ace-assign 0.64.0 → 0.66.0

data/lib/ace/assign/authority/execution_scope_observation.rb

@@ -4,10 +4,17 @@ require "ace/runtime/molecules/cgroup_observation"
 require "ace/runtime/molecules/systemd_scope_manager"
 require "ace/runtime/molecules/linux_mount_info"
 require "ace/runtime/molecules/execution_unit_installation"
+require "ace/runtime/molecules/network_installation_evidence"
+require "ace/runtime/molecules/execution_network_selection"
+require "ace/runtime/molecules/execution_boot_baseline"
+require "ace/runtime/molecules/kernel_view_topology"
 require_relative "../molecules/execution_scope_lineage"
+require_relative "../molecules/lifecycle_exclusion"
 require_relative "posix_acl"
+require_relative "maintenance_workspace_retirement"
 require "digest"
 require "json"
+require "ace/herdr/molecules/protected_native_control"
 
 module Ace
   module Assign
@@ -50,8 +57,18 @@ module Ace
           end
 
           def namespace_identity
-            stat = File.stat("/proc/self/ns/mnt")
-            {"device" => stat.dev, "inode" => stat.ino}
+            File.open("/proc/self/ns/mnt", File::RDONLY) do |namespace|
+              stat = namespace.stat
+              {"device" => stat.dev, "inode" => stat.ino}
+            end
+          end
+
+          def authority_socket_identity(authority)
+            wire = Ace::Runtime::Molecules::ProtectedSocket
+            wire.root_path!(File.dirname(authority.fetch("socket_path")), directory: true, owner: authority.fetch("uid"))
+            identity = wire.socket_identity(authority.fetch("socket_path"))
+            raise Ace::Runtime::RuntimeUnavailableError, "authority endpoint owner differs" unless identity.last == authority.fetch("uid")
+            identity
           end
 
           def pin_network_namespace(path)
@@ -90,6 +107,12 @@ module Ace
             raise
           end
 
+          def resource_topology(path, mount_id:)
+            table = Ace::Runtime::Molecules::LinuxMountInfo.new(File.read("/proc/self/mountinfo", Ace::Runtime::Molecules::LinuxMountInfo::LIMIT + 1))
+            record = table.by_id(mount_id)
+            {"major_minor" => record.fetch("major_minor"), "filesystem_path" => table.filesystem_path(record, path)}
+          end
+
           def resource_boundary_policy(path)
             stat = File.lstat(path)
             unless stat.directory? && File.realpath(path) == path
@@ -115,6 +138,37 @@ module Ace
             end
           end
 
+          def lifecycle_resource_policy!(path, authority:, identity:)
+            state_root = authority.fetch("state_root")
+            unless path.start_with?(state_root + "/lifecycle-exclusion/") && File.expand_path(path) == path
+              raise Ace::Runtime::RuntimeUnavailableError, "lifecycle resource ancestry differs"
+            end
+            parts = path.split("/").reject(&:empty?)
+            paths = ["/"] + parts.each_index.map { |index| "/" + parts.take(index + 1).join("/") }
+            paths.each do |ancestor|
+              policy = resource_boundary_policy(ancestor)
+              unless [0, authority.fetch("uid")].include?(policy.fetch("uid")) &&
+                  (policy.fetch("mode") & 0o7022).zero? && policy.fetch("acl").nil? && resource_default_acl(ancestor).nil?
+                raise Ace::Runtime::RuntimeUnavailableError, "lifecycle resource ancestry is writable"
+              end
+              if ancestor == state_root || ancestor == path
+                mode = ancestor == path ? 0o755 : 0o700
+                unless policy.values_at("uid", "gid", "mode") == authority.values_at("uid", "gid") + [mode]
+                  raise Ace::Runtime::RuntimeUnavailableError, "lifecycle resource selected ownership differs"
+                end
+              end
+              if ancestor == path && policy.values_at("device", "inode", "uid", "gid") !=
+                  identity.values_at("device", "inode", "uid", "gid")
+                raise Ace::Runtime::RuntimeUnavailableError, "lifecycle policy belongs to a replaced object"
+              end
+            end
+            true
+          end
+
+          def resource_default_acl(path)
+            PosixAcl.new.entries(path, attribute: "system.posix_acl_default")
+          end
+
           def worker_uid_quiescent!(uid)
             table = Ace::Runtime::Molecules::LinuxMountInfo.new(File.read("/proc/self/mountinfo", Ace::Runtime::Molecules::LinuxMountInfo::LIMIT + 1))
             proc_mounts = table.records.select { |record| record.fetch("mountpoint") == "/proc" }
@@ -142,6 +196,13 @@ module Ace
             true
           end
 
+          def resource_present?(path)
+            File.lstat(path)
+            true
+          rescue Errno::ENOENT
+            false
+          end
+
           def boundary_manifest(scope)
             path = "/etc/ace/execution-slots/#{scope.fetch('slot_id')}/boundary-manifest.json"
             bytes = Ace::Runtime::Molecules::ExecutionUnitInstallation::Files.new.read(path, limit: 65_536)
@@ -154,15 +215,22 @@ module Ace
           end
         end
 
