ace-assign 0.64.0 → 0.66.0

data/lib/ace/assign/authority/launch_prepared_work.rb

@@ -0,0 +1,122 @@
+# frozen_string_literal: true
+require_relative "../atoms/evidence_digest"
+
+module Ace
+  module Assign
+    module Authority
+      class LaunchLifecycle
+        # One authenticated immutable prefix; never the latest registration.
+        def original_prepared_registration!(journal:, params:, commit:)
+          original_prepared_registration_for_phase!(journal: journal, params: params, commit: commit, phase: :issued) do |map, state|
+            yield(map, state) if block_given?
+          end
+        end
+
+        private
+
+        def original_bound_prepared_registration!(journal:, params:, commit:)
+          original_prepared_registration_for_phase!(journal: journal, params: params, commit: commit, phase: :bound)
+        end
+
+        def original_prepared_registration_for_phase!(journal:, params:, commit:, phase:)
+          inventory = journal.canonical_event_inventory!(commit: commit)
+          raise AttemptErrors::EvidenceUnavailable, "prepared canonical snapshot differs" unless inventory.fetch("commit") == commit
+          assignment = params.fetch("assignment_id")
+          events = inventory.fetch("events").fetch(assignment)
+          chain = events.select { |event| event["attempt_id"] == params.fetch("attempt_id") }
+          state = origin(chain, **params.slice("assignment_id", "attempt_id", "mapping_id").transform_keys(&:to_sym))
+          reserves = chain.select { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "reserve_attempt" }
+          releases = chain.select { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "release_launch" }
+          provisioning = chain.select { |event| event["type"] == "scope_provisioning" }
+          admitted_phase = if phase == :issued
+            releases.one? && releases.first.dig("payload", "data", "phase") == "issued"
+          else
+            releases.empty? && state.fetch("phase") == "bound"
+          end
+          unless reserves.one? && admitted_phase && provisioning.one? &&
+              !terminal_events?(chain) && !chain.any? { |event| %w[scope_sealed input_inhibited attempt_stopped].include?(event["type"]) }
+            raise AttemptErrors::EvidenceUnavailable, "original prepared attempt is not #{phase} and open"
+          end
+          identity = provisioning.first.fetch("payload")
+          sha = identity.fetch("descriptor_sha256")
+          selected = if @deployment.artifact_reference.fetch("sha256") == sha
+            @deployment
+          else
+            raise AttemptErrors::EvidenceUnavailable, "original prepared deployment is unavailable" unless @deployment_history
+            @deployment_history.descriptor!(sha256: sha)
+          end
+          map = selected.mapping(params.fetch("mapping_id"))
+          original_project = selected.project(map.fetch("project_id"))
+          unless identity.fetch("deployment_digest") == Digest::SHA256.hexdigest(JSON.generate(canonical(map))) &&
+              identity.fetch("slot_id") == map.fetch("execution_scope").fetch("slot_id") && state.fetch("project_id") == map.fetch("project_id") &&
+              selected.project(map.fetch("project_id")).values_at("journal_repository", "evidence_git_ref", "evidence_checkout_root") ==
+                [journal.repo_root, journal.ref, journal.checkout_root]
+            raise AttemptErrors::EvidenceUnavailable, "original prepared deployment association differs"
+          end
+          lineage = Molecules::ExecutionScopeLineage.new(events: chain, project_id: state.fetch("project_id"),
+            assignment_id: assignment, attempt_id: params.fetch("attempt_id"), mapping_id: params.fetch("mapping_id"))
+          unless lineage.require_launch_bound! == state.fetch("process_binding")
+            raise AttemptErrors::EvidenceUnavailable, "original prepared child binding differs"
+          end
+          original = original_prompt_record!(chain, state, params: params)
+          # Authenticate the actual original worker/descendant before reading artifacts.
+          yield(map, state) if block_given?
