ace-assign 0.63.1 → 0.66.0

data/lib/ace/assign/authority/candidate_transfer.rb

@@ -0,0 +1,327 @@
+# frozen_string_literal: true
+
+require "digest"
+require "json"
+require "fileutils"
+require "tmpdir"
+require "tempfile"
+require "ace/herdr/molecules/bounded_process"
+require_relative "private_directory"
+
+module Ace
+  module Assign
+    module Authority
+      # Untrusted bundles enter a clean bare quarantine. Only complete verified
+      # objects are retained; no uploader configuration or worktree is read.
+      class CandidateTransfer
+        MAX_BYTES = 64 * 1024 * 1024
+        DEADLINE = 30
+        SHA = /\A[0-9a-f]{40}\z/
+
+        class CampaignReadView
+          def initialize(owner:, repository:, base:, deadline:)
+            @owner, @repository, @base, @deadline = owner, repository, base, deadline
+            @thread, @active = Thread.current, true
+          end
+
+          def close = @active = false
+          def head = command("rev-parse", "HEAD").strip
+          def base
+            commit!(@base)
+            @base
+          end
+          def commit!(revision)
+            raise ArgumentError, "campaign revision is invalid" unless revision.is_a?(String) && revision.match?(SHA)
+            command("cat-file", "-e", "#{revision}^{commit}")
+            true
+          end
+          def full_diff?(base, head)
+            commit!(base)
+            commit!(head)
+            !command("diff", "--raw", "--no-ext-diff", "--no-textconv", base, head, "--").empty?
+          end
+          def clean?
+            command("status", "--porcelain", "-z", "--untracked-files=all").split("\0")
+              .all? { |entry| entry.start_with?("?? .ace-local/") }
+          end
+
+          private
+
+          def command(*arguments)
+            unless @active && Thread.current.equal?(@thread)
+              raise AttemptErrors::EvidenceUnavailable, "campaign Git read view escaped its source lifetime"
+            end
+            @owner.send(:git, @repository, @deadline, *arguments)
+          rescue Timeout::Error
+            raise AttemptErrors::EvidenceUnavailable, "campaign Git read deadline expired"
+          end
+        end
+
+        def with_campaign_repository(bytes:, sha256:, size:, head:, tree:, base:)
+          raise ArgumentError, "campaign repository requires a block" unless block_given?
+          deadline = monotonic + DEADLINE
+          materialized = materialize_repository(bytes: bytes, sha256: sha256, size: size, head: head, tree: tree, root: @root)
+          directory = materialized.fetch("directory")
+          reader = CampaignReadView.new(owner: self, repository: directory, base: base, deadline: deadline)
+          unless reader.head == head
+            raise AttemptErrors::EvidenceUnavailable, "campaign Git head differs from original candidate"
+          end
+          reader.base
+          yield reader
+        ensure
+          reader&.close
+          FileUtils.remove_entry(directory) if directory && File.directory?(directory)
+        end
+
+        def initialize(root:)
+          @root = File.expand_path(root)
+          verify_root!
+        end
+
+        # Export the already validated prepared tree using the same isolated Git
+        # boundary as admission. The returned bytes are retained by the producer;
+        # registration must not rebuild them after a lost response.
+        def export_prepared(work:)
+          require_relative "prepared_work"
+          reject!("Prepared export requires validated work") unless work.is_a?(PreparedWork)
+          verify_root!
+          deadline = monotonic + DEADLINE
+          Dir.mktmpdir("prepared-export-", @root) do |directory|
+            File.chmod(0700, directory)
+            repository = File.join(directory, "repository")
+            git(directory, deadline, "init", "--template=", "--initial-branch=prepared", repository)
+            work.files.each do |path, bytes|
+              target = File.join(repository, path)
+              FileUtils.mkdir_p(File.dirname(target), mode: 0700)
+              File.open(target, File::WRONLY | File::CREAT | File::EXCL | File::NOFOLLOW, 0600) do |file|
+                file.write(bytes)
+              end
+            end
+            git(repository, deadline, "add", "--", ".")
