ace-assign 0.64.0 → 0.66.0

data/lib/ace/assign/molecules/execution_scope_lineage.rb

@@ -11,7 +11,7 @@ module Ace
       # This reader never promotes cached population into a proof event.
       class ExecutionScopeLineage
         BINDING_FIELDS = %w[project_id assignment_id attempt_id mapping_id slot_id reservation_generation
-          scope_generation deployment_digest boot_id slice_invocation_id cgroup_identity resource_mount_namespace_identity resource_identities network_installation_selection network_namespace_identity].freeze
+          scope_generation deployment_digest boot_id slice_invocation_id cgroup_identity resource_mount_namespace_identity resource_identities network_installation_selection network_namespace_identity boot_baseline_selection].freeze
         PROOF_FIELDS = %w[scope_generation scope_binding_event_id seal_event_id boot_id slice_invocation_id
           cgroup_identity populated].freeze
         PROCESS_FIELDS = %w[pid uid gid groups started_at host parent_pid].freeze
@@ -22,6 +22,20 @@ module Ace
         INVOCATION = /\A[0-9a-f]{32}\z/
         BOOT = /\A[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\z/
 
+        def self.validate_process_identity!(value, boot_id:)
+          unless boot_id.is_a?(String) && BOOT.match?(boot_id) && value.is_a?(Hash) && value.keys.sort == PROCESS_FIELDS.sort
+            raise AttemptErrors::EvidenceUnavailable, "scope process identity fields differ"
+          end
+          groups = value["groups"]
+          unless %w[pid uid gid parent_pid].all? { |key| value[key].is_a?(Integer) && value[key].positive? } &&
+              groups.is_a?(Array) && groups.all? { |id| id.is_a?(Integer) && id.positive? } && groups == groups.sort.uniq &&
+              value["started_at"].is_a?(String) && value["started_at"].match?(/\Alinux:#{Regexp.escape(boot_id)}:[0-9]+\z/) &&
+              value["host"].is_a?(String) && !value["host"].empty?
+            raise AttemptErrors::EvidenceUnavailable, "scope process birth/credentials are malformed"
+          end
+          value
+        end
+
         def self.validate_network_selection!(selection)
           unless selection.is_a?(Hash) && selection.keys.sort == %w[installer_artifact policy_export profile report]
             raise AttemptErrors::EvidenceUnavailable, "network installation selection is not closed"
@@ -37,6 +51,16 @@ module Ace
           selection
         end
 
+        def self.validate_boot_baseline_selection!(ref)
+          unless ref.is_a?(Hash) && ref.keys.sort == %w[bytes path sha256] && ref["path"].is_a?(String) &&
+              ref["path"].bytesize.between?(1, 4096) && ref["path"].start_with?("/") && !ref["path"].include?("\0") &&
+              File.expand_path(ref["path"]) == ref["path"] && ref["sha256"].is_a?(String) && DIGEST.match?(ref["sha256"]) &&
+              ref["bytes"].is_a?(Integer) && ref["bytes"].between?(1, 16_384)
+            raise AttemptErrors::EvidenceUnavailable, "boot baseline artifact reference differs"
+          end
+          ref
+        end
+
         attr_reader :binding_event, :native_event, :child_event, :seal_event, :proof_event, :admission_event
 
         def initialize(events:, project_id:, assignment_id:, attempt_id:, mapping_id:)
@@ -136,6 +160,7 @@ module Ace
           namespace!(value.fetch("resource_mount_namespace_identity"))
           namespace!(value.fetch("network_namespace_identity"))
           self.class.validate_network_selection!(value.fetch("network_installation_selection"))
+          self.class.validate_boot_baseline_selection!(value.fetch("boot_baseline_selection"))
           resources = value.fetch("resource_identities")
           resources!(resources)
           @binding_event = event
@@ -297,14 +322,7 @@ module Ace
         end
 
         def process!(value, boot_id)
-          exact_fields!(value, PROCESS_FIELDS)
-          groups = value["groups"]
-          unless %w[pid uid gid parent_pid].all? { |key| positive_integer?(value[key]) } &&
-              groups.is_a?(Array) && groups.all? { |id| positive_integer?(id) } && groups == groups.sort.uniq &&
-              value["started_at"].is_a?(String) && value["started_at"].match?(/\Alinux:#{Regexp.escape(boot_id)}:[0-9]+\z/) &&
-              value["host"].is_a?(String) && !value["host"].empty?
-            unavailable!("scope process birth/credentials are malformed")
-          end
+          self.class.validate_process_identity!(value, boot_id: boot_id)
         end
 
         def exact_fields!(value, keys)

