ace-assign 0.64.0 → 0.66.0

data/lib/ace/assign/authority/endcap_inboxes.rb

@@ -1,127 +1,20 @@
 # frozen_string_literal: true
 
-require "ace/herdr/organisms/protected_inbox"
-require_relative "../molecules/execution_scope_lineage"
-
 module Ace
   module Assign
     module Authority
       class Endcap
-        INBOX_REGISTRATION_FIELDS = %w[event_id attempt_id payload_sha256 receipt_key_sha256].freeze
-        INBOX_PAYLOAD_FIELDS = %w[version event_id attempt_id inbox_context_id registration state
-          claim_generation binding receipt_ref signature_ref].freeze
-        INBOX_BINDING_FIELDS = %w[project_id assignment_id attempt_id mapping_id inbox_context_id event_id
-          registration claim_generation native_binding scope_binding_event_id native_binding_event_id
-          scope_native_binding receipt_key_sha256 receipt_sha256 signature_sha256 submitter_uid submitter_role].freeze
-        INBOX_REF_FIELDS = %w[artifact_id ref sha256 bytes].freeze
-
-        # Shared source-owned predicate for existing scope abort/reuse/finish.
-        # The caller holds lifecycle exclusion; this is never a wire operation.
-        def inbox_settlement_complete!(journal:, events:, params:, map:, commit:)
-          protected_journal!(journal)
-          retained = journal.read_events(params.fetch("assignment_id"), commit: commit)
-            .select { |event| event["attempt_id"] == params.fetch("attempt_id") }
-          unless retained == events && Models::EvidenceEvent.chain_valid?(events)
-            raise AttemptErrors::EvidenceUnavailable, "inbox settlement requires exact canonical commit"
-          end
-          registrations = events.select { |event| event["type"] == "inbox_binding" }
-          project = @deployment.project(map.fetch("project_id"))
-          project.fetch("inbox_contexts", {}).each_key do |id|
-            context = @deployment.inbox_context(params.fetch("mapping_id"), id)
-            next unless context.fetch("native_mapping_id") == params.fetch("mapping_id")
-            @deployment.verify_inbox_context!(params.fetch("mapping_id"), id)
-            actual = Ace::Herdr::Organisms::Inbox.retained_events(deliveries_dir: context.fetch("deliveries_dir"), attempt: params.fetch("attempt_id"))
-            registered = registrations.filter_map { |event| event.dig("payload", "event_id") if event.dig("payload", "inbox_context_id") == id }
-            unless actual.sort == registered.sort
-              raise AttemptErrors::EvidenceUnavailable, "registered or unattributable inbox retention differs"
-            end
-          end
-          registrations.each do |event|
-            selected = params.merge("event_id" => event.dig("payload", "event_id"), "inbox_context_id" => event.dig("payload", "inbox_context_id"))
-            box, registration, lineage = inbox_environment(events, selected, map)
-            proof = verified_inbox_record(journal, events, selected, map, commit, box: box, registration: registration, lineage: lineage)
-            unless proof && proof["state"] == "completed"
-              raise AttemptErrors::EvidenceUnavailable, "current inbox settlement is incomplete"
-            end
-          end
-          true
-        rescue KeyError, TypeError, ArgumentError, Ace::Herdr::Error, Ace::Runtime::RuntimeUnavailableError
-          raise AttemptErrors::EvidenceUnavailable, "canonical inbox settlement is unverifiable"
-        end
+        INBOX_REGISTRATION_FIELDS = %w[event_id attempt_id payload_sha256].freeze
 