+          introductions = inventory.fetch("introductions").fetch(assignment)
+          reservation_commit = introductions.fetch(reserves.first.fetch("digest"))
+          registration = definition(journal, assignment, commit: reservation_commit)
+          original_events = journal.read_events(assignment, commit: reservation_commit)
+          authenticate_inventory_registration!(journal, assignment, original_events, registration, params.fetch("mapping_id"), map, reservation_commit, introductions)
+          registered = original_events.find { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "register_assignment" && event.dig("payload", "data") == registration }
+          registration_commit = introductions.fetch(registered.fetch("digest"))
+          TaskContextEntry.validate!(registration.fetch("task_context_entry"))
+          unless registration.fetch("task_context_entry") == map.fetch("task_context_entry")
+            raise AttemptErrors::EvidenceUnavailable, "original prepared task context entry differs"
+          end
+          prepared = registration.fetch("prepared_work")
+          unless prepared.fetch("scope") == state.fetch("scope") && prepared.fetch("task_id") == state.fetch("task_id")
+            raise AttemptErrors::EvidenceUnavailable, "original prepared selection differs"
+          end
+          bytes = journal.bounded_blob(registration.fetch("definition_ref"), commit: registration_commit, max_bytes: PreparedWork::MAX_MANIFEST)
+          unless bytes.is_a?(String) && bytes.bytesize.between?(1, PreparedWork::MAX_MANIFEST) &&
+              Digest::SHA256.hexdigest(bytes) == registration.fetch("definition_digest") && JSON.parse(bytes).fetch("prepared_work") == prepared
+            raise AttemptErrors::EvidenceUnavailable, "original prepared definition differs"
+          end
+          projection = immutable_maintenance_projection(registration: registration, registration_commit: registration_commit, state: state, map: map, events: chain,
+            workspace_exclusion: maintenance_scope_observer_for(selected, params.fetch("mapping_id")).workspace_exclusion_projection!(lineage),
+            original_worker_scratch_root: original_project.fetch("peer_credentials").fetch(map.fetch("worker_uid").to_s).fetch("scratch_root"),
+            original_binding_digest: original.fetch("binding_digest"), commit: commit)
+          pin = compact_prepared_input(projection)
+          if phase == :issued
+            unless Atoms::EvidenceDigest.digest(releases.first.dig("payload", "data", "prepared_input")) == Atoms::EvidenceDigest.digest(pin)
+              raise AttemptErrors::EvidenceUnavailable, "accepted prepared release differs"
+            end
+          else
+            bundle = journal.bounded_blob(registration.fetch("prepared_bundle_ref"), commit: registration_commit, max_bytes: CandidateTransfer::MAX_BYTES)
+            unless bundle.is_a?(String) && bundle.bytesize == registration.fetch("prepared_bundle_bytes") &&
+                bundle.bytesize.between?(1, CandidateTransfer::MAX_BYTES) && Digest::SHA256.hexdigest(bundle) == registration.fetch("prepared_bundle_sha256")
+              raise AttemptErrors::EvidenceUnavailable, "original prepared bundle differs"
+            end
+          end
+          projection
+        rescue KeyError, TypeError, NoMethodError, JSON::ParserError
+          raise AttemptErrors::EvidenceUnavailable, "original prepared registration is unavailable"
+        end
+
+        def compact_prepared_input(projection)
+          registration = projection.fetch(:registration)
+          immutable_maintenance_projection(
+            "registration_generation" => registration.fetch("generation"),
+            "registration_commit" => projection.fetch(:registration_commit),
+            "definition_digest" => registration.fetch("definition_digest"),
+            "original_binding_digest" => projection.fetch(:original_binding_digest),
+            "prepared_work" => registration.fetch("prepared_work"),
+            "worker_entry" => Ace::Runtime::Molecules::ProtectedWorkerEntry.validate!(projection.fetch(:map).fetch("worker_entry")),
+            "workspace_exclusion" => projection.fetch(:workspace_exclusion),
+            "bundle_ref" => registration.fetch("prepared_bundle_ref"),
+            "bundle_bytes" => registration.fetch("prepared_bundle_bytes"),
+            "bundle_sha256" => registration.fetch("prepared_bundle_sha256"))
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/launch_review.rb

@@ -0,0 +1,91 @@
+# frozen_string_literal: true
+
+module Ace
+  module Assign
+    module Authority
+      class LaunchLifecycle
+        # Called by Endcap only while holding the existing assignment/slot
+        # exclusion and shared authority mutex. Returned channel capacity is
+        # released after the caller leaves those locks and waits on the stream.