-        def initialize(mapping_id:, deployment:, kernel:, manager: nil, cgroups: Ace::Runtime::Molecules::CgroupObservation.new, files: Files.new)
+        def initialize(mapping_id:, deployment:, kernel:, manager: nil, cgroups: Ace::Runtime::Molecules::CgroupObservation.new, files: Files.new, network_evidence: Ace::Runtime::Molecules::NetworkInstallationEvidence.new, boot_evidence: Ace::Runtime::Molecules::ExecutionBootBaseline.new, network_selection: Ace::Runtime::Molecules::ExecutionNetworkSelection.new, workspace_reader_factory: nil)
           @mapping_id, @deployment, @kernel, @cgroups, @files = mapping_id, deployment, kernel, cgroups, files
+          @network_evidence = network_evidence
+          @boot_evidence = boot_evidence
+          @network_selection = network_selection
+          @workspace_reader_factory = workspace_reader_factory || ->(projection:) {
+            Molecules::LifecycleExclusion::WorkspaceNativeReader.new(projection: projection)
+          }
+          @native_workspace_lifetime = nil
           @map = deployment.mapping(mapping_id)
           @scope = @map.fetch("execution_scope")
           @manager = manager || Ace::Runtime::Molecules::SystemdScopeManager.new(
             slice_unit: @scope.fetch("slice_unit"), service_unit: @scope.fetch("service_unit"))
         end
 
-        def observe(lineage)
+        def observe(lineage, retirement: nil)
           @deployment.verify!(@mapping_id, kernel: @kernel, manager: @manager)
           binding = lineage.binding
           unless binding && binding.fetch("slot_id") == @scope.fetch("slot_id") && binding.fetch("boot_id") == @files.boot_id &&
@@ -175,13 +243,14 @@ module Ace
               network_selection! == binding.fetch("network_installation_selection")
             unavailable!("retained installed network namespace or selection changed")
           end
+          boot_baseline!(binding)
           before = @manager.inspect_activation
           verify_parent!(binding, before.fetch("slice"))
           pinned = @cgroups.pin(binding.fetch("cgroup_identity").fetch("path"), expected: binding.fetch("cgroup_identity"))
-          unless parent_resources! == binding.fetch("resource_identities")
+          unless parent_resources!(retirement: retirement) == binding.fetch("resource_identities")
             unavailable!("retained parent inventory changed")
           end
-          verify_resources!(binding.fetch("resource_identities"))
+          verify_resources!(binding.fetch("resource_identities"), retirement: retirement)
           value = @cgroups.observe(pinned)
           after = @manager.inspect_activation
           unless before == after && @files.boot_id == binding.fetch("boot_id")
@@ -205,6 +274,8 @@ module Ace
           network = @files.pin_network_namespace(@scope.fetch("network_namespace_path"))
           @files.worker_uid_quiescent!(@map.fetch("worker_uid"))
           boot = @files.boot_id
+          digest = Digest::SHA256.hexdigest(JSON.generate(canonical(@map)))
+          baseline = @boot_evidence.select!(expected: boot_baseline_expected(boot, digest, selection))
           namespace = @files.namespace_identity
           before = @manager.inspect_activation
           service = before.fetch("service")
@@ -228,10 +299,11 @@ module Ace
             unavailable!("fresh parent changed or acquired processes before binding")
           end
           verify_resources!(inventory)
-          context.merge("slot_id" => @scope.fetch("slot_id"), "deployment_digest" => Digest::SHA256.hexdigest(JSON.generate(canonical(@map))),
+          context.merge("slot_id" => @scope.fetch("slot_id"), "deployment_digest" => digest,
             "boot_id" => boot, "slice_invocation_id" => parent.fetch("InvocationID"), "cgroup_identity" => pinned.fetch(:identity),
             "resource_mount_namespace_identity" => namespace, "resource_identities" => inventory,
-            "network_installation_selection" => selection, "network_namespace_identity" => network.fetch(:identity))
+            "network_installation_selection" => selection, "network_namespace_identity" => network.fetch(:identity),
+            "boot_baseline_selection" => baseline.fetch("selection"))
         rescue SystemCallError, IOError, KeyError, TypeError, ArgumentError, JSON::ParserError
           unavailable!("fresh parent inventory or activation is unavailable")
         ensure
@@ -239,25 +311,137 @@ module Ace
           network&.fetch(:handle)&.close
         end
 
-        def verify_closed!(lineage)
-          value = observe(lineage)
+        def verify_closed!(lineage, retirement: nil)
+          value = observe(lineage, retirement: retirement)
           service = value.fetch("activation").fetch("service")
           unless lineage.sealed? && lineage.proof_event && value.fetch("populated").zero? &&
               %w[inactive failed].include?(service.fetch("ActiveState")) && service.fetch("MainPID").zero? &&
               service.fetch("ControlPID").zero? && service.fetch("Job") == [0, "/"]
             unavailable!("canonical closure has a live or pending native activation")
           end
+          native_cleanup_complete!
+          @files.worker_uid_quiescent!(@map.fetch("worker_uid"))
           if lineage.native_event
             native = lineage.native_event.fetch("payload")
             invocation = service.fetch("InvocationID")
             unless invocation.empty? || invocation == native.fetch("service_invocation_id")
               unavailable!("closed native incarnation was replaced")
             end
-            verify_resources!(native.fetch("resource_identities"), allow_runtime_absence: true, same_namespace: false)
+            verify_resources!(native.fetch("resource_identities"), allow_runtime_absence: true, same_namespace: false, retirement: retirement)
+          end
+          native_cleanup_complete!
+          repeated = observe(lineage, retirement: retirement)
+          unless repeated.fetch("populated").zero? && repeated.fetch("activation") == value.fetch("activation")
+            unavailable!("scope activation changed during closure verification")
           end
           true
         end
 
