ace-assign 0.63.1 → 0.66.0

data/lib/ace/assign/molecules/protected_control_exclusion.rb

@@ -0,0 +1,303 @@
+# frozen_string_literal: true
+
+require_relative "protected_workspace_exclusion"
+
+module Ace
+  module Assign
+    module Molecules
+      class LifecycleExclusion
+        # Authority-side canonical guards. This owner never selects a Git/cache
+        # root, resets a fence, or grants the lifetime workspace writer lease.
+        class ControlExclusion
+          class Protection < Ace::Runtime::Molecules::ProtectedArtifactSet::Protection
+            def initialize(authority_uid:, acl: Authority::PosixAcl.new, **options)
+              super(**options)
+              @authority_uid, @acl = authority_uid, acl
+            end
+
+            def verify!(path, handle, directory:)
+              super
+              unless (handle.stat.mode & 0o7000).zero? && @acl.entries(path).nil? &&
+                  (!directory || @acl.entries(path, attribute: "system.posix_acl_default").nil?)
+                raise AttemptErrors::EvidenceUnavailable, "Lifecycle control protection differs"
+              end
+            end
+
+            private
+            def trusted_owner?(stat) = [0, @authority_uid].include?(stat.uid)
+          end
+
+          def initialize(authority:, project_id:, descriptor_sha256:, root_identity: nil, files: File, protection: nil)
+            unless authority.is_a?(Hash) && project_id.is_a?(String) && token?(project_id) &&
+                descriptor_sha256.is_a?(String) && descriptor_sha256.match?(/\A[0-9a-f]{64}\z/) &&
+                %w[uid gid].all? { |key| authority[key].is_a?(Integer) && authority[key].positive? } &&
+                authority["state_root"].is_a?(String) && authority["state_root"].valid_encoding? &&
+                authority["state_root"].bytesize.between?(1, 4096) && !authority["state_root"].include?("\0") &&
+                authority["state_root"].start_with?("/") && File.expand_path(authority["state_root"]) == authority["state_root"]
+              unavailable!("Lifecycle control selection is malformed")
+            end
+            @root = File.join(authority.fetch("state_root"), "lifecycle-exclusion", project_id, "control")
+            unavailable!("Lifecycle control path is oversized") if @root.bytesize > 4096
+            @uid, @gid, @descriptor = authority.values_at("uid", "gid") + [descriptor_sha256.dup.freeze]
+            if root_identity
+              unless root_identity.is_a?(Hash) && root_identity.keys.sort == %w[device gid inode uid] &&
+                  root_identity.values.all? { |value| value.is_a?(Integer) && value >= 0 } &&
+                  root_identity.values_at("uid", "gid") == [@uid, @gid]
+                unavailable!("Lifecycle control original identity differs")
+              end
+              @identity = root_identity.dup.freeze
+            end
+            @files = files
+            @protection = protection || Protection.new(authority_uid: @uid)
+          end
+
+          def task_key(id) = key!("task", id)
+          def assignment_key(id) = key!("assignment", id)
+
+          def selection!
+            with_root do |handles, identities|
+              stat = handles.fetch(@root).stat
+              @identity ||= {"device" => stat.dev, "inode" => stat.ino, "uid" => stat.uid, "gid" => stat.gid}.freeze
+              {"descriptor_sha256" => @descriptor, "root_identity" => @identity}.freeze
+            end
+          end
+
+          # Invoked only after the existing complete registration admission.
+          # A partial creation is unavailable, not a missing-fence reset grant.