         private
 
-        def inbox_request(request)
-          params = request.fetch("params")
-          unless params.is_a?(Hash) && params.keys.sort == PARAMETERS.fetch("reconcile_inbox").sort
-            raise ArgumentError, "invalid inbox parameters"
-          end
-          %w[mapping_id assignment_id attempt_id event_id inbox_context_id].each { |key| result_id!(params[key]) }
-          result_id!(request.fetch("mutation_id"))
-          registration = params.fetch("expected_registration")
-          unless inbox_registration?(registration) && registration.values_at("event_id", "attempt_id") ==
-              params.values_at("event_id", "attempt_id") &&
-              params["expected_generation"].is_a?(Integer) && params["expected_generation"] >= 0 &&
-              %w[receipt_sha256 signature_sha256].all? { |key| params[key].is_a?(String) && DIGEST.match?(params[key]) }
-            raise ArgumentError, "invalid inbox registration or digest"
-          end
-          map = @deployment.mapping(params.fetch("mapping_id"))
-          raise AttemptErrors::UnauthorizedIdentity, "project mapping differs" unless map.fetch("project_id") == request.fetch("project_id")
-          [params, map]
-        end
-
         def inbox_registration?(value)
           value.is_a?(Hash) && value.keys.sort == INBOX_REGISTRATION_FIELDS.sort &&
             %w[event_id attempt_id].all? { |key| value[key].is_a?(String) && Molecules::JournalMutation::ID.match?(value[key]) } &&
-            %w[payload_sha256 receipt_key_sha256].all? { |key| value[key].is_a?(String) && DIGEST.match?(value[key]) }
+            %w[payload_sha256].all? { |key| value[key].is_a?(String) && DIGEST.match?(value[key]) }
         end
 
-        def inbox_selection(events, params, map, peer, role)
-          origin = retained_origin(events, params)
-          context = @deployment.inbox_context(params.fetch("mapping_id"), params.fetch("inbox_context_id"))
-          @kernel.live!(peer)
-          service_policy!.visible!(project: map.fetch("project_id"), uid: peer.fetch("uid"))
-          allowed = (role == :supervisor && context.fetch("supervisor_uids").include?(peer["uid"])) ||
-            (role == :launcher && peer["uid"] == map.fetch("launcher_uid") && @kernel.same?(peer, origin.fetch("launcher_identity")))
-          raise AttemptErrors::UnauthorizedIdentity, "inbox requires exact launcher or mapped supervisor" unless allowed
-          inbox_environment(events, params, map)
-        end
-
-        def inbox_environment(events, params, map)
-          unless Models::EvidenceEvent.chain_valid?(events) && events.all? { |event| event["attempt_id"] == params.fetch("attempt_id") }
-            raise AttemptErrors::EvidenceUnavailable, "canonical inbox attempt chain differs"
-          end
-          context = @deployment.inbox_context(params.fetch("mapping_id"), params.fetch("inbox_context_id"))
-          @deployment.verify_inbox_context!(params.fetch("mapping_id"), params.fetch("inbox_context_id"))
-          bindings = events.select { |event| event["type"] == "inbox_binding" && event.dig("payload", "event_id") == params["event_id"] }
-          raise AttemptErrors::NotFound, "inbox registration missing" if bindings.empty?
-          registered = bindings.one? && bindings.first.fetch("payload")
-          unless registered.is_a?(Hash) && registered.keys.sort == %w[event_id attempt_id inbox_context_id registration].sort &&
-              registered.values_at("event_id", "attempt_id", "inbox_context_id") == params.values_at("event_id", "attempt_id", "inbox_context_id") &&
-              inbox_registration?(registered["registration"])
-            raise AttemptErrors::EvidenceUnavailable, "canonical inbox context or registration differs"
-          end
-          if params.key?("expected_registration") && registered.fetch("registration") != params.fetch("expected_registration")
-            raise AttemptErrors::Conflict, "expected inbox registration differs"
-          end
-          lineage = Molecules::ExecutionScopeLineage.new(events: events, project_id: map.fetch("project_id"),
-            assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
-            mapping_id: context.fetch("native_mapping_id"))
-          raise AttemptErrors::EvidenceUnavailable, "canonical original native stage missing" unless lineage.native_event
-          native_map = @deployment.mapping(context.fetch("native_mapping_id"))
-          box = Ace::Herdr::Organisms::ProtectedInbox.build(context: context, mapping: native_map,
-            native: lineage.native_event.fetch("payload"), kernel: @kernel)
-          current = box.retained_status(event: params.fetch("event_id"))
-          unless current.slice(*INBOX_REGISTRATION_FIELDS) == registered.fetch("registration")
-            raise AttemptErrors::EvidenceUnavailable, "current inbox differs from canonical registration"
-          end
-          inbox_native_lineage!(current, lineage)
-          [box, registered.fetch("registration"), lineage]
-        rescue Ace::Herdr::Error, Ace::Runtime::RuntimeUnavailableError, KeyError, TypeError
-          raise AttemptErrors::EvidenceUnavailable, "installed inbox or native lineage is unverifiable"
-        end
-
-        def inbox_native_lineage!(record, lineage, receipt: nil)
+        def inbox_native_lineage!(record, lineage)
           workspace = lineage.native_event.fetch("payload").fetch("workspace_id")
           original = record.fetch("origin_target")
           binding = record.fetch("binding")
@@ -135,179 +28,9 @@ module Ace
               raise AttemptErrors::EvidenceUnavailable, "inbox original native child differs"
             end
           end
-          if receipt
-            signed_binding = receipt["binding"]
-            replacement = receipt["replacement_target"]
-            unless signed_binding.is_a?(Hash) && signed_binding["session"] == workspace &&
-                (!receipt.key?("replacement_target") || (replacement.is_a?(Hash) && replacement["session"] == workspace))
-              raise AttemptErrors::EvidenceUnavailable, "signed inbox native workspace differs"
-            end
-          end
-          true
-        end
-
-        def authorize_inbox_transfer!(request:, peer:, role:)
-          params, map = inbox_request(request)
-          @launch.with_assignment(params: params, map: map) do |journal, _|
-            protected_journal!(journal)
-            inbox_selection(attempt_events(journal, params), params, map, peer, role)
-          end
           true
         end
 
