ace-assign 0.63.1 → 0.66.0

data/lib/ace/assign/molecules/protected_workspace_provisioner.rb

@@ -0,0 +1,164 @@
+# frozen_string_literal: true
+
+require_relative "protected_workspace_exclusion"
+
+module Ace
+  module Assign
+    module Molecules
+      class LifecycleExclusion
+        # Original full-privilege operator phase, before publication/start.
+        # It only provisions derived exclusion artifacts, never a workspace.
+        class WorkspaceProvisioner
+          class Protection < WorkspaceHostReader::Protection
+            private
+            def root_path(_root) = nil
+          end
+
+          def initialize(mapping_id:, project_id:, authority:, cwd_resource:, files: File, directories: Dir, protection: nil)
+            @selection = LifecycleExclusion.workspace_selection(mapping_id: mapping_id, project_id: project_id,
+              authority: authority, cwd_resource: cwd_resource)
+            @authority = authority.slice("state_root", "uid", "gid").freeze
+            @files, @directories = files, directories
+            @protection = protection || Protection.new(projection: {"authority_uid" => authority.fetch("uid"),
+              "authority_gid" => authority.fetch("gid"), "root_resource" => {}})
+            @handles = {}
+          end
+
+          def provision!
+            root = @authority.fetch("state_root")
+            parts = root.split("/").reject(&:empty?)
+            (["/"] + parts.each_index.map { |index| "/" + parts.take(index + 1).join("/") }).each do |path|
+              hold_directory!(path)
+            end
+            selected_directory!(@handles.fetch(root), mode: 0o700)
+            relative = @selection.fetch("host_path").delete_prefix(root + "/").split("/")
+            parent = root
+            relative.each_with_index do |part, index|
+              path = File.join(parent, part)
+              mode = index == relative.length - 1 ? 0o755 : 0o700
+              provision_directory!(path, parent, mode)
+              verify_unchanged!
+              parent = path
+            end
+            project = File.dirname(File.dirname(File.dirname(@selection.fetch("host_path"))))
+            provision_directory!(File.join(project, "control"), project, 0o700)
+            root_stat = @handles.fetch(@selection.fetch("host_path")).stat
+            host_identity = {"device" => root_stat.dev, "inode" => root_stat.ino,
+              "uid" => root_stat.uid, "gid" => root_stat.gid}.freeze
+            # Resource mount identity is observed by the existing boundary owner;
+            # provision returns only association/host inode, not a namespace pin.
+            provision_file!("lock", "")
+            marker = provision_file!("state.json", LifecycleExclusion.workspace_initial_marker(key: @selection.fetch("key")))
+            bytes = marker.read(8193)
+            state = LifecycleExclusion.workspace_marker!(bytes: bytes, key: @selection.fetch("key"))
+            raise AttemptErrors::Conflict, "Original lifecycle workspace is already fenced" if state.fetch("removed")
+            unless [marker.stat.uid, marker.stat.gid] == @authority.values_at("uid", "gid")
+              raise AttemptErrors::EvidenceUnavailable, "Initial lifecycle marker owner differs"
+            end
+            verify_unchanged!
+            result = @selection.merge("host_identity" => host_identity)
+            result.fetch("host_identity").freeze
+            result.each_value(&:freeze)
+            result.freeze
+          rescue Ace::Runtime::RuntimeUnavailableError, SystemCallError, IOError
+            raise AttemptErrors::EvidenceUnavailable, "Original lifecycle provisioning is unavailable"
+          ensure
+            close!
+          end
+
+          private
+
+          def provision_directory!(path, parent, mode)
+            created = begin
+              @directories.mkdir(path, 0o700)
+              true
+            rescue Errno::EEXIST
+              false
+            end
+            handle = hold_directory!(path)
+            if created
+              handle.chown(@authority.fetch("uid"), @authority.fetch("gid"))
+              handle.chmod(mode)
+              handle.fsync
+              @handles.fetch(parent).fsync
+            end
+            selected_directory!(handle, mode: mode)
+          end
+
+          def hold_directory!(path)
+            handle = @files.open(path, File::RDONLY | File::NOFOLLOW | File::NONBLOCK)
+            unless handle.stat.directory? && identity(handle.stat) == identity(@files.lstat(path))
+              raise AttemptErrors::EvidenceUnavailable, "Lifecycle provisioning directory differs"
+            end
+            @protection.verify!(path, handle, directory: true)
+            @handles[path] = handle
+          ensure
+            handle&.close unless @handles[path] == handle
+          end
+
+          def selected_directory!(handle, mode:)
+            stat = handle.stat
+            unless [stat.uid, stat.gid, stat.mode & 0o7777] == @authority.values_at("uid", "gid") + [mode]
+              raise AttemptErrors::EvidenceUnavailable, "Lifecycle provisioning selected directory differs"
+            end
+          end
+
+          def provision_file!(suffix, bytes)
+            root = @selection.fetch("host_path")
+            path = File.join(root, "#{Digest::SHA256.hexdigest(@selection.fetch('key'))}.#{suffix}")
+            created = true
+            handle = begin
+              @files.open(path, File::RDWR | File::CREAT | File::EXCL | File::NOFOLLOW | File::NONBLOCK, 0o600)
+            rescue Errno::EEXIST
+              created = false
+              @files.open(path, File::RDONLY | File::NOFOLLOW | File::NONBLOCK)
+            end
+            if created
+              handle.write(bytes)
+              handle.flush
+              handle.chown(@authority.fetch("uid"), @authority.fetch("gid"))
+              handle.chmod(0o644)
+              handle.fsync
+              @handles.fetch(root).fsync
+            end
+            stat = handle.stat
+            unless stat.file? && stat.nlink == 1 && (stat.mode & 0o7777) == 0o644 &&
+                identity(stat) == identity(@files.lstat(path)) && stat.size <= 8192 &&
+                (suffix != "lock" || stat.size.zero? && [stat.uid, stat.gid] == @authority.values_at("uid", "gid"))
+              raise AttemptErrors::EvidenceUnavailable, "Lifecycle provisioning file differs"
+            end
+            @protection.verify!(path, handle, directory: false)
+            handle.rewind
+            @handles[path] = handle
+          ensure
+            handle&.close unless @handles[path] == handle
+          end
+
+          def verify_unchanged!
+            @handles.each do |path, handle|
+              unless identity(handle.stat) == identity(@files.lstat(path))
+                raise AttemptErrors::EvidenceUnavailable, "Lifecycle provisioned object was replaced"
+              end
+              @protection.verify!(path, handle, directory: handle.stat.directory?)
+            end
+          end
+
+          def identity(stat) = [stat.dev, stat.ino, stat.uid, stat.gid, stat.mode]
+
+          def close!
+            error = nil
+            @handles.values.reverse_each do |handle|
+              begin
+                handle.close unless handle.closed?
+              rescue SystemCallError, IOError => caught
+                error ||= caught
+              end
+            end
+            @handles.clear
+            raise error if error
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/molecules/queue_scanner.rb