+        def readiness_peer!(lineage, peer)
+          lineage.require_open!
+          @deployment.verify!(@mapping_id, kernel: @kernel, manager: @manager)
+          activation = observe(lineage).fetch("activation")
+          service = activation.fetch("service")
+          profile = @manager.inspect_profile
+          command = profile.fetch("service").fetch("ExecStartPostEx").first
+          unless service.fetch("ControlPID").positive? && peer.fetch("pid") == service.fetch("ControlPID") &&
+              command.fetch(7) == peer.fetch("pid") && service.fetch("MainPID").positive? &&
+              service.fetch("MainPID") != peer.fetch("pid") &&
+              peer.values_at("uid", "gid", "groups") == @map.values_at("worker_uid", "worker_gid", "worker_groups")
+            unavailable!("peer is not the exact fixed readiness actor")
+          end
+          server = @kernel.capture(service.fetch("MainPID"))
+          unless server.values_at("uid", "gid", "groups") == peer.values_at("uid", "gid", "groups")
+            unavailable!("native server principal differs")
+          end
+          @kernel.live!(peer)
+          unavailable!("readiness activation changed") unless @manager.inspect_activation == activation
+          server
+        end
+
+        def verify_readiness_report!(lineage, peer, report, challenge:)
+          server = readiness_peer!(lineage, peer)
+          unless report.is_a?(Hash) && report.keys.sort == %w[challenge_id kernel_view_topology mount_namespace_identity network_namespace_identity resource_identities resource_observer_identity resource_topology server_identity version] &&
+              report["version"] == 1 && report["challenge_id"] == challenge.fetch("challenge_id") &&
+              @kernel.same?(report.fetch("server_identity"), server) && @kernel.same?(report.fetch("resource_observer_identity"), peer)
+            unavailable!("private readiness report binding differs")
+          end
+          network = report.fetch("network_namespace_identity")
+          unless network.is_a?(Hash) && network.keys.sort == %w[device inode] &&
+              network.values.all? { |value| value.is_a?(Integer) && value.positive? } &&
+              network == lineage.binding.fetch("network_namespace_identity") &&
+              network == lineage.admission_event.dig("payload", "data", "network_installation", "namespace_identity")
+            unavailable!("original server network namespace differs from admitted installation")
+          end
+          entries = @files.boundary_manifest(@scope).fetch("resources").select { |entry| entry.fetch("worker_visible") }
+          resources = report.fetch("resource_identities")
+          unless resources.is_a?(Array) && resources.map { |entry| entry.values_at("host_path", "view_path") }.sort ==
+              entries.map { |entry| entry.values_at("host_path", "view_path") }.sort
+            unavailable!("readiness reachable resource union differs")
+          end
+          topology = report.fetch("resource_topology")
+          unless topology.is_a?(Array) && topology.size == resources.size &&
+              topology.map { |entry| entry.values_at("host_path", "view_path") }.sort ==
+                entries.map { |entry| entry.values_at("host_path", "view_path") }.sort
+            unavailable!("readiness resource mount topology differs")
+          end
+          resources.each do |resource|
+            declaration = entries.find { |entry| entry.values_at("host_path", "view_path") == resource.values_at("host_path", "view_path") }
+            view = topology.find { |entry| entry.values_at("host_path", "view_path") == resource.values_at("host_path", "view_path") }
+            unless view.keys.sort == %w[host_path major_minor mountpoint options root view_path] &&
+                view["options"].is_a?(Array) && view["options"].include?(declaration.fetch("read_only") ? "ro" : "rw") &&
+                view["mountpoint"].is_a?(String) && (resource.fetch("view_path") == view["mountpoint"] ||
+                  resource.fetch("view_path").start_with?(view["mountpoint"].delete_suffix("/") + "/"))
+              unavailable!("readiness mount flags or projection differ")
+            end
+            host_identity = @files.resource_identity(resource.fetch("host_path"))
+            host = @files.resource_topology(resource.fetch("host_path"), mount_id: host_identity.fetch("mount_id"))
+            physical = File.expand_path(File.join(view.fetch("root"), resource.fetch("view_path").delete_prefix(view.fetch("mountpoint")).delete_prefix("/")))
+            unless host.fetch("major_minor") == view.fetch("major_minor") && host.fetch("filesystem_path") == physical
+              unavailable!("readiness mounted source or subtree differs")
+            end
+          end
+          verify_resources!(resources, same_namespace: false)
+          binding = lineage.binding
+          baseline = boot_baseline!(binding)
+          authority = @deployment.authority(@map.fetch("authority_id"))
+          endpoint = @files.authority_socket_identity(authority)
+          writable = entries.reject { |entry| entry.fetch("read_only") }.map do |entry|
+            host = @files.resource_identity(entry.fetch("host_path"))
+            @files.resource_topology(entry.fetch("host_path"), mount_id: host.fetch("mount_id"))
+              .merge("view_path" => entry.fetch("view_path"), "filesystem_type" => host.fetch("filesystem_type"))
+          end
+          Ace::Runtime::Molecules::KernelViewTopology.new.verify!(topology: report.fetch("kernel_view_topology"),
+            host_ipc: baseline.fetch("host_ipc_namespace_identity"), authority_socket: endpoint, writable_resources: writable,
+            host_devpts: baseline.fetch("host_devpts_identity"), selected_devpts: baseline.fetch("selected_devpts"))
+          unavailable!("authority endpoint changed during view verification") unless endpoint == @files.authority_socket_identity(authority)
+          report.slice("server_identity", "resource_observer_identity", "mount_namespace_identity", "resource_identities").merge(
+            "scope_generation" => binding.fetch("scope_generation"), "scope_binding_event_id" => lineage.binding_event.fetch("digest"),
+            "service_invocation_id" => @manager.inspect_activation.fetch("service").fetch("InvocationID"),
+            "workspace_id" => @map.fetch("native").fetch("workspace_id"),
+            "network_namespace_identity" => network.dup,
+            "network_admission_event_id" => lineage.admission_event.fetch("digest"))
+        end
+
+        def complete_native_readiness!(lineage, payload)
+          unavailable!("completed activation lacks authenticated readiness") unless payload.is_a?(Hash)
+          activation = observe(lineage).fetch("activation")
+          service = activation.fetch("service")
+          unless service.fetch("ActiveState") == "active" && service.fetch("ControlPID").zero? && service.fetch("Job") == [0, "/"] &&
+              service.fetch("MainPID") == payload.dig("server_identity", "pid") &&
+              service.fetch("InvocationID") == payload.fetch("service_invocation_id")
+            unavailable!("native service has not completed the exact admitted activation")
+          end
+          @kernel.live!(payload.fetch("server_identity"))
+          socket = Ace::Runtime::Molecules::ProtectedSocket.socket_identity(@map.fetch("native").fetch("socket_path"))
+          value = payload.merge("socket_identity" => socket)
+          native_map = @map.merge("native" => @map.fetch("native").merge(value.slice("server_identity", "socket_identity")))
+          Ace::Herdr::Molecules::ProtectedNativeControl.new(mapping: native_map, kernel: @kernel).preflight!
+          verify_resources!(value.fetch("resource_identities"), same_namespace: false)
+          unavailable!("native activation changed during preflight") unless @manager.inspect_activation == activation
+          value
+        end
+
         def native_admission_ready!(lineage)
           value = observe(lineage)
           service = value.fetch("activation").fetch("service")
@@ -265,16 +449,34 @@ module Ace
               service.fetch("MainPID").zero? && service.fetch("ControlPID").zero? && service.fetch("Job") == [0, "/"]
             unavailable!("native admission has an occupied or pending generation")
           end
-          # Effective firewall evidence cannot be obtained through this fixed
-          # unprivileged owner. The reviewed evidence/lifetime contract is still
-          # open: unit hashes and /proc routes must never substitute for it.
-          unavailable!("required effective network boundary evidence is unavailable")
+          binding = lineage.binding
+          selection = binding.fetch("network_installation_selection")
+          evidence = @network_evidence.verify!(selection: selection, expected: {
+            "slot_id" => @scope.fetch("slot_id"), "namespace_path" => @scope.fetch("network_namespace_path"),
+            "boot_id" => binding.fetch("boot_id"), "namespace_identity" => binding.fetch("network_namespace_identity"),
+            "installer_artifact_sha256" => selection.fetch("installer_artifact").fetch("sha256")})
+          selector = lineage.binding_event.fetch("digest")
+          if @native_workspace_lifetime
+            unavailable!("native workspace lifetime belongs to another scope") unless @native_workspace_lifetime.fetch(:selector) == selector
+            @native_workspace_lifetime.fetch(:reader).verify_unchanged!
+          else
+            reader = @workspace_reader_factory.call(projection: workspace_exclusion_projection!(lineage))
+            reader.acquire!
+            @native_workspace_lifetime = {selector: selector, reader: reader}
+          end
+          evidence
         end
 