+            git(repository, deadline, "-c", "user.name=ACE prepared input", "-c", "user.email=prepared@ace.invalid",
+              "-c", "commit.gpgSign=false", "commit", "--no-verify", "-m", "Prepared assignment input")
+            head = git(repository, deadline, "rev-parse", "HEAD").strip
+            tree = git(repository, deadline, "rev-parse", "HEAD^{tree}").strip
+            bundle = File.join(directory, "prepared.bundle")
+            git(repository, deadline, "bundle", "create", bundle, "refs/heads/prepared")
+            bytes = read_bundle(bundle).freeze
+            {"head" => head.freeze, "tree" => tree.freeze, "bundle" => bytes,
+              "bytes" => bytes.bytesize, "sha256" => Digest::SHA256.hexdigest(bytes).freeze,
+              "definition_bytes" => work.definition_bytes(head: head, tree: tree)}.freeze
+          end
+        rescue Timeout::Error
+          reject!("Prepared export deadline exceeded")
+        rescue SystemCallError
+          reject!("Prepared export filesystem is unavailable")
+        end
+
+        def admit(bytes:, sha256:, size:, head:, &consumer)
+          unless bytes.is_a?(String) && size.is_a?(Integer) && size.positive? && size <= MAX_BYTES &&
+              size == bytes.bytesize && sha256.is_a?(String) &&
+              Digest::SHA256.hexdigest(bytes.b) == sha256 && head.is_a?(String) && head.match?(SHA)
+            reject!("Candidate bundle binding or size is invalid")
+          end
+          verify_root!
+          deadline = monotonic + DEADLINE
+          Dir.mktmpdir("quarantine-", @root) do |directory|
+            File.chmod(0700, directory)
+            bundle = File.join(directory, "candidate.bundle")
+            File.open(bundle, File::WRONLY | File::CREAT | File::EXCL | File::NOFOLLOW, 0600) { |f| f.write(bytes.b) }
+            repository = File.join(directory, "repository")
+            git(directory, deadline, "init", "--bare", "--template=", repository)
+            # Verification against an empty repository rejects incremental
+            # bundles requiring any caller-supplied prerequisites.
+            git(repository, deadline, "bundle", "verify", bundle)
+            advertised = git(repository, deadline, "bundle", "list-heads", bundle).lines.map { |line| line.split.first }
+            reject!("Candidate head is not advertised") unless advertised.include?(head)
+            git(repository, deadline, "fetch", "--no-tags", bundle, "#{head}:refs/heads/candidate")
+            actual = git(repository, deadline, "rev-parse", "refs/heads/candidate^{commit}").strip
+            reject!("Candidate commit differs from declared head") unless actual == head
+            git(repository, deadline, "fsck", "--full", "--strict", "--no-reflogs")
+            tree = git(repository, deadline, "rev-parse", "#{head}^{tree}").strip
+            exported = File.join(directory, "verified.bundle")
+            git(repository, deadline, "bundle", "create", exported, "refs/heads/candidate")
+            verified = read_bundle(exported)
+            # The journal owns candidate identity/generation. This object is
+            # only immutable transport bytes, not another authority ledger.
+            result = {"head" => head, "tree" => tree, "bundle" => verified,
+                      "sha256" => Digest::SHA256.hexdigest(verified), "bytes" => verified.bytesize}
+            consumer ? consumer.call(repository, deadline, result) : result
+          end
+        rescue Timeout::Error
+          reject!("Candidate transfer deadline exceeded")
+        rescue SystemCallError
+          reject!("Candidate transfer filesystem is unavailable")
+        end
+
+        # root is selected from installed peer credentials by the receiver,
+        # never a request field. Materialization reads objects rather than Git
+        # checkout, so .gitattributes, filters and uploader hooks cannot run.
+        def materialize(bytes:, sha256:, size:, head:, tree:, root:)
+          self.class.new(root: root)
+          admit(bytes: bytes, sha256: sha256, size: size, head: head) do |repository, deadline, result|
+            reject!("Candidate tree differs from accepted tree") unless result["tree"] == tree
+            destination = Dir.mktmpdir("candidate-", root)
+            File.chmod(0700, destination)
+            begin
+              entries = git(repository, deadline, "ls-tree", "-r", "-z", head, limit: MAX_BYTES).b.split("\0")
+              total = 0
+              links = []
+              entries.each do |entry|
+                metadata, path = entry.split("\t", 2)
+                mode, kind, oid = metadata.to_s.split(" ")
+                parts = path.to_s.split("/", -1)
+                unless path && !path.start_with?("/") &&
+                    parts.none? { |part| part.empty? || %w[. .. .git].include?(part.downcase) } &&
+                    kind == "blob" && %w[100644 100755 120000].include?(mode) && oid.match?(SHA)
+                  reject!("Candidate contains unsafe filesystem entry")
+                end
+                content = git(repository, deadline, "cat-file", "blob", oid, limit: MAX_BYTES).b
+                total += content.bytesize
+                reject!("Candidate expanded content is oversized") if total > MAX_BYTES
+                target = File.join(destination, path)
+                FileUtils.mkdir_p(File.dirname(target), mode: 0700)
+                if mode == "120000"
+                  resolved = File.expand_path(content, File.dirname(target))
+                  unless !content.include?("\0") && !content.start_with?("/") &&
+                      resolved.start_with?(destination + "/")
+                    reject!("Candidate symlink escapes private checkout")
+                  end
+                  links << [target, content]
+                else
+                  File.open(target, File::WRONLY | File::CREAT | File::EXCL | File::NOFOLLOW,
+                    mode == "100755" ? 0700 : 0600) { |file| file.write(content) }
+                end
+                yield(path.freeze, mode.freeze, oid.freeze, content.freeze) if block_given?