+          def provision_keys!(keys:)
+            ordered = keys!(keys)
+            with_root do |handles, identities|
+              root = handles.fetch(@root)
+              ordered.each do |key|
+                lock_path, marker_path = paths(key)
+                lock, created = create_or_open!(lock_path, "", root)
+                begin
+                  validate_file!(lock_path, lock, empty: true)
+                  marker = if created
+                    create_or_open!(marker_path, Atoms::EvidenceDigest.canonical_json(
+                      {"key" => key, "removed" => false, "removed_at" => nil}), root).first
+                  else
+                    @files.open(marker_path, File::RDONLY | File::NOFOLLOW | File::NONBLOCK)
+                  end
+                  begin
+                    live_marker!(key, marker_path, marker)
+                  ensure
+                    marker&.close
+                  end
+                ensure
+                  lock&.close
+                end
+                unchanged!(handles, identities)
+              end
+            end
+            self
+          rescue SystemCallError, IOError, Ace::Runtime::RuntimeUnavailableError
+            unavailable!("Lifecycle control provisioning is unavailable")
+          end
+
+          def with_shared_multi(keys, &block) = with_locks(keys, File::LOCK_SH, &block)
+          def with_shared(key, &block) = with_shared_multi([key], &block)
+          def with_exclusive(key, deadline: nil, &block) = with_locks([key], File::LOCK_EX, deadline: deadline, &block)
+
+          # The canonical writer calls this again immediately before CAS. It
+          # authenticates the same held keys, not freshly reopened substitutes.
+          def verify_unchanged!
+            checks = Thread.current[:ace_assign_control_checks]&.fetch(object_id, nil)
+            unavailable!("Lifecycle control is not held") unless checks && !checks.empty?
+            checks.each(&:call)
+            true
+          end
+
+          private
+
+          def with_locks(keys, mode, deadline: nil)
+            callback_error = nil
+            ordered = keys!(keys)
+            deadline!(deadline) if deadline
+            with_root do |handles, identities|
+              locks, markers, marker_facts, lock_facts = [], [], [], []
+              begin
+                ordered.each do |key|
+                  path, marker_path = paths(key)
+                  lock = @files.open(path, File::RDONLY | File::NOFOLLOW | File::NONBLOCK)
+                  locks << lock
+                  validate_file!(path, lock, empty: true)
+                  lock_facts << file_metadata(lock.stat)
+                  unless lock.flock(mode | File::LOCK_NB)
+                    raise AttemptErrors::MaintenanceBusy, "Lifecycle control is under maintenance"
+                  end
+                  marker = @files.open(marker_path, File::RDONLY | File::NOFOLLOW | File::NONBLOCK)
+                  markers << marker
+                  live_marker!(key, marker_path, marker)
+                  marker_facts << file_metadata(marker.stat)
+                end
+                deadline!(deadline) if deadline
+                unchanged!(handles, identities)
+                check = proc do
+                  ordered.each_with_index do |key, index|
+                    path, marker_path = paths(key)
+                    lock, marker = locks.fetch(index), markers.fetch(index)
+                    validate_file!(path, lock, empty: true)
+                    unless file_metadata(lock.stat) == lock_facts.fetch(index) &&
+                        file_metadata(marker.stat) == marker_facts.fetch(index)
+                      unavailable!("Lifecycle control key changed")
+                    end
+                    marker.rewind
+                    live_marker!(key, marker_path, marker)
+                  end
+                  unchanged!(handles, identities)
+                end
+                registry = Thread.current[:ace_assign_control_checks] ||= {}
+                checks = registry[object_id] ||= []
+                checks << check
+                begin
+                  begin
+                    result = yield
+                  rescue Exception => error
+                    callback_error = error
+                    raise
+                  end
+                  verify_unchanged!
+                ensure
+                  checks.pop
+                  registry.delete(object_id) if checks.empty?
+                end
+                deadline!(deadline) if deadline
+                result
+              ensure
+                close_all!(locks + markers)
+              end
+            end
+          rescue SystemCallError, IOError, Ace::Runtime::RuntimeUnavailableError
+            raise if callback_error
+            unavailable!("Lifecycle control admission is unavailable")
+          end
+
+          def with_root
+            callback_error = nil
+            handles, identities = {}, {}
+            begin
+              parts = @root.split("/").reject(&:empty?)