+        def reserve_review_dispatch!(events:, params:, map:)
+          state = origin(events, **params.slice("mapping_id", "assignment_id", "attempt_id").transform_keys(&:to_sym))
+          unless state["phase"] == "issued" && !terminal_events?(events)
+            raise AttemptErrors::Conflict, "review delegation requires an issued original launcher"
+          end
+          scope_open_for_effect!(events: events, params: params, map: map)
+          original = original_prompt_record!(events, state, params: params)
+          @kernel.live!(state.fetch("launcher_identity"))
+          channel = @control_channels[steering_key(params, map)]
+          raise AttemptErrors::EvidenceUnavailable, "original review channel is unavailable" unless channel
+          [channel, channel.reserve_dispatch!, original]
+        end
+
+        def review_original_reference!(events:, params:)
+          state = origin(events, **params.slice("mapping_id", "assignment_id", "attempt_id").transform_keys(&:to_sym))
+          original_prompt_record!(events, state, params: params)
+        end
+
+        # Read-only original-launcher projection at the exact request commit.
+        # Permission to assign still belongs to Endcap's fresh/replay checks.
+        def launch_review_intent!(request:, peer:, role:)
+          params = request.fetch("params")
+          strict!(params, %w[mapping_id assignment_id attempt_id mutation_id request_event_id journal_commit original_binding_digest])
+          raise ArgumentError, "Review intent lookup is read-only" unless request.fetch("mutation_id").nil?
+          raise AttemptErrors::UnauthorizedIdentity, "Review intent requires original launcher" unless role == :launcher
+          %w[mapping_id assignment_id attempt_id mutation_id].each { |key| token!(params.fetch(key)) }
+          unless %w[request_event_id original_binding_digest].all? { |key| params[key].is_a?(String) && params[key].match?(/\A[0-9a-f]{64}\z/) } &&
+              params["journal_commit"].is_a?(String) && params["journal_commit"].match?(/\A(?:[0-9a-f]{40}|[0-9a-f]{64})\z/)
+            raise ArgumentError, "Review intent selectors differ"
+          end
+          map = steering_principal!(params, peer, role)
+          raise AttemptErrors::UnauthorizedIdentity, "Review project differs" unless request.fetch("project_id") == map.fetch("project_id")
+          journal = journal_for(map)
+          commit = params.fetch("journal_commit")
+          journal.verify_canonical_prefix!(commit: commit)
+          events = journal.read_events(params.fetch("assignment_id"), commit: commit).select { |event| event["attempt_id"] == params.fetch("attempt_id") }
+          state = origin(events, **params.slice("mapping_id", "assignment_id", "attempt_id").transform_keys(&:to_sym))
+          unless @kernel.same?(state.fetch("launcher_identity"), peer)
+            raise AttemptErrors::UnauthorizedIdentity, "Review intent requires exact original launcher birth"
+          end
+          original = original_prompt_record!(events, state, params: params)
+          event = events.find { |item| item["digest"] == params.fetch("request_event_id") }
+          accepted = journal.mutation_result(params.fetch("mutation_id"), commit: commit)
+          unless event && event["type"] == "authority_mutation" && event.dig("payload", "operation") == "request_review" &&
+              event.dig("payload", "mutation_id") == params.fetch("mutation_id") && accepted &&
+              accepted == event.fetch("payload").merge("journal_commit" => commit) &&
+              original.fetch("binding_digest") == params.fetch("original_binding_digest")
+            raise AttemptErrors::EvidenceUnavailable, "Canonical review request introduction differs"
+          end
+          data = event.fetch("payload").fetch("data")
+          fields = %w[candidate_generation generation head original_binding_digest requester reviewer_process_binding reviewer_uid]