+              end
+              links.each { |target, content| File.symlink(content, target) }
+              links.each do |target, _content|
+                resolved = File.realpath(target)
+                reject!("Candidate symlink escapes private checkout") unless resolved.start_with?(destination + "/")
+              end
+              result.reject { |key, _value| key == "bundle" }.merge("directory" => destination)
+            rescue Exception
+              # Only this freshly created private disposable directory is
+              # removed. An existing peer scratch tree is never cleaned.
+              FileUtils.rm_rf(destination)
+              raise
+            end
+          end
+        rescue SystemCallError, ArgumentError
+          reject!("Candidate filesystem materialization is unverifiable")
+        end
+
+        # Executing campaign children need local Git history as well as files.
+        # Create only our own empty administration; no uploader configuration,
+        # checkout filters or hooks enter this private repository.
+        def materialize_repository(bytes:, sha256:, size:, head:, tree:, root:)
+          deadline = monotonic + DEADLINE
+          result = materialize(bytes: bytes, sha256: sha256, size: size, head: head, tree: tree, root: root)
+          directory = result.fetch("directory")
+          Tempfile.create(["campaign-candidate-", ".bundle"], root) do |file|
+            file.binmode
+            file.write(bytes); file.flush
+            git(directory, deadline, "init", "--template=", "--initial-branch=work")
+            git(directory, deadline, "fetch", "--no-tags", file.path, "#{head}:refs/heads/candidate")
+            git(directory, deadline, "symbolic-ref", "HEAD", "refs/heads/candidate")
+            git(directory, deadline, "read-tree", head)
+            reject!("Campaign private repository differs") unless git(directory, deadline, "rev-parse", "HEAD^{tree}").strip == tree
+          end
+          result
+        rescue Exception
+          FileUtils.remove_entry(directory) if directory && File.directory?(directory) && !File.symlink?(directory)
+          raise
+        end
+
+        # Full immutable review input comes from the same admitted Git objects
+        # used for materialization, never a second read of the scratch checkout.
+        def review_snapshot(bytes:, sha256:, size:, head:, tree:, root:)
+          subject = JSON.generate("schema" => "ace.candidate-review-snapshot/v1", "head" => head, "tree" => tree)
+            .delete_suffix("}") + ',"files":['
+          first = true
+          result = materialize(bytes: bytes, sha256: sha256, size: size, head: head, tree: tree, root: root) do |path, mode, oid, content|
+            entry = JSON.generate("path" => review_bytes(path), "mode" => mode, "oid" => oid, "content" => review_bytes(content))
+            separator = first ? "" : ","
+            reject!("Complete candidate review snapshot is oversized") if subject.bytesize + separator.bytesize + entry.bytesize + 2 > MAX_BYTES
+            subject << separator << entry
+            first = false
+          end
+          subject << "]}"
+          result.merge("subject" => subject.freeze)
+        end
+
+        # Prepared instructions have a narrower tree contract than candidates:
+        # no executable entries or symlinks, and bounded UTF-8 files. Read only
+        # verified Git objects; never run checkout filters or reopen uploader paths.
+        def prepared_files(repository:, deadline:, head:)
+          entries = git(repository, deadline, "ls-tree", "-r", "-z", head, limit: MAX_BYTES).b.split("\0")
+          reject!("Prepared file inventory is oversized") unless entries.size.between?(4, 4096)
+          total = 0
+          files = entries.to_h do |entry|
+            metadata, path = entry.split("\t", 2)
+            mode, kind, oid = metadata.to_s.split(" ")
+            unless path && mode == "100644" && kind == "blob" && oid.match?(SHA) &&
+                !path.start_with?("/") && path.split("/", -1).none? { |part| part.empty? || %w[. .. .git].include?(part.downcase) }
+              reject!("Prepared tree contains unsafe entry")
+            end
+            size = git(repository, deadline, "cat-file", "-s", oid).strip
+            reject!("Prepared text is oversized") unless size.match?(/\A[0-9]+\z/) && size.to_i.between?(1, 1024 * 1024)
+            total += size.to_i
+            reject!("Prepared expanded content is oversized") if total > MAX_BYTES
+            [path, git(repository, deadline, "cat-file", "blob", oid, limit: 1024 * 1024).b]
+          end
+          reject!("Prepared inventory has duplicate paths") unless files.size == entries.size
+          files
+        end
+
+        private
+
+        def review_bytes(bytes)
+          text = bytes.dup.force_encoding(Encoding::UTF_8)
+          if text.valid_encoding? && !text.include?("\0")
+            {"encoding" => "utf-8", "bytes" => text}
+          else
+            {"encoding" => "base64", "bytes" => [bytes].pack("m0")}
+          end
+        end
+
+        def verify_root!
