ace-assign 0.64.0 → 0.66.0

data/lib/ace/assign/molecules/evidence_journal.rb

@@ -1,9 +1,13 @@
 # frozen_string_literal: true
 
+require_relative "canonical_attempt_state"
+
 require "digest"
 require "fileutils"
 require "json"
 require "open3"
+require "pathname"
+require "ace/herdr/molecules/bounded_process"
 require_relative "proposal_journal"
 require_relative "journal_mutation"
 
@@ -29,6 +33,20 @@ module Ace
         include JournalMutation
         include ProposalJournal
         CAS_ATTEMPTS = 3
+        HISTORY_LIMIT = 100_000
+        EVENT_BATCH_BYTES = 1024 * 1024
+
+        OPERATION_INVENTORY_LIMIT = 8
+
+        # A wire operation may retain one event/raw service selection and bounded immutable inventories, never admission
+        # or current-ref truth. Nested operations own independent selections.
+        def self.with_event_read_operation
+          previous = Thread.current[:ace_assign_event_read_operation]
+          Thread.current[:ace_assign_event_read_operation] = {}
+          yield
+        ensure
+          Thread.current[:ace_assign_event_read_operation] = previous
+        end
 
         # Selected by source composition, never by receipt or wire parameters.
         def evidence_mode
@@ -39,12 +57,16 @@ module Ace
         # @param ref [String, nil] Evidence ref (default from config)
         # @param checkout_root [String, nil] Isolated checkout root (default from config)
         def initialize(repo_root:, ref: nil, checkout_root: nil, mode: :local,
-          evidence_reader: nil, service_authorizer: nil)
+          evidence_reader: nil, service_authorizer: nil, read_boundary: nil)
           unless %i[local protected].include?(mode) &&
               (mode != :protected || [evidence_reader, service_authorizer].all? { |owner| owner.respond_to?(:call) })
             raise ArgumentError, "protected journal requires source-owned evidence and service boundaries"
           end
           @mode, @evidence_reader, @service_authorizer = mode, evidence_reader, service_authorizer
+          if read_boundary && !%i[call blob_batch blob history_diff blob_sizes].all? { |method| read_boundary.respond_to?(method) }
+            raise ArgumentError, "read-only journal boundary is malformed"
+          end
+          @read_boundary = read_boundary
           @repo_root = repo_root
           @ref = ref || default_config("evidence_git_ref") || "refs/ace/execution"
           root = checkout_root || default_config("evidence_checkout_root") || ".ace-local/assign/evidence-checkout"
@@ -58,6 +80,71 @@ module Ace
           git_ok?("rev-parse", "--git-dir")
         end
 
+        # Original operator preparation only. Reuse the journal's existing lock
+        # and absent-ref CAS; never manufacture an event or reset existing history.
+        def initialize_canonical!(owner_uid:, owner_gid:, owner_groups:)
+          raise AttemptErrors::EvidenceUnavailable, "read-only journal cannot initialize canonical evidence" if @read_boundary
+          unless [owner_uid, owner_gid].all? { |id| id.is_a?(Integer) && id.between?(0, 2**31 - 1) } && @repo_root.is_a?(String) && @checkout_root.is_a?(String) &&
+              [@repo_root, @checkout_root].all? { |path| Pathname.new(path).absolute? && File.expand_path(path) == path } &&
+              File.directory?(@repo_root) && !File.symlink?(@repo_root) &&
+              git_ok?("check-ref-format", @ref)
+            raise AttemptErrors::EvidenceUnavailable, "canonical initialization selection is invalid"
+          end
+          unless owner_groups.is_a?(Array) && owner_groups.all? { |id| id.is_a?(Integer) && id.between?(0, 2**31 - 1) } &&
+              owner_groups.uniq.size == owner_groups.size &&
+              [Process.uid, Process.euid, Process.gid, Process.egid] == [owner_uid, owner_uid, owner_gid, owner_gid] &&
+              Process.groups.sort == owner_groups.sort
+            raise AttemptErrors::EvidenceUnavailable, "canonical initialization process identity differs"
+          end
+          selected = File.stat(@repo_root)
+          raise AttemptErrors::EvidenceUnavailable, "canonical initialization repository owner differs" unless selected.uid == owner_uid
+          identity = [selected.dev, selected.ino, selected.uid, selected.gid, selected.mode]
+          with_lock(cleanup_on_failure: false, owner_uid: owner_uid, owner_gid: owner_gid) do
+            value = ref_value
+            unless value
+              if File.exist?(checkout_dir) || File.symlink?(checkout_dir)
+                raise AttemptErrors::EvidenceUnavailable, "uninitialized journal has foreign checkout state"
+              end
+              seed_ref
+              value = ref_value
+            end
+            nodes = canonical_history_nodes!(value)
+            seed = nodes.last.first
+            tree = git!("rev-parse", "#{seed}^{tree}").first
+            message = git!("show", "-s", "--format=%B", seed).first
+            unless tree == git!("hash-object", "-t", "tree", "--stdin").first && message == "seed: ace-assign execution evidence"
+              raise AttemptErrors::EvidenceUnavailable, "canonical initialization has foreign root history"
+            end
+            canonical_event_inventory!(commit: value)
+            raw_paths = bounded_history_read!(["ls-tree", "-r", "-z", "--name-only", value], "", HISTORY_DIFF_BYTES)
+            paths = raw_paths.empty? ? [] : raw_paths.split("\0", -1)
+            unless paths.empty? || paths.pop == ""
+              raise AttemptErrors::EvidenceUnavailable, "canonical initialization tree inventory is incomplete"
+            end
+            raise AttemptErrors::EvidenceUnavailable, "canonical initialization tree inventory is oversized" if paths.size > HISTORY_LIMIT
+            paths.each do |path|
+              parts = path.split("/", -1)
+              event = parts.size == 4 && parts[0] == "execution" && parts[2] == "events" && JournalMutation::ID.match?(parts[1]) && parts[3].end_with?(".json")
+              request = parts.size == 3 && parts[0, 2] == %w[execution requests] && parts[2].end_with?(".json") && JournalMutation::ID.match?(parts[2].delete_suffix(".json"))
+              # Definitions, prepared packets, candidate bundles and imports
+              # retain the SAME mutation owner's closed immutable blob dialect.
+              validate_blob_path!(path) unless event || request
+            end
+            records = service_request_records(commit: value)
+            expected_requests = paths.select { |path| path.start_with?("execution/requests/") }.map { |path| File.basename(path, ".json") }.sort
+            unless records.map { |record| record.fetch("request_id") }.sort == expected_requests
+              raise AttemptErrors::EvidenceUnavailable, "canonical initialization service inventory differs"
+            end
+            current = File.stat(@repo_root)
+            unless !File.symlink?(@repo_root) && [current.dev, current.ino, current.uid, current.gid, current.mode] == identity && ref_value == value
+              raise AttemptErrors::EvidenceUnavailable, "canonical initialization selection changed"
+            end
+            value.dup.freeze
+          end
+        rescue SystemCallError, ArgumentError
+          raise AttemptErrors::EvidenceUnavailable, "canonical initialization repository is unavailable"
+        end
+
         # Current value of the evidence ref.
         #
         # @return [String, nil] Commit SHA or nil when the ref does not exist
@@ -70,6 +157,376 @@ module Ace
           nil
         end
 