         def start_admitted_service!
+          unavailable!("native workspace lifetime is not retained") unless @native_workspace_lifetime
+          @native_workspace_lifetime.fetch(:reader).verify_unchanged!
           @manager.start_service
         end
 
+        # The original source callback passes the maintained dedicated selection.
+        # It cannot choose a different slot, slice, principal or unit at launch.
+
+
         def sealed_service_stop_required?(lineage)
           unavailable!("service stop requires the canonical original seal") unless lineage.sealed?
           service = observe(lineage).fetch("activation").fetch("service")
@@ -282,11 +484,47 @@ module Ace
             service.fetch("MainPID").zero? && service.fetch("ControlPID").zero?)
         end
 
+
+
         def stop_sealed_service!
           @manager.stop_service
         end
 
+        # Read-only original owner check used before all-root retirement.
+        def verify_maintenance_closed!(lineages, retirement: nil)
+          @deployment.verify!(@mapping_id, kernel: @kernel, manager: @manager)
+          activation = @manager.inspect_activation
+          service, slice = activation.values_at("service", "slice")
+          unless %w[inactive failed].include?(service.fetch("ActiveState")) &&
+              service.fetch("Job") == [0, "/"] && service.fetch("MainPID").zero? && service.fetch("ControlPID").zero? &&
+              slice.fetch("Job") == [0, "/"]
+            unavailable!("maintenance has live or pending fixed-unit activation")
+          end
+          parent_resources!(retirement: retirement)
+          @files.worker_uid_quiescent!(@map.fetch("worker_uid"))
+          if %w[inactive failed].include?(slice.fetch("ActiveState"))
+            unless slice.fetch("InvocationID").empty? || lineages.any? { |lineage| lineage.binding.fetch("slice_invocation_id") == slice.fetch("InvocationID") }
+              unavailable!("stopped maintenance parent is unknown")
+            end
+            unless slice.fetch("ControlGroup").empty?
+              pinned = @cgroups.pin(Ace::Runtime::Molecules::CgroupObservation::ROOT + slice.fetch("ControlGroup"))
+              unavailable!("stopped maintenance parent has writers") unless @cgroups.observe(pinned).fetch("populated").zero?
+            end
+          else
+            exact = lineages.select { |lineage| lineage.binding.fetch("slice_invocation_id") == slice.fetch("InvocationID") }
+            unavailable!("maintenance parent has no unique canonical released owner") unless exact.size == 1
+            verify_closed!(exact.first, retirement: retirement)
+          end
+          unless @manager.inspect_activation == activation
+            unavailable!("maintenance fixed activation changed during observation")
+          end
+          true
+        ensure
+          pinned&.fetch(:handle)&.close
+        end
+
         def retire_released_parent!(lineages)
+          verify_maintenance_closed!(lineages)
           @deployment.verify!(@mapping_id, kernel: @kernel, manager: @manager)
           activation = @manager.inspect_activation
           service = activation.fetch("service")
@@ -323,42 +561,141 @@ module Ace
               service.fetch("MainPID").zero? && service.fetch("ControlPID").zero? && service.fetch("Job") == [0, "/"]
             unavailable!("sealed parent still has writers or pending activation")
           end
-          admitted = events.any? { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "scope_service_admission" }
-          if admitted && !lineage.native_event
-            unavailable!("admitted native activation lacks verified writer-boundary evidence")
-          end
-          if admitted || lineage.native_event || lineage.child_event || events.any? { |event|
-              %w[process_start service_claim service_transition inbox_binding].include?(event["type"]) ||
-                event["type"] == "authority_mutation" && %w[record_launch bind_process release_launch].include?(event.dig("payload", "operation")) }
-            unavailable!("post-native writer-boundary revalidation is unavailable")
+          native_cleanup_complete!
+          # A stopped admitted-but-unbound start can have executed. Its proof
+          # therefore uses the same positive writer baseline as a native bound
+          # generation; absence of a binding is never a no-execution assertion.
+          if lineage.native_event
+            native = lineage.native_event.fetch("payload")
+            invocation = service.fetch("InvocationID")
+            unless invocation.empty? || invocation == native.fetch("service_invocation_id")
+              unavailable!("closed native incarnation was replaced")
+            end
+            verify_resources!(native.fetch("resource_identities"), allow_runtime_absence: true, same_namespace: false)
           end
-          # This bounded path proves a generation that never admitted native,
-          # child or effect creation. It is not post-native readiness proof.
           current = parent_resources!
           unless current == lineage.binding.fetch("resource_identities") &&
               @files.namespace_identity == lineage.binding.fetch("resource_mount_namespace_identity")
-            unavailable!("never-admitted parent resources or observation namespace changed")
+            unavailable!("sealed parent resources or observation namespace changed")
           end
           @files.worker_uid_quiescent!(@map.fetch("worker_uid"))
+          native_cleanup_complete!
           # Rejoin object and population after the credential baseline, keeping
           # the snapshot bounded by the same retained activation and exclusion.
