ace-assign 0.64.0 → 0.66.0

data/lib/ace/assign/authority/endcap.rb

@@ -6,6 +6,7 @@ require "securerandom"
 require_relative "candidate_transfer"
 require_relative "receipt_transfer"
 require_relative "service_evidence"
+require_relative "service_delivery_evidence"
 require_relative "../molecules/canonical_evidence"
 
 module Ace
@@ -14,43 +15,81 @@ module Ace
       # Business admission shares the launch origin, lifecycle exclusion and
       # journal CAS. Network transfer is completed outside those locks.
       class Endcap
-        OPERATIONS = %w[submit_candidate export_candidate assign_review accept_review request_service begin_dispatch complete_service service_authorization service_status submit_result evidence_fetch reconcile_inbox].freeze
+        OPERATIONS = %w[submit_candidate export_candidate request_review review_status assign_review cancel_review accept_review request_service begin_dispatch complete_service publication_challenge publication_continue claim_service_settlement complete_no_effect service_authorization service_status workspace_prune_preview_context submit_result evidence_fetch bind_inbox finish recover campaign_record_round campaign_export_result].freeze
         TRANSFER_OPERATIONS = {
-          "reconcile_inbox" => {direction: :upload, purpose: :inbox_proof, roles: %i[launcher supervisor]},
+          "campaign_export_result" => {direction: :download, purpose: :artifacts, roles: %i[worker launcher supervisor]},
+          "campaign_record_round" => {direction: :upload, purpose: :receipt_artifacts, roles: %i[launcher supervisor]},
           "submit_result" => {direction: :upload, purpose: :receipt_artifacts, roles: [:worker]},
-          "evidence_fetch" => {direction: :download, purpose: :artifacts, roles: %i[worker reviewer executor launcher supervisor]},
+          "evidence_fetch" => {direction: :download, purpose: :artifacts, roles: %i[worker reviewer executor launcher supervisor signer]},
           "submit_candidate" => {direction: :upload, purpose: :candidate, roles: %i[worker launcher]},
           "export_candidate" => {direction: :download, purpose: :candidate, roles: %i[reviewer executor]},
           "accept_review" => {direction: :upload, purpose: :receipt_artifacts, roles: [:reviewer]},
           "request_service" => {direction: :upload, purpose: :service_input, roles: [:executor]},
           "begin_dispatch" => {direction: :upload, purpose: :service_input, roles: [:executor]},
           "service_authorization" => {direction: :upload, purpose: :service_input, roles: [:executor]},
-          "complete_service" => {direction: :upload, purpose: :receipt_artifacts, roles: [:executor]}
+          "complete_service" => {direction: :upload, purpose: :receipt_artifacts, roles: [:executor]},
+          "publication_challenge" => {direction: :upload, purpose: :receipt_artifacts, roles: [:executor]},
+          "complete_no_effect" => {direction: :upload, purpose: :receipt_artifacts, roles: [:executor]}
         }.freeze
         PARAMETERS = {
-          "reconcile_inbox" => %w[mapping_id assignment_id attempt_id expected_generation event_id inbox_context_id expected_registration receipt_sha256 signature_sha256 transfer],
+          "campaign_export_result" => %w[mapping_id assignment_id attempt_id candidate_generation head],
+          "campaign_record_round" => %w[mapping_id assignment_id attempt_id candidate_generation head input_sha256 transfer],
           "submit_result" => %w[mapping_id assignment_id attempt_id expected_generation candidate_generation head receipt_sha256 transfer],
           "evidence_fetch" => %w[mapping_id assignment_id attempt_id kind purpose_id artifact_id],
           "submit_candidate" => %w[mapping_id assignment_id attempt_id expected_generation candidate_generation head transfer],
           "export_candidate" => %w[mapping_id assignment_id attempt_id candidate_generation head purpose_id],
+          "request_review" => %w[mapping_id assignment_id attempt_id expected_generation candidate_generation head],
           "assign_review" => %w[mapping_id assignment_id attempt_id expected_generation candidate_generation head reviewer_uid reviewer_process_binding],
+          "cancel_review" => %w[mapping_id assignment_id attempt_id head candidate_generation review_event_id expected_generation],
           "accept_review" => %w[mapping_id assignment_id attempt_id expected_generation candidate_generation head purpose_id receipt_sha256 transfer],
           "request_service" => %w[mapping_id assignment_id attempt_id expected_generation candidate_generation head request_id operation input_digest target authorization service_id worker_process_binding transfer],
           "begin_dispatch" => %w[mapping_id assignment_id attempt_id expected_generation candidate_generation head request_id claim_binding transfer],
+          "workspace_prune_preview_context" => %w[mapping_id assignment_id attempt_id service_id worker_process_binding],
           "service_status" => %w[mapping_id assignment_id attempt_id candidate_generation head request_id],
           "service_authorization" => %w[mapping_id assignment_id attempt_id candidate_generation head request_id claim_binding input_digest transfer],
-          "complete_service" => %w[mapping_id assignment_id attempt_id candidate_generation head request_id claim_binding receipt_sha256 transfer]
+          "complete_service" => %w[mapping_id assignment_id attempt_id candidate_generation head request_id claim_binding receipt_sha256 transfer],
