ace-assign 0.63.1 → 0.66.0

data/lib/ace/assign/authority/endcap_campaign_rounds.rb

@@ -0,0 +1,266 @@
+# frozen_string_literal: true
+require_relative "campaign_round_transfer"
+
+module Ace
+  module Assign
+    module Authority
+      class Endcap
+        private
+
+        def campaign_round_request!(request)
+          params = request.fetch("params")
+          unless params.is_a?(Hash) && params.keys.sort == PARAMETERS.fetch("campaign_record_round").sort &&
+              params["head"].is_a?(String) && params["head"].match?(CandidateTransfer::SHA) &&
+              params["candidate_generation"].is_a?(Integer) && params["candidate_generation"].positive? &&
+              params["input_sha256"].is_a?(String) && params["input_sha256"].match?(DIGEST)
+            raise ArgumentError, "campaign round request differs"
+          end
+          %w[mapping_id assignment_id attempt_id].each { |key| result_id!(params.fetch(key)) }
+          result_id!(request.fetch("mutation_id"))
+          map = @deployment.mapping(params.fetch("mapping_id"))
+          raise AttemptErrors::UnauthorizedIdentity, "campaign project differs" unless map["project_id"] == request.fetch("project_id")
+          [params, map]
+        end
+
+        def authorize_campaign_round!(request:, peer:, role:)
+          params, map = campaign_round_request!(request)
+          @launch.with_assignment(params: params, map: map) do |journal, registration|
+            protected_journal!(journal)
+            descriptor = @launch.send(:control_original_descriptor!, registration.fetch("lifecycle_control"))
+            original_map = descriptor.mapping(params.fetch("mapping_id"))
+            events = @launch.preview_attempt_events!(journal: journal, commit: journal.ref_value, params: params, map: original_map)
+            finish_identity!(events, params, original_map, peer, role)
+            definition = @launch.preview_attempt_definition!(journal: journal, commit: journal.ref_value, params: params, map: original_map)
+            CampaignExecution.validate_parent!(definition.review_campaign)
+          end
+          true
+        end
+
+        def with_campaign_receipt!(journal:, commit:, events:, params:, map:, receipt:, result:, historical:)
+          unless result.is_a?(Hash) && result["schema"] == "ace.review.accepted-result/v1" &&
+              receipt["campaign"].is_a?(Hash) && receipt["campaign"].keys.sort == %w[id result] &&
+              receipt["operation"] == "review" && receipt["verdict"] == "succeeded"
+            raise AttemptErrors::ReceiptRejected, "parent campaign receipt differs"
+          end
+          context = @launch.send(:control_registration_context!, params, map, journal, commit: commit)
+          original_map = context.fetch(:map)
+          descriptor = context.fetch(:descriptor)
+          selected = CampaignExecution.validate_parent!(@launch.preview_attempt_definition!(journal: journal,
+            commit: commit, params: params, map: original_map).review_campaign)
+          unless receipt.dig("campaign", "id") == selected.fetch("campaign_id") && result["campaign_id"] == selected.fetch("campaign_id")
+            raise AttemptErrors::ReceiptRejected, "parent campaign identity differs"
+          end
+          origin = retained_origin(events, params)
+          parent = params.merge("scope" => origin.fetch("scope"), "base" => origin.fetch("base_head"), "head" => receipt.fetch("head"))
+          current = exact_candidate!(retained_candidate(events, params.fetch("candidate_generation")), parent)
+          project = descriptor.project(original_map.fetch("project_id"))
+          root = File.join(project.fetch("campaign_repository"), ".ace-local", "review", "candidate-views")
+          FileUtils.mkdir_p(root, mode: 0o700)
+          bundle = journal.bounded_blob(current.fetch("bundle_ref"), commit: commit, max_bytes: CandidateTransfer::MAX_BYTES)
+          CandidateTransfer.new(root: root).with_campaign_repository(bytes: bundle, sha256: current.fetch("sha256"),
+            size: current.fetch("bytes"), head: current.fetch("head"), tree: current.fetch("tree"), base: parent.fetch("base")) do |candidate_reader|
+            manager = @launch.send(:campaign_manager_for!, context,
+              **campaign_execution_dependencies!(journal: journal, commit: commit, parent_params: parent, parent_map: original_map),
+              candidate_reader: candidate_reader)
+            binding = selected.slice("subject", "contract_identity", "policy").transform_keys(&:to_sym).merge(
+              result: result, head: receipt.fetch("head"), base: parent.fetch("base"),
+              producer: receipt.fetch("producer").fetch("actor"), reviewer: receipt.fetch("review").fetch("reviewer").fetch("actor"))
+            if historical
+              manager.verify_retained_result!(**binding)
+              yield
+            else
+              deployment_sha = @launch.send(:protected_descriptor_sha256!)