+              (["/"] + parts.each_index.map { |index| "/" + parts.take(index + 1).join("/") }).each do |path|
+                handle = @files.open(path, File::RDONLY | File::NOFOLLOW | File::NONBLOCK)
+                handles[path] = handle
+                unless handle.stat.directory? && file_identity(handle.stat) == file_identity(@files.lstat(path))
+                  unavailable!("Lifecycle control directory changed")
+                end
+                @protection.verify!(path, handle, directory: true)
+                identities[path] = file_identity(handle.stat)
+              end
+              root = handles.fetch(@root).stat
+              unless [root.uid, root.gid, root.mode & 0o7777] == [@uid, @gid, 0o700] &&
+                  (!@identity || [root.dev, root.ino, root.uid, root.gid] == @identity.values_at("device", "inode", "uid", "gid"))
+                unavailable!("Lifecycle control original root differs")
+              end
+              begin
+                result = yield handles, identities
+              rescue Exception => error
+                callback_error = error
+                raise
+              end
+              unchanged!(handles, identities)
+              result
+            ensure
+              close_all!(handles.values)
+            end
+          rescue SystemCallError, IOError, Ace::Runtime::RuntimeUnavailableError
+            raise if callback_error
+            unavailable!("Lifecycle control root is unavailable")
+          end
+
+          def unchanged!(handles, identities)
+            handles.each do |path, handle|
+              unless file_identity(handle.stat) == identities.fetch(path) &&
+                  identities.fetch(path) == file_identity(@files.lstat(path))
+                unavailable!("Lifecycle control directory changed")
+              end
+              @protection.verify!(path, handle, directory: true)
+            end
+          end
+
+          def create_or_open!(path, bytes, root)
+            created = true
+            file = begin
+              @files.open(path, File::RDWR | File::CREAT | File::EXCL | File::NOFOLLOW | File::NONBLOCK, 0o600)
+            rescue Errno::EEXIST
+              created = false
+              @files.open(path, File::RDONLY | File::NOFOLLOW | File::NONBLOCK)
+            end
+            if created
+              file.write(bytes)
+              file.flush
+              file.fsync
+              root.fsync
+            end
+            file.rewind
+            [file, created]
+          rescue Exception
+            file&.close
+            raise
+          end
+
+          def validate_file!(path, file, empty: false)
+            stat = file.stat
+            unless stat.file? && stat.nlink == 1 && [stat.uid, stat.gid, stat.mode & 0o7777] == [@uid, @gid, 0o600] &&
+                file_identity(stat) == file_identity(@files.lstat(path)) && (empty ? stat.size.zero? : stat.size.between?(1, 8192))
+              unavailable!("Lifecycle control file differs")
+            end
+            @protection.verify!(path, file, directory: false)
+          end
+
+          def live_marker!(key, path, file)
+            validate_file!(path, file)
+            before = file.stat
+            bytes = file.read(8193)
+            state = LifecycleExclusion.workspace_marker!(bytes: bytes, key: key)
+            unless bytes.bytesize == before.size && file_metadata(before) == file_metadata(file.stat) &&
+                file_metadata(before) == file_metadata(@files.lstat(path))
+              unavailable!("Lifecycle control marker changed")
+            end
+            raise AttemptErrors::Conflict, "Lifecycle control identity is fenced" if state.fetch("removed")
+          end
+
+          def keys!(keys)
+            values = Array(keys).uniq
+            unless values.any? && values.all? { |key| key.is_a?(String) && key.match?(/\A(?:task|assignment):[A-Za-z0-9][A-Za-z0-9._-]{0,127}\z/) }
+              unavailable!("Lifecycle control keys differ")
+            end
+            values.sort_by { |key| [key.start_with?("task:") ? 0 : 1, key] }
+          end
+
+          def key!(kind, id)
+            unavailable!("Lifecycle control key differs") unless id.is_a?(String) && token?(id)
+            "#{kind}:#{id}"
+          end
+          def token?(value) = value.match?(/\A[A-Za-z0-9][A-Za-z0-9._-]{0,127}\z/)
+          def paths(key)
+            stem = File.join(@root, Digest::SHA256.hexdigest(key))
+            [stem + ".lock", stem + ".state.json"]
+          end
+          def file_identity(stat) = [stat.dev, stat.ino, stat.uid, stat.gid, stat.mode]
+          def file_metadata(stat) = file_identity(stat) + [stat.size, stat.mtime, stat.ctime]
+          def unavailable!(message) = raise(AttemptErrors::EvidenceUnavailable, message)
+          def deadline!(deadline)
+            unless deadline.is_a?(Numeric) && deadline.finite? && deadline > Process.clock_gettime(Process::CLOCK_MONOTONIC)
+              raise AttemptErrors::MaintenanceBusy, "Lifecycle control admission deadline elapsed"
+            end
+          end
+          def close_all!(files)
+            error = nil
+            files.reverse_each do |file|
+              begin
+                file.close unless file.closed?