-          unless observe(lineage).fetch("populated").zero?
-            unavailable!("never-admitted parent acquired a writer during baseline observation")
+          repeated = observe(lineage)
+          unless repeated.fetch("populated").zero? && repeated.fetch("activation") == value.fetch("activation")
+            unavailable!("sealed parent acquired a writer or pending activation during baseline observation")
           end
-          lineage.binding.slice("scope_generation", "boot_id", "slice_invocation_id", "cgroup_identity").merge(
+          proof = lineage.binding.slice("scope_generation", "boot_id", "slice_invocation_id", "cgroup_identity").merge(
             "scope_binding_event_id" => lineage.binding_event.fetch("digest"), "seal_event_id" => lineage.seal_event.fetch("digest"), "populated" => 0)
+          if @native_workspace_lifetime
+            unavailable!("closed proof differs from native workspace lifetime") unless @native_workspace_lifetime.fetch(:selector) == lineage.binding_event.fetch("digest")
+            @native_workspace_lifetime.fetch(:reader).verify_unchanged!
+            @native_workspace_lifetime.fetch(:reader).close!
+            @native_workspace_lifetime = nil
+          end
+          proof
+        end
+
+        # Declaration bytes are selected by this original observer's pinned
+        # deployment digest. A workspace cannot inherit eligibility merely
+        # because another parent resource has the same host pathname.
+        def maintenance_workspace_resource!(lineage)
+          manifest = @files.boundary_manifest(@scope)
+          declarations = manifest.fetch("resources").select { |entry| entry.fetch("host_path") == @map.fetch("worker_cwd") }
+          unless declarations.one? && declarations.first.values_at("stage", "worker_visible", "read_only") == ["parent", true, false]
+            unavailable!("workspace original declaration is not a writable parent view")
+          end
+          declaration = declarations.first
+          resources = lineage.binding.fetch("resource_identities").select do |entry|
+            entry.values_at("host_path", "view_path") == declaration.values_at("host_path", "view_path")
+          end
+          unless resources.one? && %w[mount_id device inode].all? { |key| resources.first.fetch(key).is_a?(Integer) && resources.first.fetch(key).positive? }
+            unavailable!("workspace original parent identity is unavailable")
+          end
+          resources.first
+        rescue KeyError, TypeError, ArgumentError, Ace::Runtime::RuntimeUnavailableError
+          unavailable!("workspace original boundary is unavailable")
+        end
+
+        def maintenance_parent_resource_declarations!(lineage)
+          declarations = @files.boundary_manifest(@scope).fetch("resources").select { |entry| entry.fetch("stage") == "parent" }.map do |entry|
+            entry.slice("host_path", "view_path", "stage", "worker_visible", "read_only")
+          end
+          identities = lineage.binding.fetch("resource_identities")
+          selectors = declarations.map { |entry| entry.values_at("host_path", "view_path") }
+          bound = identities.map { |entry| entry.values_at("host_path", "view_path") }
+          unless selectors.uniq == selectors && bound.uniq == bound && selectors.sort == bound.sort &&
+              declarations.all? { |entry| entry.keys.sort == %w[host_path read_only stage view_path worker_visible] } &&
+              identities.all? { |entry| entry.keys.sort == Molecules::ExecutionScopeLineage::RESOURCE_FIELDS.sort }
+            unavailable!("original parent declarations differ from bound identities")
+          end
+          declarations
+        rescue KeyError, TypeError, ArgumentError, Ace::Runtime::RuntimeUnavailableError
+          unavailable!("original parent resource declarations are unavailable")
+        end
+
+        def workspace_exclusion_projection!(lineage)
+          declarations = maintenance_parent_resource_declarations!(lineage)
+          cwd = maintenance_workspace_resource!(lineage)
+          authority = @deployment.authority(@map.fetch("authority_id"))
+          selection = Molecules::LifecycleExclusion.workspace_selection(mapping_id: @mapping_id,
+            project_id: @map.fetch("project_id"), authority: authority, cwd_resource: cwd)
+          matches = declarations.select do |entry|
+            entry.values_at("host_path", "view_path") == selection.values_at("host_path", "view_path")
+          end
+          roots = lineage.binding.fetch("resource_identities").select do |entry|
+            entry.values_at("host_path", "view_path") == selection.values_at("host_path", "view_path")
+          end
+          unless matches.one? && matches.first.values_at("stage", "worker_visible", "read_only") == ["parent", true, true] &&
+              roots.one? && roots.first.values_at("uid", "gid") == authority.values_at("uid", "gid")
+            unavailable!("original workspace lifecycle exclusion is unavailable")
+          end
+          value = JSON.parse(JSON.generate({"key" => selection.fetch("key"), "root_resource" => roots.first,
+            "worker_cwd_resource" => cwd, "authority_uid" => authority.fetch("uid"), "authority_gid" => authority.fetch("gid")}))
+          pending = [value]
+          until pending.empty?
+            entry = pending.pop
+            pending.concat(entry.values) if entry.is_a?(Hash)
+            pending.concat(entry) if entry.is_a?(Array)
+            entry.freeze
+          end
+          value
+        rescue KeyError, TypeError, ArgumentError
+          unavailable!("original workspace lifecycle projection differs")
         end
 