+              CampaignConsumerPolicy.new.with(@deployment.project(original_map.fetch("project_id")).fetch("campaign_policy")) do |profiles, held|
+                manager.with_verified_result!(**binding, consumer_profiles: profiles) do |_verified, snapshot|
+                  unless result == snapshot
+                    raise AttemptErrors::ReceiptRejected, "exported campaign result bytes differ from verified owner"
+                  end
+                  held.verify_unchanged!
+                  campaign_parent_candidate!(journal: journal, commit: commit, params: parent, map: original_map)
+                  unless @launch.send(:protected_descriptor_sha256!) == deployment_sha
+                    raise AttemptErrors::Conflict, "campaign consumer policy descriptor advanced"
+                  end
+                  value = yield
+                  held.verify_unchanged!
+                  unless @launch.send(:protected_descriptor_sha256!) == deployment_sha
+                    raise AttemptErrors::Conflict, "campaign consumer policy descriptor advanced"
+                  end
+                  value
+                end
+              end
+            end
+          end
+        rescue Ace::Review::Atoms::CampaignContract::Invalid, KeyError, TypeError, ArgumentError
+          raise AttemptErrors::ReceiptRejected, "canonical parent campaign evidence is unavailable"
+        end
+
+        def with_campaign_submission!(journal:, commit:, events:, params:, map:, admitted:, replay:)
+          receipt = admitted.fetch(:receipt)
+          return yield unless receipt["campaign"]
+          definition = @launch.preview_attempt_definition!(journal: journal, commit: commit, params: params, map: map)
+          unless definition.review_campaign
+            raise AttemptErrors::EvidenceUnavailable, "protected campaigns require their canonical owner"
+          end
+          reference = receipt.fetch("campaign").fetch("result")
+          index = receipt.fetch("artifacts").index(reference)
+          raise AttemptErrors::ReceiptRejected, "campaign result is not an uploaded artifact" unless index
+          result = JSON.parse(admitted.fetch(:artifacts).fetch(index), create_additions: false,
+            max_nesting: 64, allow_duplicate_key: false, allow_comments: false)
+          with_campaign_receipt!(journal: journal, commit: commit, events: events, params: params, map: map,
+            receipt: receipt, result: result, historical: !replay.nil?) { yield }
+        rescue JSON::ParserError
+          raise AttemptErrors::ReceiptRejected, "campaign result JSON is malformed"
+        end
+
+        # Service callers already retain with_assignment's original control SH
+        # and authority mutex through CAS. Round writers take the same keys EX
+        # before R1, so this read cannot invert with an admitted round writer.
+        def campaign_service_checks!(journal:, commit:, events:, params:, map:, current:)
+          definition = @launch.preview_attempt_definition!(journal: journal, commit: commit, params: params, map: map)
+          return true unless definition.review_campaign
+          parent = params.merge("head" => current.fetch("head"), "candidate_generation" => current.fetch("candidate_generation"))
+          result = verified_result(journal, events, parent, map, retained_origin(events, parent), current, commit)
+          unless result&.dig("receipt", "campaign") && result.dig("receipt", "verdict") == "succeeded"
+            raise AttemptErrors::ReceiptRejected, "ready or merge requires its canonical parent campaign result and executed checks"
+          end
+          with_campaign_finish!(journal: journal, commit: commit, events: events,
+            params: parent.merge("result_id" => result.fetch("result_id")), map: map) { true }
+        end
+
+        def with_campaign_finish!(journal:, commit:, events:, params:, map:)
+          record = events.find { |event| event["type"] == "result_submitted" && event.dig("payload", "result_id") == params["result_id"] }
+          return yield unless record&.dig("payload", "receipt", "campaign")
+          current = exact_candidate!(candidate(events), params)
+          payload = verified_result(journal, events, params, map, retained_origin(events, params), current, commit,
+            result_id: params.fetch("result_id"))
+          reference = payload.fetch("receipt").fetch("campaign").fetch("result")
+          canonical = Molecules::CanonicalEvidence.new(journal: journal)
+          bytes = canonical.read({"ref" => reference.fetch("path"), "sha256" => reference.fetch("sha256")},
+            **result_context(payload.fetch("binding")), commit: commit)
+          result = JSON.parse(bytes, create_additions: false, max_nesting: 64, allow_duplicate_key: false, allow_comments: false)
+          with_campaign_receipt!(journal: journal, commit: commit, events: events, params: params, map: map,
+            receipt: payload.fetch("receipt"), result: result, historical: false) { yield }
+        rescue JSON::ParserError
+          raise AttemptErrors::ReceiptRejected, "canonical campaign result JSON is malformed"
+        end
+
+        def dispatch_campaign_export(request:, peer:, role:, body: true)
+          params = request.fetch("params")
+          unless params.is_a?(Hash) && params.keys.sort == PARAMETERS.fetch("campaign_export_result").sort &&
+              params["head"].is_a?(String) && params["head"].match?(CandidateTransfer::SHA) &&
+              params["candidate_generation"].is_a?(Integer) && params["candidate_generation"].positive? && request["mutation_id"].nil?