+          "claim_service_settlement" => %w[mapping_id assignment_id attempt_id candidate_generation head request_id expected_generation],
+          "publication_challenge" => %w[mapping_id assignment_id attempt_id candidate_generation head request_id claim_binding input_digest expected_generation receipt_sha256 transfer],
+          "publication_continue" => %w[mapping_id assignment_id attempt_id candidate_generation head request_id claim_binding input_digest expected_generation challenge_digest],
+          "complete_no_effect" => %w[mapping_id assignment_id attempt_id candidate_generation head request_id claim_binding reconciliation_challenge receipt_sha256 transfer]
         }.freeze
 
-        def initialize(deployment:, launch:, kernel: Ace::Runtime::Molecules::ProtectedLinux.new, service_policy: nil)
+        def initialize(deployment:, launch:, kernel: Ace::Runtime::Molecules::ProtectedLinux.new, service_policy: nil, inbox_context_clients: nil, deployment_history: nil)
           @deployment, @launch, @kernel, @service_policy = deployment, launch, kernel, service_policy
+          @inbox_context_clients = inbox_context_clients
+          @deployment_history = deployment_history
           launch.attach_result_owner(self) if launch.respond_to?(:attach_result_owner)
         end
 
+        # Internal registration consumer only: caller holds the original parent
+        # lifecycle exclusion. Read one authenticated prefix; never accept a
+        # child's revisions as evidence of the parent's current candidate.
+        def campaign_parent_candidate!(journal:, commit:, params:, map:)
+          events = @launch.preview_attempt_events!(journal: journal, commit: commit, params: params, map: map)
+          original = active_origin(events, params)
+          current = candidate(events)
+          unless current && original.fetch("scope") == params.fetch("scope") &&
+              original.fetch("base_head") == params.fetch("base") &&
+              current.fetch("head") == params.fetch("head") &&
+              current.fetch("candidate_generation") == params.fetch("candidate_generation") && journal.ref_value == commit
+            raise AttemptErrors::Conflict, "campaign parent candidate changed"
+          end
+          projection = params.slice("assignment_id", "attempt_id").merge(
+            "scope" => original.fetch("scope"), "base" => original.fetch("base_head"),
+            "head" => current.fetch("head"), "candidate_generation" => current.fetch("candidate_generation"))
+          projection.transform_values { |value| value.is_a?(String) ? value.dup.freeze : value }.freeze
+        rescue KeyError, TypeError
+          raise AttemptErrors::EvidenceUnavailable, "campaign parent candidate is unavailable"
+        end
+
         def authorize_transfer!(request:, peer:, role:)
-          return authorize_inbox_transfer!(request: request, peer: peer, role: role) if request.fetch("operation") == "reconcile_inbox"
+          return dispatch_campaign_export(request: request, peer: peer, role: role, body: false) if request.fetch("operation") == "campaign_export_result"
+          return authorize_campaign_round!(request: request, peer: peer, role: role) if request.fetch("operation") == "campaign_record_round"
+          return dispatch_prepared_fetch(request: request, peer: peer, role: role, body: false) if prepared_fetch?(request)
           return authorize_result_transfer!(request: request, peer: peer, role: role) if %w[submit_result evidence_fetch].include?(request.fetch("operation"))
           params, map = validate_request(request)
+          return authorize_service_settlement!(request, params, map, peer, role) if request.fetch("operation") == "complete_no_effect"
+          return authorize_publication_transfer!(request, params, map, peer, role) if request.fetch("operation") == "publication_challenge"
           return authorize_service_transfer!(request, params, map, peer, role) if %w[request_service begin_dispatch complete_service service_authorization].include?(request.fetch("operation"))
           @launch.with_assignment(params: params, map: map) do |journal, _registration|
             protected_journal!(journal)
@@ -58,7 +97,7 @@ module Ace
             origin = active_origin(events, params)
             if request.fetch("operation") == "submit_candidate"
               worker_or_launcher!(peer, role, map, origin)
-              candidate_generation!(candidate(events), params)
+              candidate_generation!(candidate(events), params) unless candidate_submission_replay!(journal, events, request, params)
             else
               export_admission!(journal, events, params, map, origin, peer, role)
             end
@@ -67,9 +106,23 @@ module Ace
         end
 
         def dispatch(request:, peer:, role:, transfer: nil)
-          return dispatch_inbox(request: request, peer: peer, role: role, transfer: transfer) if request.fetch("operation") == "reconcile_inbox"
+          return dispatch_campaign_export(request: request, peer: peer, role: role) if request.fetch("operation") == "campaign_export_result"
+          return dispatch_campaign_round(request: request, peer: peer, role: role, transfer: transfer) if request.fetch("operation") == "campaign_record_round"
+          if prepared_fetch?(request)
+            raise ArgumentError, "prepared fetch forbids upload" unless transfer.nil?