+          PrivateDirectory.verify!(@root)
+        end
+
+        def git(repository, deadline, *arguments, limit: 65_536)
+          remaining = deadline - monotonic
+          raise Timeout::Error if remaining <= 0
+          # Git variables may redirect object/config storage even in a clean
+          # repository. Strip every inherited Git setting and global config.
+          environment = ENV.keys.to_h { |key| [key, nil] }
+          environment.merge!("GIT_CONFIG_NOSYSTEM" => "1", "GIT_CONFIG_GLOBAL" => "/dev/null",
+            "GIT_TERMINAL_PROMPT" => "0", "GIT_ALLOW_PROTOCOL" => "file",
+            "GIT_NO_REPLACE_OBJECTS" => "1", "PATH" => "/usr/bin:/bin", "LC_ALL" => "C")
+          result = Herdr::Molecules::BoundedProcess.call([environment, "/usr/bin/git", "-C", repository,
+            "-c", "core.hooksPath=/dev/null", "-c", "protocol.file.allow=always", *arguments],
+            stdin_data: "", timeout_s: remaining, output_limit: limit)
+          reject!("Candidate Git verification failed") unless result.status.success? && !result.oversized
+          result.stdout
+        end
+
+        def read_bundle(path)
+          File.open(path, File::RDONLY | File::NOFOLLOW) do |file|
+            reject!("Verified bundle is oversized") unless file.stat.file? && file.stat.size <= MAX_BYTES
+            bytes = file.read(MAX_BYTES + 1).b
+            reject!("Verified bundle is oversized") if bytes.bytesize > MAX_BYTES
+            bytes
+          end
+        end
+
+        def monotonic
+          Process.clock_gettime(Process::CLOCK_MONOTONIC)
+        end
+
+        def reject!(message)
+          raise AttemptErrors::ReceiptRejected, message
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/cleanup_result_protection.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+require "fiddle"
+require "ace/runtime/molecules/protected_artifact_set"
+
+module Ace
+  module Assign
+    module Authority
+      # Extends the existing held artifact protection solely for the bounded
+      # root result view. Private archive storage is never admitted here.
+      class CleanupResultProtection < Ace::Runtime::Molecules::ProtectedArtifactSet::Protection
+        class LinuxACL
+          def absent!(handle, attribute)
+            unless RUBY_PLATFORM.include?("linux")
+              raise Ace::Runtime::RuntimeUnavailableError, "cleanup result ACL evidence requires Linux"
+            end
+            function = Fiddle::Function.new(Fiddle::Handle::DEFAULT["fgetxattr"],
+              [Fiddle::TYPE_INT, Fiddle::TYPE_VOIDP, Fiddle::TYPE_VOIDP, Fiddle::TYPE_SIZE_T], Fiddle::TYPE_SSIZE_T)
+            size = function.call(handle.fileno, attribute, 0, 0)
+            error = Fiddle.last_error
+            unless size == -1 && error == Errno::ENODATA::Errno
+              raise Ace::Runtime::RuntimeUnavailableError, "cleanup result ACL protection is unavailable"
+            end
+          rescue Fiddle::DLError
+            raise Ace::Runtime::RuntimeUnavailableError, "cleanup result ACL reader is unavailable"
+          end
+        end
+
+        def initialize(result_path:, authority_gid:, acl: LinuxACL.new, **options)
+          unless result_path.is_a?(String) && result_path.start_with?("/") && !result_path.include?("\0") &&
+              File.expand_path(result_path) == result_path && authority_gid.is_a?(Integer) && authority_gid.positive?
