are malformed"
+          end
+          value
+        end
+
+        def self.validate_network_selection!(selection)
+          unless selection.is_a?(Hash) && selection.keys.sort == %w[installer_artifact policy_export profile report]
+            raise AttemptErrors::EvidenceUnavailable, "network installation selection is not closed"
+          end
+          selection.each_value do |ref|
+            unless ref.is_a?(Hash) && ref.keys.sort == %w[bytes path sha256] && ref["path"].is_a?(String) &&
+                ref["path"].bytesize.between?(1, 4096) && ref["path"].start_with?("/") && !ref["path"].include?("\0") &&
+                File.expand_path(ref["path"]) == ref["path"] && ref["sha256"].is_a?(String) && DIGEST.match?(ref["sha256"]) &&
+                ref["bytes"].is_a?(Integer) && ref["bytes"].between?(1, 1_048_576)
+              raise AttemptErrors::EvidenceUnavailable, "network installation artifact reference differs"
+            end
+          end
+          selection
+        end
+
+        def self.validate_boot_baseline_selection!(ref)
+          unless ref.is_a?(Hash) && ref.keys.sort == %w[bytes path sha256] && ref["path"].is_a?(String) &&
+              ref["path"].bytesize.between?(1, 4096) && ref["path"].start_with?("/") && !ref["path"].include?("\0") &&
+              File.expand_path(ref["path"]) == ref["path"] && ref["sha256"].is_a?(String) && DIGEST.match?(ref["sha256"]) &&
+              ref["bytes"].is_a?(Integer) && ref["bytes"].between?(1, 16_384)
+            raise AttemptErrors::EvidenceUnavailable, "boot baseline artifact reference differs"
+          end
+          ref
+        end
+
+        attr_reader :binding_event, :native_event, :child_event, :seal_event, :proof_event, :admission_event
+
+        def initialize(events:, project_id:, assignment_id:, attempt_id:, mapping_id:)
+          events = freeze_tree(JSON.parse(JSON.generate(events)))
+          unless events.is_a?(Array) && Models::EvidenceEvent.chain_valid?(events) &&
+              events.all? { |event| event["attempt_id"] == attempt_id }
+            unavailable!("scope requires its intact exact attempt chain")
+          end
+          @expected = {"project_id" => project_id, "assignment_id" => assignment_id,
+            "attempt_id" => attempt_id, "mapping_id" => mapping_id}
+          generation = 0
+          events.each do |event|
+            generation += 1 if event["type"] == "authority_mutation"
+            accept_reservation!(event, generation) if event["type"] == "authority_mutation" &&
+              event.dig("payload", "operation") == "reserve_attempt"
+            accept_admission!(event, generation) if event["type"] == "authority_mutation" &&
+              event.dig("payload", "operation") == "scope_service_admission"
+            case event["type"]
+            when "scope_bound" then accept_binding!(event, generation + 1)
+            when "scope_native_bound" then accept_native!(event)
+            when "scope_child_bound" then accept_child!(event)
+            when "scope_sealed" then accept_seal!(event)
+            when "scope_closed_no_writers" then accept_proof!(event)
+            end
+          end
+        rescue KeyError, NoMethodError, TypeError
+          unavailable!("canonical scope lineage is incomplete")
+        end
+
+        def binding
+          binding_event&.fetch("payload")
+        end
+
+        def sealed?
+          !seal_event.nil?
+        end
+
+        def proof_id
+          proof_event&.fetch("digest")
+        end
+
+        def require_open!
+          unavailable!("canonical scope binding is missing") unless binding
+          raise AttemptErrors::Conflict, "execution generation is sealed" if sealed?
+          true
+        end
+
+        def require_launch_bound!
+          require_open!
+          unavailable!("original native and child stages are missing") unless native_event && child_event
+          child_event.fetch("payload").fetch("original_process_binding")
+        end
+
+        def require_positive!(scope_generation:, scope_binding_event_id:, seal_event_id:, proof_id:)
+          unless proof_event && binding.fetch("scope_generation") == scope_generation &&
+              binding_event.fetch("digest") == scope_binding_event_id && seal_event.fetch("digest") == seal_event_id &&
+              proof_event.fetch("digest") == proof_id