data/lib/ace/assign/molecules/fork_session_launcher.rb

@@ -85,14 +85,22 @@ module Ace
         end
 
         def launch_provider_session(assignment_id:, fork_root:, provider:, cli_args: nil, timeout: nil, cache_dir: nil,
-          last_message_file: nil, session_meta_file: nil)
+          last_message_file: nil, session_meta_file: nil, prepared_input: nil)
           ensure_not_same_scoped_refork!(assignment_id: assignment_id, fork_root: fork_root)
           resolved_provider = provider || config.dig("execution", "provider") || DEFAULT_PROVIDER
           resolved_timeout = timeout || config.dig("execution", "timeout") || DEFAULT_TIMEOUT
           scoped_assignment = "#{assignment_id}@#{fork_root}"
-          prompt = "/as-assign-drive #{scoped_assignment}"
+          if prepared_input && prepared_input.descriptor.values_at("assignment_id", "scope") != [assignment_id, fork_root]
+            raise Error, "Prepared provider scope differs"
+          end
+          prompt = prepared_input ? prepared_input.drive_prompt : "/as-assign-drive #{scoped_assignment}"
           last_msg_file = last_message_file || build_last_message_file(cache_dir, fork_root)
           scope_env = self.class.fork_scope_env(assignment_id: assignment_id, fork_root: fork_root)
+          if prepared_input
+            scope_env = scope_env.merge("ACE_ASSIGN_LAUNCH_MAPPING" => prepared_input.descriptor.fetch("mapping_id"),
+              "ACE_ASSIGN_ASSIGNMENT_ID" => assignment_id, "ACE_ASSIGN_ATTEMPT_ID" => prepared_input.descriptor.fetch("attempt_id"),
+              "ACE_ASSIGN_TASK_CONTEXT_ENTRY" => JSON.generate(prepared_input.descriptor.fetch("task_context_entry").fetch("manifest")))
+          end
 
           result = query_interface.query(
             resolved_provider,
@@ -102,7 +110,8 @@ module Ace
             timeout: resolved_timeout,
             fallback: false,
             last_message_file: last_msg_file,
-            subprocess_env: scope_env
+            subprocess_env: scope_env,
+            working_dir: prepared_input&.working_directory
           )
 
           if last_msg_file && result[:text] && !result[:text].strip.empty?
@@ -110,7 +119,8 @@ module Ace
             File.write(last_msg_file, result[:text]) if existing.empty?
           end
 
-          write_session_metadata(last_msg_file, result, prompt: prompt, session_meta_file: session_meta_file)
+          write_session_metadata(last_msg_file, result, prompt: prompt, session_meta_file: session_meta_file,
+            discover_session: prepared_input.nil?)
 
           result
         rescue Ace::LLM::Error => e
@@ -220,12 +230,12 @@ module Ace
           File.write(session_meta_file, meta.to_yaml) unless meta.empty?
         end
 
-        def write_session_metadata(last_msg_file, result, prompt:, session_meta_file: nil)
+        def write_session_metadata(last_msg_file, result, prompt:, session_meta_file: nil, discover_session: true)
           return unless last_msg_file
 
           session_id = result.dig(:metadata, :session_id)
 
-          if session_id.nil? || session_id.to_s.strip.empty?
+          if discover_session && (session_id.nil? || session_id.to_s.strip.empty?)
             detected = detect_provider_session(result[:provider], prompt)
             session_id = detected&.dig(:session_id)
           end