+            raise ArgumentError, "invalid fixed cleanup result view"
+          end
+          super(**options)
+          @result_path, @parent, @authority_gid, @acl = result_path.dup.freeze, File.dirname(result_path).freeze, authority_gid, acl
+        end
+
+        def verify!(path, handle, directory:)
+          super
+          return unless path == @result_path || path == @parent
+          parent = path == @parent
+          stat = handle.stat
+          unless directory == parent && stat.gid == @authority_gid &&
+              (stat.mode & 0o7777) == (parent ? 0o2750 : 0o640)
+            raise Ace::Runtime::RuntimeUnavailableError, "cleanup result view mode or group differs"
+          end
+          @acl.absent!(handle, "system.posix_acl_access")
+          @acl.absent!(handle, "system.posix_acl_default") if parent
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/client.rb

@@ -0,0 +1,257 @@
+# frozen_string_literal: true
+require "securerandom"
+require_relative "deployment"
+require_relative "transfer_codec"
+require_relative "campaign_execution"
+require_relative "candidate_transfer"
+require_relative "../molecules/canonical_evidence"
+require_relative "../molecules/execution_scope_lineage"
+
+module Ace
+  module Assign
+    module Authority
+      class Client
+        Reply = Struct.new(:data, :replayed, :parts, keyword_init: true)
+        attr_reader :mapping_id
+        def initialize(mapping_id:, deployment: Deployment.load, kernel: Ace::Runtime::Molecules::ProtectedLinux.new)
+          @mapping_id, @deployment, @kernel = mapping_id, deployment, kernel
+          @map = deployment.mapping(mapping_id)
+          @service = deployment.authority(@map.fetch("authority_id"))
+        end
+
+        def call(operation, params, mutation_id: nil, timeout: nil, upload_parts: nil, download: false, purpose: nil)
+          if operation == "register_assignment" && (!upload_parts || purpose != :candidate || download)
+            raise ArgumentError, "prepared registration requires fixed candidate upload"
+          end
+          if operation == "evidence_fetch" && (!download || purpose != (%w[prepared_work campaign_candidate].include?(params["kind"]) ? :candidate : :artifacts) || upload_parts)
+            raise ArgumentError, "evidence fetch requires source-fixed kind download"
+          end
+          if operation == "submit_result" && (!upload_parts || purpose != :receipt_artifacts || download)
+            raise ArgumentError, "result submission requires fixed receipt upload"
+          end
+          if operation == "campaign_export_result" && (!download || purpose != :artifacts || upload_parts || mutation_id)
+            raise ArgumentError, "campaign result requires fixed read-only artifact download"
+          end
+          if operation == "campaign_record_round" && (!upload_parts || purpose != :receipt_artifacts || download)
+            raise ArgumentError, "campaign round requires fixed bounded upload"
+          end
+          @deployment.verify!(mapping_id, kernel: @kernel)
+          wire = Ace::Runtime::Molecules::ProtectedSocket
+          path = @service.fetch("socket_path")
+          before = wire.socket_identity(path)
+          raise Ace::Runtime::RuntimeUnavailableError, "authority endpoint owner differs" unless before.last == @service.fetch("uid")
+          raise ArgumentError, "cannot upload and download on one request" if upload_parts && download
+          prepared_download = operation == "evidence_fetch" && %w[prepared_work campaign_candidate].include?(params["kind"])
+          codec = transfer_codec if upload_parts || download && !prepared_download
+          descriptor = codec.descriptor(upload_parts, purpose: purpose) if upload_parts
+          parameters = upload_parts ? params.merge("transfer" => descriptor) : params
+          cap = %w[reserve_attempt close_execution_scope stop_attempt].include?(operation) ? 90 : 30
+          duration = timeout || (cap == 90 ? 90 : 5)
+          unless duration.is_a?(Numeric) && duration.positive? && duration.finite?
+            raise ArgumentError, "authority timeout must be finite and positive"
+          end
+          deadline = wire.deadline([duration, cap].min)
+          wire.connect(path, deadline: deadline) do |socket|
+            peer = @kernel.peer(socket)
+            unless peer["uid"] == @service.fetch("uid") && peer["gid"] == @service.fetch("gid") &&
+                peer["groups"] == @service.fetch("groups") && wire.socket_identity(path) == before
+              raise AttemptErrors::UnauthorizedIdentity, "authority endpoint peer changed"
+            end
+            wire.write(socket, {"version" => 1, "operation" => operation,
+              "mutation_id" => mutation_id, "project_id" => @map.fetch("project_id"),
+              "params" => parameters.merge("mapping_id" => mapping_id)}, deadline: deadline, limit: upload_parts || download ? 16_384 : wire::LIMIT)