+              rescue SystemCallError, IOError => caught
+                error ||= caught
+              end
+            end
+            raise error if error
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/molecules/protected_workspace_exclusion.rb

@@ -0,0 +1,330 @@
+# frozen_string_literal: true
+
+require_relative "lifecycle_exclusion"
+require_relative "../authority/posix_acl"
+require "ace/runtime/molecules/protected_artifact_set"
+
+module Ace
+  module Assign
+    module Molecules
+      class LifecycleExclusion
+        # A retained reader lease only. It cannot provision, reset or publish.
+        # Source-owned original PreparedInput selects its closed projection.
+        class WorkspaceReader
+          attr_reader :projection
+          class Protection < Ace::Runtime::Molecules::ProtectedArtifactSet::Protection
+            def initialize(projection:, acl: Authority::PosixAcl.new, **options)
+              super(**options)
+              @projection, @acl = projection, acl
+            end
+
+            def verify!(path, handle, directory:)
+              super
+              unless (handle.stat.mode & 0o7000).zero? && @acl.entries(path).nil? &&
+                  (!directory || @acl.entries(path, attribute: "system.posix_acl_default").nil?)
+                raise AttemptErrors::EvidenceUnavailable, "Lifecycle reader protection differs"
+              end
+              root = @projection.fetch("root_resource")
+              if path == root_path(root)
+                actual = handle.stat
+                unless directory && [actual.dev, actual.ino, actual.uid, actual.gid, actual.mode & 0o7777] ==
+                    root.values_at("device", "inode", "uid", "gid") + [0o755]
+                  raise AttemptErrors::EvidenceUnavailable, "Lifecycle reader root identity differs"
+                end
+                verify_root_mount!(path, handle, root)
+              elsif !directory
+                unless handle.stat.nlink == 1 && (handle.stat.mode & 0o7777) == 0o644
+                  raise AttemptErrors::EvidenceUnavailable, "Lifecycle reader file protection differs"
+                end
+              end
+            end
+
+            private
+
+            def root_path(root) = root.fetch("view_path")
+
+            def verify_root_mount!(path, handle, root)
+                mount = @mounts.mount_identity(handle)
+                table = Ace::Runtime::Molecules::LinuxMountInfo.new(
+                  @mounts.read("/proc/self/mountinfo", limit: Ace::Runtime::Molecules::LinuxMountInfo::LIMIT))
+                selected = table.by_id(mount.fetch("mount_id"))
+                unless mount == selected.slice(*mount.keys) && selected.fetch("mountpoint") == path &&
+                    selected.fetch("filesystem_type") == root.fetch("filesystem_type") &&
+                    selected.fetch("options").include?("ro") && !selected.fetch("options").include?("rw")
+                  raise AttemptErrors::EvidenceUnavailable, "Lifecycle reader view is not the selected readonly mount"
+                end
+            end
+
+            def trusted_owner?(stat)
+              [0, @projection.fetch("authority_uid")].include?(stat.uid)
+            end
+          end
+
+          def initialize(projection:, protection: nil, files: File)
+            @projection = JSON.parse(JSON.generate(projection))
+            validate_projection!
+            pending = [@projection]
+            until pending.empty?