@@ -53,19 +53,42 @@ module Ace
           end.compact
         end
 
+        # Source-authenticated callers retain exact step/report bytes through
+        # validation and parsing. No pathname reopen chooses executable work.
+        def scan_captured(steps:, assignment:, reports:)
+          parsed = Atoms::StepSorter.sort(steps.keys).map do |filename|
+            path = File.join(assignment.steps_dir, filename)
+            info = Atoms::StepFileParser.parse_filename(filename)
+            report_name = Atoms::StepFileParser.generate_report_filename(info.fetch(:number), info.fetch(:name))
+            report = reports[report_name]
+            report = Atoms::StepFileParser.parse(report).fetch(:body).strip if report
+            parse_step_content(path, steps.fetch(filename), report)
+          end
+          Models::QueueState.new(steps: parsed, assignment: assignment)
+        end
+
         private
 
         def parse_step_file(file_path)
           content = File.read(file_path)
+          filename_info = Atoms::StepFileParser.parse_filename(File.basename(file_path))
+          report = load_report(file_path, filename_info[:number], filename_info[:name])
+          parse_step_content(file_path, content, report)
+        rescue ArgumentError => e
+          warn "Invalid step file #{file_path}: #{e.message}"
+          nil
+        rescue => e
+          warn "Failed to parse step file #{file_path}: #{e.message}" if Ace::Assign.debug?
+          nil
+        end
+
+        def parse_step_content(file_path, content, report)
           parsed = Atoms::StepFileParser.parse(content)
           fields = Atoms::StepFileParser.extract_fields(parsed)
 