+        # Read-only verification for a fixed immutable maintenance snapshot.
+        def verify_commit!(commit)
+          unless commit.is_a?(String) && commit.match?(/\A[0-9a-f]{40}\z/)
+            raise AttemptErrors::EvidenceUnavailable, "canonical journal commit is invalid"
+          end
+          kind, error, status = git("cat-file", "-t", commit)
+          unless status.success? && kind == "commit"
+            raise AttemptErrors::EvidenceUnavailable, "canonical journal commit is unavailable: #{error}"
+          end
+          true
+        end
+
+        # All immutable owner queries select retained canonical evidence, not
+        # arbitrary Git objects or valid-looking abandoned CAS candidates.
+        def verify_canonical_prefix!(commit:, canonical_commit: ref_value)
+          verify_commit!(commit)
+          verify_commit!(canonical_commit)
+          text, _error, status = git("rev-list", "--first-parent", "--parents",
+            "--max-count=#{self.class::HISTORY_LIMIT + 1}", canonical_commit)
+          nodes = text.lines.map(&:split)
+          unless status.success? && nodes.size <= self.class::HISTORY_LIMIT && !nodes.empty? &&
+              nodes.all? { |node| node.size.between?(1, 2) && node.all? { |sha| sha.match?(/\A[0-9a-f]{40}\z/) } } &&
+              nodes.each_cons(2).all? { |left, right| left[1] == right[0] } && nodes.last.size == 1 &&
+              nodes.any? { |node| node.first == commit }
+            raise AttemptErrors::EvidenceUnavailable, "Evidence prefix is not retained canonical first-parent history"
+          end
+          true
+        end
+
+        # Normal append commits inherit the event unchanged. Locate its one
+        # introduction; inherited appearances are not competing provenance.
+        def event_commit!(assignment_id:, event_digest:, commit:)
+          event_commits!(assignment_id: assignment_id, event_digests: [event_digest], commit: commit).fetch(event_digest)
+        end
+
+        # Operation-scoped batch of the same provenance proof. Reuse only the
+        # already authenticated exact wire inventory; never an owner cache.
+        def event_commits!(assignment_id:, event_digests:, commit:)
+          event_commits_for_assignments!(selectors: {assignment_id => event_digests}, commit: commit).fetch(assignment_id)
+        end
+
+        # One immutable walk for an operation selecting several assignments.
+        # Every selected assignment retains its complete chain and exact raw
+        # blob proof; the result is returned, never cached on this owner.
+        def event_commits_for_assignments!(selectors:, commit:)
+          unless selectors.is_a?(Hash) && !selectors.empty? && selectors.size <= HISTORY_LIMIT &&
+              selectors.keys.all? { |id| id.is_a?(String) && id.match?(JournalMutation::ID) } &&
+              selectors.values.all? { |digests| digests.is_a?(Array) && !digests.empty? &&
+                digests.uniq.size == digests.size && digests.all? { |digest| digest.is_a?(String) && digest.match?(/\A[0-9a-f]{64}\z/) } } &&
+              selectors.values.sum(&:size) <= HISTORY_LIMIT
+            raise AttemptErrors::EvidenceUnavailable, "historical event selectors are invalid"
+          end
+          if (inventory = retained_operation_inventory(commit))
+            return selectors.to_h do |id, digests|
+              introductions = inventory.fetch("introductions").fetch(id)
+              [id.dup.freeze, digests.to_h { |digest| [digest.dup.freeze, introductions.fetch(digest)] }.freeze]
+            end.freeze
+          end
+          nodes = canonical_history_nodes!(commit)
+          states = selectors.to_h do |id, digests|
+            [id, digests.to_h { |digest| [digest, {retained: nil, blob: nil, absent: false, introduction: nil}] }]
+          end
+          each_history_event_snapshot!(states.keys, nodes: nodes) do |node, snapshots, files|
+            states.each do |assignment_id, selected_states|
+              events = snapshots.fetch(assignment_id)
+              validated_attempt_chains!(events)
+              matches = events.select { |event| selected_states.key?(event["digest"]) }.group_by { |event| event.fetch("digest") }
+              selected_states.each do |digest, state|
+                selected = matches.fetch(digest, [])
+                raise AttemptErrors::EvidenceUnavailable, "historical event selector is ambiguous" if selected.size > 1
+                if selected.empty?
+                  raise AttemptErrors::EvidenceUnavailable, "historical event disappeared" if state[:retained]
+                  next
+                end
+                event = selected.first
+                blob = files.fetch(assignment_id).fetch(event_filename(event))
+                if (state[:retained] && state[:retained] != event) || (state[:blob] && state[:blob] != blob)
+                  raise AttemptErrors::EvidenceUnavailable, "historical event changed"
+                end
+                state[:blob] ||= blob
+                state[:retained] ||= event
+                state[:introduction] ||= node.first
+              end
+            end
+          end
+          unless states.values.all? { |selected_states| selected_states.values.all? { |state| state[:introduction] } }
+            raise AttemptErrors::EvidenceUnavailable, "historical canonical event is unavailable"
+          end
+          states.to_h do |id, selected_states|
+            [id.dup.freeze, selected_states.to_h { |digest, state| [digest.dup.freeze, state.fetch(:introduction).dup.freeze] }.freeze]
+          end.freeze
+        rescue KeyError, TypeError, ArgumentError, NoMethodError
+          raise AttemptErrors::EvidenceUnavailable, "historical canonical event selectors are unverifiable"
+        end
+
+        HISTORY_DIFF_BYTES = 256 * 1024 * 1024
+        HISTORY_DIFF_FLAGS = %w[diff-tree --stdin --always --root -r --raw -z --no-renames
+          --no-ext-diff --no-textconv --no-abbrev --].freeze
+
+        # The existing history owner still validates every prefix. Git returns
+        # all requested headers, including unchanged commits; only immutable
+        # changed blob bytes are batched rather than respawned at each node.
+        def each_history_event_snapshot!(ids, nodes:)
+          inventory = ids.nil?
+          ids = [] if inventory
+          files = ids.to_h { |id| [id, {}] }
+          contents = ids.to_h { |id| [id, {}] }
+          paths = inventory ? ["execution/"] : ids.map { |id| "execution/#{id}/events/" }
+          nodes.reverse.each_slice(64) do |chunk|
+            commits = chunk.map(&:first)
+            raw = history_diff!(commits, paths)
+            changes = decode_history_diff!(commits, paths, raw, all_paths: inventory)
+            if inventory
+              changes.each_value do |entries|
+                entries.each do |path, *_|
+                  id = path.split("/")[1]
+                  next if id == "requests"
+                  unless id && id.match?(JournalMutation::ID)
+                    raise AttemptErrors::EvidenceUnavailable, "historical assignment path is invalid"
+                  end
+                  unless files.key?(id)
+                    raise AttemptErrors::EvidenceUnavailable, "historical assignment inventory exceeds bound" if ids.size >= HISTORY_LIMIT
+                    ids << id
+                    files[id], contents[id] = {}, {}
+                  end