         private
 
+        def boot_baseline!(binding)
+          @boot_evidence.verify!(selection: binding.fetch("boot_baseline_selection"), expected:
+            boot_baseline_expected(binding.fetch("boot_id"), binding.fetch("deployment_digest"),
+              binding.fetch("network_installation_selection")))
+        end
+
+        def boot_baseline_expected(boot, digest, selection)
+          {"slot_id" => @scope.fetch("slot_id"), "boot_id" => boot, "deployment_digest" => digest,
+            "installer_artifact" => selection.fetch("installer_artifact")}
+        end
+
         # Inventory only: no configurable security booleans or alternative
         # policy backend. Native-only objects are observed at their later stage.
+        def native_cleanup_complete!
+          @files.boundary_manifest(@scope).fetch("resources").each do |entry|
+            next unless entry.fetch("stage") == "native"
+            if @files.resource_present?(entry.fetch("host_path"))
+              unavailable!("fixed service cleanup retained a service-created resource")
+            end
+          end
+          true
+        end
+
         def network_selection!
           manifest = @files.boundary_manifest(@scope)
-          Molecules::ExecutionScopeLineage.validate_network_selection!(manifest.fetch("network_installation"))
+          @network_selection.select!(static_selection: manifest.fetch("network_installation"), slot_id: @scope.fetch("slot_id"))
         end
 