+            return dispatch_prepared_fetch(request: request, peer: peer, role: role)
+          end
+          return dispatch_bind_inbox(request: request, peer: peer, role: role, transfer: transfer) if request.fetch("operation") == "bind_inbox"
+          return dispatch_finish(request: request, peer: peer, role: role, transfer: transfer) if request.fetch("operation") == "finish"
+          return dispatch_recover(request: request, peer: peer, role: role, transfer: transfer) if request.fetch("operation") == "recover"
           return dispatch_result(request: request, peer: peer, role: role, transfer: transfer) if %w[submit_result evidence_fetch].include?(request.fetch("operation"))
+          return review_status(request, peer, role, transfer) if request.fetch("operation") == "review_status"
           params, map = validate_request(request)
+          return request_review(request, params, map, peer, role, transfer) if request.fetch("operation") == "request_review"
+          return cancel_review(request, params, map, peer, role, transfer) if request.fetch("operation") == "cancel_review"
+          return dispatch_publication(request, params, map, peer, role, transfer) if %w[publication_challenge publication_continue].include?(request.fetch("operation"))
+          return dispatch_service_settlement(request, params, map, peer, role, transfer) if %w[claim_service_settlement complete_no_effect].include?(request.fetch("operation"))
+          return workspace_prune_preview_context(request, params, map, peer, role, transfer) if request.fetch("operation") == "workspace_prune_preview_context"
           return service_status(request, params, map, peer, role) if request.fetch("operation") == "service_status"
           return dispatch_service(request, params, map, peer, role, transfer) if %w[request_service begin_dispatch complete_service service_authorization].include?(request.fetch("operation"))
           admitted = nil
@@ -107,7 +160,9 @@ module Ace
               worker_or_launcher!(peer, role, map, origin,
                 launcher_only: request.fetch("operation") == "assign_review")
             end
-            journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
+            delegated_review_request!(journal, events, request, params, peer, role) if request.fetch("operation") == "assign_review"
+            candidate_submission_replay!(journal, events, request, params, admitted: admitted) if request.fetch("operation") == "submit_candidate"
+            result = journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
               mutation_id: request.fetch("mutation_id"), operation: request.fetch("operation"),
               parameters_digest: Atoms::EvidenceDigest.digest(params), expected_generation: params.fetch("expected_generation"),
               with_replay: true) do |events, _commit, _generation|
@@ -125,6 +180,15 @@ module Ace
               when "assign_review"
                 worker_or_launcher!(peer, role, map, origin, launcher_only: true)
                 current = exact_candidate!(candidate(events), params)
+                delegated = delegated_review_request!(journal, events, request, params, peer, role)
+                reservation = active_review_reservation(events, current)
+                if delegated
+                  unless reservation && reservation.fetch("digest") == delegated.fetch("digest") && !active_review_event(events, current)
+                    raise AttemptErrors::Conflict, "delegated review reservation is no longer assignable"
+                  end
+                elsif reservation
+                  raise AttemptErrors::Conflict, "candidate review reservation is active"
+                end
                 reviewer = params.fetch("reviewer_process_binding")
                 uid = params.fetch("reviewer_uid")
                 project = @deployment.project(map.fetch("project_id"))
@@ -142,6 +206,11 @@ module Ace
                 accept_review_plan(journal, events, params, map, current, review, admitted)
               end
             end
+            if request.fetch("operation") == "assign_review"
+              review_event_reply(journal, result, request, params, "assignment_event_id")
+            else
+              result
+            end
           end
         end
 
@@ -162,11 +231,11 @@ module Ace
           %w[mapping_id assignment_id attempt_id].each do |key|
             raise ArgumentError, "invalid Endcap identifier" unless params[key].is_a?(String) && params[key].match?(Molecules::JournalMutation::ID)
           end
-          unless params["head"].is_a?(String) && params["head"].match?(CandidateTransfer::SHA) &&
-              params["candidate_generation"].is_a?(Integer) && params["candidate_generation"] >= 0
+          unless operation == "workspace_prune_preview_context" || (params["head"].is_a?(String) && params["head"].match?(CandidateTransfer::SHA) &&
+              params["candidate_generation"].is_a?(Integer) && params["candidate_generation"] >= 0)
             raise ArgumentError, "invalid candidate binding"
           end
-          if %w[service_authorization service_status].include?(operation) && !request.fetch("mutation_id").nil?