           # Extract number and name from filename
           filename_info = Atoms::StepFileParser.parse_filename(File.basename(file_path))
 
-          # Load report from separate file if it exists
-          report = load_report(file_path, filename_info[:number], filename_info[:name])
-
           Models::Step.new(
             number: filename_info[:number],
             name: fields[:name] || filename_info[:name],
@@ -93,14 +116,6 @@ module Ace
             stall_reason: fields[:stall_reason],
             file_path: file_path
           )
-        rescue ArgumentError => e
-          # ArgumentError indicates invalid data (e.g., invalid context value)
-          # Surface these errors visibly to help users fix configuration
-          warn "Invalid step file #{file_path}: #{e.message}"
-          nil
-        rescue => e
-          warn "Failed to parse step file #{file_path}: #{e.message}" if Ace::Assign.debug?
-          nil
         end
 
         # Load report from the reports/ directory

data/lib/ace/assign/molecules/receipt_verifier.rb

@@ -22,8 +22,18 @@ module Ace
         APPROVED_VERDICT = "approved"
 
         # @param identity_resolver [ExecutionIdentityResolver] Trust boundary
-        def initialize(identity_resolver: nil)
+        # @param artifact_reader [#call, nil] Source-owned canonical byte
+        #   reader for protected composition; nil selects explicit local files
+        def initialize(identity_resolver: nil, artifact_reader: nil, campaign_verifier: nil)
           @identity_resolver = identity_resolver || ExecutionIdentityResolver.new
+          unless artifact_reader.nil? || artifact_reader.respond_to?(:call)
+            raise ArgumentError, "artifact reader must be a source-owned callable"
+          end
+          @artifact_reader = artifact_reader
+          unless campaign_verifier.nil? || campaign_verifier.respond_to?(:call)
+            raise ArgumentError, "campaign verifier must be a source-owned callable"
+          end
+          @campaign_verifier = campaign_verifier
         end
 
         # Validate a submitted receipt against an attempt.
@@ -36,6 +46,18 @@ module Ace
         # @return [Models::ExecutionReceipt] Normalized receipt with digest
         # @raise [AttemptErrors::ReceiptRejected] on any validation failure
         def verify!(data, attempt:, identity:, live_head:, repo_root:)
+          verify_receipt!(data, attempt: attempt, live_head: live_head, repo_root: repo_root) do
+            verify_authority(data, identity)
+          end
+        end
+
+        # Submission validates evidence without granting terminal acceptance.
+        # The authenticated owner separately checks the exact worker attribution.
+        def verify_result!(data, attempt:, live_head:, repo_root:)
+          verify_receipt!(data, attempt: attempt, live_head: live_head, repo_root: repo_root)
+        end
+
+        def verify_receipt!(data, attempt:, live_head:, repo_root:)
           reject_unless(data.is_a?(Hash), "receipt must be a JSON object")
 
           if Models::ExecutionReceipt.forbidden_field?(data)
@@ -51,7 +73,7 @@ module Ace
 
           verify_binding(data, attempt)
           verify_producer(data)
-          verify_authority(data, identity)
+          yield if block_given?
           verify_head(data, live_head)
           verify_artifacts(data, repo_root) if data["verdict"] == "succeeded"
           verify_checks(data)
@@ -63,18 +85,26 @@ module Ace
 