+            raise ArgumentError, "campaign result selectors differ"
+          end
+          %w[mapping_id assignment_id attempt_id].each { |key| result_id!(params.fetch(key)) }
+          map = @deployment.mapping(params.fetch("mapping_id"))
+          raise AttemptErrors::UnauthorizedIdentity, "campaign project differs" unless map["project_id"] == request.fetch("project_id")
+          @launch.with_assignment(params: params, map: map, exclusive: true) do |journal, registration|
+            protected_journal!(journal)
+            commit = journal.ref_value
+            descriptor = @launch.send(:control_original_descriptor!, registration.fetch("lifecycle_control"))
+            original_map = descriptor.mapping(params.fetch("mapping_id"))
+            context = @launch.send(:control_registration_context!, params, original_map, journal, commit: commit)
+            events = @launch.preview_attempt_events!(journal: journal, commit: commit, params: params, map: original_map)
+            origin = active_origin(events, params)
+            role == :worker ? worker_or_launcher!(peer, role, original_map, origin) : finish_identity!(events, params, original_map, peer, role)
+            selected = CampaignExecution.validate_parent!(@launch.preview_attempt_definition!(journal: journal,
+              commit: commit, params: params, map: original_map).review_campaign)
+            return true unless body
+            parent = params.merge("scope" => origin.fetch("scope"), "base" => origin.fetch("base_head"))
+            campaign_parent_candidate!(journal: journal, commit: commit, params: parent, map: original_map)
+            current = exact_candidate!(candidate(events), params)
+            bundle = journal.bounded_blob(current.fetch("bundle_ref"), commit: commit, max_bytes: CandidateTransfer::MAX_BYTES)
+            project = descriptor.project(original_map.fetch("project_id"))
+            root = File.join(project.fetch("campaign_repository"), ".ace-local", "review", "candidate-views")
+            FileUtils.mkdir_p(root, mode: 0o700)
+            CandidateTransfer.new(root: root).with_campaign_repository(bytes: bundle, sha256: current.fetch("sha256"),
+              size: current.fetch("bytes"), head: current.fetch("head"), tree: current.fetch("tree"), base: parent.fetch("base")) do |candidate_reader|
+              manager = @launch.send(:campaign_manager_for!, context,
+                **campaign_execution_dependencies!(journal: journal, commit: commit, parent_params: parent, parent_map: original_map),
+                candidate_reader: candidate_reader)
+              result = manager.accepted_result_snapshot(selected.fetch("campaign_id"))
+              deployment_sha = @launch.send(:protected_descriptor_sha256!)
+              CampaignConsumerPolicy.new.with(@deployment.project(original_map.fetch("project_id")).fetch("campaign_policy")) do |profiles, held|
+              manager.with_verified_result!(result: result, **selected.slice("subject", "contract_identity", "policy").transform_keys(&:to_sym),
+                head: params.fetch("head"), base: parent.fetch("base"), producer: result.fetch("producer"), reviewer: result.fetch("reviewer"),
+                consumer_profiles: profiles) do
+                held.verify_unchanged!