+          unless data.is_a?(Hash) && data.keys.sort == fields && data["original_binding_digest"] == original.fetch("binding_digest") &&
+              data["head"].is_a?(String) && data["head"].match?(/\A(?:[0-9a-f]{40}|[0-9a-f]{64})\z/) &&
+              %w[candidate_generation generation reviewer_uid].all? { |key| data[key].is_a?(Integer) && data[key].positive? }
+            raise AttemptErrors::EvidenceUnavailable, "Canonical review request data differs"
+          end
+          identity = data.fetch("reviewer_process_binding")
+          boot = identity.is_a?(Hash) && identity["started_at"].is_a?(String) && identity["started_at"].split(":", -1)[1]
+          Molecules::ExecutionScopeLineage.validate_process_identity!(identity, boot_id: boot)
+          requester = data["requester"]
+          unless requester.is_a?(Hash) && requester.keys.sort == %w[gid groups role uid] &&
+              %w[uid gid].all? { |key| requester[key].is_a?(Integer) } && requester["groups"].is_a?(Array) &&
+              requester["groups"].all? { |group| group.is_a?(Integer) } &&
+              requester == identity.slice("uid", "gid", "groups").merge("role" => "reviewer") &&
+              data["reviewer_uid"] == identity["uid"] && identity["uid"] != map.fetch("worker_uid")
+            raise AttemptErrors::EvidenceUnavailable, "Canonical reviewer attribution differs"
+          end
+          candidate = events.reverse.find { |item| item["type"] == "authority_mutation" && item.dig("payload", "operation") == "submit_candidate" }&.dig("payload", "data")
+          unless candidate && candidate.values_at("head", "candidate_generation") == data.values_at("head", "candidate_generation")
+            raise AttemptErrors::EvidenceUnavailable, "Canonical request candidate differs"
+          end
+          assignment = params.slice("mapping_id", "assignment_id", "attempt_id").merge(
+            data.slice("head", "candidate_generation", "reviewer_uid", "reviewer_process_binding"),
+            "expected_generation" => data.fetch("generation"))
+          {data: params.slice("request_event_id", "original_binding_digest").merge("assignment_params" => assignment), replayed: false}
+        rescue KeyError, TypeError
+          raise AttemptErrors::EvidenceUnavailable, "Canonical review intent is incomplete"
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/launch_scope_abort.rb

@@ -21,13 +21,6 @@ module Ace
               raise AttemptErrors::EvidenceUnavailable, "canonical service settlement owner is unavailable"
             end
           end
-          contexts = @deployment.project(map.fetch("project_id")).fetch("inbox_contexts", {})
-          if contexts.any? || events.any? { |event| event["type"].start_with?("inbox_") }
-            unless @result_owner && @result_owner.respond_to?(:inbox_settlement_complete!)
-              raise AttemptErrors::EvidenceUnavailable, "canonical inbox settlement owner is unavailable"
-            end
-            @result_owner.inbox_settlement_complete!(journal: journal, events: events, params: params, map: map, commit: commit)
-          end
           true
         end
 

data/lib/ace/assign/authority/launch_scope_admission.rb

@@ -19,9 +19,66 @@ module Ace
           journal = journal_for(map)
           input = params.reject { |key, _| key == "mutation_id" }
           digest = Digest::SHA256.hexdigest(JSON.generate(canonical(input)))
-          with_exclusion(params, map, journal) do
+          result = with_exclusion(params, map, journal) do
             admit_native_service_held!(params, map, journal, peer, role, digest)
           end
+          complete_native_start!(params, map, journal, peer, role, result) unless result.fetch(:replayed)
+          result
+        ensure
+          settle_native_issuer!(params, map) if map
+        end
+
+        # Private transport owner. Exact manager hook attribution precedes
+        # challenge issuance; this never enters the ordinary worker dispatcher.