+            unavailable!("exact canonical scope proof is unavailable")
+          end
+          proof_event.fetch("payload")
+        end
+
+        private
+
+        def accept_reservation!(event, generation)
+          unavailable!("canonical reservation is repeated") if @reservation
+          value = event.dig("payload", "data")
+          unless value.is_a?(Hash) && value.slice(*@expected.keys) == @expected &&
+              value["reservation_generation"] == generation && value["generation"] == generation &&
+              value["launch_ticket"].is_a?(String) && ID.match?(value["launch_ticket"])
+            unavailable!("canonical reservation binding differs")
+          end
+          @reservation = value
+        end
+
+        def freeze_tree(value)
+          case value
+          when Hash then value.each { |key, item| key.freeze; freeze_tree(item) }
+          when Array then value.each { |item| freeze_tree(item) }
+          end
+          value.freeze
+        end
+
+        def accept_binding!(event, generation)
+          unavailable!("scope binding cannot be replaced") if binding_event
+          value = event.fetch("payload")
+          exact_fields!(value, BINDING_FIELDS)
+          unless value.slice(*@expected.keys) == @expected &&
+              value["slot_id"].is_a?(String) && ID.match?(value["slot_id"]) &&
+              value["scope_generation"] == generation && @reservation &&
+              value["reservation_generation"] == @reservation["reservation_generation"] &&
+              digest?(value["deployment_digest"]) && boot?(value["boot_id"]) &&
+              invocation?(value["slice_invocation_id"])
+            unavailable!("scope generation binding differs")
+          end
+          cgroup!(value.fetch("cgroup_identity"))
+          namespace!(value.fetch("resource_mount_namespace_identity"))
+          namespace!(value.fetch("network_namespace_identity"))
+          self.class.validate_network_selection!(value.fetch("network_installation_selection"))
+          self.class.validate_boot_baseline_selection!(value.fetch("boot_baseline_selection"))
+          resources = value.fetch("resource_identities")
+          resources!(resources)
+          @binding_event = event
+        end
+
+        def stage_reference!(value)
+          unavailable!("scope stage requires its original open parent") unless binding && !sealed?
+          unless value["scope_generation"] == binding.fetch("scope_generation") &&
+              value["scope_binding_event_id"] == binding_event.fetch("digest")
+            unavailable!("scope stage references another parent")
+          end
+        end
+
+        def accept_admission!(event, generation)
+          unavailable!("native admission cannot replace an existing stage") if admission_event || native_event
+          value = event.fetch("payload").fetch("data")
+          stage_reference!(value)
+          unless value.slice(*@expected.keys) == @expected && value["generation"] == generation &&
+              value["native_admission"] == "issued_uncertain"
+            unavailable!("native admission does not name the exact current reserved owner")
+          end
+          installation = value.fetch("network_installation")
+          exact_fields!(installation, %w[report_id boot_id slot_id namespace_path namespace_identity profile_sha256 policy_export_sha256 report_sha256 installer_artifact_sha256])
+          namespace!(installation.fetch("namespace_identity"))
+          selection = binding.fetch("network_installation_selection")
+          unless boot?(installation["report_id"]) && installation["boot_id"] == binding["boot_id"] &&
+              installation["slot_id"] == binding["slot_id"] && installation["namespace_identity"] == binding["network_namespace_identity"] &&
+              installation["namespace_path"].is_a?(String) && installation["namespace_path"].start_with?("/") &&
+              !installation["namespace_path"].include?("\0") && File.expand_path(installation["namespace_path"]) == installation["namespace_path"] &&
+              %w[profile policy_export report installer_artifact].all? { |key| installation["#{key}_sha256"] == selection.fetch(key).fetch("sha256") }
+            unavailable!("native admission installation differs from original parent selection")
+          end
+          @admission_event = event
+        end
+
+        def accept_native!(event)