-        def parent_resources!
+        def parent_resources!(retirement: nil)
           manifest = @files.boundary_manifest(@scope)
           unless manifest.is_a?(Hash) && manifest.keys.sort == %w[network_installation resources schema slot_id] &&
               manifest["schema"] == BOUNDARY_SCHEMA && manifest["slot_id"] == @scope.fetch("slot_id") &&
@@ -367,7 +704,10 @@ module Ace
           end
           pairs = []
           resources = manifest.fetch("resources").filter_map do |resource|
-            unless resource.is_a?(Hash) && resource.keys.sort == %w[host_path stage view_path] && %w[parent native].include?(resource["stage"])
+            unless resource.is_a?(Hash) && resource.keys.sort == %w[host_path read_only stage view_path worker_visible] &&
+                [true, false].include?(resource["worker_visible"]) && [true, false].include?(resource["read_only"]) &&
+                (resource["worker_visible"] || resource["stage"] == "parent" && resource["read_only"]) &&
+                (resource["stage"] != "native" || resource["worker_visible"]) && %w[parent native].include?(resource["stage"])
               unavailable!("boundary resource inventory is not closed")
             end
             paths = resource.values_at("host_path", "view_path")
@@ -377,30 +717,72 @@ module Ace
             end
             pairs << paths
             next if resource.fetch("stage") == "native"
-            actual = @files.resource_identity(resource.fetch("host_path"))
+            actual = retirement_resource_identity(resource.fetch("host_path"), retirement) || @files.resource_identity(resource.fetch("host_path"))
             unless LOCAL_FILESYSTEMS.include?(actual.fetch("filesystem_type"))
               unavailable!("parent resource backing is not local kernel-managed storage")
             end
             resource.slice("host_path", "view_path").merge(actual)
           end
           unavailable!("parent resource inventory is empty") if resources.empty?
-          verify_parent_access_boundary!(resources)
+          verify_parent_access_boundary!(resources, declarations: manifest.fetch("resources"), retirement: retirement)
           resources
         end
 
-        def verify_parent_access_boundary!(resources)
+        def lifecycle_parent_resource!(resources, declarations)
+          view = "/run/ace/lifecycle-exclusion/#{@mapping_id}"
+          selected = declarations.select { |entry| entry.fetch("view_path") == view }
+          return nil if selected.empty?
+          unless selected.one? && selected.first.values_at("stage", "worker_visible", "read_only") == ["parent", true, true]
+            unavailable!("lifecycle resource is not the exact readonly parent view")
+          end
+          cwd = resources.select { |resource| resource.fetch("host_path") == @map.fetch("worker_cwd") }
+          cwd_declarations = declarations.select { |entry| entry.fetch("host_path") == @map.fetch("worker_cwd") }
+          unless cwd.one? && cwd_declarations.one? &&
+              cwd_declarations.first.values_at("stage", "worker_visible", "read_only") == ["parent", true, false]
+            unavailable!("lifecycle resource lacks original writable workspace identity")
+          end
+          authority = @deployment.authority(@map.fetch("authority_id"))
+          selection = Molecules::LifecycleExclusion.workspace_selection(mapping_id: @mapping_id,
+            project_id: @map.fetch("project_id"), authority: authority, cwd_resource: cwd.first)
+          expected = selection.fetch("host_path")
+          resource = resources.find { |entry| entry.values_at("host_path", "view_path") == [expected, view] }
+          unless selected.first.fetch("host_path") == expected && resource &&
+              resource.values_at("uid", "gid") == authority.values_at("uid", "gid")
+            unavailable!("lifecycle resource is not selected by original workspace and authority")
+          end
+          @files.lifecycle_resource_policy!(expected, authority: authority, identity: resource)
+          @files.resource_aliases(expected, identity: resource).each do |path|
+            @files.lifecycle_resource_policy!(path, authority: authority, identity: resource)
+          end
+          resource
+        end
+
+        def verify_parent_access_boundary!(resources, declarations:, retirement: nil)
+          lifecycle = lifecycle_parent_resource!(resources, declarations)
+          resources = resources.reject { |resource| resource.equal?(lifecycle) }
+          covered = resources.select { |resource| retirement_covered_resource(resource, retirement) }
+          vanished = retirement && retirement.descriptor.fetch("phase") != "captured" ? covered : []
+          resources = resources - vanished
           worker = @map.fetch("worker_uid")
           authority = @deployment.authority(@map.fetch("authority_id")).fetch("uid")
           readers = @deployment.project(@map.fetch("project_id")).fetch("supervisor_uids")
           trusted = [worker, authority, @map.fetch("launcher_uid"), *readers].uniq
           policies = resources.to_h do |resource|
             path = resource.fetch("host_path")
-            policy = @files.resource_boundary_policy(path)
+            observed_path = retirement_observation_path(resource, retirement)
+            policy = @files.resource_boundary_policy(observed_path)
             unless %w[device inode uid gid].all? { |key| policy.fetch(key) == resource.fetch(key) }
               unavailable!("parent access policy belongs to a replaced object")
             end
             [path, policy]
           end
+          captured_ancestors = covered.flat_map do |resource|
+            path = retirement_observation_path(resource, retirement)
+            next [] if path == resource.fetch("host_path")
+            parts = File.dirname(path).split("/").reject(&:empty?)
+            ["/"] + parts.each_index.map { |index| "/" + parts.take(index + 1).join("/") }
+          end.uniq
+          captured_ancestors.each { |path| policies[path] = @files.resource_boundary_policy(path) }
           barriers = policies.select do |_path, policy|
             next false unless policy.fetch("uid").zero? && (policy.fetch("mode") & 0o7022).zero?
             acl = policy.fetch("acl")
@@ -417,13 +799,13 @@ module Ace
               end
             end
           end
-          unless resources.any? { |resource| resource.fetch("uid") == worker } && resources.all? { |resource|
-              path = resource.fetch("host_path")
+          unless (resources + vanished).any? { |resource| resource.fetch("uid") == worker } && resources.all? { |resource|
+              path = retirement_observation_path(resource, retirement)
               [0, worker].include?(resource.fetch("uid")) && barriers.keys.any? { |ancestor| path == ancestor || path.start_with?(ancestor + "/") } }
             unavailable!("parent roots lack an immutable exclusive host traversal boundary")
           end
           resources.each do |resource|
-            aliases = @files.resource_aliases(resource.fetch("host_path"), identity: resource)
+            aliases = @files.resource_aliases(retirement_observation_path(resource, retirement), identity: resource)
             unless aliases.all? { |path| barriers.keys.any? { |ancestor| path == ancestor || path.start_with?(ancestor + "/") } }
               unavailable!("protected parent backing is exposed through an outside writable mount")
             end
@@ -439,11 +821,11 @@ module Ace
           end
         end
 