+          if %w[service_authorization service_status workspace_prune_preview_context].include?(operation) && !request.fetch("mutation_id").nil?
             raise ArgumentError, "authorization read must not supply a mutation ID"
           end
           map = @deployment.mapping(params.fetch("mapping_id"))
@@ -209,6 +278,34 @@ module Ace
           event&.dig("payload", "data")
         end
 
+        # Header replay admission still requires the live original caller above.
+        # TransferCodec and CandidateTransfer verify the exact body before dispatch;
+        # the descriptor is part of the original immutable parameter digest.
+        def candidate_submission_replay!(journal, events, request, params, admitted: nil)
+          replay = journal.mutation_result(request.fetch("mutation_id"))
+          return false unless replay
+          unless replay["operation"] == "submit_candidate" && replay["assignment_id"] == params.fetch("assignment_id") &&
+              replay["attempt_id"] == params.fetch("attempt_id") && replay["parameters_digest"] == Atoms::EvidenceDigest.digest(params)
+            raise AttemptErrors::Conflict, "candidate replay input differs"
+          end
+          data = replay.fetch("data")
+          retained = retained_candidate(events, data.fetch("candidate_generation"))
+          unless retained == data && data.fetch("candidate_generation") == params.fetch("candidate_generation") + 1 &&
+              data.fetch("head") == params.fetch("head")
+            raise AttemptErrors::EvidenceUnavailable, "candidate replay provenance differs"
+          end
+          bytes = journal.bounded_blob(data.fetch("bundle_ref"), commit: replay.fetch("journal_commit"), max_bytes: 64 * 1024 * 1024)
+          unless bytes.bytesize == data.fetch("bytes") && Digest::SHA256.hexdigest(bytes) == data.fetch("sha256")
+            raise AttemptErrors::EvidenceUnavailable, "candidate replay bundle differs"
+          end
+          if admitted && admitted.values_at("head", "tree", "sha256", "bytes") != data.values_at("head", "tree", "sha256", "bytes")
+            raise AttemptErrors::EvidenceUnavailable, "candidate replay normalized bundle differs"
+          end
+          true
+        rescue KeyError, TypeError
+          raise AttemptErrors::EvidenceUnavailable, "candidate replay evidence is malformed"
+        end
+
         def candidate_generation!(current, params)
           unless (current && current.fetch("candidate_generation") || 0) == params.fetch("candidate_generation")
             raise AttemptErrors::Conflict, "candidate generation changed"
@@ -225,7 +322,7 @@ module Ace
           current = exact_candidate!(candidate(events), params)
           @kernel.live!(peer)
           if role == :reviewer
-            assignment = assigned_review(events)
+            assignment = active_review_event(events, current)&.dig("payload", "data")
             unless assignment && assignment["review_id"] == params["purpose_id"] && assignment["head"] == current["head"] &&
                 assignment["candidate_generation"] == current["candidate_generation"] && assignment["reviewer_uid"] == peer["uid"] &&
                 @kernel.descendant?(peer, assignment.fetch("reviewer_process_binding"))