+              value = pending.pop
+              pending.concat(value.values) if value.is_a?(Hash)
+              pending.concat(value) if value.is_a?(Array)
+              value.freeze
+            end
+            @root = @projection.fetch("root_resource").fetch("view_path")
+            @protection = protection || Protection.new(projection: @projection)
+            @files = files
+            @handles, @lock, @active = {}, nil, false
+          end
+
+          def acquire!
+            raise AttemptErrors::Conflict, "Lifecycle reader already acquired" if @active || !@handles.empty?
+            parts = @root.split("/").reject(&:empty?)
+            (["/"] + parts.each_index.map { |index| "/" + parts.take(index + 1).join("/") }).each do |path|
+              pin!(path, directory: true)
+            end
+            @lock = pin!(path_for("lock"), directory: false)
+            stat = @lock.stat
+            unless stat.size.zero? && [stat.uid, stat.gid] == @projection.values_at("authority_uid", "authority_gid")
+              raise AttemptErrors::EvidenceUnavailable, "Lifecycle reader immutable lock differs"
+            end
+            unless @lock.flock(lock_mode | File::LOCK_NB)
+              raise AttemptErrors::MaintenanceBusy, "Lifecycle workspace is under maintenance"
+            end
+            @active = true
+            marker = pin!(path_for("state.json"), directory: false)
+            state = read_marker!(marker)
+            owner = [marker.stat.uid, marker.stat.gid]
+            unless owner == @projection.values_at("authority_uid", "authority_gid") || state.fetch("removed") && owner == [0, 0]
+              raise AttemptErrors::EvidenceUnavailable, "Lifecycle marker selected owner differs"
+            end
+            require_live_marker!(state)
+            verify_unchanged!
+            self
+          rescue Ace::Runtime::RuntimeUnavailableError, SystemCallError, IOError, JSON::ParserError, KeyError, TypeError, ArgumentError
+            close!
+            raise AttemptErrors::EvidenceUnavailable, "Original lifecycle reader admission is unavailable"
+          rescue Exception
+            close!
+            raise
+          end
+
+          def verify_unchanged!
+            raise AttemptErrors::EvidenceUnavailable, "Lifecycle reader is not held" unless @active
+            @handles.each do |path, entry|
+              unless identity(entry.fetch(:handle).stat) == entry.fetch(:identity) &&
+                  identity(@files.lstat(path)) == entry.fetch(:identity)
+                raise AttemptErrors::EvidenceUnavailable, "Lifecycle reader retained object changed"
+              end
+              @protection.verify!(path, entry.fetch(:handle), directory: entry.fetch(:directory))
+            end
+            true
+          end
+
+          # The maintained creator calls this only after confirmed completion.
+          # Unknown child ownership retains the lease until its owner exits.
+          def close!
+            begin
+              @lock.flock(File::LOCK_UN) if @active && @lock && !@lock.closed?
+            ensure
+              close_error = nil
+              @handles.values.reverse_each do |entry|
+                begin
+                  entry.fetch(:handle).close unless entry.fetch(:handle).closed?
+                rescue IOError, SystemCallError => error
+                  close_error ||= error
+                end
+              end
+              @handles.clear
+              @active = false
+              raise close_error if close_error
+            end
+          end
+
+          private
+
+          def require_live_marker!(state)
+            raise AttemptErrors::Conflict, "Original lifecycle workspace was fenced for removal" if state.fetch("removed")
+          end
+
+          def lock_mode = File::LOCK_SH
+
+          def validate_projection!