+        def native_readiness!(mapping_id:, peer:, socket:, codec:, deadline:)
+          map = @deployment.mapping(mapping_id)
+          journal = journal_for(map)
+          pending, key = @mutex.synchronize do
+            selected = @native_issuers.select { |identity, _| identity[0] == map.fetch("project_id") && identity[1] == mapping_id }
+            raise AttemptErrors::EvidenceUnavailable, "no unique live admitted issuer" unless selected.size == 1
+            identity, entry = selected.first
+            raise AttemptErrors::Conflict, "readiness already supplied" if entry[:report] || entry[:challenge]
+            entry[:challenge] = SecureRandom.hex(32)
+            [entry, identity]
+          end
+          params = pending.fetch(:params)
+          observer = scope_observer_for(mapping_id)
+          challenge = with_exclusion(params, map, journal) do
+            @mutex.synchronize do
+              events = journal.read_events(params.fetch("assignment_id")).select { |event| event["attempt_id"] == params.fetch("attempt_id") }
+              lineage = Molecules::ExecutionScopeLineage.new(events: events, project_id: map.fetch("project_id"),
+                assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"), mapping_id: mapping_id)
+              lineage.require_open!
+              server = observer.readiness_peer!(lineage, peer)
+              {"version" => 1, "challenge_id" => pending.fetch(:challenge), "server_identity" => server}
+            end
+          end
+          wire.write(socket, challenge, deadline: deadline, limit: 16_384)
+          envelope = wire.read(socket, deadline: deadline, limit: 16_384)
+          unless envelope.is_a?(Hash) && envelope.keys.sort == %w[challenge_id transfer version] &&
+              envelope["version"] == 1 && envelope["challenge_id"] == challenge.fetch("challenge_id")
+            raise ArgumentError, "private readiness upload envelope differs"
+          end
+          codec.receive(socket, descriptor: envelope.fetch("transfer"), purpose: :scope_boundary_observation,
+            deadline: deadline) do |input|
+            bytes = input.bytes.force_encoding(Encoding::UTF_8)
+            raise ArgumentError, "readiness observation is not UTF-8" unless bytes.valid_encoding?
+            report = JSON.parse(bytes, create_additions: false, max_nesting: 12, allow_duplicate_key: false, allow_comments: false)
+            with_exclusion(params, map, journal) do
+              @mutex.synchronize do
+                unless @native_issuers[key].equal?(pending) && !pending[:report]
+                  raise AttemptErrors::EvidenceUnavailable, "readiness issuer lifetime ended"
+                end
+                events = journal.read_events(params.fetch("assignment_id")).select { |event| event["attempt_id"] == params.fetch("attempt_id") }
+                lineage = Molecules::ExecutionScopeLineage.new(events: events, project_id: map.fetch("project_id"),
+                  assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"), mapping_id: mapping_id)
+                lineage.require_open!
+                pending[:report] = observer.verify_readiness_report!(lineage, peer, report, challenge: challenge)
+              end
+            end
+          end
+          wire.write(socket, {"version" => 1, "challenge_id" => challenge.fetch("challenge_id"), "status" => "ready"},
+            deadline: deadline, limit: 16_384)
         end
 
         private
@@ -58,15 +115,89 @@ module Ace
                 {events: [], blobs: {}, data: data}
               end
             end
-            # No authority mutex or journal ref lock is held while systemd waits
-            # for its private readiness callback. Slot exclusion still prevents
-            # another generation, seal or maintenance from racing this start.
             unless result.fetch(:replayed)
-              scope_observer_for(params.fetch("mapping_id")).start_admitted_service!
+              @mutex.synchronize do
+                raise AttemptErrors::Conflict, "native issuer already active" if @native_issuers.key?(native_issuer_key(params, map))
+                @native_issuers[native_issuer_key(params, map)] = {params: params.dup.freeze, report: nil, owner: Thread.current}
+              end
             end
             result
         end
 
+        def complete_native_start!(params, map, journal, peer, role, result)
+          attempt_id = params.fetch("attempt_id")
+          observer = scope_observer_for(params.fetch("mapping_id"))
+          issue = with_exclusion(params, map, journal) do
+            @mutex.synchronize do
+              events = journal.read_events(params.fetch("assignment_id")).select { |event| event["attempt_id"] == attempt_id }
+              _, lineage = scope_admission_owner!(params, map, events, peer, role)
+              !lineage.sealed?
+            end
+          end
+          observer.start_admitted_service! if issue
+          # The pending issuer lifetime remains live through this final check
+          # and cleanup. A seal cannot publish proof then permit a late start.