@@ -251,10 +348,10 @@ module Ace
         # A retained approval grants permission only while its original imported
         # bytes, independent reviewer and exact candidate still verify. An old
         # successful mutation reply is not a substitute for canonical evidence.
-        def approved_review!(journal, events, params, map, current)
+        def approved_review!(journal, events, params, map, current, commit: journal.ref_value, service_operation: nil)
           accepted = events.reverse.find { |event| event["type"] == "authority_mutation" &&
             event.dig("payload", "operation") == "accept_review" }&.dig("payload", "data")
-          review = assigned_review(events)
+          review = active_review_event(events, current)&.dig("payload", "data")
           unless accepted && review && accepted["head"] == current["head"] &&
               accepted["candidate_generation"] == current["candidate_generation"] &&
               accepted["review_id"] == review["review_id"] && accepted["reviewer_uid"] == review["reviewer_uid"] &&
@@ -267,7 +364,6 @@ module Ace
             binding: accepted.fetch("review_binding"), request_id_or_event_id: review.fetch("review_id"),
             generation: current.fetch("candidate_generation")}
           canonical = Molecules::CanonicalEvidence.new(journal: journal)
-          commit = journal.ref_value
           reader = ->(_data, artifact) { canonical.read({"ref" => artifact.fetch("path"), "sha256" => artifact.fetch("sha256")},
             **context, commit: commit) }
           intent = events.find { |event| event["type"] == "intent" }
@@ -280,6 +376,9 @@ module Ace
               receipt.to_h.dig("review", "reviewer", "actor") == review.fetch("reviewer_actor")
             raise AttemptErrors::ReceiptRejected, "canonical review receipt differs"
           end
+          if %w[ready merge].include?(service_operation)
+            campaign_service_checks!(journal: journal, commit: commit, events: events, params: params, map: map, current: current)
+          end
           accepted
         rescue KeyError
           raise AttemptErrors::ReceiptRejected, "canonical review binding is incomplete"
@@ -336,7 +435,21 @@ module Ace
 end
 
 require_relative "endcap_services"
+require_relative "endcap_service_settlement"
 
+require_relative "endcap_campaign_results"
+require_relative "endcap_campaign_rounds"
 require_relative "endcap_results"
 
 require_relative "endcap_inboxes"
+
+require_relative "endcap_contexts"
+require_relative "endcap_prepared_work"
+
+require_relative "endcap_reviews"
+
+require_relative "endcap_review_requests"
+
+require_relative "endcap_attempts"
+
+require_relative "endcap_publication"

data/lib/ace/assign/authority/endcap_attempts.rb

@@ -0,0 +1,274 @@
+# frozen_string_literal: true
+
+module Ace
+  module Assign
+    module Authority
+      class Endcap
+        BIND_INBOX_PARAMETERS = %w[mapping_id assignment_id attempt_id expected_generation event_id inbox_context_id].freeze
+        FINISH_PARAMETERS = %w[mapping_id assignment_id attempt_id expected_generation candidate_generation head result_id].freeze
+        RECOVERY_PARAMETERS = %w[mapping_id assignment_id attempt_id expected_generation].freeze
+
+        # Called only by the canonical terminal owner at its authenticated
+        # introduction prefix, using the original deployment mapping.
+        def finished_review_evidence!(journal:, events:, params:, map:, commit:)
+          current = exact_candidate!(retained_candidate(events, params.fetch("candidate_generation")), params)
+          accepted = approved_review!(journal, events, params, map, current, commit: commit)
+          result = verified_result(journal, events, params, map, retained_origin(events, params), current, commit)
+          raise AttemptErrors::EvidenceUnavailable, "finished canonical result is missing" unless result
+          campaign_finished_result!(journal: journal, commit: commit, events: events, params: params, map: map,
+            result: result, accepted: accepted)
+          @launch.campaign_children_settled!(journal: journal, commit: commit, params: params, map: map)
+          accepted
+        end
+
+        private
+
+        def dispatch_recover(request:, peer:, role:, transfer: nil)
+          raise ArgumentError, "Recovery forbids transfer" unless transfer.nil?
+          params, map = attempt_consumer_request!(request, RECOVERY_PARAMETERS)
+          selected_commit = nil
+          journal = @launch.journals.fetch(map.fetch("project_id"))
+          readonly = @launch.with_assignment(params: params, map: map) do |selected, _|
+            protected_journal!(selected)
+            selected_commit = selected.ref_value
+            events = @launch.preview_attempt_events!(journal: selected, commit: selected_commit, params: params, map: map)
+            finish_identity!(events, params, map, peer, role)
+            accepted = selected.mutation_result(request.fetch("mutation_id"), commit: selected_commit)
+            if accepted
+              verify_recovery_reply!(selected, accepted, request, params, map)
+              next({data: accepted.fetch("data").merge("journal_commit" => accepted.fetch("journal_commit")), replayed: true})
+            end
+            state = Molecules::CanonicalAttemptState.derive(events)
+            next unless %w[succeeded failed stopped].include?(state)
+            terminal = @launch.completion_terminal!(journal: selected, commit: selected_commit, params: params, map: map)
+            {data: {"attempt_id" => params.fetch("attempt_id"), "state" => terminal.fetch("canonical_state"),
+              "decision" => "restart-required", "reason" => "terminal_attempt", "generation" => terminal.fetch("generation"),
+              "journal_commit" => selected_commit}, replayed: false}
+          end
+          return readonly if readonly