+                end
+                entries.select! do |path, *_|
+                  id = path.split("/")[1]
+                  id != "requests" && path.start_with?("execution/#{id}/events/") && path.end_with?(".json")
+                end
+              end
+            end
+            oids = changes.values.flatten(1).filter_map { |change| change[3] unless change[3] == "0" * 40 }.uniq
+            decoded = {}
+            oids.each_slice(64) do |batch|
+              sizes = history_blob_sizes!(batch)
+              entries = batch.zip(sizes)
+              groups = []
+              entries.each do |entry|
+                groups << [] if groups.empty? || (!groups.last.empty? && groups.last.sum(&:last) + entry.last > EVENT_BATCH_BYTES)
+                groups.last << entry
+              end
+              groups.each do |group|
+                decode_event_blobs!(group, read_event_blobs!(group)).each_with_index do |bytes, index|
+                  decoded[group.fetch(index).first] = JSON.parse(bytes)
+                end
+              end
+            end
+            chunk.each do |node|
+              changes.fetch(node.first).each do |path, status, old, fresh|
+                id = ids.find { |selected| path.start_with?("execution/#{selected}/events/") }
+                name = path.delete_prefix("execution/#{id}/events/")
+                current = files.fetch(id)[name]
+                unless (status == "A" && old == "0" * 40 && current.nil?) ||
+                    (%w[M D T].include?(status) && current == old)
+                  raise AttemptErrors::EvidenceUnavailable, "historical tree change differs from previous immutable snapshot"
+                end
+                if status == "D"
+                  files.fetch(id).delete(name)
+                  contents.fetch(id).delete(name)
+                else
+                  files.fetch(id)[name] = fresh
+                  contents.fetch(id)[name] = decoded.fetch(fresh)
+                end
+              end
+              snapshots = contents.transform_values do |selected|
+                events = selected.values
+                digests = events.map { |event| event.fetch("digest") }
+                raise AttemptErrors::EvidenceUnavailable, "historical event digest is ambiguous" unless digests.uniq.size == digests.size
+                order_by_chain(events)
+              end
+              yield node, snapshots, files
+            end
+          end
+          _events, actual = ids.empty? ? [{}, {}] : read_event_snapshots!(ids, commit: nodes.first.first)
+          raise AttemptErrors::EvidenceUnavailable, "historical reconstructed tip differs from its immutable tree" unless files == actual
+        rescue JSON::ParserError, KeyError, TypeError, ArgumentError
+          raise AttemptErrors::EvidenceUnavailable, "historical batched snapshots are unverifiable"
+        end
+
+        def history_diff!(commits, paths)
+          return @read_boundary.history_diff(commits, paths, output_limit: HISTORY_DIFF_BYTES) if @read_boundary
+          bounded_history_read!(HISTORY_DIFF_FLAGS + paths, commits.join("\n") + "\n", HISTORY_DIFF_BYTES)
+        end
+
+        def history_blob_sizes!(oids)
+          raw = if @read_boundary
+            @read_boundary.blob_sizes(oids)
+          else
+            bounded_history_read!(%w[cat-file --batch-check], oids.join("\n") + "\n", oids.size * 128)
+          end
+          lines = raw.lines
+          raise AttemptErrors::EvidenceUnavailable, "historical blob metadata count differs" unless lines.size == oids.size
+          lines.zip(oids).map do |line, oid|
+            match = /\A([0-9a-f]{40}) blob (0|[1-9][0-9]*)\n\z/.match(line)
+            raise AttemptErrors::EvidenceUnavailable, "historical blob metadata differs" unless match && match[1] == oid
+            match[2].to_i
+          end
+        end
+
+        def bounded_history_read!(argv, stdin, limit)
+          result = Herdr::Molecules::BoundedProcess.call(["git", *argv], chdir: File.expand_path(@repo_root),
+            stdin_data: stdin, timeout_s: 30, output_limit: limit)
+          raise AttemptErrors::EvidenceUnavailable, "historical batch unavailable or exceeds bound" unless result.status.success? && !result.oversized
+          result.stdout.to_s.b
+        rescue Timeout::Error, Herdr::Molecules::BoundedProcess::PostLaunchError, IOError, SystemCallError
+          raise AttemptErrors::EvidenceUnavailable, "historical batch is unavailable"
+        end
+
+        def decode_history_diff!(commits, paths, raw, all_paths: false)
+          unless raw.is_a?(String) && raw.end_with?("\0")
+            raise AttemptErrors::EvidenceUnavailable, "historical diff frame is incomplete"
+          end
+          tokens = raw.split("\0", -1)
+          tokens.pop
+          result = commits.to_h { |commit| [commit, []] }
+          position = 0
+          commits.each do |commit|
+            raise AttemptErrors::EvidenceUnavailable, "historical commit header differs" unless tokens[position] == commit
+            position += 1
+            seen = {}
+            while tokens[position]&.start_with?(":")
+              metadata, path = tokens.values_at(position, position + 1)
+              match = /\A:([0-7]{6}) ([0-7]{6}) ([0-9a-f]{40}) ([0-9a-f]{40}) ([AMDT])\z/.match(metadata)
+              unless match && path.is_a?(String) && paths.any? { |prefix| path.start_with?(prefix) } && !seen[path]
+                raise AttemptErrors::EvidenceUnavailable, "historical tree metadata differs"
+              end
+              seen[path] = true
+              position += 2
+              next unless all_paths || path.end_with?(".json")
+              old, fresh, status = match.values_at(3, 4, 5)
+              if all_paths && !path.match?(%r{\Aexecution/[^/]+/events/.*\.json\z})
+                # Complete discovery needs these assignment paths, but their
+                # non-event bodies/modes never become canonical event facts.
+                result.fetch(commit) << [path, status, old, fresh]
+                next
+              end
+              if all_paths && path.start_with?("execution/requests/")
+                result.fetch(commit) << [path, status, old, fresh]
+                next
+              end
+              modes = match.values_at(1, 2)
+              unless modes.all? { |mode| %w[000000 100644 100755 120000].include?(mode) } &&
+                  (status == "A" ? old == "0" * 40 && fresh != "0" * 40 && modes.first == "000000" && modes.last != "000000" :
+                    status == "D" ? old != "0" * 40 && fresh == "0" * 40 && modes.first != "000000" && modes.last == "000000" :
+                      old != "0" * 40 && fresh != "0" * 40 && modes.none? { |mode| mode == "000000" })
+                raise AttemptErrors::EvidenceUnavailable, "historical event object type differs"
+              end
+              result.fetch(commit) << [path, status, old, fresh]
+            end
+          end
+          raise AttemptErrors::EvidenceUnavailable, "historical diff has extra headers or bytes" unless position == tokens.size
+          result
+        end
+        private :each_history_event_snapshot!, :history_diff!, :history_blob_sizes!, :bounded_history_read!, :decode_history_diff!
+
+        # Complete immutable index facts are authenticated before any caller
+        # filters ownership. A missing current fact cannot hide an older one.