+          unavailable!("native binding cannot be replaced") if native_event
+          value = event.fetch("payload")
+          exact_fields!(value, %w[scope_generation scope_binding_event_id service_invocation_id server_identity socket_identity workspace_id
+            mount_namespace_identity resource_observer_identity resource_identities network_namespace_identity network_admission_event_id])
+          stage_reference!(value)
+          namespace!(value.fetch("network_namespace_identity"))
+          unless admission_event && value["network_admission_event_id"] == admission_event.fetch("digest") &&
+              value["network_namespace_identity"] == binding.fetch("network_namespace_identity")
+            unavailable!("native server does not join the original admitted network installation")
+          end
+          process!(value.fetch("server_identity"), binding.fetch("boot_id"))
+          socket = value.fetch("socket_identity")
+          unless invocation?(value["service_invocation_id"]) && value["workspace_id"].is_a?(String) &&
+              value["workspace_id"].match?(/\Aw[1-9][0-9]{0,8}\z/) && socket.is_a?(Array) && socket.size == 3 &&
+              socket.all? { |part| part.is_a?(Integer) && part >= 0 } && socket.last == value.dig("server_identity", "uid")
+            unavailable!("scope native incarnation differs")
+          end
+          namespace!(value.fetch("mount_namespace_identity"))
+          observer = value.fetch("resource_observer_identity")
+          process!(observer, binding.fetch("boot_id"))
+          server = value.fetch("server_identity")
+          unless observer.values_at("uid", "gid", "groups", "host") == server.values_at("uid", "gid", "groups", "host") &&
+              observer["pid"] != server["pid"]
+            unavailable!("native resource observer is not the distinct fixed same-user hook")
+          end
+          resources!(value.fetch("resource_identities"))
+          parent_resources = binding.fetch("resource_identities").to_h { |resource| [resource.values_at("host_path", "view_path"), resource] }
+          value.fetch("resource_identities").each do |resource|
+            original = parent_resources[resource.values_at("host_path", "view_path")]
+            if original && original.slice("device", "inode", "filesystem_type", "uid", "gid") != resource.slice("device", "inode", "filesystem_type", "uid", "gid")
+              unavailable!("native view substitutes a parent-pinned backing object")
+            end
+          end
+          @native_event = event
+        end
+
+        def accept_child!(event)
+          unavailable!("child binding requires its single native predecessor") unless native_event && !child_event
+          value = event.fetch("payload")
+          exact_fields!(value, %w[scope_generation scope_binding_event_id native_binding_event_id original_process_binding])
+          stage_reference!(value)
+          unless value["native_binding_event_id"] == native_event.fetch("digest")
+            unavailable!("child references another native incarnation")
+          end
+          native = native_event.fetch("payload")
+          original = value.fetch("original_process_binding")
+          exact_fields!(original, %w[runtime session pane terminal_id process_identity shell_identity native_origin])
+          process!(original.fetch("process_identity"), binding.fetch("boot_id"))
+          socket = native.fetch("socket_identity")
+          server = native.fetch("server_identity")
+          child = original.fetch("process_identity")
+          origin = original.fetch("native_origin")
+          exact_fields!(origin, %w[workspace tab pane server_identity socket_identity command cwd])
+          command = origin.fetch("command")
+          unless child["parent_pid"] == server["pid"] &&
+              child.values_at("uid", "gid", "groups") == server.values_at("uid", "gid", "groups") &&
+              original["runtime"] == "herdr" && original["shell_identity"] == child &&
+              original["session"] == native["workspace_id"] && origin["workspace"] == native["workspace_id"] &&
+              origin["server_identity"] == server && origin["socket_identity"] == socket &&
+              origin["pane"] == original["pane"] && %w[pane terminal_id].all? { |key| original[key].is_a?(String) && !original[key].empty? } &&