+            fields = %w[authority_gid authority_uid key root_resource worker_cwd_resource]
+            resource_fields = %w[device filesystem_type gid host_path inode mount_id uid view_path]
+            unless @projection.is_a?(Hash)
+              raise AttemptErrors::EvidenceUnavailable, "Lifecycle original reader projection differs"
+            end
+            root, cwd = @projection.values_at("root_resource", "worker_cwd_resource")
+            unless @projection.keys.sort == fields && [root, cwd].all? { |value| value.is_a?(Hash) && value.keys.sort == resource_fields } &&
+                %w[authority_uid authority_gid].all? { |key| @projection[key].is_a?(Integer) && @projection[key].positive? }
+              raise AttemptErrors::EvidenceUnavailable, "Lifecycle original reader projection differs"
+            end
+            unless [root, cwd].all? { |value|
+                %w[host_path view_path].all? { |key| value[key].is_a?(String) && value[key].valid_encoding? &&
+                  value[key].bytesize.between?(1, 4096) && !value[key].include?("\0") && value[key].start_with?("/") &&
+                  File.expand_path(value[key]) == value[key] } &&
+                %w[device inode uid gid].all? { |key| value[key].is_a?(Integer) && value[key] >= 0 } &&
+                value["mount_id"].is_a?(Integer) && value["mount_id"].positive? &&
+                %w[ext4 xfs btrfs tmpfs].include?(value["filesystem_type"]) }
+              raise AttemptErrors::EvidenceUnavailable, "Lifecycle original reader resource differs"
+            end
+            mapping = root.fetch("view_path").delete_prefix("/run/ace/lifecycle-exclusion/")
+            digest = Atoms::EvidenceDigest.digest(cwd)
+            unless mapping.match?(/\A[A-Za-z0-9][A-Za-z0-9._-]{0,127}\z/) &&
+                @projection.fetch("key") == "workspace:#{mapping}:#{digest}" &&
+                root.fetch("host_path").end_with?("/workspaces/#{mapping}/#{digest}") &&
+                root.values_at("uid", "gid") == @projection.values_at("authority_uid", "authority_gid")
+              raise AttemptErrors::EvidenceUnavailable, "Lifecycle original reader association differs"
+            end
+          end
+
+          def pin!(path, directory:)
+            file = @files.open(path, File::RDONLY | File::NOFOLLOW | File::NONBLOCK)
+            @protection.verify!(path, file, directory: directory)
+            stat = file.stat
+            unless (directory ? stat.directory? : stat.file?) && identity(stat) == identity(@files.lstat(path))
+              raise AttemptErrors::EvidenceUnavailable, "Lifecycle reader object is substituted"
+            end
+            @handles[path] = {handle: file, identity: identity(stat), directory: directory}
+            file
+          ensure
+            file&.close unless @handles.key?(path)
+          end
+
+          def identity(stat)
+            core = [stat.dev, stat.ino, stat.uid, stat.gid, stat.mode]
+            stat.directory? ? core : core + [stat.nlink, stat.size, stat.mtime, stat.ctime]
+          end
+
+          def path_for(suffix)
+            File.join(@root, "#{Digest::SHA256.hexdigest(@projection.fetch('key'))}.#{suffix}")
+          end
+
+          def read_marker!(file)
+            size = file.stat.size
+            unless size.between?(1, 8192)
+              raise AttemptErrors::EvidenceUnavailable, "Lifecycle marker bytes differ"
+            end
+            bytes = file.read(8193).force_encoding(Encoding::UTF_8)
+            unless bytes.valid_encoding? && bytes.bytesize == size
+              raise AttemptErrors::EvidenceUnavailable, "Lifecycle marker is not bounded UTF8"
+            end
+            state = LifecycleExclusion.workspace_marker!(bytes: bytes, key: @projection.fetch("key"))
+            @marker_bytes = bytes.freeze
+            state
+          end
+        end
+        # Native activation owns this host lease for the original scope lifetime.
+        # An admission deadline must not become a provider lifetime ceiling.
+        class WorkspaceNativeReader < WorkspaceReader
+          def initialize(projection:, protection: nil, files: File)
+            super(projection: projection, protection: protection, files: files)
+            @root = @projection.fetch("root_resource").fetch("host_path")
+            @protection = protection || WorkspaceHostReader::Protection.new(projection: @projection)
+          end
+        end
+
+        class WorkspaceHostReader < WorkspaceReader
+          class Protection < WorkspaceReader::Protection
+            private
+            def root_path(root) = root.fetch("host_path")
+            def verify_root_mount!(_path, handle, root)
+              unless @mounts.mount_identity(handle).fetch("filesystem_type") == root.fetch("filesystem_type")
+                raise AttemptErrors::EvidenceUnavailable, "Lifecycle writer filesystem differs"
+              end
+            end
+          end
+
+          def initialize(projection:, protection: nil, files: File)
+            super(projection: projection, protection: protection, files: files)
+            @root = @projection.fetch("root_resource").fetch("host_path")
+            @protection = protection || Protection.new(projection: @projection)
+          end
+
+          def acquire!(deadline:)
+            @deadline = deadline
+            deadline!(deadline)
+            super()
+            deadline!(deadline)
+            self
+          rescue Exception
+            close!