+        def canonical_event_inventory!(commit:)
+          context = Thread.current[:ace_assign_event_read_operation]
+          reusable = context && @mode == :protected && commit.is_a?(String) && commit.match?(/\A[0-9a-f]{40}\z/)
+          selection = operation_inventory_selection(commit) if reusable
+          if reusable
+            inventories = context[:inventories] ||= {}
+            if inventories.key?(selection)
+              # Refresh bounded insertion order, retaining only immutable facts.
+              inventory = inventories.delete(selection)
+              inventories[selection] = inventory
+              return inventory
+            end
+          else
+            context&.delete(:inventories)
+          end
+          inventory = read_canonical_inventory!(commit: commit)
+          if reusable
+            inventories.shift while inventories.size >= OPERATION_INVENTORY_LIMIT
+            inventories[selection] = inventory
+          end
+          inventory
+        end
+
+        # Query only the exact full history already authenticated in this wire
+        # operation. No historical selector builds or advances this snapshot.
+        def operation_inventory_selection(commit)
+          [object_id, @repo_root, @ref, @checkout_root, @mode, @read_boundary&.object_id, commit]
+            .map { |value| value.is_a?(String) ? value.dup.freeze : value }.freeze
+        end
+
+        def retained_operation_inventory(commit)
+          context = Thread.current[:ace_assign_event_read_operation]
+          return unless context && @mode == :protected && commit.is_a?(String) && commit.match?(/\A[0-9a-f]{40}\z/)
+          context.fetch(:inventories, {})[operation_inventory_selection(commit)]
+        end
+        private :operation_inventory_selection, :retained_operation_inventory
+
+        def read_canonical_inventory!(commit:)
+          nodes = canonical_history_nodes!(commit)
+          root_events, introductions = {}, {}
+          previous_chains, previous_files = {}, {}
+          each_history_event_snapshot!(nil, nodes: nodes) do |node, snapshots, files|
+            chains = snapshots.transform_values { |events| validated_attempt_chains!(events) }
+            snapshots.each do |id, events|
+              unless events.all? { |event| files.fetch(id).key?(event_filename(event)) }
+                raise AttemptErrors::EvidenceUnavailable, "canonical event filename differs"
+              end
+            end
+            previous_chains.each do |id, attempts|
+              attempts.each do |attempt_id, chain|
+                newer = chains.fetch(id, {}).fetch(attempt_id, [])
+                unless chain == newer.take(chain.size)
+                  raise AttemptErrors::EvidenceUnavailable, "canonical inventory history removed or rewrote an attempt"
+                end
+              end
+            end
+            previous_files.each do |id, selected_files|
+              unless selected_files.all? { |name, oid| files.fetch(id, {})[name] == oid }
+                raise AttemptErrors::EvidenceUnavailable, "canonical inventory history removed or rewrote event bytes"
+              end
+            end
+            snapshots.each do |id, events|
+              introductions[id] ||= {}
+              events.each { |event| introductions.fetch(id)[event.fetch("digest")] ||= node.first }
+            end
+            root_events = snapshots.reject { |_id, events| events.empty? }
+            previous_chains = chains
+            previous_files = files.transform_values(&:dup)
+          end
+          introductions.select! { |id, _| root_events.key?(id) }
+          freeze_inventory_projection("commit" => commit, "events" => root_events, "introductions" => introductions)
+        rescue KeyError, TypeError, ArgumentError, NoMethodError
+          raise AttemptErrors::EvidenceUnavailable, "canonical inventory history is unverifiable"
+        end
+
+        private :read_canonical_inventory!
+
+        def canonical_history_nodes!(commit)
+          verify_commit!(commit)
+          topology, error, status = git("rev-list", "--first-parent", "--parents",
+            "--max-count=#{HISTORY_LIMIT + 1}", commit)
+          nodes = topology.lines.map(&:split)
+          unless status.success? && !nodes.empty? && nodes.size <= HISTORY_LIMIT &&
+              nodes.all? { |node| node.size.between?(1, 2) && node.all? { |sha| sha.match?(/\A[0-9a-f]{40}\z/) } } &&
+              nodes.each_cons(2).all? { |left, right| left[1] == right[0] } && nodes.last.size == 1
+            raise AttemptErrors::EvidenceUnavailable, "canonical history topology is unsupported or incomplete: #{error}"
+          end
+          nodes
+        end
+
+        def validated_attempt_chains!(events)
+          chains = events.group_by { |event| event.fetch("attempt_id") }
+          unless chains.values.all? { |chain| Models::EvidenceEvent.chain_valid?(chain) }
+            raise AttemptErrors::EvidenceUnavailable, "historical canonical event chain is corrupt"
+          end
+          chains
+        end
+
+        def freeze_inventory_projection(value)
+          case value
+          when Hash
+            value.to_h { |key, item| [freeze_inventory_projection(key), freeze_inventory_projection(item)] }.freeze
+          when Array
+            value.map { |item| freeze_inventory_projection(item) }.freeze
+          when String
+            value.dup.freeze
+          else
+            value.freeze
+          end
+        end
+        private :canonical_history_nodes!, :validated_attempt_chains!, :freeze_inventory_projection
+
         # Append accepted events to the journal under lock + CAS.
         #
         # @param assignment_id [String] Assignment ID (journal path segment)
@@ -132,21 +589,83 @@ module Ace
         # @param assignment_id [String] Assignment ID
         # @return [Array<Hash>] Parsed events in journal order
         def read_events(assignment_id, commit: ref_value)
-          value = commit
-          return [] if value.nil?
+          context = Thread.current[:ace_assign_event_read_operation]
+          if commit.nil?
+            context&.delete(:selection)
+            context&.delete(:events)
+            return []
+          end
+          unless context && @mode == :protected && commit.is_a?(String) && commit.match?(/\A[0-9a-f]{40}\z/)
+            context&.delete(:selection)
+            context&.delete(:events)
+            return read_event_snapshots!([assignment_id], commit: commit).first.fetch(assignment_id)
+          end
+          selection = [object_id, @repo_root, @ref, @checkout_root, @mode, @read_boundary&.object_id,
+            assignment_id, commit].map { |value| value.is_a?(String) ? value.dup.freeze : value }.freeze
+          return context.fetch(:events) if context[:selection] == selection
+          context.delete(:selection)
+          context.delete(:events)
+          inventory = retained_operation_inventory(commit) if assignment_id.is_a?(String) && assignment_id.match?(JournalMutation::ID)
+          events = if inventory
+            inventory.fetch("events").fetch(assignment_id, [])
+          else
+            read_event_snapshots!([assignment_id], commit: commit).first.fetch(assignment_id)
+          end
+          frozen = freeze_inventory_projection(events)
+          context[:selection], context[:events] = selection, frozen
+          frozen
+        end
 