-        def dispatch_inbox(request:, peer:, role:, transfer:)
-          params, map = inbox_request(request)
-          authorize_inbox_transfer!(request: request, peer: peer, role: role)
-          unless transfer && transfer.count == 2
-            raise ArgumentError, "inbox requires receipt and signature"
-          end
-          bytes, signature = [transfer.bytes(index: 0), transfer.bytes(index: 1)]
-          unless [bytes, signature].all? { |part| part.is_a?(String) && part.bytesize.between?(1, 16 * 1024) } &&
-              Digest::SHA256.hexdigest(bytes) == params.fetch("receipt_sha256") &&
-              Digest::SHA256.hexdigest(signature) == params.fetch("signature_sha256")
-            raise ArgumentError, "inbox proof bytes differ"
-          end
-          receipt = JSON.parse(bytes.dup.force_encoding(Encoding::UTF_8))
-          @launch.with_assignment(params: params, map: map) do |journal, _|
-            protected_journal!(journal)
-            commit = journal.ref_value
-            events = journal.read_events(params.fetch("assignment_id"), commit: commit).select { |event| event["attempt_id"] == params.fetch("attempt_id") }
-            box, registration, lineage = inbox_selection(events, params, map, peer, role)
-            replay = journal.mutation_result(request.fetch("mutation_id"))
-            if replay && replay["operation"] == "reconcile_inbox"
-              retained = verified_inbox(journal, events, params, map, peer, role, commit)
-              unless retained && inbox_projection(retained) == replay.fetch("data").slice(*inbox_projection(retained).keys)
-                raise AttemptErrors::EvidenceUnavailable, "retained inbox reply differs"
-              end
-            end
-            result = journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
-              mutation_id: request.fetch("mutation_id"), operation: "reconcile_inbox", parameters_digest: Atoms::EvidenceDigest.digest(params),
-              expected_generation: params.fetch("expected_generation"), with_replay: true) do |fresh, fresh_commit, _generation|
-              box, registration, lineage = inbox_selection(fresh, params, map, peer, role)
-              retained = verified_inbox(journal, fresh, params, map, peer, role, fresh_commit)
-              if retained
-                unless retained.dig("binding", "receipt_sha256") == params.fetch("receipt_sha256") &&
-                    retained.dig("binding", "signature_sha256") == params.fetch("signature_sha256")
-                  raise AttemptErrors::Conflict, "canonical inbox proof already differs"
-                end
-                next({data: inbox_projection(retained)})
-              end
-              inbox_native_lineage!(box.retained_status(event: params.fetch("event_id")), lineage, receipt: receipt)
-              accepted = box.reconcile(event: params.fetch("event_id"), receipt: receipt, signed_bytes: bytes,
-                signature: signature, expected_registration: registration)
-              raise AttemptErrors::EvidenceUnavailable, "signed inbox proof refused" if accepted["reconciliation_refusal"]
-              binding = inbox_binding(params, map, peer, role, registration, lineage, accepted)
-              plan = Molecules::CanonicalEvidence.new(journal: journal).import_plan(**inbox_context(binding),