data/lib/ace/assign/molecules/journal_input_inhibition.rb

@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+require_relative "execution_scope_lineage"
+
+module Ace
+  module Assign
+    module Molecules
+      module JournalInputInhibition
+        INPUT_INHIBITION_FIELDS = %w[assignment_id attempt_id mapping_id original_binding_digest project_id seal_event_id].freeze
+
+        def observe_input_inhibition(selection:, evidence:, &authentication)
+          raise ArgumentError, "Original inhibition authentication is required" unless authentication
+          input = selection.merge("guarded_evidence" => evidence)
+          digest = Digest::SHA256.hexdigest(JSON.generate(canonical_prompt_value(input)))
+          mutate(assignment_id: selection.fetch("assignment_id"), attempt_id: selection.fetch("attempt_id"),
+            mutation_id: "input-inhibit.#{selection.fetch('seal_event_id')}", operation: "input_inhibition_observation",
+            parameters_digest: digest, expected_generation: nil, generation_mode: :input_inhibition,
+            input_inhibition: input, with_replay: true) do |events, commit, generation|
+            original = authentication.call(events, commit, generation)
+            unless original.is_a?(Hash) && original.keys.sort == %w[binding_digest origin] && original["binding_digest"] == selection.fetch("original_binding_digest")
+              raise AttemptErrors::EvidenceUnavailable, "Original input inhibition record differs"
+            end
+            verify_input_drained_evidence!(evidence, original.fetch("origin"))
+            {events: [{type: "input_inhibited", payload: selection.merge("guarded_evidence" => evidence)}], blobs: {},
+              data: selection.slice("original_binding_digest", "seal_event_id")}
+          end
+        end
+
+        def verify_input_drained_evidence!(evidence, original)
+          unless original.is_a?(Hash) && evidence.is_a?(Hash) && evidence.keys.sort == %w[input_state origin outcome pending_input] &&
+              evidence["outcome"] == "inhibited" && evidence["input_state"] == "inhibited" &&
+              evidence["pending_input"].is_a?(Integer) && evidence["pending_input"].zero?
+            raise AttemptErrors::EvidenceUnavailable, "Native input drainage is unconfirmed"
+          end
+          received = Ace::Herdr::Molecules::GuardedNativeOrigin.verify!(evidence.fetch("origin"),
+            terminal_id: original.fetch("terminal_id"), child: original.fetch("child"))
+          raise AttemptErrors::EvidenceUnavailable, "Native input drainage origin differs" unless received == original
+          true
+        rescue Ace::Runtime::RuntimeUnavailableError, KeyError, TypeError
+          raise AttemptErrors::EvidenceUnavailable, "Native input drainage is unverifiable"
+        end
+
+        private
+
+        def verify_input_inhibition!(input, mutation_id:, digest:, assignment_id:, attempt_id:, commit:)
+          unless input.is_a?(Hash) && input.keys.sort == (INPUT_INHIBITION_FIELDS + ["guarded_evidence"]).sort &&
+              INPUT_INHIBITION_FIELDS.all? { |key| input[key].is_a?(String) } &&
+              %w[original_binding_digest seal_event_id].all? { |key| input.fetch(key).match?(/\A[0-9a-f]{64}\z/) } &&
+              input["assignment_id"] == assignment_id && input["attempt_id"] == attempt_id &&
+              mutation_id == "input-inhibit.#{input.fetch('seal_event_id')}" &&
+              digest == Digest::SHA256.hexdigest(JSON.generate(canonical_prompt_value(input)))
+            raise ArgumentError, "Invalid fixed input inhibition selector"
+          end
+          events = read_events(assignment_id, commit: commit).select { |event| event["attempt_id"] == attempt_id }
+          authority_generation(events)
+          record = events.find { |event| event["digest"] == input.fetch("original_binding_digest") && event["type"] == "authority_mutation" &&
+            event.dig("payload", "operation") == "record_launch" }
+          data = record&.dig("payload", "data")
+          seal = events.find { |event| event["digest"] == input.fetch("seal_event_id") && event["type"] == "scope_sealed" }
+          accepted_seal = seal && events.find { |event| event["type"] == "authority_mutation" && event["previous_digest"] == seal.fetch("digest") &&
+            %w[close_execution_scope stop_attempt].include?(event.dig("payload", "operation")) }
+          lineage = ExecutionScopeLineage.new(events: events, project_id: input.fetch("project_id"), assignment_id: assignment_id,
+            attempt_id: attempt_id, mapping_id: input.fetch("mapping_id"))
+          unless data.is_a?(Hash) && %w[assignment_id attempt_id mapping_id].all? { |key| data[key] == input.fetch(key) } &&
+              seal && accepted_seal && lineage.seal_event == seal && events.index(record) < events.index(seal) &&
+              events.drop(events.index(seal) + 1).none? { |event| event["type"] == "prompt_issued" } &&
+              events.none? { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "scope_reservation_release" }
+            raise AttemptErrors::EvidenceUnavailable, "Input inhibition does not join accepted original seal"
+          end
+          origin = Ace::Herdr::Molecules::GuardedNativeOrigin.verify!(data.fetch("guarded_origin"),
+            terminal_id: data.fetch("process_binding").fetch("terminal_id"), child: data.fetch("process_binding").fetch("process_identity"))
+          verify_input_drained_evidence!(input.fetch("guarded_evidence"), origin)
+        rescue KeyError, TypeError, Ace::Runtime::RuntimeUnavailableError
+          raise AttemptErrors::EvidenceUnavailable, "Input inhibition canonical selection is malformed"
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/molecules/journal_mutation.rb

@@ -2,6 +2,9 @@
 
 require "json"
 require "digest"
+require "ace/herdr/molecules/bounded_process"
+require_relative "journal_prompt_mutation"
+require_relative "journal_input_inhibition"
 
 module Ace
   module Assign
@@ -9,6 +12,8 @@ module Ace
       # Protected authority mutations share the execution ref's lock and CAS.
       # Replies live in chained attempt events, rather than an RPC ledger.
       module JournalMutation
+        include JournalPromptMutation
+        include JournalInputInhibition
         ID = /\A[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}\z/
 