-          paths, stderr, status = git("ls-tree", "-r", "--name-only", value, "--",
-            "execution/#{assignment_id}/events/")
-          raise AttemptErrors::EvidenceUnavailable, "Cannot read journal events: #{stderr}" unless status.success?
-          events = paths.lines.map(&:strip).select { |path| path.end_with?(".json") }.map do |path|
-            content, error, read_status = git("show", "#{value}:#{path}")
-            raise AttemptErrors::EvidenceUnavailable, "Cannot read journal event: #{error}" unless read_status.success?
-            JSON.parse(content)
+        # Bounded argv/blob batches from the same immutable tree. Preserve the
+        # actual file OIDs alongside parsed chains for introduction proofs.
+        def read_event_snapshots!(assignment_ids, commit:)
+          unless assignment_ids.is_a?(Array) && !assignment_ids.empty? && assignment_ids.size <= HISTORY_LIMIT &&
+              assignment_ids.uniq.size == assignment_ids.size && assignment_ids.all? { |id| id.is_a?(String) && id.match?(JournalMutation::ID) }
+            raise AttemptErrors::EvidenceUnavailable, "canonical assignment selectors are invalid"
+          end
+          events = assignment_ids.to_h { |id| [id, []] }
+          files = assignment_ids.to_h { |id| [id, {}] }
+          entries = []
+          assignment_ids.each_slice(64) do |ids|
+            paths, stderr, status = git("ls-tree", "-r", "-l", commit, "--", *ids.map { |id| "execution/#{id}/events/" })
+            raise AttemptErrors::EvidenceUnavailable, "Cannot read journal events: #{stderr}" unless status.success?
+            paths.lines.each do |line|
+              metadata, path = line.chomp.split("\t", 2)
+              next unless path&.end_with?(".json")
+              _mode, kind, oid, size = metadata.split
+              id = path.split("/")[1]
+              unless events.key?(id) && path.start_with?("execution/#{id}/events/") && kind == "blob" &&
+                  oid&.match?(/\A[0-9a-f]{40}\z/) && size&.match?(/\A(?:0|[1-9][0-9]*)\z/)
+                raise AttemptErrors::EvidenceUnavailable, "canonical event blob selection is invalid"
+              end
+              name = path.delete_prefix("execution/#{id}/events/")
+              raise AttemptErrors::EvidenceUnavailable, "canonical event file is ambiguous" if files.fetch(id).key?(name)
+              files.fetch(id)[name] = oid
+              entries << [oid, size.to_i, id]
+            end
+          end
+          batches = []
+          entries.each do |entry|
+            batches << [] if batches.empty? || batches.last.size == 64 ||
+              (!batches.last.empty? && batches.last.sum { |item| item[1] } + entry[1] > EVENT_BATCH_BYTES)
+            batches.last << entry
           end
-          order_by_chain(events)
-        rescue JSON::ParserError => e
-          raise AttemptErrors::EvidenceUnavailable, "Corrupt journal event for #{assignment_id}: #{e.message}"
+          batches.each do |batch|
+            selected = batch.map { |oid, size, _id| [oid, size] }
+            contents = decode_event_blobs!(selected, read_event_blobs!(selected))
+            batch.zip(contents).each { |(_oid, _size, id), content| events.fetch(id) << JSON.parse(content) }
+          end
+          events.each_value do |chain|
+            digests = chain.map { |event| event.fetch("digest") }
+            unless digests.uniq.size == digests.size
+              raise AttemptErrors::EvidenceUnavailable, "canonical event digest is ambiguous"
+            end
+          end
+          [events.transform_values { |chain| order_by_chain(chain) }, files]
+        rescue JSON::ParserError
+          raise AttemptErrors::EvidenceUnavailable, "Corrupt canonical journal event"
         end
+        private :read_event_snapshots!
 