+                unless @launch.send(:protected_descriptor_sha256!) == deployment_sha
+                  raise AttemptErrors::Conflict, "campaign export policy descriptor advanced"
+                end
+                campaign_parent_candidate!(journal: journal, commit: commit, params: parent, map: original_map)
+                bytes = JSON.generate(result).b
+                raise AttemptErrors::EvidenceUnavailable, "campaign result exceeds artifact bound" if bytes.bytesize > 64 * 1024
+                {data: {"campaign_id" => selected.fetch("campaign_id"), "result_identity" => result.fetch("result_identity"),
+                  "sha256" => Digest::SHA256.hexdigest(bytes), "bytes" => bytes.bytesize, "head" => params.fetch("head"),
+                  "candidate_generation" => params.fetch("candidate_generation"), "journal_commit" => commit},
+                  replayed: false, transfer_parts: [bytes]}
+              end
+              end
+            end
+          end
+        rescue Ace::Review::Atoms::CampaignContract::Invalid, KeyError, TypeError
+          raise AttemptErrors::EvidenceUnavailable, "canonical campaign result is unavailable"
+        end
+
+        def dispatch_campaign_round(request:, peer:, role:, transfer:)
+          params, map = campaign_round_request!(request)
+          admitted = CampaignRoundTransfer.decode(input: transfer, sha256: params.fetch("input_sha256"))
+          input = admitted.fetch(:round)
+          unless input["attempt_id"] == request.fetch("mutation_id") && input["head"] == params.fetch("head")
+            raise AttemptErrors::Conflict, "campaign round stable request or head differs"
+          end
+          @launch.with_assignment(params: params, map: map, exclusive: true) do |journal, registration|
+            protected_journal!(journal)
+            commit = journal.ref_value
+            descriptor = @launch.send(:control_original_descriptor!, registration.fetch("lifecycle_control"))
+            original_map = descriptor.mapping(params.fetch("mapping_id"))
+            context = @launch.send(:control_registration_context!, params, original_map, journal, commit: commit)
+            events = @launch.preview_attempt_events!(journal: journal, commit: commit, params: params, map: original_map)
+            origin = finish_identity!(events, params, original_map, peer, role)
+            selected = CampaignExecution.validate_parent!(@launch.preview_attempt_definition!(journal: journal,
+              commit: commit, params: params, map: original_map).review_campaign)
+            parent_params = params.merge("scope" => origin.fetch("scope"), "base" => input.fetch("base"))
+            project = descriptor.project(original_map.fetch("project_id"))
+            paths = CampaignRoundTransfer.materialize(admitted: admitted, repository: project.fetch("campaign_repository"),
+              request_id: request.fetch("mutation_id"))
+            dependencies = campaign_execution_dependencies!(journal: journal, commit: commit,
+              parent_params: parent_params, parent_map: original_map)
+            current = exact_candidate!(retained_candidate(events, params.fetch("candidate_generation")), params)
+            bundle = journal.bounded_blob(current.fetch("bundle_ref"), commit: commit, max_bytes: CandidateTransfer::MAX_BYTES)
+            quarantine = File.join(project.fetch("campaign_repository"), ".ace-local", "review", "candidate-views")
+            FileUtils.mkdir_p(quarantine, mode: 0o700)
+            transfer_owner = CandidateTransfer.new(root: quarantine)
+            transfer_owner.with_campaign_repository(bytes: bundle, sha256: current.fetch("sha256"), size: current.fetch("bytes"),
+              head: current.fetch("head"), tree: current.fetch("tree"), base: input.fetch("base")) do |candidate_reader|
+              manager = @launch.send(:campaign_manager_for!, context, **dependencies, artifact_paths: paths, candidate_reader: candidate_reader)
+              deployment_sha = @launch.send(:protected_descriptor_sha256!)
+              CampaignConsumerPolicy.new.with(@deployment.project(original_map.fetch("project_id")).fetch("campaign_policy")) do |profiles, held|
+                # The existing R1 store checks exact replay before fresh policy,
+                # and binds the complete supplied frame in its input_digest.
+                data = manager.record_round(selected.fetch("campaign_id"), input, source_digest: admitted.fetch(:sha256),
+                  expected_campaign: selected.reject { |key, _| key == "version" }, consumer_profiles: profiles,
+                  before_record: -> {
+                    held.verify_unchanged!
+                    campaign_parent_candidate!(journal: journal, commit: commit, params: parent_params, map: original_map)
+                    unless @launch.send(:protected_descriptor_sha256!) == deployment_sha
+                      raise AttemptErrors::Conflict, "campaign policy descriptor advanced"
+                    end
+                  })
+                held.verify_unchanged!
+                unless journal.ref_value == commit && @launch.send(:protected_descriptor_sha256!) == deployment_sha
+                  raise AttemptErrors::Conflict, "campaign round canonical selection advanced"
+                end
+                reply = data.slice("campaign_id", "recorded_complete", "completed_rounds", "accepted", "result_identity", "replayed")
+                  .merge("request_id" => request.fetch("mutation_id"), "round_id" => input.fetch("round_id"))