+          recover_under_exclusion!(request, params, map, peer, role, selected_commit)
+        end
+
+        def recover_under_exclusion!(request, params, map, peer, role, selected_commit)
+          @launch.with_assignment(params: params, map: map, exclusive: true) do |journal, _|
+            unless journal.ref_value == selected_commit
+              raise AttemptErrors::Conflict, "Recovery canonical selection advanced"
+            end
+            events = @launch.preview_attempt_events!(journal: journal, commit: selected_commit, params: params, map: map)
+            finish_identity!(events, params, map, peer, role)
+            journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
+              mutation_id: request.fetch("mutation_id"), operation: "recover", parameters_digest: Atoms::EvidenceDigest.digest(params),
+              expected_generation: params.fetch("expected_generation"), with_replay: true) do |fresh, prefix, _generation|
+              unless prefix == selected_commit
+                raise AttemptErrors::Conflict, "Recovery canonical selection advanced"
+              end
+              origin = finish_identity!(fresh, params, map, peer, role)
+              state = Molecules::CanonicalAttemptState.derive(fresh)
+              effects_pending = recovery_pending_settlement do
+                service_settlement_evidence!(journal: journal, events: fresh, params: params, map: map, commit: prefix)
+              end
+              bound = %w[bound issued].include?(origin["phase"])
+              observation = if !effects_pending && state == "running" && bound
+                @launch.recovery_observation!(journal: journal, events: fresh, params: params, map: map, commit: prefix)
+              else
+                {"liveness" => "unknown"}
+              end
+              decision, reason = Organisms::AttemptCoordinator.protected_recovery_decision(state: state,
+                effects_pending: effects_pending, bound: bound,
+                live: observation["liveness"] == "live", checkpoint: true)
+              plan = Organisms::AttemptCoordinator.protected_recovery_plan(events: fresh, decision: decision, reason: reason, observation: observation)
+              plan.except(:state).merge(data: {"attempt_id" => params.fetch("attempt_id"), "state" => plan.fetch(:state),
+                "decision" => decision, "reason" => reason})
+            end
+          end
+        end
+
+        def recovery_pending_settlement
+          yield
+          false
+        rescue AttemptErrors::ServiceSettlementPending
+          true
+        end
+
+        def verify_recovery_reply!(journal, accepted, request, params, map)
+          unless accepted["operation"] == "recover" && accepted["parameters_digest"] == Atoms::EvidenceDigest.digest(params) &&
+              accepted.values_at("assignment_id", "attempt_id") == params.values_at("assignment_id", "attempt_id")
+            raise AttemptErrors::Conflict, "Recovery mutation is already bound to different input"
+          end
+          prefix = accepted.fetch("journal_commit")
+          events = @launch.preview_attempt_events!(journal: journal, commit: prefix, params: params, map: map)
+          index = events.index { |event| event.dig("payload", "mutation_id") == request.fetch("mutation_id") && event.dig("payload", "operation") == "recover" }
+          raise AttemptErrors::EvidenceUnavailable, "Recovery acceptance is missing" unless index && index.positive?
+          before = events.take(index)
+          transition = before.last["type"] == "transition" && before.last.dig("payload", "to") == "uncertain" ? before.pop : nil
+          observation = before.last
+          data = accepted.fetch("data")
+          reasons = %w[live_owner unresolved_effect unresolved_inbox launch_unbound scope_unverifiable attempt_uncertain checkpoint_unavailable]
+          unless data.is_a?(Hash) && data.keys.sort == %w[attempt_id state decision reason generation].sort &&
+              data["attempt_id"] == params.fetch("attempt_id") && data["generation"].is_a?(Integer) &&
+              data["generation"] == journal.authority_generation(events) && reasons.include?(data["reason"]) &&
+              ((data["decision"] == "adopt" && data["reason"] == "live_owner" && data["state"] == "running") ||
+                (data["decision"] == "reconcile-required" && data["reason"] != "live_owner")) &&
+              events[index]["type"] == "authority_mutation" && index == events.length - 1
+            raise AttemptErrors::EvidenceUnavailable, "Recovery reply schema or accepted prefix differs"
+          end
+          unless observation && observation["type"] == "recovery_observation" && observation.dig("payload", "decision") == data["decision"] &&
+              observation.dig("payload", "recovery_reason") == data["reason"] && observation.dig("payload", "observation").is_a?(Hash) &&
+              (!transition || transition.fetch("payload") == {"from" => "running", "to" => "uncertain", "reason" => data.fetch("reason")}) &&
+              Molecules::CanonicalAttemptState.derive(events) == data.fetch("state")
+            raise AttemptErrors::EvidenceUnavailable, "Recovery observation acceptance differs"
+          end
+          binding = retained_origin(events, params).fetch("process_binding", nil)
+          observed = observation.dig("payload", "observation")
+          if observed["liveness"] == "live" && (!binding || observed["runtime_binding"] != binding || observed["identity"] != binding.fetch("process_identity"))
+            raise AttemptErrors::EvidenceUnavailable, "Recovery original live binding differs"
+          end
+          true
+        end
+
+        def dispatch_finish(request:, peer:, role:, transfer: nil)
+          raise ArgumentError, "Result finish forbids transfer" unless transfer.nil?