+            raise
+          end
+
+          def verify_unchanged!
+            deadline!(@deadline) unless @deadline.nil?
+            super
+          end
+
+          private
+          def deadline!(value)
+            unless value.is_a?(Numeric) && value.finite? && value > Process.clock_gettime(Process::CLOCK_MONOTONIC)
+              raise AttemptErrors::MaintenanceBusy, "Lifecycle maintenance deadline elapsed"
+            end
+          end
+        end
+
+        # Inspection evidence only: never permits creation or publication.
+        class WorkspaceFenceReader < WorkspaceHostReader
+          def fence_evidence!
+            verify_unchanged!
+            bytes = @marker_bytes
+            reference = {"path" => path_for("state.json").freeze,
+              "sha256" => Digest::SHA256.hexdigest(bytes).freeze, "bytes" => bytes.bytesize}.freeze
+            {"reference" => reference, "bytes" => bytes}.freeze
+          end
+
+          private
+          def require_live_marker!(_state); end
+        end
+
+        class WorkspaceWriter < WorkspaceHostReader
+          # Refusal fence only; canonical physical proof is owned separately.
+          def publish_removed!(removed_at:)
+            verify_unchanged!
+            unless removed_at.is_a?(String) && Time.iso8601(removed_at).utc.iso8601 == removed_at
+              raise AttemptErrors::EvidenceUnavailable, "Lifecycle fence timestamp differs"
+            end
+            bytes = Atoms::EvidenceDigest.canonical_json({"key" => @projection.fetch("key"),
+              "removed" => true, "removed_at" => removed_at}).freeze
+            target = path_for("state.json")
+            temporary = File.join(@root, ".#{SecureRandom.hex(16)}.fence")
+            begin
+              @files.open(temporary, File::WRONLY | File::CREAT | File::EXCL | File::NOFOLLOW | File::NONBLOCK, 0o644) do |file|
+                file.chmod(0o644)
+                file.write(bytes)
+                file.flush
+                unless file.stat.file? && file.stat.nlink == 1 && file.stat.size == bytes.bytesize &&
+                    [file.stat.uid, file.stat.gid, file.stat.mode & 0o7777] == [0, 0, 0o644]
+                  raise AttemptErrors::EvidenceUnavailable, "Lifecycle temporary fence protection differs"
+                end
+                file.fsync
+              end
+              verify_unchanged!
+              @files.rename(temporary, target)
+              @handles.fetch(@root).fetch(:handle).fsync
+              previous = @handles.delete(target)
+              previous.fetch(:handle).close
+              marker = pin!(target, directory: false)
+              unless [marker.stat.uid, marker.stat.gid] == [0, 0] && read_marker!(marker).fetch("removed")
+                raise AttemptErrors::EvidenceUnavailable, "Lifecycle published fence owner differs"
+              end
+              verify_unchanged!
+              reference = {"path" => target.freeze, "sha256" => Digest::SHA256.hexdigest(bytes).freeze,
+                "bytes" => bytes.bytesize}.freeze
+              {"reference" => reference, "bytes" => bytes}.freeze
+            ensure
+              @files.unlink(temporary) if @files.exist?(temporary)
+            end
+          rescue SystemCallError, IOError, ArgumentError
+            raise AttemptErrors::EvidenceUnavailable, "Lifecycle removal fence publication is unavailable"
+          end
+
+          private
+          def lock_mode = File::LOCK_EX
+        end
+      end
+    end
+  end
+end