+                {data: reply, replayed: data["replayed"] == true}
+              end
+            end
+          end
+        rescue Ace::Review::Atoms::CampaignContract::Invalid, KeyError, TypeError
+          raise AttemptErrors::EvidenceUnavailable, "canonical campaign round is unavailable"
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/endcap_contexts.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+require "ace/herdr/molecules/inbox_context_client"
+
+module Ace
+  module Assign
+    module Authority
+      class Endcap
+        private
+
+        def with_inbox_context(params, map, mutation_id:)
+          context = @deployment.inbox_context(params.fetch("mapping_id"), params.fetch("inbox_context_id"))
+          @deployment.verify_inbox_context!(params.fetch("mapping_id"), params.fetch("inbox_context_id"))
+          client = @inbox_context_clients&.fetch(params.fetch("inbox_context_id"))
+          client ||= Ace::Herdr::Molecules::InboxContextClient.selected(context_id: params.fetch("inbox_context_id"),
+            socket_path: context.fetch("control_socket_path"), owner_credentials: context.fetch("owner_credentials"), kernel: @kernel)
+          yield client
+        rescue Ace::Runtime::RuntimeUnavailableError, Ace::Herdr::Error
+          raise AttemptErrors::EvidenceUnavailable, "protected inbox context is unavailable"
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/endcap_inboxes.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+module Ace
+  module Assign
+    module Authority
+      class Endcap
+        INBOX_REGISTRATION_FIELDS = %w[event_id attempt_id payload_sha256].freeze
+
+        private
+
+        def inbox_registration?(value)
+          value.is_a?(Hash) && value.keys.sort == INBOX_REGISTRATION_FIELDS.sort &&
+            %w[event_id attempt_id].all? { |key| value[key].is_a?(String) && Molecules::JournalMutation::ID.match?(value[key]) } &&
+            %w[payload_sha256].all? { |key| value[key].is_a?(String) && DIGEST.match?(value[key]) }
+        end
+
+        def inbox_native_lineage!(record, lineage)
+          workspace = lineage.native_event.fetch("payload").fetch("workspace_id")
+          original = record.fetch("origin_target")
+          binding = record.fetch("binding")
+          unless original.is_a?(Hash) && binding.is_a?(Hash) &&
+              original["session"] == workspace && binding["session"] == workspace
+            raise AttemptErrors::EvidenceUnavailable, "inbox original native workspace differs"
+          end
+          if lineage.child_event
+            child = lineage.child_event.fetch("payload").fetch("original_process_binding")
+            unless original.values_at("session", "pane", "terminal_id") == child.values_at("session", "pane", "terminal_id")
+              raise AttemptErrors::EvidenceUnavailable, "inbox original native child differs"
+            end
+          end
+          true
+        end
+
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/endcap_prepared_work.rb

@@ -0,0 +1,80 @@
+# frozen_string_literal: true
+
+module Ace
+  module Assign
+    module Authority
+      class Endcap
+
+        def prepared_fetch?(request)
+          request["operation"] == "evidence_fetch" && %w[prepared_work campaign_candidate].include?(request.dig("params", "kind"))
+        end
+
+        def dispatch_prepared_fetch(request:, peer:, role:, body: true)
+          params = request.fetch("params")
+          unless request.fetch("mutation_id").nil? && params.is_a?(Hash) && params.keys.sort == PARAMETERS.fetch("evidence_fetch").sort &&
+              [%w[prepared_work original_prepared_work prepared_bundle],
+                %w[campaign_candidate original_campaign_candidate candidate_bundle]].include?(params.values_at("kind", "purpose_id", "artifact_id"))
+            raise ArgumentError, "prepared fetch envelope differs"
+          end
+          %w[mapping_id assignment_id attempt_id].each { |key| result_id!(params.fetch(key)) }
+          map = @deployment.mapping(params.fetch("mapping_id"))
+          raise AttemptErrors::UnauthorizedIdentity, "prepared project differs" unless map.fetch("project_id") == request.fetch("project_id")
+          raise AttemptErrors::UnauthorizedIdentity, "prepared fetch requires original worker" unless role == :worker
+          @kernel.live!(peer)
+          service_policy!.visible!(project: map.fetch("project_id"), uid: peer.fetch("uid"))
+          journal = @launch.send(:journal_for, map)
+          protected_journal!(journal)
+          commit = journal.ref_value
+          selected = @launch.original_prepared_registration!(journal: journal, params: params, commit: commit) do |original_map, state|
+            unless peer.values_at("uid", "gid", "groups") == original_map.values_at("worker_uid", "worker_gid", "worker_groups")
+              raise AttemptErrors::UnauthorizedIdentity, "prepared worker principal differs"
+            end
+            binding = state.fetch("process_binding")
+            @kernel.live!(binding.fetch("process_identity"))
+            @kernel.live!(binding.fetch("native_origin").fetch("server_identity"))
+            worker_or_launcher!(peer, role, original_map, state)
+          end
+          original_map = selected.fetch(:map)
+          registration = selected.fetch(:registration)
+          if params.fetch("kind") == "campaign_candidate"
+            definition = @launch.preview_attempt_definition!(journal: journal, commit: commit, params: params, map: original_map)
+            execution = definition.campaign_execution