+          params, map = attempt_consumer_request!(request, FINISH_PARAMETERS)
+          unless params["candidate_generation"].is_a?(Integer) && params["candidate_generation"].positive? &&
+              params["head"].is_a?(String) && params["head"].match?(CandidateTransfer::SHA) &&
+              params["result_id"].is_a?(String) && params["result_id"].match?(/\A[0-9a-f]{32}\z/)
+            raise ArgumentError, "Result finish selectors differ"
+          end
+          journal = @launch.journals.fetch(map.fetch("project_id"))
+          replay = @launch.with_assignment(params: params, map: map) do |selected, _|
+            commit = selected.ref_value
+            accepted = selected.mutation_result(request.fetch("mutation_id"), commit: commit)
+            next unless accepted
+            unless accepted["operation"] == "finish" && accepted["parameters_digest"] == Atoms::EvidenceDigest.digest(params) &&
+                accepted.values_at("assignment_id", "attempt_id") == params.values_at("assignment_id", "attempt_id")
+              raise AttemptErrors::Conflict, "Finish mutation is already bound to different input"
+            end
+            events = @launch.preview_attempt_events!(journal: selected, commit: commit, params: params, map: map)
+            finish_identity!(events, params, map, peer, role)
+            @launch.completion_terminal!(journal: selected, commit: commit, params: params, map: map)
+            {data: accepted.fetch("data").merge("journal_commit" => accepted.fetch("journal_commit")), replayed: true}
+          end
+          return replay if replay
+            @launch.with_assignment(params: params, map: map, exclusive: true) do |selected, _|
+              protected_journal!(selected)
+              commit = selected.ref_value
+              events = @launch.preview_attempt_events!(journal: selected, commit: commit, params: params, map: map)
+              finish_identity!(events, params, map, peer, role)
+              replay = selected.mutation_result(request.fetch("mutation_id"), commit: commit)
+              if replay && replay["operation"] == "finish"
+                @launch.completion_terminal!(journal: selected, commit: commit, params: params, map: map)
+              end
+              with_campaign_finish!(journal: selected, commit: commit, events: events, params: params, map: map) do
+                selected.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
+                mutation_id: request.fetch("mutation_id"), operation: "finish", parameters_digest: Atoms::EvidenceDigest.digest(params),
+                expected_generation: params.fetch("expected_generation"), with_replay: true) do |fresh, prefix, _generation|
+                origin = finish_identity!(fresh, params, map, peer, role)
+                unless Molecules::CanonicalAttemptState.derive(fresh) == "running" && %w[bound issued].include?(origin["phase"])
+                  raise AttemptErrors::Conflict, "Result finish requires an active bound attempt"
+                end
+                current = exact_candidate!(candidate(fresh), params)
+                result = verified_result(selected, fresh, params, map, origin, current, prefix, result_id: params.fetch("result_id"))
+                unless result && result.fetch("result_id") == params.fetch("result_id")
+                  raise AttemptErrors::EvidenceUnavailable, "Result finish requires its exact submitted receipt"
+                end
+                if result.dig("receipt", "verdict") == "succeeded"
+                  accepted = approved_review!(selected, fresh, params, map, current, commit: prefix)
+                  campaign_finished_result!(journal: selected, commit: prefix, events: fresh, params: params, map: map,
+                    result: result, accepted: accepted)
+                end
+                @launch.campaign_children_settled!(journal: selected, commit: prefix, params: params, map: map)
+                @launch.completion_scope!(journal: selected, events: fresh, params: params, map: map, commit: prefix)
+                service_settlement_evidence!(journal: selected, events: fresh, params: params, map: map, commit: prefix)
+                plan = Organisms::AttemptCoordinator.finished_transition_plan(events: fresh, receipt: result.fetch("receipt"))
+                plan.merge(data: params.slice("attempt_id", "result_id", "head", "candidate_generation").merge(
+                  "receipt_digest" => result.fetch("receipt_digest"), "state" => result.dig("receipt", "verdict")))
+                end
+              end
+            end
+        end
+
+        def finish_identity!(events, params, map, peer, role)
+          unless %i[launcher supervisor].include?(role)
+            raise AttemptErrors::UnauthorizedIdentity, "Result finish requires mapped completion owner"
+          end
+          origin = retained_origin(events, params)
+          purpose_peer!(events, params, map, origin, peer, role, kind: "result")
+          origin
+        end
+
+        def attempt_consumer_request!(request, fields)
+          params = request.fetch("params")
+          unless params.is_a?(Hash) && params.keys.sort == fields.sort
+            raise ArgumentError, "attempt consumer parameters differ"
+          end
+          %w[mapping_id assignment_id attempt_id].each { |key| result_id!(params.fetch(key)) }
+          result_id!(request.fetch("mutation_id"))
+          unless params["expected_generation"].is_a?(Integer) && params["expected_generation"] >= 0
+            raise ArgumentError, "attempt consumer generation differs"
+          end
+          map = @deployment.mapping(params.fetch("mapping_id"))
+          unless map.fetch("project_id") == request.fetch("project_id")
+            raise AttemptErrors::UnauthorizedIdentity, "attempt consumer project differs"
+          end
+          [params, map]
+        end
+
+        # Original registration comes from the admitted fixed Inbox owner, not
+        # from peer fields or a current filesystem receipt. Bind and seal share
+        # the same canonical slot/task/assignment exclusion and CAS.