         # Shared canonical projection used by admission and protected status.
@@ -29,11 +34,39 @@ module Ace
         # returns events [{type:, payload:}], immutable blobs, and public data.
         # Only the authority calls this internal journal API; wire requests
         # cannot select blob paths, event types, or accepted response data.
-        def mutate(assignment_id:, attempt_id:, mutation_id:, operation:, parameters_digest:, expected_generation:, with_replay: false, generation_mode: :expected)
+        def mutate(assignment_id:, attempt_id:, mutation_id:, operation:, parameters_digest:, expected_generation:, with_replay: false, generation_mode: :expected, prompt_binding: nil, prompt_completion: nil, prompt_observation: nil, input_inhibition: nil)
           unless (generation_mode == :expected && expected_generation.is_a?(Integer) && expected_generation >= 0) ||
-              (generation_mode == :recorded_completion && operation == "complete_service" && expected_generation.nil?)
+              (generation_mode == :recorded_completion && %w[complete_service complete_no_effect].include?(operation) && expected_generation.nil?) ||
+              (generation_mode == :prompt_completion && operation == "prompt_attempt" && expected_generation.nil? && prompt_completion.is_a?(Hash)) ||
+              (generation_mode == :prompt_observation && operation == "prompt_observation" && expected_generation.nil? && prompt_observation.is_a?(Hash)) ||
+              (generation_mode == :input_inhibition && operation == "input_inhibition_observation" && expected_generation.nil? && input_inhibition.is_a?(Hash))
             raise ArgumentError, "invalid fixed mutation generation mode"
           end
+          if input_inhibition && generation_mode != :input_inhibition
+            raise ArgumentError, "Input inhibition requires its fixed mode"
+          end
+          if operation == "input_inhibition_observation" && !(generation_mode == :input_inhibition && input_inhibition)
+            raise ArgumentError, "Input inhibition observation requires its accepted original selector"
+          end
+          if mutation_id.is_a?(String) && mutation_id.start_with?("input-inhibit.") && !(operation == "input_inhibition_observation" && input_inhibition)
+            raise ArgumentError, "Reserved input inhibition namespace"
+          end
+          if prompt_completion && generation_mode != :prompt_completion
+            raise ArgumentError, "prompt completion selector requires its fixed mode"
+          end
+          if prompt_observation && generation_mode != :prompt_observation
+            raise ArgumentError, "prompt observation selector requires its fixed mode"
+          end
+          if operation == "prompt_issue"
+            validate_prompt_binding!(prompt_binding)
+            digest = Digest::SHA256.hexdigest(JSON.generate(canonical_prompt_value(prompt_binding)))
+            unless parameters_digest == digest && mutation_id == "prompt-issue.#{digest}" &&
+                assignment_id == prompt_binding.fetch("assignment_id") && attempt_id == prompt_binding.fetch("attempt_id")
+              raise ArgumentError, "prompt phase does not match source binding"
+            end
+          elsif prompt_binding
+            raise ArgumentError, "prompt binding is only accepted by its fixed issue phase"
+          end
           [assignment_id, attempt_id, mutation_id].each { |id| validate_mutation_id!(id) }
           unless parameters_digest.is_a?(String) && parameters_digest.match?(/\A[0-9a-f]{64}\z/)
             raise ArgumentError, "invalid mutation parameter digest"
@@ -44,7 +77,19 @@ module Ace
               ensure_checkout!
               old = ref_value if old.nil?
               sync_checkout(old)
-              replay = mutation_result(mutation_id)
+              if prompt_binding
+                verify_prompt_external_namespace!(prompt_binding.fetch("mutation_id"), parameters_digest,
+                  assignment_id: assignment_id, attempt_id: attempt_id, commit: old)
+              end
+              verify_prompt_completion!(prompt_completion, mutation_id: mutation_id, digest: parameters_digest,
+                assignment_id: assignment_id, attempt_id: attempt_id, commit: old) if prompt_completion
+              verify_prompt_observation!(prompt_observation, mutation_id: mutation_id,
+                assignment_id: assignment_id, attempt_id: attempt_id, commit: old) if prompt_observation
+              verify_input_inhibition!(input_inhibition, mutation_id: mutation_id, digest: parameters_digest,
+                assignment_id: assignment_id, attempt_id: attempt_id, commit: old) if input_inhibition
+              verify_prompt_mutation_namespace!(mutation_id: mutation_id, operation: operation, parameters_digest: parameters_digest,
+                assignment_id: assignment_id, attempt_id: attempt_id, prompt_completion: prompt_completion, prompt_observation: prompt_observation, commit: old)
+              replay = mutation_result(mutation_id, commit: old)
               if replay
                 unless replay["operation"] == operation && replay["parameters_digest"] == parameters_digest &&
                     replay["assignment_id"] == assignment_id && replay["attempt_id"] == attempt_id
@@ -53,16 +98,16 @@ module Ace
                 result = replay.fetch("data").merge("journal_commit" => replay.fetch("journal_commit"))
                 return with_replay ? {data: result, replayed: true} : result
               end
-              current = read_events(assignment_id).select { |event| event["attempt_id"] == attempt_id }
+              current = read_events(assignment_id, commit: old).select { |event| event["attempt_id"] == attempt_id }
               generation = authority_generation(current)
-              unless generation_mode == :recorded_completion || expected_generation == generation
+              unless %i[recorded_completion prompt_completion prompt_observation input_inhibition].include?(generation_mode) || expected_generation == generation
                 raise AttemptErrors::Conflict, "Authority registration generation changed"
               end
               plan = yield(current, old, generation)
               blobs = plan.fetch(:blobs, {})
               events = chain_mutation_events(attempt_id, current.last&.fetch("digest"), plan.fetch(:events, []))
               updates = prepare_service_updates(plan.fetch(:service_updates, []), assignment_id: assignment_id,
-                attempt_id: attempt_id, pending: {current_events: current, pending_events: events, blobs: blobs, commit: old,
+                attempt_id: attempt_id, pending: {current_events: current, pending_events: events, blobs: blobs, commit: old, operation: operation,
                   service_inputs: service_input_context(plan)})
               events.concat(chain_mutation_events(attempt_id, events.last&.fetch("digest") || current.last&.fetch("digest"),
                 updates.map { |prepared| prepared.fetch(:event) }))
@@ -91,10 +136,10 @@ module Ace
           end
         end
 