+            raise AttemptErrors::UnauthorizedIdentity, "original worker is not a campaign child" unless execution
+            descriptor, candidate_bytes = campaign_prepared_candidate!(journal: journal, commit: commit, execution: execution, map: original_map)
+            return true unless body
+            unless journal.ref_value == commit
+              raise AttemptErrors::Conflict, "campaign original candidate selection advanced"
+            end
+            descriptor = descriptor.merge(params.slice("mapping_id", "assignment_id", "attempt_id"),
+              "project_id" => original_map.fetch("project_id"),
+              "original_worker_identity" => selected.fetch(:state).fetch("process_binding").fetch("process_identity"),
+              "original_worker_scratch_root" => selected.fetch(:original_worker_scratch_root),
+              "original_binding_digest" => selected.fetch(:original_binding_digest))
+            return {data: {"descriptor" => descriptor, "generation" => journal.authority_generation(selected.fetch(:events)),
+              "journal_commit" => commit}, replayed: false, transfer_parts: [candidate_bytes]}
+          end
+          return true unless body
+          reference = registration.fetch("prepared_work")
+          bytes = journal.bounded_blob(registration.fetch("prepared_bundle_ref"), commit: selected.fetch(:registration_commit), max_bytes: CandidateTransfer::MAX_BYTES)
+          unless bytes.is_a?(String) && bytes.bytesize == registration.fetch("prepared_bundle_bytes") &&
+              bytes.bytesize.between?(1, CandidateTransfer::MAX_BYTES) && Digest::SHA256.hexdigest(bytes) == registration.fetch("prepared_bundle_sha256")
+            raise AttemptErrors::EvidenceUnavailable, "original prepared bundle differs"
+          end
+          descriptor = reference.slice("task_id", "scope", "selection_sha256", "prepared_head", "prepared_tree", "manifest_bytes", "manifest_sha256").merge(
+            params.slice("mapping_id", "assignment_id", "attempt_id"), "version" => 1, "kind" => "prepared_work", "purpose" => "original_prepared_work", "artifact" => "prepared_bundle",
+            "project_id" => original_map.fetch("project_id"), "definition_digest" => registration.fetch("definition_digest"),
+            "task_context_entry" => registration.fetch("task_context_entry"),
+            "original_worker_identity" => selected.fetch(:state).fetch("process_binding").fetch("process_identity"),
+            "original_worker_scratch_root" => selected.fetch(:original_worker_scratch_root),
+            "workspace_exclusion" => selected.fetch(:workspace_exclusion),
+            "registration_generation" => registration.fetch("generation"), "registration_commit" => selected.fetch(:registration_commit),
+            "original_binding_digest" => selected.fetch(:original_binding_digest), "ref" => registration.fetch("prepared_bundle_ref"), "bytes" => bytes.bytesize,
+            "sha256" => registration.fetch("prepared_bundle_sha256"))
+          {data: {"descriptor" => descriptor, "generation" => journal.authority_generation(selected.fetch(:events)), "journal_commit" => commit}, replayed: false, transfer_parts: [bytes]}
+        rescue KeyError, TypeError
+          raise AttemptErrors::EvidenceUnavailable, "original prepared input is unavailable"
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/endcap_publication.rb

@@ -0,0 +1,207 @@
+# frozen_string_literal: true
+
+module Ace
+  module Assign
+    module Authority
+      class Endcap
+        # The same held assignment owner authenticates the receiver and current
+        # candidate both before transfer and inside each canonical CAS attempt.
+        # Ordinary HITL uses this same original launch and project journal;
+        # no local assignment cache or caller-selected coordinator participates.
+        def with_worker_hitl!(assignment:, attempt:, project:, requester_uid:, peer: nil)
+          selected = @deployment.data.fetch("launch_mappings").select do |_id, map|
+            map.fetch("project_id") == project && map.fetch("worker_uid") == requester_uid
+          end
+          raise AttemptErrors::UnauthorizedIdentity, "HITL worker mapping is missing or ambiguous" unless selected.size == 1
+          mapping_id, map = selected.first
+          params = {"mapping_id" => mapping_id, "assignment_id" => assignment, "attempt_id" => attempt}
+          @launch.with_assignment(params: params, map: map) do |journal, _registration|
+            protected_journal!(journal)
+            events = attempt_events(journal, params)
+            origin = active_origin(events, params)
+            @launch.scope_open_for_effect!(events: events, params: params, map: map)
+            if peer
+              unless peer.values_at("uid", "gid", "groups") == map.values_at("worker_uid", "worker_gid", "worker_groups")
+                raise AttemptErrors::UnauthorizedIdentity, "HITL requester credentials differ"
+              end
+              @kernel.live!(peer)
+              worker_or_launcher!(peer, :worker, map, origin)
+            end
+            reverse = origin.fetch("process_binding").slice("session", "pane")
+            unless reverse.values.all? { |value| value.is_a?(String) && !value.empty? } && reverse.size == 2
+              raise AttemptErrors::EvidenceUnavailable, "HITL native reverse is unavailable"
+            end
+            yield settlement_immutable(reverse.merge("schema" => "ace.hitl.ref/v1"))
+          end
+        end
+
+        def publication_executor_identity?(project:, uid:)