         # Accepted receipt payloads recorded for an assignment.
         #
@@ -261,6 +780,17 @@ module Ace
               "Service settlement requires a no-effect attestation artifact"
           end
           if @mode == :protected
+            if (current["operation"] == "prune-preserved-workspace" && %w[succeeded failed-settled].include?(state)) ||
+                (current["operation"] == "publish" && %w[succeeded failed].include?(state))
+              # The same installed evidence reader owns the entire imported
+              # cleanup pair; individual textual markers cannot authorize it.
+              contents = @evidence_reader.call(evidence_items, current, state, pending)
+              unless contents.is_a?(Array) && contents.size == evidence_items.size &&
+                  contents.each_with_index.all? { |content, index| content.is_a?(String) && Digest::SHA256.hexdigest(content.b) == evidence_items.fetch(index).fetch("sha256") }
+                raise AttemptErrors::ReceiptRejected, "Canonical cleanup evidence is unverifiable"
+              end
+              return true
+            end
             evidence_items.each do |item|
               content = @evidence_reader.call(item, current, state, pending)
               unless content.is_a?(String) && Digest::SHA256.hexdigest(content.b) == item["sha256"]
@@ -292,14 +822,75 @@ module Ace
         end
 
         def service_request(request_id, commit: ref_value)
+          read_service_request(request_id, commit: commit, pending: {commit: commit})
+        end
+
+        # A read operation owns this view only until its caller returns. The
+        # original complete first-parent/raw-blob owner supplies every fact;
+        # it is never retained on the journal or reused for another operation.
+        ServiceReadView = Struct.new(:journal, :commit, :inventory, :projection, keyword_init: true)
+
+        def service_settlement_read(request_id, commit: ref_value)
+          verify_canonical_prefix!(commit: commit)
+          record = read_service_request(request_id, commit: commit, pending: {commit: commit}, terminal: false)
+          return {record: nil, settlement_context: nil, read_view: nil}.freeze unless record
+          id = record.fetch("assignment_id")
+          events = read_events(id, commit: commit)
+          selectors = events.map { |event| event.fetch("digest") }
+          introductions = event_commits!(assignment_id: id, event_digests: selectors, commit: commit)
+          inventory = freeze_inventory_projection("commit" => commit, "events" => {id => events}, "introductions" => {id => introductions})
+          view = ServiceReadView.new(journal: self, commit: commit, inventory: inventory)
+          if @mode == :protected && terminal_state?(record["state"])
+            validate_terminal_receipt!(record, record["state"], record["receipt"],
+              pending: {commit: commit, service_read_view: view})
+          end
+          view.freeze
+          {record: freeze_inventory_projection(record), settlement_context: view.projection, read_view: view}.freeze
+        end
+
+        def read_service_request(request_id, commit:, pending:, terminal: true)
+          context = Thread.current[:ace_assign_event_read_operation]
           validate_request_id!(request_id)
-          value = commit
-          return nil unless value
-          out, stderr, status = git("show", "#{value}:#{service_request_path(request_id)}")
+          reusable = context && @mode == :protected && commit.is_a?(String) && commit.match?(/\A[0-9a-f]{40}\z/)
+          selection = if reusable
+            (operation_inventory_selection(commit) + [@evidence_reader&.object_id, @service_authorizer&.object_id, request_id])
+              .map { |value| value.is_a?(String) ? value.dup.freeze : value }.freeze
+          end
+          if reusable && context[:service_record_selection] == selection
+            retained = context[:service_record]
+          else
+            context&.delete(:service_record_selection)
+            context&.delete(:service_record)
+            retained = read_service_request_record(request_id, commit: commit)
+            if reusable && retained
+              retained = freeze_inventory_projection(retained)
+              context[:service_record_selection], context[:service_record] = selection, retained
+            end
+          end
+          # This memo contains JSON and its immutable accepted event proof,
+          # never terminal evidence admission. Every callback remains fresh;
+          # callers receive their own mutable copy rather than cached state.
+          record = retained && (reusable ? JSON.parse(JSON.generate(retained)) : retained)
+          validate_terminal_receipt!(record, record["state"], record["receipt"], pending: pending) if
+            record && terminal && @mode == :protected && terminal_state?(record["state"])
+          # Historical dependency reads may replace this one slot while the
+          # fresh callback executes. Restore only this successful raw view.
+          if reusable && retained
+            context[:service_record_selection], context[:service_record] = selection, retained
+          end
+          record
+        rescue Exception
+          context&.delete(:service_record_selection)
+          context&.delete(:service_record)
+          raise
+        end
+
+        def read_service_request_record(request_id, commit:)
+          return nil unless commit
+          out, stderr, status = git("show", "#{commit}:#{service_request_path(request_id)}")
           if status.success?
             record = JSON.parse(out)
-            verify_service_record!(record, commit: value) if @mode == :protected
-            validate_terminal_receipt!(record, record["state"], record["receipt"], pending: {commit: value}) if @mode == :protected && terminal_state?(record["state"])
+            verify_service_record!(record, commit: commit) if @mode == :protected
             return record
           end
           return nil if stderr.include?("does not exist") || stderr.include?("exists on disk")
@@ -308,6 +899,8 @@ module Ace
           raise AttemptErrors::EvidenceUnavailable, "Corrupt service request #{request_id}"
         end
 