+          with_exclusion(params, map, journal) do
+            events, lineage = @mutex.synchronize do
+              current = journal.read_events(params.fetch("assignment_id")).select { |event| event["attempt_id"] == attempt_id }
+              _, retained = scope_admission_owner!(params, map, current, peer, role)
+              [current, retained]
+            end
+            if lineage.sealed?
+              observer.stop_sealed_service!
+            elsif issue
+              payload = observer.complete_native_readiness!(lineage,
+                @mutex.synchronize { @native_issuers.fetch(native_issuer_key(params, map)).fetch(:report) })
+              @mutex.synchronize { commit_ready_native!(params, map, journal, events, lineage, payload) }
+            end
+          end
+        rescue StandardError
+          # Lost command completion is uncertain. Cleanup of the fixed service
+          # must finish before the live issuer can retire its pending lifetime.
+          observer.stop_sealed_service! if issue
+          raise
+        ensure
+          settle_native_issuer!(params, map) if attempt_id
+        end
+
+        def commit_ready_native!(params, map, journal, events, lineage, payload)
+          context = params.slice("mapping_id", "assignment_id", "attempt_id").merge(
+            "scope_binding_event_id" => lineage.binding_event.fetch("digest"))
+          journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
+            mutation_id: "scope-native-#{Digest::SHA256.hexdigest(lineage.binding_event.fetch('digest'))[0, 48]}",
+            operation: "scope_native_binding", parameters_digest: Digest::SHA256.hexdigest(JSON.generate(canonical(context))),
+            expected_generation: journal.authority_generation(events), with_replay: true) do |current, _commit, _generation|
+            fresh = Molecules::ExecutionScopeLineage.new(events: current, project_id: map.fetch("project_id"),
+              assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"), mapping_id: params.fetch("mapping_id"))
+            fresh.require_open!
+            raise AttemptErrors::Conflict, "native binding already exists" if fresh.native_event
+            at = Time.now.utc
+            event = Models::EvidenceEvent.build(type: "scope_native_bound", attempt_id: params.fetch("attempt_id"),
+              payload: payload, previous_digest: current.last&.fetch("digest"), recorded_at: at)
+            Molecules::ExecutionScopeLineage.new(events: current + [event], project_id: map.fetch("project_id"),
+              assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"), mapping_id: params.fetch("mapping_id"))
+            {events: [{type: "scope_native_bound", payload: payload, recorded_at: at}], blobs: {}, data: context}
+          end
+        end
+
+        def native_issuer_key(params, map)
+          [map.fetch("project_id"), params.fetch("mapping_id"), params.fetch("assignment_id"), params.fetch("attempt_id")].freeze
+        end
+
+        def settle_native_issuer!(params, map)
+          @mutex.synchronize do
+            key = native_issuer_key(params, map)
+            pending = @native_issuers[key]
+            @native_issuers.delete(key) if pending && pending[:owner].equal?(Thread.current)
+          end
+        end
+
+        def native_issuer_pending!(params, map)
+          if @native_issuers.key?(native_issuer_key(params, map))
+            raise AttemptErrors::EvidenceUnavailable, "native issuance is still pending"
+          end
+        end
+
         def scope_admission_owner!(params, map, events, peer, role)
           state = states(events)[params.fetch("attempt_id")]
           unless state && state["mapping_id"] == params.fetch("mapping_id") &&

data/lib/ace/assign/authority/launch_scope_close.rb

@@ -17,8 +17,9 @@ module Ace
           journal = journal_for(map)
           input = params.reject { |key, _| key == "mutation_id" }
           digest = Digest::SHA256.hexdigest(JSON.generate(canonical(input)))
-          with_exclusion(params, map, journal) do
-            stop_after_commit = false
+          stop_after_commit = false
+          inhibit_after_commit = false
+          result = with_containment_exclusion(params, map, journal) do
             result = @mutex.synchronize do
               current = journal.read_events(params.fetch("assignment_id")).select { |event| event["attempt_id"] == params.fetch("attempt_id") }
               scope_close_owner!(params, map, current, peer, role)
@@ -26,44 +27,27 @@ module Ace
                 mutation_id: params.fetch("mutation_id"), operation: "close_execution_scope", parameters_digest: digest,
                 expected_generation: params.fetch("expected_generation"), with_replay: true) do |events, _commit, _generation|
                 lineage = scope_close_owner!(params, map, events, peer, role)
-                binding = lineage.binding
-                raise AttemptErrors::EvidenceUnavailable, "original parent binding is missing" unless binding
-                projection = {"attempt_id" => params.fetch("attempt_id"), "scope_generation" => binding.fetch("scope_generation"),
-                  "state" => "running", "proof_id" => nil, "required_action" => "close_scope"}
-                if !lineage.sealed?