+          @deployment.project(project).fetch("service_executor_uids").include?(uid)
+        end
+
+        def with_publication_hitl!(binding:, project:, peer:)
+          params = binding.slice("mapping_id", "assignment_id", "attempt_id", "request_id", "claim_binding", "input_digest", "candidate_generation", "head")
+          map = @deployment.mapping(params.fetch("mapping_id"))
+          raise AttemptErrors::UnauthorizedIdentity, "publication project differs" unless map.fetch("project_id") == project
+          @launch.with_assignment(params: params, map: map) do |journal, _registration|
+            protected_journal!(journal)
+            record = publication_record!(journal, params, map, peer, :executor)
+            unless record["dispatch_phase"] == "otp_pending" && record["publication_challenge_digest"] == binding.fetch("challenge_digest")
+              raise AttemptErrors::Conflict, "publication HITL challenge is no longer pending"
+            end
+            ServiceEvidence.new(journal: journal).publication_challenge!(record)
+            selection = settlement_immutable({"executor_process_binding" => record.fetch("executor_process_binding"),
+              "challenge_ref" => record.fetch("publication_challenge_ref").fetch("ref")})
+            yield selection
+          end
+        end
+
+        def authorize_publication_update!(journal:, existing:, replacement:, pending:)
+          operation = pending.fetch(:operation)
+          allowed = ServicePublicationEvidence::PUBLICATION_FIELDS + ["dispatch_phase"]
+          unless existing.except(*allowed) == replacement.except(*allowed) && existing["state"] == "uncertain"
+            raise AttemptErrors::InvalidState, "publication transition changed original binding"
+          end
+          owner = ServiceEvidence.new(journal: journal)
+          if operation == "publication_challenge"
+            unless %w[dispatch_started issuing].include?(existing["dispatch_phase"]) && replacement["dispatch_phase"] == "otp_pending" &&
+                replacement["publication_issuing_event_digest"] == existing["publication_issuing_event_digest"]
+              raise AttemptErrors::InvalidState, "publication need has no source-owned rejected push"
+            end
+            need = owner.publication_challenge!(replacement, pending: pending)
+            unless need["previous_challenge_digest"] == existing["publication_challenge_digest"]
+              raise AttemptErrors::InvalidState, "publication need predecessor differs"
+            end
+          elsif operation == "publication_continue"
+            unless existing["dispatch_phase"] == "otp_pending" && replacement["dispatch_phase"] == "issuing" &&
+                (allowed - %w[dispatch_phase publication_issuing_event_digest]).all? { |key| existing[key] == replacement[key] }
+              raise AttemptErrors::InvalidState, "publication continuation is not a unique pending challenge"
+            end
+            owner.publication_challenge!(replacement, pending: pending)
+            events = pending.fetch(:current_events) + pending.fetch(:pending_events)
+            event = events.find { |row| row["digest"] == replacement["publication_issuing_event_digest"] }
+            unless event && event["type"] == "service_publication_issuing" &&
+                %w[request_id input_digest claim_binding publication_challenge_digest].all? { |key| event.dig("payload", key) == replacement[key] }
+              raise AttemptErrors::EvidenceUnavailable, "publication issuing event is unavailable"
+            end
+          else
+            raise AttemptErrors::InvalidState, "publication transition has no fixed source owner"
+          end
+          true
+        end
+
+        def publication_record!(journal, params, map, peer, role, events: nil)
+          record = journal.service_request(params.fetch("request_id"))
+          unless record && record["operation"] == "publish" && record["state"] == "uncertain" &&
+              %w[dispatch_started otp_pending issuing].include?(record["dispatch_phase"]) &&
+              %w[claim_binding input_digest candidate_generation].all? { |key| record[key] == params[key] } &&
+              record["candidate_head"] == params["head"] && record["mapping_id"] == params["mapping_id"]
+            raise AttemptErrors::Conflict, "publication original tuple or phase differs"
+          end
+          service_executor!(peer, role, record)
+          service_ticket!(record, params, map, peer)
+          events ||= attempt_events(journal, params)
+          current = exact_candidate!(candidate(events), params)
+          origin = active_origin(events, params)
+          worker_or_launcher!(record.fetch("worker_process_binding"), :worker, map, origin)
+          approved_review!(journal, events, params, map, current)
+          @launch.scope_open_for_effect!(events: events, params: params, map: map)
+          service_policy!.authorize!(record)
+          ServiceEvidence.new(journal: journal).context(record)
+          record
+        end
+
+        def authorize_publication_transfer!(request, params, map, peer, role)
+          @launch.with_assignment(params: params, map: map) do |journal, _registration|
+            protected_journal!(journal)
+            publication_record!(journal, params, map, peer, role)
+          end
+          true
+        end
+
+        def dispatch_publication(request, params, map, peer, role, transfer)
+          authorize_publication_transfer!(request, params, map, peer, role)