+        private :read_service_request, :read_service_request_record
+
         # Every service request recorded in this evidence ref, whatever the
         # owning assignment. Backs the journal-wide request-ID and
         # authorization-consumption checks.
@@ -431,6 +1024,46 @@ module Ace
 
         private
 
+        # Sizes come from the same immutable tree selection. Batch memory is
+        # bounded by that selection; an existing larger single event retains
+        # its previous read semantics rather than gaining a lifetime ceiling.
+        def read_event_blobs!(entries)
+          limit = entries.sum { |_oid, size| size + 128 }
+          return @read_boundary.blob_batch(entries.map(&:first), output_limit: limit) if @read_boundary
+          result = Herdr::Molecules::BoundedProcess.call(["git", "cat-file", "--batch"],
+            chdir: File.expand_path(@repo_root), stdin_data: entries.map { |oid, _size| "#{oid}\n" }.join,
+            timeout_s: 30, output_limit: limit)
+          unless result.status.success? && !result.oversized
+            raise AttemptErrors::EvidenceUnavailable, "canonical blob batch is unavailable or exceeds selected sizes"
+          end
+          result.stdout.to_s.b
+        rescue Timeout::Error, Herdr::Molecules::BoundedProcess::PostLaunchError, IOError, SystemCallError => error
+          raise AttemptErrors::EvidenceUnavailable, "canonical blob batch is unavailable: #{error.message}"
+        end
+
+        def decode_event_blobs!(entries, output)
+          output = output.b
+          offset = 0
+          entries.map do |oid, size|
+            ending = output.index("\n", offset)
+            unless ending && ending - offset <= 127 && output.byteslice(offset, ending - offset) == "#{oid} blob #{size}"
+              raise AttemptErrors::EvidenceUnavailable, "canonical blob batch header is invalid"
+            end
+            offset = ending + 1
+            content = output.byteslice(offset, size)
+            unless content&.bytesize == size && output.byteslice(offset + size, 1) == "\n" &&
+                Digest::SHA1.hexdigest("blob #{size}\0" + content) == oid
+              raise AttemptErrors::EvidenceUnavailable, "canonical blob batch bytes are invalid"
+            end
+            offset += size + 1
+            content
+          end.tap do
+            unless offset == output.bytesize
+              raise AttemptErrors::EvidenceUnavailable, "canonical blob batch has unexpected trailing bytes"
+            end
+          end
+        end
+
         def update_service_request(request_id, expected:, replacement:, event_type:, guard: nil)
           validate_request_id!(request_id)
           with_lock do
@@ -468,7 +1101,7 @@ module Ace
         def prepare_service_update(request_id:, expected:, replacement:, event_type:, guard: nil, pending: nil)
           validate_request_id!(request_id)
           unless replacement.is_a?(Hash) && replacement["request_id"] == request_id &&
-              %w[service_claim service_transition].include?(event_type) &&
+              %w[service_claim service_transition service_challenge].include?(event_type) &&
               %w[accepted uncertain rejected succeeded failed failed-settled].include?(replacement["state"])
             raise ArgumentError, "invalid service update plan"
           end
@@ -496,17 +1129,43 @@ module Ace
               raise_authorization_conflict!(conflict) if conflict
             end
           else
-            unless event_type == "service_transition"
+            challenge_update = event_type == "service_challenge" && pending && pending[:operation] == "claim_service_settlement" &&
+              existing["state"] == replacement["state"] && existing["receipt"] == replacement["receipt"] &&
+              %w[uncertain failed].include?(existing["state"])
+            unless event_type == "service_transition" || challenge_update
               raise AttemptErrors::InvalidState, "Existing service request needs a transition"
             end
             terminal = %w[succeeded failed rejected failed-settled].include?(existing["state"])
             settlement = replacement["state"] == "failed-settled" &&
               (existing["state"] == "failed" || (existing["state"] == "rejected" && existing["consumed"] != false))
-            if terminal && !settlement
+            recovered_cleanup = @mode == :protected && pending && pending[:operation] == "complete_service" &&
+              existing["operation"] == "prune-preserved-workspace" && existing["state"] == "failed" &&
+              existing["dispatch_phase"] == "dispatch_started" && existing["completion_digest"].nil? &&
+              replacement["state"] == "succeeded"
+            if terminal && !settlement && !challenge_update && !recovered_cleanup
               raise AttemptErrors::InvalidState, "Service request #{request_id} is terminal"
             end
             mutable = %w[state receipt reason claimed_at failed_at dispatch_phase no_effect_challenge
-              challenge_generation challenge_event_digest completion_digest]
+              challenge_generation challenge_event_digest completion_digest no_effect_completion_digest]
+            # Only this authenticated fresh dispatch may introduce the fixed
+            # root collaborator identity. It is immutable on every later update.
+            if @mode == :protected && pending && pending[:operation] == "begin_dispatch" &&
+                existing["operation"] == "prune-preserved-workspace" && existing["dispatch_phase"] == "issued" &&
+                replacement["dispatch_phase"] == "dispatch_started" &&
+                %w[operation_owner_binding executor_process_binding].none? { |key| existing.key?(key) } &&
+                %w[operation_owner_binding executor_process_binding].all? { |key| replacement.key?(key) }
+              mutable.concat(%w[operation_owner_binding executor_process_binding])
+            end
+            if @mode == :protected && pending && existing["operation"] == "publish"
+              if pending[:operation] == "begin_dispatch" && existing["dispatch_phase"] == "issued" &&
+                  replacement["dispatch_phase"] == "dispatch_started" && !existing.key?("executor_process_binding") &&
+                  replacement.key?("executor_process_binding")
+                mutable << "executor_process_binding"
+              elsif %w[publication_challenge publication_continue].include?(pending[:operation])
+                mutable.concat(%w[publication_challenge_digest publication_challenge_ref publication_challenge_event_digest
+                  publication_challenge_generation publication_issuing_event_digest])
+              end
+            end
             unless existing.except(*mutable) == replacement.except(*mutable)
               raise AttemptErrors::Conflict, "Service request #{request_id} changed immutable binding"
             end
@@ -554,7 +1213,7 @@ module Ace
             raise AttemptErrors::EvidenceUnavailable, "Canonical service event chain is unverifiable"
           end
           event = events.reverse.find do |entry|
-            %w[service_claim service_transition].include?(entry["type"]) && entry.dig("payload", "request_id") == record["request_id"]
+            %w[service_claim service_transition service_challenge].include?(entry["type"]) && entry.dig("payload", "request_id") == record["request_id"]
           end
           unless event && event.dig("payload", "record_digest") == Atoms::EvidenceDigest.digest(record)
             raise AttemptErrors::EvidenceUnavailable, "Canonical service record does not match accepted event"
@@ -589,22 +1248,7 @@ module Ace
         # Latest lifecycle state implied by the events, or nil when the
         # events do not describe a full attempt (intent missing).
         def derive_state(events)
-          return nil unless events.any? { |event| event["type"] == "intent" }
-
-          state = "reserved"
-          events.each do |event|
-            case event["type"]
-            when "process_start"
-              state = "running"
-            when "receipt_accepted"
-              state = event.dig("payload", "receipt", "verdict") || state
-            when "transition"
-              state = event.dig("payload", "to") || state
-            when "reconciliation"
-              state = event.dig("payload", "resolution") || state
-            end
-          end
-          state
+          CanonicalAttemptState.derive(events)
         end
 