-        def verify_resources!(resources, allow_runtime_absence: false, same_namespace: true)
+        def verify_resources!(resources, allow_runtime_absence: false, same_namespace: true, retirement: nil)
           resources.each do |resource|
             path = resource.fetch("host_path")
             begin
-              actual = @files.resource_identity(path)
+              actual = retirement_resource_identity(path, retirement) || @files.resource_identity(path)
             rescue Errno::ENOENT
               runtime = @scope.fetch("runtime_directory")
               # Fixed stopped RuntimeDirectoryPreserve=no cleanup may remove
@@ -459,6 +841,51 @@ module Ace
           end
         end
 
+        def retirement_covered_resource(resource, retirement)
+          return nil unless retirement
+          unless retirement.is_a?(MaintenanceWorkspaceRetirement::Evidence)
+            unavailable!("maintenance retirement requires source-owned proof")
+          end
+          retirement.verify_consumption!
+          entry = retirement.covered_resource(resource.fetch("host_path"))
+          unavailable!("retirement row differs from original resource") if entry && entry.fetch("original") != resource
+          entry
+        end
+
+        def retirement_resource_identity(path, retirement)
+          return nil unless retirement
+          unless retirement.is_a?(MaintenanceWorkspaceRetirement::Evidence)
+            unavailable!("maintenance retirement requires source-owned proof")
+          end
+          retirement.verify_consumption!
+          entry = retirement.covered_resource(path)
+          return nil unless entry
+          resource = entry.fetch("original")
+          return resource.reject { |key, _| %w[host_path view_path].include?(key) } unless retirement.descriptor.fetch("phase") == "captured"
+          observed_path = retirement_observation_path(resource, retirement)
+          actual = @files.resource_identity(observed_path)
+          unless %w[device inode uid gid mount_id filesystem_type].all? { |key| actual.fetch(key) == resource.fetch(key) }
+            unavailable!("retirement captured path differs from original resource")
+          end
+          actual
+        end
+
+        def retirement_observation_path(resource, retirement)
+          entry = retirement_covered_resource(resource, retirement)
+          return resource.fetch("host_path") unless entry && retirement.descriptor.fetch("phase") == "captured"
+          held = retirement.owner.retirement_resource_handle!(evidence: retirement, resource: resource)
+          unless held.is_a?(Hash) && held.keys.sort == %i[captured_host_path handle].sort &&
+              held.fetch(:captured_host_path) == entry.fetch("captured_host_path")
+            unavailable!("retirement captured resource handle differs")
+          end
+          handle = held.fetch(:handle)
+          stat = handle.stat
+          unless !handle.closed? && stat.directory? && [stat.dev, stat.ino, stat.uid, stat.gid] == resource.values_at("device", "inode", "uid", "gid")
+            unavailable!("retirement captured resource is not original held inode")
+          end
+          held.fetch(:captured_host_path)
+        end
+
         def canonical(value)
           case value
           when Hash then value.sort.to_h.transform_values { |item| canonical(item) }