-                  stop_after_commit = true
-                  payload = {"scope_generation" => binding.fetch("scope_generation"), "scope_binding_event_id" => lineage.binding_event.fetch("digest")}
-                  {events: [{type: "scope_sealed", payload: payload}], blobs: {}, data: projection}
-                elsif lineage.proof_event
-                  scope_observer_for(params.fetch("mapping_id")).verify_closed!(lineage)
-                  {events: [], blobs: {}, data: projection.merge("state" => "closed_no_writers", "proof_id" => lineage.proof_id, "required_action" => nil)}
-                elsif scope_observer_for(params.fetch("mapping_id")).sealed_service_stop_required?(lineage)
-                  # A fresh canonical close resumes a stop lost after the seal.
-                  # Replaying either mutation performs no manager I/O.
-                  stop_after_commit = true
-                  {events: [], blobs: {}, data: projection}
-                else
-                  # This call must return a fresh validated observation, never
-                  # a cached population, caller JSON or a manifest boolean.
-                  payload = scope_observer_for(params.fetch("mapping_id")).closed_observation_for_proof!(lineage, events: events)
-                  expected = binding.slice("scope_generation", "boot_id", "slice_invocation_id", "cgroup_identity").merge(
-                    "scope_binding_event_id" => lineage.binding_event.fetch("digest"), "seal_event_id" => lineage.seal_event.fetch("digest"), "populated" => 0)
-                  unless payload == expected
-                    raise AttemptErrors::EvidenceUnavailable, "fresh observation does not name the retained sealed parent"
-                  end
-                  at = Time.now.utc
-                  event = Models::EvidenceEvent.build(type: "scope_closed_no_writers", attempt_id: params.fetch("attempt_id"),
-                    payload: payload, previous_digest: events.last&.fetch("digest"), recorded_at: at)
-                  {events: [{type: "scope_closed_no_writers", payload: payload, recorded_at: at}], blobs: {},
-                    data: projection.merge("state" => "closed_no_writers", "proof_id" => event.fetch("digest"), "required_action" => nil)}
-                end
+                closure = scope_closure_plan!(lineage: lineage, params: params, map: map, events: events, journal: journal, commit: _commit)
+                stop_after_commit = closure.fetch(:stop_required)
+                inhibit_after_commit = closure.fetch(:inhibit_required)
+                closure.fetch(:plan)
               end
             end
-            if !result.fetch(:replayed) && stop_after_commit
+            result
+          end
+          if !result.fetch(:replayed) && inhibit_after_commit
+            request_original_input_inhibition!(params, map, journal)
+          end
+          if !result.fetch(:replayed) && stop_after_commit
+            with_containment_exclusion(params, map, journal) do
+              @mutex.synchronize do
+                current = journal.read_events(params.fetch("assignment_id")).select { |event| event["attempt_id"] == params.fetch("attempt_id") }
+                scope_close_owner!(params, map, current, peer, role)
+              end
               scope_observer_for(params.fetch("mapping_id")).stop_sealed_service!