+            if %w[bind_inbox finish recover request_review review_status launch_review_intent cancel_review assignment_inventory evidence_fetch observe_execution_scope close_execution_scope stop_attempt prompt_status launch_input_inhibit_selection launch_input_inhibit_completion launch_prompt_intent launch_prompt_completion claim_service_settlement workspace_prune_preview_context].include?(operation) || (operation == "attempt_status" && params.key?("result_candidate_generation"))
+              socket.shutdown(Socket::SHUT_WR)
+            end
+            if upload_parts
+              codec.send(socket, parts: upload_parts, descriptor: descriptor, purpose: purpose, deadline: deadline)
+              socket.shutdown(Socket::SHUT_WR)
+            end
+            result = wire.read(socket, deadline: deadline, limit: 16_384)
+            unless result.is_a?(Hash) && result["status"] == "ok" && result["data"].is_a?(Hash)
+              code = result.is_a?(Hash) ? result.dig("error", "code") : nil
+              raise AttemptErrors::BoundedResultUnavailable, "protected authority result exceeds frame bound" if code == "bounded_result"
+              raise AttemptErrors::EvidenceUnavailable, "protected authority refused (#{code || 'invalid_response'})"
+            end
+            transport = result.fetch("transport")
+            unless transport.is_a?(Hash) && transport.keys == ["replayed"] && [true, false].include?(transport["replayed"])
+              raise AttemptErrors::EvidenceUnavailable, "authority replay metadata is unavailable"
+            end
+            if operation == "evidence_fetch"
+              if %w[prepared_work campaign_candidate].include?(params["kind"]) && transport.fetch("replayed")
+                raise AttemptErrors::EvidenceUnavailable, "prepared fetch cannot replay a mutation"
+              end
+              validate_evidence_download!(result.fetch("data"), params)
+            end
+            parts = if download
+              codec = prepared_transfer_codec(result.fetch("data").fetch("descriptor")) if prepared_download
+              codec.receive(socket, descriptor: result.fetch("data").fetch("transfer"), purpose: purpose, deadline: deadline) do |input|
+                Array.new(input.count) { |index| input.bytes(index: index) }
+              end
+            end
+            Reply.new(data: result.fetch("data"), replayed: transport.fetch("replayed"), parts: parts)
+          end
+        rescue SystemCallError, IOError
+          raise AttemptErrors::EvidenceUnavailable, "protected authority connection unavailable; no local fallback"
+        end
+
+
+        # Fixed original-launcher stream. Public calls retain their existing
+        # complete-upload EOF contract; no caller-selected framing flag exists.
+        def with_launch_control(state:)
+          @deployment.verify!(mapping_id, kernel: @kernel)
+          wire = Ace::Runtime::Molecules::ProtectedSocket
+          path = @service.fetch("socket_path")
+          before = wire.socket_identity(path)
+          raise Ace::Runtime::RuntimeUnavailableError, "Authority endpoint owner differs" unless before.last == @service.fetch("uid")
+          deadline = wire.deadline(30)
+          wire.connect(path, deadline: deadline) do |socket|
+            peer = @kernel.peer(socket)
+            unless peer.values_at("uid", "gid", "groups") == @service.values_at("uid", "gid", "groups") && wire.socket_identity(path) == before
+              raise AttemptErrors::UnauthorizedIdentity, "Authority stream peer changed"
+            end
+            wire.write(socket, {"version" => 1, "operation" => "launch_control", "mutation_id" => nil,
+              "project_id" => @map.fetch("project_id"), "params" => state.slice("assignment_id", "attempt_id").merge("mapping_id" => mapping_id)},
+              deadline: deadline, limit: 16_384)
+            ready = wire.read(socket, deadline: deadline, limit: 16_384)
+            validate_launch_control_ready!(ready, state)
+            yield socket, transfer_codec, ready
+          end
+        rescue IOError, SystemCallError
+          raise AttemptErrors::EvidenceUnavailable, "Original launch control connection is unavailable"
+        end
+
+        private
+
+        def validate_launch_control_ready!(ready, state)
+          unless ready.is_a?(Hash) && ready.keys.sort == %w[attempt_id generation journal_commit original_binding_digest type version] &&
+              ready["version"].is_a?(Integer) && ready["version"] == 1 && ready["type"] == "launch_control_ready" &&
+              ready["attempt_id"] == state.fetch("attempt_id") && ready["generation"].is_a?(Integer) && ready["generation"].positive? &&
+              ready["journal_commit"].is_a?(String) && ready["journal_commit"].match?(/\A(?:[0-9a-f]{40}|[0-9a-f]{64})\z/) &&
+              ready["original_binding_digest"].is_a?(String) && ready["original_binding_digest"].match?(/\A[0-9a-f]{64}\z/)