-        def mutation_result(mutation_id)
+        def mutation_result(mutation_id, commit: ref_value)
           validate_mutation_id!(mutation_id)
-          assignment_ids.each do |assignment_id|
-            events = read_events(assignment_id)
+          assignment_ids(commit: commit).each do |assignment_id|
+            events = read_events(assignment_id, commit: commit)
             events.group_by { |event| event["attempt_id"] }.each_value do |chain|
               unless Models::EvidenceEvent.chain_valid?(chain)
                 raise AttemptErrors::EvidenceUnavailable, "Authority mutation event chain is corrupt"
@@ -106,9 +151,9 @@ module Ace
             next unless event
 
             path = "execution/#{assignment_id}/events/#{event_filename(event)}"
-            commit = git!("log", "--diff-filter=A", "-1", "--format=%H", ref_value, "--", path).first
-            raise AttemptErrors::EvidenceUnavailable, "Mutation acceptance commit is missing" if commit.empty?
-            return event.fetch("payload").merge("journal_commit" => commit)
+            acceptance_commit = git!("log", "--diff-filter=A", "-1", "--format=%H", commit, "--", path).first
+            raise AttemptErrors::EvidenceUnavailable, "Mutation acceptance commit is missing" if acceptance_commit.empty?
+            return event.fetch("payload").merge("journal_commit" => acceptance_commit)
           end
           nil
         end
@@ -133,12 +178,36 @@ module Ace
         def blob(path, commit: ref_value)
           validate_blob_path!(path)
           raise AttemptErrors::EvidenceUnavailable, "Canonical evidence ref is missing" unless commit
+          return @read_boundary.blob(path, commit: commit, max_bytes: CanonicalEvidence::MAX_ARTIFACT_BYTES) if @read_boundary
           out, _error, status = Open3.capture3("git", "show", "#{commit}:#{path}",
             chdir: repo_root, stdin_data: "")
           raise AttemptErrors::EvidenceUnavailable, "Canonical evidence blob is missing" unless status.success?
           out.b
         end
 
+        # Prepared inputs use the same immutable Git owner, with a bounded
+        # capture before any bytes can reach a worker transport.
+        def bounded_blob(path, commit:, max_bytes:)
+          validate_blob_path!(path)
+          unless commit.is_a?(String) && commit.match?(/\A[0-9a-f]{40}(?:[0-9a-f]{24})?\z/) &&
+              max_bytes.is_a?(Integer) && max_bytes.between?(1, 64 * 1024 * 1024)
+            raise AttemptErrors::EvidenceUnavailable, "Canonical prepared blob selector differs"
+          end
+          return @read_boundary.blob(path, commit: commit, max_bytes: max_bytes) if @read_boundary
+          environment = ENV.keys.to_h { |key| [key, nil] }
+          environment.merge!("GIT_CONFIG_NOSYSTEM" => "1", "GIT_CONFIG_GLOBAL" => "/dev/null",
+            "GIT_TERMINAL_PROMPT" => "0", "GIT_NO_REPLACE_OBJECTS" => "1", "PATH" => "/usr/bin:/bin", "LC_ALL" => "C")
+          result = Herdr::Molecules::BoundedProcess.call([environment, "/usr/bin/git", "-C", repo_root,
+            "-c", "core.hooksPath=/dev/null", "cat-file", "blob", "#{commit}:#{path}"],
+            stdin_data: "", timeout_s: 30, output_limit: max_bytes)
+          unless result.status.success? && !result.oversized
+            raise AttemptErrors::EvidenceUnavailable, "Canonical prepared blob is missing or oversized"
+          end
+          result.stdout.b
+        rescue Timeout::Error, Herdr::Molecules::BoundedProcess::PostLaunchError, SystemCallError, IOError
+          raise AttemptErrors::EvidenceUnavailable, "Canonical prepared blob read is unavailable"
+        end
+
         private
 
         def validate_mutation_id!(id)
@@ -146,7 +215,7 @@ module Ace
         end
 
         def validate_blob_path!(path)
-          unless path.is_a?(String) && path.match?(%r{\A(?:evidence/imports|execution/definitions|candidates/bundles)/[a-zA-Z0-9_.-]+\z}) &&
+          unless path.is_a?(String) && path.match?(%r{\A(?:evidence/imports|execution/definitions|execution/prepared|candidates/bundles)/[a-zA-Z0-9_.-]+\z}) &&
               !%w[. ..].include?(File.basename(path))
             raise ArgumentError, "invalid canonical blob reference"
           end