           receipt
         end
+        private :verify_receipt!
+
         # Recheck the source artifacts/checks of an already accepted receipt.
-        # Historical reads (recorded at a past head) validate acceptance from
+        # Local historical reads (recorded at a past head) validate acceptance from
         # the append-only journal without re-hashing artifacts: the review
         # lifecycle legitimately archives and annotates finding files after
         # collection, and `.ace-local` working files are disposable, so their
         # current existence proves nothing about an accepted past receipt.
-        # Current-head reads keep full artifact re-verification.
+        # Current-head reads keep full artifact re-verification. Protected
+        # readers always reverify imported bytes, including historical reads.
         def verify_accepted_evidence!(data, live_head:, repo_root:, historical: false)
           verify_head(data, live_head)
-          verify_artifacts(data, repo_root) unless historical
+          artifacts = data["artifacts"]
+          reject_unless(artifacts.is_a?(Array), "accepted artifacts must be an array")
+          if (@artifact_reader || !historical) && (data["verdict"] == "succeeded" || !artifacts.empty?)
+            verify_artifacts(data, repo_root)
+          end
           verify_checks(data)
           verify_review(data)
+          verify_campaign(data, repo_root: repo_root, live_head: live_head) if @artifact_reader
         end
 
         # @param operation [String] Receipt operation
@@ -147,17 +177,7 @@ module Ace
             recorded = artifact["sha256"].to_s
             reject("artifact missing path or sha256") if path.empty? || recorded.empty?
 
-            expanded = begin
-              File.expand_path(path, File.realpath(repo_root))
-            rescue Errno::ENOENT, Errno::EACCES
-              nil
-            end
-            reject("artifact file not found: #{path}") if expanded.nil? || !File.exist?(expanded)
-
-            resolved = safe_resolve(repo_root, path)
-            reject("artifact path escapes project root: #{path}") if resolved.nil?
-
-            actual = Digest::SHA256.hexdigest(File.read(resolved))
+            actual = Digest::SHA256.hexdigest(artifact_bytes(data, artifact, repo_root))
             reject("artifact digest mismatch for #{path}") unless actual == recorded
           end
         end
@@ -225,28 +245,44 @@ module Ace
           unless Array(data["artifacts"]).include?(reference)
             reject("campaign result must be included in verified receipt artifacts")
           end
-          resolved = safe_resolve(repo_root, reference["path"].to_s)
-          reject("campaign result path escapes repository or is missing") unless resolved
-          result = JSON.parse(File.read(resolved))
+          result = JSON.parse(artifact_bytes(data, reference, repo_root))
           reject_unless(result.is_a?(Hash), "campaign result must be an object")
-          require "ace/review"
-          current = Ace::Review::Organisms::CampaignManager.new(repo_root: repo_root).status(campaign["id"])
-          unless result["campaign_id"] == campaign["id"] && result["accepted"] == true &&
-              result["dry_run"] == false && current["accepted"] == true &&
-              result["result_identity"] == current["result_identity"] &&
-              result.dig("evidence", "current_head") == live_head && current.dig("evidence", "current_head") == live_head
-            reject("campaign result is stale, incomplete, blocked or does not match live authority")
-          end
-          approval = current["rounds"].last["approval"]
-          unless approval["producer"] == data.dig("producer", "actor") &&
-              approval["reviewer"] == data.dig("review", "reviewer", "actor") &&
-              approval["head"] == data["head"]
-            reject("campaign producer/reviewer attribution does not match independently validated receipt")
+          if @campaign_verifier
+            @campaign_verifier.call(data, result, live_head)
+            return
           end
+          require "ace/review"
+          manager = Ace::Review::Organisms::CampaignManager.new(repo_root: repo_root)
+          current = manager.status(campaign["id"])
+          reject("campaign result ID differs from receipt") unless result["campaign_id"] == campaign["id"]
+          manager.with_verified_result!(result: result, subject: current.fetch("subject"),
+            contract_identity: current.fetch("contract_identity"), policy: current.fetch("effective_policy"),
+            head: live_head, base: current.fetch("evidence").fetch("current_base"),
+            producer: data.dig("producer", "actor"), reviewer: data.dig("review", "reviewer", "actor")) { true }
         rescue JSON::ParserError, ArgumentError, TypeError, KeyError => e
           reject("invalid campaign result: #{e.message}")
         end
 