+          challenge = request.fetch("operation") == "publication_challenge"
+          bytes = nil
+          if challenge
+            unless transfer && transfer.count == 1
+              raise ArgumentError, "publication need requires one bounded artifact"
+            end
+            bytes = transfer.bytes.dup.freeze
+            unless Digest::SHA256.hexdigest(bytes) == params.fetch("receipt_sha256")
+              raise AttemptErrors::ReceiptRejected, "publication need transfer digest differs"
+            end
+          elsif transfer
+            raise ArgumentError, "publication continuation forbids upload"
+          end
+          @launch.with_assignment(params: params, map: map) do |journal, _registration|
+            publication_record!(journal, params, map, peer, role)
+            result = journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
+              mutation_id: request.fetch("mutation_id"), operation: request.fetch("operation"),
+              parameters_digest: Atoms::EvidenceDigest.digest(params), expected_generation: params.fetch("expected_generation"),
+              with_replay: true) do |events, _commit, generation|
+              record = publication_record!(journal, params, map, peer, role, events: events)
+              if challenge
+                publication_challenge_plan(journal, events, record, params, bytes, generation)
+              else
+                publication_continue_plan(journal, events, record, params, generation)
+              end
+            end
+            if !challenge && result.fetch(:replayed)
+              result = result.merge(data: result.fetch(:data).merge("invocation" => "already_issued"))
+            end
+            result
+          end
+        end
+
+        def publication_challenge_plan(journal, events, record, params, bytes, generation)
+          owner = ServiceEvidence.new(journal: journal)
+          digest = Digest::SHA256.hexdigest(bytes)
+          if record["dispatch_phase"] == "otp_pending"
+            owner.publication_challenge!(record)
+            raise AttemptErrors::Conflict, "publication pending challenge differs" unless record["publication_challenge_digest"] == digest
+            return {data: service_projection(record).merge("challenge" => "retained")}
+          end
+          unless %w[dispatch_started issuing].include?(record["dispatch_phase"])
+            raise AttemptErrors::InvalidState, "publication has no rejected push"
+          end
+          previous = record["publication_challenge_digest"]
+          owner.publication_challenge!(record) if previous
+          owner.publication_need!(bytes, record, previous: previous)
+          payload = record.slice("request_id", "input_digest", "claim_binding").merge(
+            "challenge_digest" => digest, "previous_challenge_digest" => previous, "generation" => generation + 1)
+          time = Time.now.utc
+          event = Models::EvidenceEvent.build(type: "service_publication_challenge", attempt_id: record.fetch("attempt_id"),
+            payload: payload, previous_digest: events.last&.fetch("digest"), recorded_at: time)
+          plan = Molecules::CanonicalEvidence.new(journal: journal).import_plan(**owner.context(record),
+            artifacts: [bytes], admitted_after_event_digest: event.fetch("digest"))
+          replacement = record.merge("dispatch_phase" => "otp_pending", "publication_challenge_digest" => digest,
+            "publication_challenge_ref" => plan.fetch(:references).fetch(0),
+            "publication_challenge_event_digest" => event.fetch("digest"), "publication_challenge_generation" => generation + 1)
+          plan.merge(events: [{type: "service_publication_challenge", payload: payload, recorded_at: time}] + plan.fetch(:events),
+            data: service_projection(replacement).merge("challenge" => "created"), service_updates: [{request_id: record.fetch("request_id"),
+              expected: record, replacement: replacement, event_type: "service_transition"}])
+        end
+
+        def publication_continue_plan(journal, events, record, params, generation)
+          ServiceEvidence.new(journal: journal).publication_challenge!(record)
+          unless record["publication_challenge_digest"] == params.fetch("challenge_digest")
+            raise AttemptErrors::Conflict, "publication continuation challenge differs"
+          end
+          if record["dispatch_phase"] == "issuing"
+            return {data: service_projection(record).merge("invocation" => "already_issued")}
+          end
+          raise AttemptErrors::InvalidState, "publication is not pending" unless record["dispatch_phase"] == "otp_pending"
+          payload = record.slice("request_id", "input_digest", "claim_binding", "publication_challenge_digest").merge("generation" => generation + 1)
+          time = Time.now.utc
+          event = Models::EvidenceEvent.build(type: "service_publication_issuing", attempt_id: record.fetch("attempt_id"),
+            payload: payload, previous_digest: events.last&.fetch("digest"), recorded_at: time)
+          replacement = record.merge("dispatch_phase" => "issuing", "publication_issuing_event_digest" => event.fetch("digest"))
+          {events: [{type: "service_publication_issuing", payload: payload, recorded_at: time}],
+            data: service_projection(replacement).merge("invocation" => "permitted"), service_updates: [{request_id: record.fetch("request_id"),
+              expected: record, replacement: replacement, event_type: "service_transition"}]}
+        end
+      end
+    end
+  end
+end