data/lib/ace/assign/molecules/journal_prompt_mutation.rb

@@ -0,0 +1,241 @@
+# frozen_string_literal: true
+require "ace/herdr/molecules/guarded_native_origin"
+
+module Ace
+  module Assign
+    module Molecules
+      # Durable N2 phases in the existing canonical journal, never an effect ledger.
+      module JournalPromptMutation
+        # Source-only phase: commit intent before the caller obtains any
+        # native dispatch permit. The scope owner reauthenticates inside this
+        # side-effect-free callback on EVERY journal CAS attempt.
+        def issue_prompt(binding:, issued_by:, &admission)
+          validate_prompt_binding!(binding)
+          unless issued_by.is_a?(Hash) && issued_by.keys.all? { |key| key.is_a?(String) } &&
+              issued_by.keys.sort == %w[gid groups host parent_pid pid started_at uid] &&
+              %w[uid gid groups].all? { |key| issued_by[key] == binding.fetch("caller").fetch(key) } &&
+              %w[pid parent_pid].all? { |key| issued_by[key].is_a?(Integer) && issued_by[key].positive? } &&
+              %w[host started_at].all? { |key| issued_by[key].is_a?(String) && issued_by[key].bytesize.between?(1, 255) }
+            raise ArgumentError, "invalid original prompt issuer evidence"
+          end
+          binding = JSON.parse(JSON.generate(binding))
+          issued_by = JSON.parse(JSON.generate(issued_by))
+          raise ArgumentError, "prompt admission callback is required" unless admission
+          digest = Digest::SHA256.hexdigest(JSON.generate(canonical_prompt_value(binding)))
+          internal_id = "prompt-issue.#{digest}"
+          response = mutate(assignment_id: binding.fetch("assignment_id"), attempt_id: binding.fetch("attempt_id"),
+            mutation_id: internal_id, operation: "prompt_issue", parameters_digest: digest,
+            expected_generation: binding.fetch("expected_generation"), with_replay: true, prompt_binding: binding) do |events, commit, generation|
+            admission.call(events, commit, generation)
+            {events: [{type: "prompt_issued", payload: {"external_mutation_id" => binding.fetch("mutation_id"),
+              "binding_digest" => digest, "binding" => binding, "issued_by" => issued_by}}],
+              data: {"mutation_id" => binding.fetch("mutation_id"), "binding_digest" => digest, "intent_mutation_id" => internal_id}}
+          end
+          response
+        end
+
+        # Fixed source-owned completion. Its selector authenticates the actual
+        # accepted issue on every CAS; the callback rejoins the original scope
+        # and guard without performing an effect. Replay keeps the FIRST public
+        # reply even if a later observation has a different outcome.
+        def finalize_prompt(mutation_id:, intent_event_id:, binding_digest:, evidence:, &authentication)
+          raise ArgumentError, "prompt completion authentication is required" unless authentication
+          intent = prompt_intent(mutation_id)
+          raise AttemptErrors::EvidenceUnavailable, "Prompt issue is unavailable" unless intent
+          binding = intent.fetch("payload").fetch("binding")
+          selector = {"intent_event_id" => intent_event_id, "binding_digest" => binding_digest}
+          mutate(assignment_id: binding.fetch("assignment_id"), attempt_id: binding.fetch("attempt_id"),
+            mutation_id: mutation_id, operation: "prompt_attempt", parameters_digest: binding_digest,
+            expected_generation: nil, generation_mode: :prompt_completion, prompt_completion: selector, with_replay: true) do |events, commit, generation|
+            if events.any? { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "scope_reservation_release" }
+              raise AttemptErrors::EvidenceUnavailable, "Released prompt scope cannot accept new outcome"
+            end
+            original = authentication.call(events, commit, generation)
+            unless original.is_a?(Hash) && original.keys.sort == %w[binding_digest origin] &&
+                original["binding_digest"] == binding.fetch("original_binding_digest")
+              raise AttemptErrors::EvidenceUnavailable, "Original prompt scope binding differs"
+            end
+            validate_prompt_evidence!(evidence, original.fetch("origin"))
+            {events: [{type: "prompt_outcome", payload: {"external_mutation_id" => mutation_id,
+              "intent_event_id" => intent_event_id, "binding_digest" => binding_digest, "evidence" => evidence}}],
+              data: {"mutation_id" => mutation_id, "attempt_id" => binding.fetch("attempt_id"),
+                "intent_event_id" => intent_event_id, "outcome" => evidence.fetch("outcome"), "guarded_evidence" => evidence}}
+          end
+        end
+
+        def verify_prompt_completion!(selector, mutation_id:, digest:, assignment_id:, attempt_id:, commit:)
+          unless selector.is_a?(Hash) && selector.keys.all? { |key| key.is_a?(String) } && selector.keys.sort == %w[binding_digest intent_event_id] &&
+              selector.values.all? { |value| value.is_a?(String) && value.match?(/\A[0-9a-f]{64}\z/) }
+            raise ArgumentError, "invalid fixed prompt completion selector"
+          end
+          intent = prompt_intent(mutation_id, commit: commit)
+          unless intent && intent["digest"] == selector.fetch("intent_event_id") &&
+              intent.dig("payload", "binding_digest") == digest && selector.fetch("binding_digest") == digest &&