+        # Protected composition injects the canonical imported-byte owner.
+        # Its failure never falls through to the disposable workspace copy.
+        def artifact_bytes(data, artifact, repo_root)
+          if @artifact_reader
+            bytes = @artifact_reader.call(data, artifact)
+            reject("canonical artifact reader did not return bytes") unless bytes.is_a?(String)
+            return bytes.b
+          end
+          path = artifact["path"].to_s
+          expanded = begin
+            File.expand_path(path, File.realpath(repo_root))
+          rescue Errno::ENOENT, Errno::EACCES
+            nil
+          end
+          reject("artifact file not found: #{path}") if expanded.nil? || !File.exist?(expanded)
+          resolved = safe_resolve(repo_root, path)
+          reject("artifact path escapes project root: #{path}") if resolved.nil?
+          File.read(resolved)
+        end
+
         # Resolve a project-relative artifact path to its real location,
         # rejecting traversal and symlink escapes (an in-repo symlink must
         # not smuggle in an external file); returns nil when the path leaves

data/lib/ace/assign/molecules/step_writer.rb

@@ -11,6 +11,10 @@ module Ace
       # Handles creation of new step files and updating existing ones,
       # including appending reports and updating frontmatter.
       class StepWriter
+        PRIVATE_MAX_BYTES = 1024 * 1024
+        def initialize(private_files: false)
+          @private_files = private_files
+        end
         # Create a new step file
         #
         # @param steps_dir [String] Path to steps directory
@@ -101,6 +105,8 @@ module Ace
 
           # Extract number and name from filename for report file
           filename_info = Atoms::StepFileParser.parse_filename(File.basename(file_path))
+          encoded_report = report_bytes(filename_info[:number], filename_info[:name], report_content)
+          validate_private_bytes!(encoded_report)
 
           # Update frontmatter only (status + completed_at)
           new_frontmatter = parsed[:frontmatter].merge({
@@ -119,7 +125,7 @@ module Ace
           )
           report_path = File.join(reports_dir, report_filename)
 
-          write_report(report_path, filename_info[:number], filename_info[:name], report_content)
+          write_report(report_path, filename_info[:number], filename_info[:name], report_content, encoded: encoded_report)
 
           file_path
         end
@@ -204,8 +210,15 @@ module Ace
         # Write content atomically using temp file + rename pattern.
         # Prevents partial writes if process crashes mid-write.
         def atomic_write(path, content)
+          validate_private_bytes!(content)
           temp_path = "#{path}.tmp.#{Process.pid}"
-          File.write(temp_path, content)
+          if @private_files
+            File.open(temp_path, File::WRONLY | File::CREAT | File::EXCL | File::NOFOLLOW, 0600) do |file|
+              file.write(content); file.flush; file.fsync
+            end
+          else
+            File.write(temp_path, content)
+          end
           File.rename(temp_path, path)
         end
 
@@ -230,15 +243,24 @@ module Ace
         # @param number [String] Step number
         # @param name [String] Step name
         # @param content [String] Report content
-        def write_report(report_path, number, name, content)
+        def write_report(report_path, number, name, content, encoded: nil)
+          atomic_write(report_path, encoded || report_bytes(number, name, content))
+        end
+
+        def report_bytes(number, name, content)
           frontmatter = {
             "step" => number,
             "name" => name,
             "completed_at" => Time.now.utc.iso8601
           }
           yaml = frontmatter.to_yaml
-          report_content = "#{yaml}---\n\n#{content}\n"
-          atomic_write(report_path, report_content)
+          "#{yaml}---\n\n#{content}\n"
+        end
+
+        def validate_private_bytes!(content)
+          if @private_files && (!content.is_a?(String) || !content.bytesize.between?(1, PRIVATE_MAX_BYTES))
+            raise ArgumentError, "private queue output exceeds captured text bound"
+          end
         end
       end
     end