         def build_attempt(assignment_id, attempt_id, intent_payload, events, state)
@@ -743,21 +1387,52 @@ module Ace
           File.join(@checkout_root, ".evidence.lock")
         end
 
-        def with_lock
+        def with_lock(cleanup_on_failure: true, owner_uid: nil, owner_gid: nil)
+          raise AttemptErrors::EvidenceUnavailable, "read-only journal cannot mutate canonical evidence" if @read_boundary
           FileUtils.mkdir_p(@checkout_root)
-          File.open(lock_path, File::RDWR | File::CREAT) do |lock|
+          lock = if owner_uid
+            initialization_lock!(owner_uid: owner_uid, owner_gid: owner_gid)
+          else
+            File.open(lock_path, File::RDWR | File::CREAT, 0o600)
+          end
+          begin
             lock.flock(File::LOCK_EX)
             begin
               yield
             rescue StandardError
-              # No rejected writer may leave staged or untracked transaction
-              # data for the next writer to admit. This checkout is disposable.
-              sync_checkout(ref_value) if File.exist?(File.join(checkout_dir, ".git"))
+              # Ordinary mutation rollback is unchanged. Initialization must
+              # not adopt/reset a foreign disposable checkout on refusal.
+              sync_checkout(ref_value) if cleanup_on_failure && File.exist?(File.join(checkout_dir, ".git"))
               raise
             ensure
               lock.flock(File::LOCK_UN)
             end
+          ensure
+            lock.close
+          end
+        end
+
+        def initialization_lock!(owner_uid:, owner_gid:)
+          created = false
+          begin
+            file = File.open(lock_path, File::RDWR | File::CREAT | File::EXCL | File::NOFOLLOW, 0o600)
+            created = true
+          rescue Errno::EEXIST
+            file = File.open(lock_path, File::RDWR | File::NOFOLLOW)
+          end
+          if created
+            file.flush
+            file.fsync
+          end
+          info = file.stat
+          unless info.file? && info.nlink == 1 && info.size.zero? &&
+              [info.uid, info.gid, info.mode & 0o7777] == [owner_uid, owner_gid, 0o600]
+            raise AttemptErrors::EvidenceUnavailable, "canonical initialization lock protection differs"
           end
+          file
+        rescue Exception
+          file&.close
+          raise
         end
 
         def ensure_checkout!
@@ -811,6 +1486,7 @@ module Ace
         end
 
         def git(*argv)
+          return @read_boundary.call(argv) if @read_boundary
           unless File.directory?(@repo_root)
             return ["", "repository root missing: #{@repo_root}", FAILED_RESULT]
           end