+              origin["tab"].is_a?(String) && !origin["tab"].empty? && path?(origin["cwd"]) &&
+              command.is_a?(Array) && command.size == 3 && path?(command.first) && command[1] == binding["mapping_id"] &&
+              command.last == @reservation.fetch("launch_ticket")
+            unavailable!("scope original-child lineage differs")
+          end
+          @child_event = event
+        end
+
+        def accept_seal!(event)
+          unavailable!("scope seal has no immutable binding or is repeated") unless binding && !seal_event
+          value = event.fetch("payload")
+          exact_fields!(value, %w[scope_generation scope_binding_event_id])
+          unless value == {"scope_generation" => binding.fetch("scope_generation"),
+                          "scope_binding_event_id" => binding_event.fetch("digest")}
+            unavailable!("scope seal references another incarnation")
+          end
+          @seal_event = event
+        end
+
+        def accept_proof!(event)
+          unavailable!("scope proof requires its original seal and single observation") unless sealed? && !proof_event
+          value = event.fetch("payload")
+          exact_fields!(value, PROOF_FIELDS)
+          expected = binding.slice("scope_generation", "boot_id", "slice_invocation_id", "cgroup_identity")
+          expected.merge!("scope_binding_event_id" => binding_event.fetch("digest"),
+            "seal_event_id" => seal_event.fetch("digest"), "populated" => 0)
+          unavailable!("scope proof is not exact sealed empty population") unless value == expected
+          @proof_event = event
+        end
+
+        def namespace!(value)
+          exact_fields!(value, %w[device inode])
+          unless value["device"].is_a?(Integer) && value["device"] >= 0 && positive_integer?(value["inode"])
+            unavailable!("scope mount namespace identity is malformed")
+          end
+        end
+
+        def resources!(resources)
+          unless resources.is_a?(Array) && resources.size <= 64 &&
+              resources.all? { |resource| resource.is_a?(Hash) } &&
+              resources.map { |resource| resource.values_at("host_path", "view_path") }.uniq.size == resources.size &&
+              resources.map { |resource| resource["view_path"] }.uniq.size == resources.size
+            unavailable!("scope resource observations are duplicate or oversized")
+          end
+          resources.each do |resource|
+            exact_fields!(resource, RESOURCE_FIELDS)
+            unless path?(resource["host_path"]) && path?(resource["view_path"]) && positive_integer?(resource["mount_id"]) &&
+                %w[device inode uid gid].all? { |key| resource[key].is_a?(Integer) && resource[key] >= 0 } &&
+                resource["filesystem_type"].is_a?(String) && resource["filesystem_type"].bytesize.between?(1, 64) &&
+                resource["filesystem_type"].ascii_only? && !resource["filesystem_type"].match?(/[\s\0]/)
+              unavailable!("scope resource identity is malformed")
+            end
+          end
+        end
+
+        def cgroup!(value)
+          exact_fields!(value, CGROUP_FIELDS)
+          unless path?(value["path"]) && value["path"].start_with?("/sys/fs/cgroup/") &&
+              value["filesystem_type"] == "cgroup2" &&
+              %w[mount_id device inode].all? { |key| value[key].is_a?(Integer) && value[key] >= 0 }
+            unavailable!("scope parent object identity is malformed")
+          end
+        end
+
+        def process!(value, boot_id)
+          self.class.validate_process_identity!(value, boot_id: boot_id)
+        end
+
+        def exact_fields!(value, keys)
+          unavailable!("scope event schema differs") unless value.is_a?(Hash) && value.keys.sort == keys.sort
+        end
+
+        def path?(value)
+          value.is_a?(String) && value.bytesize.between?(2, 4096) && !value.include?("\0") &&
+            value.start_with?("/") && File.expand_path(value) == value
+        end
+
+        def positive_integer?(value) = value.is_a?(Integer) && value.positive?
+        def digest?(value) = value.is_a?(String) && DIGEST.match?(value)
+        def boot?(value) = value.is_a?(String) && BOOT.match?(value)
+        def invocation?(value) = value.is_a?(String) && INVOCATION.match?(value)
+        def unavailable!(message) = raise(AttemptErrors::EvidenceUnavailable, message)
+      end
+    end
+  end
+end