data/lib/ace/assign/molecules/terminal_scope_receipt.rb

@@ -0,0 +1,88 @@
+# frozen_string_literal: true
+require_relative "receipt_verifier"
+require_relative "canonical_evidence"
+
+module Ace
+  module Assign
+    module Molecules
+      # Pure reader over already accepted terminal owner evidence. A submitted
+      # result alone carries no terminal authority; local filesystem artifacts
+      # are never substituted for its imported protected bytes.
+      class TerminalScopeReceipt
+        BINDING_FIELDS = %w[mapping_id project_id assignment_id attempt_id result_id worker_uid worker_actor
+          launch_ticket process_binding head candidate_generation uploaded_receipt_sha256 original_receipt_digest].freeze
+        PAYLOAD_FIELDS = %w[version result_id binding uploaded_receipt_sha256 original_receipt_digest receipt_digest receipt artifacts].freeze
+
+        def self.verify!(events:, lineage:, journal:, commit:, mapping:)
+          raise AttemptErrors::EvidenceUnavailable, "terminal receipt chain differs" unless Models::EvidenceEvent.chain_valid?(events)
+          terminal = events.select { |event| event["type"] == "receipt_accepted" &&
+            %w[succeeded failed].include?(event.dig("payload", "receipt", "verdict")) }
+          raise AttemptErrors::EvidenceUnavailable, "no unique accepted terminal receipt" unless terminal.size == 1
+          accepted = terminal.first
+          receipt = accepted.fetch("payload").fetch("receipt")
+          before = events.take_while { |event| event.fetch("digest") != accepted.fetch("digest") }
+          submitted = before.select { |event| event["type"] == "result_submitted" &&
+            event.dig("payload", "receipt_digest") == receipt.fetch("digest") }
+          raise AttemptErrors::EvidenceUnavailable, "accepted terminal result provenance differs" unless submitted.size == 1
+          payload = submitted.first.fetch("payload")
+          binding = payload.fetch("binding")
+          reservation = before.find { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "reserve_attempt" }
+          origin = reservation.fetch("payload").fetch("data")
+          expected = {"mapping_id" => origin.fetch("mapping_id"), "project_id" => mapping.fetch("project_id"),
+            "assignment_id" => origin.fetch("assignment_id"), "attempt_id" => accepted.fetch("attempt_id"),
+            "worker_uid" => mapping.fetch("worker_uid"), "worker_actor" => mapping.fetch("worker_actor"),
+            "launch_ticket" => origin.fetch("launch_ticket"), "process_binding" => lineage.child_event.fetch("payload").fetch("original_process_binding")}
+          candidates = before.select { |event| event["type"] == "authority_mutation" &&
+            event.dig("payload", "operation") == "submit_candidate" &&
+            event.dig("payload", "data", "candidate_generation") == binding.fetch("candidate_generation") }
+          candidate = candidates.one? && candidates.first.dig("payload", "data")
+          unless payload.keys.sort == PAYLOAD_FIELDS.sort && binding.keys.sort == BINDING_FIELDS.sort &&
+              payload["version"] == 1 && expected.all? { |key, value| binding[key] == value } &&
+              candidate && candidate["head"] == binding["head"] && receipt["head"] == binding["head"] &&
+              payload["result_id"] == binding["result_id"] && payload["uploaded_receipt_sha256"] == binding["uploaded_receipt_sha256"] &&
+              payload["original_receipt_digest"] == binding["original_receipt_digest"] &&
+              Models::ExecutionReceipt.from_h(payload.fetch("receipt")).digest_payload == Models::ExecutionReceipt.from_h(receipt).digest_payload &&
+              (receipt.keys - Models::ExecutionReceipt.from_h(receipt).to_h.keys).empty? &&
+              payload["artifacts"] == receipt["artifacts"] &&
+              receipt["producer"] == {"actor" => mapping.fetch("worker_actor"), "role" => "worker", "runtime" => "herdr"} &&
+              journal.canonical_attempt_state(events) == receipt.fetch("verdict")
+            raise AttemptErrors::EvidenceUnavailable, "accepted terminal receipt selectors differ"
+          end
+          model = Models::ExecutionReceipt.from_h(receipt)
+          unless model.digest == Atoms::EvidenceDigest.digest(model.digest_payload) && model.digest == payload.fetch("receipt_digest")
+            raise AttemptErrors::EvidenceUnavailable, "accepted terminal receipt digest differs"
+          end
+          finishes = events.select { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "finish" }
+          unless finishes.empty?
+            transition = events[events.index(accepted) + 1]
+            finish = events[events.index(accepted) + 2]
+            expected_reply = binding.slice("attempt_id", "result_id", "head", "candidate_generation").merge(
+              "receipt_digest" => payload.fetch("receipt_digest"), "state" => receipt.fetch("verdict"))
+            unless finishes.one? && finishes.first == finish && transition && transition["type"] == "transition" &&
+                transition.fetch("payload") == {"from" => "running", "to" => receipt.fetch("verdict"), "reason" => "protected_result_accepted"} &&
+                finish.dig("payload", "data").except("generation") == expected_reply &&
+                finish.dig("payload", "data", "generation") == events.take(events.index(finish) + 1).count { |event| event["type"] == "authority_mutation" }
+              raise AttemptErrors::EvidenceUnavailable, "accepted finish reply or terminal transition differs"
+            end
+          end
+          canonical = CanonicalEvidence.new(journal: journal)
+          context = {kind: "result", project_id: binding.fetch("project_id"), assignment_id: binding.fetch("assignment_id"),
+            attempt_id: binding.fetch("attempt_id"), peer_uid: binding.fetch("worker_uid"), binding: binding,
+            request_id_or_event_id: binding.fetch("result_id"), generation: binding.fetch("candidate_generation")}
+          reader = ->(_data, artifact) { canonical.read({"ref" => artifact.fetch("path"), "sha256" => artifact.fetch("sha256")},
+            **context, commit: commit) }
+          Array(receipt["artifacts"]).each { |artifact| reader.call(receipt, artifact) }
+          intent = before.find { |event| event["type"] == "intent" }
+          attempt = journal.send(:build_attempt, binding.fetch("assignment_id"), binding.fetch("attempt_id"),
+            intent.fetch("payload"), before, "running")
+          verifier = ReceiptVerifier.new(artifact_reader: reader)
+          verifier.verify_result!(receipt, attempt: attempt, live_head: binding.fetch("head"), repo_root: journal.repo_root)
+          verifier.verify_accepted_evidence!(receipt, live_head: binding.fetch("head"), repo_root: journal.repo_root, historical: true)
+          accepted
+        rescue KeyError, TypeError, ArgumentError, NoMethodError, AttemptErrors::ReceiptRejected
+          raise AttemptErrors::EvidenceUnavailable, "authenticated terminal scope receipt unavailable"
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/organisms/assignment_executor.rb