+            raise AttemptErrors::EvidenceUnavailable, "Original launch control admission is unavailable"
+          end
+          true
+        end
+
+        def validate_evidence_download!(data, params)
+          descriptor, transfer = data.values_at("descriptor", "transfer")
+          if params["kind"] == "prepared_work"
+            validate_prepared_download!(data, params)
+            return
+          end
+          if params["kind"] == "campaign_candidate"
+            validate_campaign_candidate_download!(data, params)
+            return
+          end
+          unless data.keys.sort == %w[descriptor generation journal_commit transfer] &&
+              Molecules::CanonicalEvidence.valid_descriptor?(descriptor) &&
+              descriptor["project_id"] == @map.fetch("project_id") &&
+              {"assignment_id" => "assignment_id", "attempt_id" => "attempt_id", "kind" => "kind",
+                "request_id_or_event_id" => "purpose_id", "artifact_id" => "artifact_id"}.all? { |field, key| descriptor[field] == params[key] } &&
+              data["generation"].is_a?(Integer) && data["generation"] >= 0 &&
+              data["journal_commit"].is_a?(String) && data["journal_commit"].match?(/\A[0-9a-f]{40,64}\z/) &&
+              transfer.is_a?(Hash) && transfer.keys.sort == %w[bytes parts sha256 version] && transfer["version"] == 1 &&
+              transfer["bytes"] == descriptor["bytes"] && transfer["sha256"] == descriptor["sha256"] &&
+              transfer["parts"] == [descriptor.slice("bytes", "sha256")]
+            raise AttemptErrors::EvidenceUnavailable, "canonical download descriptor differs"
+          end
+        end
+
+        def transfer_codec
+          peer = @kernel.capture(Process.pid)
+          project = @deployment.project(@map.fetch("project_id"))
+          installed = project.fetch("peer_credentials").fetch(peer.fetch("uid").to_s)
+          unless peer["gid"] == installed["gid"] && peer["groups"] == installed["groups"]
+            raise AttemptErrors::UnauthorizedIdentity, "transfer scratch principal differs"
+          end
+          TransferCodec.new(root: installed.fetch("scratch_root"))
+        end
+
+        def validate_prepared_download!(data, params)
+          descriptor, transfer = data.values_at("descriptor", "transfer")
+          fields = %w[version kind purpose artifact project_id mapping_id assignment_id attempt_id task_id scope definition_digest selection_sha256 prepared_head prepared_tree manifest_bytes manifest_sha256 registration_generation registration_commit original_binding_digest ref bytes sha256 task_context_entry original_worker_identity original_worker_scratch_root workspace_exclusion].sort
+          valid = data.keys.sort == %w[descriptor generation journal_commit transfer] && descriptor.is_a?(Hash) && descriptor.keys.sort == fields &&
+            descriptor["version"].is_a?(Integer) && descriptor["version"] == 1 &&
+            params.values_at("kind", "purpose_id", "artifact_id") == %w[prepared_work original_prepared_work prepared_bundle] &&
+            descriptor.values_at("kind", "purpose", "artifact") == %w[prepared_work original_prepared_work prepared_bundle] &&
+            descriptor["project_id"] == @map.fetch("project_id") && descriptor["mapping_id"] == mapping_id &&
+            %w[assignment_id attempt_id].all? { |key| descriptor[key] == params[key] } &&
+            descriptor["task_id"].is_a?(String) && descriptor["task_id"].match?(Deployment::TOKEN) &&
+            descriptor["scope"].is_a?(String) && descriptor["scope"].bytesize.between?(1, 128) && descriptor["scope"].match?(/\A[0-9]+(?:\.[0-9]+)*\z/) &&
+            %w[definition_digest selection_sha256 manifest_sha256 original_binding_digest sha256].all? { |key| descriptor[key].is_a?(String) && descriptor[key].match?(/\A[0-9a-f]{64}\z/) } &&
+            %w[prepared_head prepared_tree].all? { |key| descriptor[key].is_a?(String) && descriptor[key].match?(/\A[0-9a-f]{40}\z/) } &&
+            descriptor["manifest_bytes"].is_a?(Integer) && descriptor["manifest_bytes"].between?(1, 32_768) &&
+            descriptor["registration_generation"].is_a?(Integer) && descriptor["registration_generation"].positive? &&
+            descriptor["bytes"].is_a?(Integer) && descriptor["bytes"].between?(1, TransferCodec::LIMITS.fetch(:candidate).first) &&
+            descriptor["registration_commit"].is_a?(String) && descriptor["registration_commit"].match?(/\A(?:[0-9a-f]{40}|[0-9a-f]{64})\z/) &&
+            descriptor["ref"] == "execution/prepared/#{params.fetch('assignment_id')}-#{descriptor['sha256']}.bundle" &&
+            data["generation"].is_a?(Integer) && data["generation"].positive? &&
+            data["journal_commit"].is_a?(String) && data["journal_commit"].match?(/\A(?:[0-9a-f]{40}|[0-9a-f]{64})\z/) &&
+            transfer.is_a?(Hash) && transfer.keys.sort == %w[bytes parts sha256 version] && transfer["version"].is_a?(Integer) && transfer["version"] == 1 &&