             end
-            result
           end
+          result
         end
 
         def observe_execution_scope!(params:, peer:, role:)
@@ -72,7 +56,7 @@ module Ace
           @kernel.live!(peer)
           map = @deployment.mapping(params.fetch("mapping_id"))
           journal = journal_for(map)
-          with_exclusion(params, map, journal) do
+          with_containment_exclusion(params, map, journal) do
             @mutex.synchronize do
               commit = journal.ref_value
               events = journal.read_events(params.fetch("assignment_id"), commit: commit).select { |event| event["attempt_id"] == params.fetch("attempt_id") }
@@ -83,7 +67,9 @@ module Ace
               return projection unless lineage.binding
               begin
                 observation = scope_observer_for(params.fetch("mapping_id")).observe(lineage)
-                if lineage.proof_event
+                if pending_prompt_issuers?(events, journal, commit)
+                  projection.merge("required_action" => "drain_original_prompt_issuer")
+                elsif lineage.proof_event
                   scope_observer_for(params.fetch("mapping_id")).verify_closed!(lineage)
                   projection.merge("state" => "closed_no_writers", "proof_id" => lineage.proof_id, "required_action" => nil)
                 elsif lineage.sealed? && observation.fetch("populated").zero?
@@ -100,6 +86,51 @@ module Ace
 
         private
 
+        # Shared source-only plan for close and public stop. It does not issue
+        # manager/native control, mutate canonical state or acquire exclusions.
+        # Each CAS invocation derives its own post-commit work flags anew.
+        def scope_closure_plan!(lineage:, params:, map:, events:, journal:, commit:)
+          stop_required = false
+          inhibit_required = false
+          binding = lineage.binding
+          raise AttemptErrors::EvidenceUnavailable, "original parent binding is missing" unless binding
+          projection = {"attempt_id" => params.fetch("attempt_id"), "scope_generation" => binding.fetch("scope_generation"),
+            "state" => "running", "proof_id" => nil, "required_action" => "close_scope"}
+          plan = if !lineage.sealed?
+            stop_required = true
+            inhibit_required = true
+            payload = {"scope_generation" => binding.fetch("scope_generation"), "scope_binding_event_id" => lineage.binding_event.fetch("digest")}
+            {events: [{type: "scope_sealed", payload: payload}], blobs: {}, data: projection}
+          elsif @native_issuers.key?(native_issuer_key(params, map)) || pending_prompt_issuers?(events, journal, commit)
+            # A live issuer may still start after this inactive snapshot.
+            inhibit_required = true
+            {events: [], blobs: {}, data: projection}
+          elsif lineage.proof_event
+            scope_observer_for(params.fetch("mapping_id")).verify_closed!(lineage)
+            {events: [], blobs: {}, data: projection.merge("state" => "closed_no_writers", "proof_id" => lineage.proof_id, "required_action" => nil)}
+          elsif scope_observer_for(params.fetch("mapping_id")).sealed_service_stop_required?(lineage)
+            # A fresh canonical close resumes a stop lost after the seal.
+            # Replaying either mutation performs no manager I/O.
+            stop_required = true
+            {events: [], blobs: {}, data: projection}
+          else
+            # This call must return a fresh validated observation, never
+            # a cached population, caller JSON or a manifest boolean.
+            payload = scope_observer_for(params.fetch("mapping_id")).closed_observation_for_proof!(lineage, events: events)
+            expected = binding.slice("scope_generation", "boot_id", "slice_invocation_id", "cgroup_identity").merge(
+              "scope_binding_event_id" => lineage.binding_event.fetch("digest"), "seal_event_id" => lineage.seal_event.fetch("digest"), "populated" => 0)
+            unless payload == expected
+              raise AttemptErrors::EvidenceUnavailable, "fresh observation does not name the retained sealed parent"
+            end
+            at = Time.now.utc
+            event = Models::EvidenceEvent.build(type: "scope_closed_no_writers", attempt_id: params.fetch("attempt_id"),
+              payload: payload, previous_digest: events.last&.fetch("digest"), recorded_at: at)
+            {events: [{type: "scope_closed_no_writers", payload: payload, recorded_at: at}], blobs: {},
+              data: projection.merge("state" => "closed_no_writers", "proof_id" => event.fetch("digest"), "required_action" => nil)}
+          end
+          {plan: plan, stop_required: stop_required, inhibit_required: inhibit_required}
+        end
+
         def scope_close_owner!(params, map, events, peer, role)
           state = states(events)[params.fetch("attempt_id")]
           unless state && state["mapping_id"] == params.fetch("mapping_id") &&