@@ -37,10 +37,10 @@ module Ace
           end
         end
 
-        def initialize(cache_base: nil, skill_source_resolver: nil, step_catalog: nil)
-          @assignment_manager = Molecules::AssignmentManager.new(cache_base: cache_base)
-          @queue_scanner = Molecules::QueueScanner.new
-          @step_writer = Molecules::StepWriter.new
+        def initialize(cache_base: nil, skill_source_resolver: nil, step_catalog: nil, selected_assignment: nil, queue_scanner: nil)
+          @assignment_manager = Molecules::AssignmentManager.new(cache_base: cache_base, selected_assignment: selected_assignment)
+          @queue_scanner = queue_scanner || Molecules::QueueScanner.new
+          @step_writer = Molecules::StepWriter.new(private_files: !selected_assignment.nil?)
           @skill_source_resolver = skill_source_resolver || Molecules::SkillAssignSourceResolver.new
           @step_catalog = nil
           @step_catalog_from_fixture = step_catalog
@@ -68,6 +68,12 @@ module Ace
 
           assignment_config = config["assignment"] || {}
           steps_config = config["steps"] || []
+          if config.key?("delivery")
+            Atoms::DeliveryParameters.validate(config["delivery"])
+            unless Array(steps_config).any? { |step| %w[create-pr update-pr-desc mark-pr-ready].include?(step["name"]) }
+              raise ArgumentError, "Explicit delivery inputs require remote steps"
+            end
+          end
 
           raise Error, "No steps defined in config" if steps_config.empty?