+        def dispatch_bind_inbox(request:, peer:, role:, transfer: nil)
+          raise ArgumentError, "Inbox binding forbids transfer" unless transfer.nil?
+          params, map = attempt_consumer_request!(request, BIND_INBOX_PARAMETERS)
+          %w[event_id inbox_context_id].each { |key| result_id!(params.fetch(key)) }
+          with_inbox_context(params, map, mutation_id: request.fetch("mutation_id")) do |session|
+            @launch.with_assignment(params: params, map: map, exclusive: true) do |journal, _|
+              protected_journal!(journal)
+              commit = journal.ref_value
+              events = @launch.preview_attempt_events!(journal: journal, commit: commit, params: params, map: map)
+              binding = bind_inbox_selection!(events, params, map, peer, role, session)
+              replay = journal.mutation_result(request.fetch("mutation_id"), commit: commit)
+              verify_inbox_binding_reply!(events, replay, binding) if replay && replay["operation"] == "bind_inbox"
+              journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
+                mutation_id: request.fetch("mutation_id"), operation: "bind_inbox", parameters_digest: Atoms::EvidenceDigest.digest(params),
+                expected_generation: params.fetch("expected_generation"), with_replay: true) do |fresh, _prefix, _generation|
+                @launch.scope_open_for_effect!(events: fresh, params: params, map: map)
+                selected = bind_inbox_selection!(fresh, params, map, peer, role, session)
+                existing = fresh.select { |event| event["type"] == "inbox_binding" && event.dig("payload", "event_id") == params.fetch("event_id") }
+                unless existing.empty? || (existing.one? && existing.first.fetch("payload") == selected)
+                  raise AttemptErrors::Conflict, "Inbox registration is already bound differently"
+                end
+                {events: existing.empty? ? [{type: "inbox_binding", payload: selected}] : [], blobs: {}, data: selected}
+              end
+            end
+          end
+        end
+
+        def bind_inbox_selection!(events, params, map, peer, role, session)
+          unless Molecules::CanonicalAttemptState.derive(events) == "running"
+            raise AttemptErrors::EvidenceUnavailable, "Inbox binding requires an active original worker"
+          end
+          submitting_worker!(events, params, map, peer, role)
+          context = @deployment.inbox_context(params.fetch("mapping_id"), params.fetch("inbox_context_id"))
+          lineage = Molecules::ExecutionScopeLineage.new(events: events, project_id: map.fetch("project_id"),
+            assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"), mapping_id: context.fetch("native_mapping_id"))
+          original = params.slice("assignment_id", "mapping_id", "inbox_context_id").merge("project_id" => map.fetch("project_id"))
+          record = session.request("status_context", {"event_id" => params.fetch("event_id"),
+            "attempt_id" => params.fetch("attempt_id"), "original" => original}).fetch("record")
+          registration = record.slice(*INBOX_REGISTRATION_FIELDS)
+          unless inbox_registration?(registration) && registration.values_at("event_id", "attempt_id") == params.values_at("event_id", "attempt_id")
+            raise AttemptErrors::EvidenceUnavailable, "Inbox original registration differs"
+          end
+          inbox_native_lineage!(record, lineage)
+          params.slice("event_id", "attempt_id", "inbox_context_id").merge("registration" => registration)
+        end
+
+        def verify_inbox_binding_reply!(events, reply, selected)
+          bindings = events.select { |event| event["type"] == "inbox_binding" && event.fetch("payload") == selected }
+          unless bindings.one? && reply.fetch("data").except("generation") == selected
+            raise AttemptErrors::EvidenceUnavailable, "Inbox binding replay provenance differs"
+          end
+        end
+      end
+    end
+  end
+end