+              intent.dig("payload", "binding", "assignment_id") == assignment_id && intent["attempt_id"] == attempt_id
+            raise AttemptErrors::EvidenceUnavailable, "Prompt completion does not join accepted issue"
+          end
+          true
+        end
+        private :verify_prompt_completion!
+
+        # Later authenticated native completion is a separate canonical fact.
+        # It never replaces the first immutable public prompt reply.
+        def observe_prompt_completion(mutation_id:, intent_event_id:, binding_digest:, evidence:, &authentication)
+          raise ArgumentError, "prompt observation authentication is required" unless authentication
+          intent = prompt_intent(mutation_id)
+          raise AttemptErrors::EvidenceUnavailable, "Prompt issue is unavailable" unless intent
+          binding = intent.fetch("payload").fetch("binding")
+          selector = {"external_mutation_id" => mutation_id, "intent_event_id" => intent_event_id, "binding_digest" => binding_digest}
+          digest = Digest::SHA256.hexdigest(JSON.generate(canonical_prompt_value(selector.merge("evidence" => evidence))))
+          mutate(assignment_id: binding.fetch("assignment_id"), attempt_id: binding.fetch("attempt_id"),
+            mutation_id: "prompt-observe.#{intent_event_id}", operation: "prompt_observation", parameters_digest: digest,
+            expected_generation: nil, generation_mode: :prompt_observation, prompt_observation: selector, with_replay: true) do |events, commit, generation|
+            if events.any? { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "scope_reservation_release" }
+              raise AttemptErrors::EvidenceUnavailable, "Released prompt scope cannot accept new observation"
+            end
+            original = authentication.call(events, commit, generation)
+            unless original.is_a?(Hash) && original.keys.sort == %w[binding_digest origin] && original["binding_digest"] == binding.fetch("original_binding_digest")
+              raise AttemptErrors::EvidenceUnavailable, "Original prompt scope binding differs"
+            end
+            validate_prompt_evidence!(evidence, original.fetch("origin"))
+            unless %w[submitted not_issued].include?(evidence.fetch("outcome"))
+              raise AttemptErrors::EvidenceUnavailable, "Unknown native outcome is not completed evidence"
+            end
+            {events: [{type: "prompt_completion_observed", payload: selector.merge("evidence" => evidence)}],
+              data: selector.merge("outcome" => evidence.fetch("outcome"), "guarded_evidence" => evidence)}
+          end
+        end
+
+        def verify_prompt_observation!(selector, mutation_id:, assignment_id:, attempt_id:, commit:)
+          unless selector.is_a?(Hash) && selector.keys.sort == %w[binding_digest external_mutation_id intent_event_id] &&
+              mutation_id == "prompt-observe.#{selector["intent_event_id"]}"
+            raise ArgumentError, "invalid fixed prompt observation selector"
+          end
+          verify_prompt_completion!(selector.slice("intent_event_id", "binding_digest"),
+            mutation_id: selector.fetch("external_mutation_id"), digest: selector.fetch("binding_digest"),
+            assignment_id: assignment_id, attempt_id: attempt_id, commit: commit)
+        end
+        private :verify_prompt_observation!
+
+        def validate_prompt_evidence!(evidence, original)
+          unless original.is_a?(Hash) && evidence.is_a?(Hash) && evidence.keys.all? { |key| key.is_a?(String) } && evidence["origin"] == original
+            raise AttemptErrors::EvidenceUnavailable, "Prompt outcome original guard differs"
+          end
+          Ace::Herdr::Molecules::GuardedNativeOrigin.verify!(original, terminal_id: original.fetch("terminal_id"), child: original.fetch("child"))
+          Ace::Herdr::Molecules::GuardedNativeOrigin.verify!(evidence.fetch("origin"), terminal_id: original.fetch("terminal_id"), child: original.fetch("child"))
+          case evidence["outcome"]
+          when "submitted"
+            valid = evidence.keys.sort == %w[origin outcome submission] && evidence["submission"] == "submitted"
+          when "not_issued"
+            valid = evidence.keys.sort == %w[code origin outcome phase] && evidence["phase"] == "not_issued" &&
+              %w[guard_mismatch origin_unavailable origin_exited agent_blocked agent_not_ready target_missing submission_busy].include?(evidence["code"])
+          when "uncertain"
+            valid = evidence.keys.sort == %w[origin outcome]
+          end
+          raise AttemptErrors::EvidenceUnavailable, "Prompt outcome is malformed" unless valid
+          true
+        rescue KeyError, TypeError, Ace::Runtime::RuntimeUnavailableError
+          raise AttemptErrors::EvidenceUnavailable, "Prompt outcome original guard is malformed"
+        end
+        private :validate_prompt_evidence!
+
+        # A read-only selected canonical chain lookup, never a dispatch permit.
+        def prompt_intent(mutation_id, commit: ref_value)
+          validate_mutation_id!(mutation_id)
+          found = nil
+          assignment_ids(commit: commit).each do |assignment_id|
+            events = read_events(assignment_id, commit: commit)
+            events.group_by { |event| event.fetch("attempt_id") }.each_value do |chain|
+              unless Models::EvidenceEvent.chain_valid?(chain)
+                raise AttemptErrors::EvidenceUnavailable, "Prompt intent event chain is corrupt"