+            transfer.values_at("bytes", "sha256") == descriptor.values_at("bytes", "sha256") && transfer["parts"] == [descriptor.slice("bytes", "sha256")]
+          raise AttemptErrors::EvidenceUnavailable, "original prepared download descriptor differs" unless valid
+          TaskContextEntry.validate!(descriptor.fetch("task_context_entry"))
+          Molecules::LifecycleExclusion.workspace_reader(projection: descriptor.fetch("workspace_exclusion"))
+          unless descriptor.dig("workspace_exclusion", "root_resource", "view_path") ==
+              "/run/ace/lifecycle-exclusion/#{descriptor.fetch('mapping_id')}"
+            raise AttemptErrors::EvidenceUnavailable, "original prepared lifecycle mapping differs"
+          end
+          identity = descriptor.fetch("original_worker_identity")
+          birth = identity.is_a?(Hash) && identity["started_at"]
+          boot = birth.is_a?(String) && birth.split(":", -1)[1]
+          Molecules::ExecutionScopeLineage.validate_process_identity!(identity, boot_id: boot)
+          root = descriptor.fetch("original_worker_scratch_root")
+          unless root.is_a?(String) && root.valid_encoding? && root.bytesize.between?(2, 4096) &&
+              root.start_with?("/") && !root.include?("\0") && File.expand_path(root) == root
+            raise AttemptErrors::EvidenceUnavailable, "original prepared scratch root differs"
+          end
+        rescue ArgumentError, KeyError
+          raise AttemptErrors::EvidenceUnavailable, "original prepared download descriptor differs"
+        end
+
+        def validate_campaign_candidate_download!(data, params)
+          descriptor, transfer = data.values_at("descriptor", "transfer")
+          fields = %w[head tree bytes sha256 candidate_generation campaign_execution mapping_id assignment_id attempt_id
+            project_id original_worker_identity original_worker_scratch_root original_binding_digest].sort
+          unless data.keys.sort == %w[descriptor generation journal_commit transfer] &&
+              descriptor.is_a?(Hash) && descriptor.keys.sort == fields &&
+              params.values_at("purpose_id", "artifact_id") == %w[original_campaign_candidate candidate_bundle] &&
+              descriptor["mapping_id"] == mapping_id && descriptor["project_id"] == @map.fetch("project_id") &&
+              %w[assignment_id attempt_id].all? { |key| descriptor[key] == params[key] } &&
+              %w[head tree].all? { |key| descriptor[key].is_a?(String) && descriptor[key].match?(CandidateTransfer::SHA) } &&
+              %w[sha256 original_binding_digest].all? { |key| descriptor[key].is_a?(String) && descriptor[key].match?(/\A[0-9a-f]{64}\z/) } &&
+              descriptor["candidate_generation"].is_a?(Integer) && descriptor["candidate_generation"].positive? &&
+              descriptor["bytes"].is_a?(Integer) && descriptor["bytes"].between?(1, CandidateTransfer::MAX_BYTES) &&
+              descriptor["campaign_execution"].is_a?(Hash) && descriptor["campaign_execution"].keys.sort == CampaignExecution::FIELDS &&
+              data["generation"].is_a?(Integer) && data["generation"].positive? &&
+              data["journal_commit"].is_a?(String) && data["journal_commit"].match?(/\A(?:[0-9a-f]{40}|[0-9a-f]{64})\z/) &&
+              transfer.is_a?(Hash) && transfer.keys.sort == %w[bytes parts sha256 version] && transfer["version"] == 1 &&
+              transfer["version"].is_a?(Integer) &&
+              transfer.values_at("bytes", "sha256") == descriptor.values_at("bytes", "sha256") && transfer["parts"] == [descriptor.slice("bytes", "sha256")]
+            raise AttemptErrors::EvidenceUnavailable, "original campaign candidate download differs"
+          end
+          identity = descriptor.fetch("original_worker_identity")
+          birth = identity.is_a?(Hash) && identity["started_at"]
+          Molecules::ExecutionScopeLineage.validate_process_identity!(identity, boot_id: birth.to_s.split(":", -1)[1])
+          root = descriptor.fetch("original_worker_scratch_root")
+          unless root.is_a?(String) && root.valid_encoding? && root.bytesize.between?(2, 4096) &&
+              root.start_with?("/") && !root.include?("\0") && File.expand_path(root) == root
+            raise AttemptErrors::EvidenceUnavailable, "original campaign scratch root differs"
+          end
+        rescue ArgumentError, KeyError
+          raise AttemptErrors::EvidenceUnavailable, "original campaign candidate download differs"
+        end
+
+        def prepared_transfer_codec(descriptor)
+          peer = @kernel.capture(Process.pid)
+          original = descriptor.fetch("original_worker_identity")
+          unless peer.values_at("uid", "gid", "groups") == original.values_at("uid", "gid", "groups")
+            raise AttemptErrors::UnauthorizedIdentity, "original prepared scratch principal differs"
+          end
+          TransferCodec.new(root: descriptor.fetch("original_worker_scratch_root"))
+        end
+      end
+    end
+  end
+end