data/lib/ace/assign/molecules/fork_session_launcher.rb

@@ -85,14 +85,22 @@ module Ace
         end
 
         def launch_provider_session(assignment_id:, fork_root:, provider:, cli_args: nil, timeout: nil, cache_dir: nil,
-          last_message_file: nil, session_meta_file: nil)
+          last_message_file: nil, session_meta_file: nil, prepared_input: nil)
           ensure_not_same_scoped_refork!(assignment_id: assignment_id, fork_root: fork_root)
           resolved_provider = provider || config.dig("execution", "provider") || DEFAULT_PROVIDER
           resolved_timeout = timeout || config.dig("execution", "timeout") || DEFAULT_TIMEOUT
           scoped_assignment = "#{assignment_id}@#{fork_root}"
-          prompt = "/as-assign-drive #{scoped_assignment}"
+          if prepared_input && prepared_input.descriptor.values_at("assignment_id", "scope") != [assignment_id, fork_root]
+            raise Error, "Prepared provider scope differs"
+          end
+          prompt = prepared_input ? prepared_input.drive_prompt : "/as-assign-drive #{scoped_assignment}"
           last_msg_file = last_message_file || build_last_message_file(cache_dir, fork_root)
           scope_env = self.class.fork_scope_env(assignment_id: assignment_id, fork_root: fork_root)
+          if prepared_input
+            scope_env = scope_env.merge("ACE_ASSIGN_LAUNCH_MAPPING" => prepared_input.descriptor.fetch("mapping_id"),
+              "ACE_ASSIGN_ASSIGNMENT_ID" => assignment_id, "ACE_ASSIGN_ATTEMPT_ID" => prepared_input.descriptor.fetch("attempt_id"),
+              "ACE_ASSIGN_TASK_CONTEXT_ENTRY" => JSON.generate(prepared_input.descriptor.fetch("task_context_entry").fetch("manifest")))
+          end
 
           result = query_interface.query(
             resolved_provider,
@@ -102,7 +110,8 @@ module Ace
             timeout: resolved_timeout,
             fallback: false,
             last_message_file: last_msg_file,
-            subprocess_env: scope_env
+            subprocess_env: scope_env,
+            working_dir: prepared_input&.working_directory
           )
 
           if last_msg_file && result[:text] && !result[:text].strip.empty?
@@ -110,7 +119,8 @@ module Ace
             File.write(last_msg_file, result[:text]) if existing.empty?
           end
 
-          write_session_metadata(last_msg_file, result, prompt: prompt, session_meta_file: session_meta_file)
+          write_session_metadata(last_msg_file, result, prompt: prompt, session_meta_file: session_meta_file,
+            discover_session: prepared_input.nil?)
 
           result
         rescue Ace::LLM::Error => e
@@ -220,12 +230,12 @@ module Ace
           File.write(session_meta_file, meta.to_yaml) unless meta.empty?
         end
 
-        def write_session_metadata(last_msg_file, result, prompt:, session_meta_file: nil)
+        def write_session_metadata(last_msg_file, result, prompt:, session_meta_file: nil, discover_session: true)
           return unless last_msg_file
 
           session_id = result.dig(:metadata, :session_id)
 
-          if session_id.nil? || session_id.to_s.strip.empty?
+          if discover_session && (session_id.nil? || session_id.to_s.strip.empty?)
             detected = detect_provider_session(result[:provider], prompt)
             session_id = detected&.dig(:session_id)
           end