+              end
+            end
+            events.each do |event|
+              next unless event["type"] == "prompt_issued" && event.dig("payload", "external_mutation_id") == mutation_id
+              raise AttemptErrors::EvidenceUnavailable, "Prompt intent is ambiguous" if found
+              payload = event.fetch("payload")
+              validate_prompt_binding!(payload.fetch("binding"))
+              digest = Digest::SHA256.hexdigest(JSON.generate(canonical_prompt_value(payload.fetch("binding"))))
+              binding = payload.fetch("binding")
+              acceptance = events.find { |entry| entry["type"] == "authority_mutation" &&
+                entry.dig("payload", "mutation_id") == "prompt-issue.#{digest}" &&
+                entry.dig("payload", "operation") == "prompt_issue" &&
+                entry.dig("payload", "parameters_digest") == digest && entry["previous_digest"] == event["digest"] }
+              unless acceptance && payload["binding_digest"] == digest && binding["mutation_id"] == mutation_id &&
+                  binding["assignment_id"] == assignment_id && binding["attempt_id"] == event["attempt_id"]
+                raise AttemptErrors::EvidenceUnavailable, "Prompt intent acceptance binding differs"
+              end
+              found = event
+            end
+          end
+          found
+        rescue KeyError, TypeError, ArgumentError
+          raise AttemptErrors::EvidenceUnavailable, "Prompt intent is malformed"
+        end
+
+        def validate_prompt_binding!(binding)
+          fields = %w[action assignment_id attempt_id caller expected_generation mapping_id mutation_id original_binding_digest project_id text_bytes text_sha256]
+          unless binding.is_a?(Hash) && binding.keys.all? { |key| key.is_a?(String) } && binding.keys.sort == fields &&
+              binding["action"] == "prompt_attempt" && binding["expected_generation"].is_a?(Integer) && binding["expected_generation"] >= 0 &&
+              binding["text_bytes"].is_a?(Integer) && binding["text_bytes"].between?(1, 16_384) &&
+              %w[text_sha256 original_binding_digest].all? { |key| binding[key].is_a?(String) && binding[key].match?(/\A[0-9a-f]{64}\z/) }
+            raise ArgumentError, "invalid fixed prompt binding"
+          end
+          %w[assignment_id attempt_id mapping_id mutation_id project_id].each { |key| validate_mutation_id!(binding.fetch(key)) }
+          if binding.fetch("mutation_id").start_with?("prompt-issue.", "prompt-observe.", "input-inhibit.")
+            raise ArgumentError, "public mutation ID uses reserved prompt namespace"
+          end
+          caller = binding.fetch("caller")
+          unless caller.is_a?(Hash) && caller.keys.all? { |key| key.is_a?(String) } && caller.keys.sort == %w[gid groups role uid] &&
+              %w[launcher supervisor].include?(caller["role"]) &&
+              %w[uid gid].all? { |key| caller[key].is_a?(Integer) && caller[key].between?(0, 0xffff_ffff) } &&
+              caller["groups"].is_a?(Array) && caller["groups"].size <= 256 &&
+              caller["groups"].all? { |group| group.is_a?(Integer) && group.between?(0, 0xffff_ffff) } &&
+              caller["groups"] == caller["groups"].sort.uniq
+            raise ArgumentError, "invalid authenticated stable prompt principal"
+          end
+          true
+        end
+        private :validate_prompt_binding!
+
+        def canonical_prompt_value(value)
+          case value
+          when Hash then value.keys.sort.to_h { |key| [key, canonical_prompt_value(value.fetch(key))] }
+          when Array then value.map { |item| canonical_prompt_value(item) }
+          else value
+          end
+        end
+        private :canonical_prompt_value
+
+        def verify_prompt_external_namespace!(external_id, digest, assignment_id:, attempt_id:, commit:)
+          intent = prompt_intent(external_id, commit: commit)
+          accepted = mutation_result(external_id, commit: commit)
+          if accepted || (intent && (intent.dig("payload", "binding_digest") != digest ||
+              intent.dig("payload", "binding", "assignment_id") != assignment_id || intent["attempt_id"] != attempt_id))
+            raise AttemptErrors::Conflict, "Mutation ID is already bound to different input"
+          end
+        end
+        private :verify_prompt_external_namespace!
+
+        def verify_prompt_mutation_namespace!(mutation_id:, operation:, parameters_digest:, assignment_id:, attempt_id:, prompt_completion:, prompt_observation: nil, commit:)
+          # Ordinary mutations cannot steal an external ID while its accepted
+          # prompt issue has no finalized public reply yet.
+          if mutation_id.start_with?("prompt-issue.")
+            raise ArgumentError, "reserved internal prompt namespace" unless operation == "prompt_issue"
+            return
+          end
+          if mutation_id.start_with?("prompt-observe.")
+            raise ArgumentError, "reserved internal prompt observation namespace" unless operation == "prompt_observation" && prompt_observation
+            return
+          end
+          return if operation == "prompt_attempt" && prompt_completion
+          if prompt_intent(mutation_id, commit: commit)
+            raise AttemptErrors::Conflict, "Mutation ID is reserved by accepted prompt intent"
+          end
+        end
+        private :verify_prompt_mutation_namespace!
+
+      end
+    end
+  end
+end