data/lib/ace/assign/molecules/journal_input_inhibition.rb

@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+require_relative "execution_scope_lineage"
+
+module Ace
+  module Assign
+    module Molecules
+      module JournalInputInhibition
+        INPUT_INHIBITION_FIELDS = %w[assignment_id attempt_id mapping_id original_binding_digest project_id seal_event_id].freeze
+
+        def observe_input_inhibition(selection:, evidence:, &authentication)
+          raise ArgumentError, "Original inhibition authentication is required" unless authentication
+          input = selection.merge("guarded_evidence" => evidence)
+          digest = Digest::SHA256.hexdigest(JSON.generate(canonical_prompt_value(input)))
+          mutate(assignment_id: selection.fetch("assignment_id"), attempt_id: selection.fetch("attempt_id"),
+            mutation_id: "input-inhibit.#{selection.fetch('seal_event_id')}", operation: "input_inhibition_observation",
+            parameters_digest: digest, expected_generation: nil, generation_mode: :input_inhibition,
+            input_inhibition: input, with_replay: true) do |events, commit, generation|
+            original = authentication.call(events, commit, generation)
+            unless original.is_a?(Hash) && original.keys.sort == %w[binding_digest origin] && original["binding_digest"] == selection.fetch("original_binding_digest")
+              raise AttemptErrors::EvidenceUnavailable, "Original input inhibition record differs"
+            end
+            verify_input_drained_evidence!(evidence, original.fetch("origin"))
+            {events: [{type: "input_inhibited", payload: selection.merge("guarded_evidence" => evidence)}], blobs: {},
+              data: selection.slice("original_binding_digest", "seal_event_id")}
+          end
+        end
+
+        def verify_input_drained_evidence!(evidence, original)
+          unless original.is_a?(Hash) && evidence.is_a?(Hash) && evidence.keys.sort == %w[input_state origin outcome pending_input] &&
+              evidence["outcome"] == "inhibited" && evidence["input_state"] == "inhibited" &&
+              evidence["pending_input"].is_a?(Integer) && evidence["pending_input"].zero?
+            raise AttemptErrors::EvidenceUnavailable, "Native input drainage is unconfirmed"
+          end
+          received = Ace::Herdr::Molecules::GuardedNativeOrigin.verify!(evidence.fetch("origin"),
+            terminal_id: original.fetch("terminal_id"), child: original.fetch("child"))
+          raise AttemptErrors::EvidenceUnavailable, "Native input drainage origin differs" unless received == original
+          true
+        rescue Ace::Runtime::RuntimeUnavailableError, KeyError, TypeError
+          raise AttemptErrors::EvidenceUnavailable, "Native input drainage is unverifiable"
+        end
+
+        private
+
+        def verify_input_inhibition!(input, mutation_id:, digest:, assignment_id:, attempt_id:, commit:)
+          unless input.is_a?(Hash) && input.keys.sort == (INPUT_INHIBITION_FIELDS + ["guarded_evidence"]).sort &&
+              INPUT_INHIBITION_FIELDS.all? { |key| input[key].is_a?(String) } &&
+              %w[original_binding_digest seal_event_id].all? { |key| input.fetch(key).match?(/\A[0-9a-f]{64}\z/) } &&
+              input["assignment_id"] == assignment_id && input["attempt_id"] == attempt_id &&
+              mutation_id == "input-inhibit.#{input.fetch('seal_event_id')}" &&
+              digest == Digest::SHA256.hexdigest(JSON.generate(canonical_prompt_value(input)))
+            raise ArgumentError, "Invalid fixed input inhibition selector"
+          end
+          events = read_events(assignment_id, commit: commit).select { |event| event["attempt_id"] == attempt_id }
+          authority_generation(events)
+          record = events.find { |event| event["digest"] == input.fetch("original_binding_digest") && event["type"] == "authority_mutation" &&
+            event.dig("payload", "operation") == "record_launch" }
+          data = record&.dig("payload", "data")
+          seal = events.find { |event| event["digest"] == input.fetch("seal_event_id") && event["type"] == "scope_sealed" }
+          accepted_seal = seal && events.find { |event| event["type"] == "authority_mutation" && event["previous_digest"] == seal.fetch("digest") &&
+            %w[close_execution_scope stop_attempt].include?(event.dig("payload", "operation")) }
+          lineage = ExecutionScopeLineage.new(events: events, project_id: input.fetch("project_id"), assignment_id: assignment_id,
+            attempt_id: attempt_id, mapping_id: input.fetch("mapping_id"))
+          unless data.is_a?(Hash) && %w[assignment_id attempt_id mapping_id].all? { |key| data[key] == input.fetch(key) } &&
+              seal && accepted_seal && lineage.seal_event == seal && events.index(record) < events.index(seal) &&
+              events.drop(events.index(seal) + 1).none? { |event| event["type"] == "prompt_issued" } &&
+              events.none? { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "scope_reservation_release" }
+            raise AttemptErrors::EvidenceUnavailable, "Input inhibition does not join accepted original seal"
+          end
+          origin = Ace::Herdr::Molecules::GuardedNativeOrigin.verify!(data.fetch("guarded_origin"),
+            terminal_id: data.fetch("process_binding").fetch("terminal_id"), child: data.fetch("process_binding").fetch("process_identity"))
+          verify_input_drained_evidence!(input.fetch("guarded_evidence"), origin)
+        rescue KeyError, TypeError, Ace::Runtime::RuntimeUnavailableError
+          raise AttemptErrors::EvidenceUnavailable, "Input inhibition canonical selection is malformed"
+        end
+      end
+    end
+  end
+end