-                admitted_after_event_digest: fresh.last.fetch("digest"), artifacts: [bytes, signature])
-              refs = plan.fetch(:references).each_with_index.map do |ref, index|
-                ref.merge("artifact_id" => ref.fetch("ref").delete_prefix("evidence/imports/"), "bytes" => [bytes, signature][index].bytesize)
-              end
-              payload = {"version" => 1, "event_id" => params.fetch("event_id"), "attempt_id" => params.fetch("attempt_id"),
-                "inbox_context_id" => params.fetch("inbox_context_id"), "registration" => registration,
-                "state" => accepted.fetch("state"), "claim_generation" => accepted.fetch("claim_generation"),
-                "binding" => binding, "receipt_ref" => refs[0], "signature_ref" => refs[1]}
-              {data: inbox_projection(payload), blobs: plan.fetch(:blobs), events: plan.fetch(:events) +
-                [{type: "inbox_reconciliation", payload: payload}]}
-            end
-            final_commit = journal.ref_value
-            final_events = journal.read_events(params.fetch("assignment_id"), commit: final_commit).select { |event| event["attempt_id"] == params.fetch("attempt_id") }
-            retained = verified_inbox(journal, final_events, params, map, peer, role, final_commit)
-            unless retained && inbox_projection(retained) == result.fetch(:data).slice(*inbox_projection(retained).keys)
-              raise AttemptErrors::EvidenceUnavailable, "accepted inbox provenance differs"
-            end
-            result
-          end
-        rescue JSON::ParserError, EncodingError, Ace::Herdr::Error
-          raise AttemptErrors::EvidenceUnavailable, "inbox proof is unverifiable"
-        end
-
-        def inbox_binding(params, map, peer, role, registration, lineage, accepted)
-          {"project_id" => map.fetch("project_id"), "assignment_id" => params.fetch("assignment_id"),
-            "attempt_id" => params.fetch("attempt_id"), "mapping_id" => params.fetch("mapping_id"),
-            "inbox_context_id" => params.fetch("inbox_context_id"), "event_id" => params.fetch("event_id"),
-            "registration" => registration, "claim_generation" => accepted.fetch("claim_generation"),
-            "native_binding" => accepted.fetch("binding"), "scope_binding_event_id" => lineage.binding_event.fetch("digest"),
-            "native_binding_event_id" => lineage.native_event.fetch("digest"), "scope_native_binding" => lineage.native_event.fetch("payload"),
-            "receipt_key_sha256" => registration.fetch("receipt_key_sha256"), "receipt_sha256" => params.fetch("receipt_sha256"),
-            "signature_sha256" => params.fetch("signature_sha256"), "submitter_uid" => peer.fetch("uid"), "submitter_role" => role.to_s}
-        end
-
-        def inbox_context(binding)
-          {kind: "inbox", project_id: binding.fetch("project_id"), assignment_id: binding.fetch("assignment_id"),
-            attempt_id: binding.fetch("attempt_id"), peer_uid: binding.fetch("submitter_uid"), binding: binding,
-            request_id_or_event_id: binding.fetch("event_id"), generation: binding.fetch("claim_generation")}
-        end
-
-        def inbox_projection(payload)
-          payload.slice("event_id", "attempt_id", "inbox_context_id", "registration", "state", "receipt_ref", "signature_ref")
-        end
-
-        def verified_inbox(journal, events, params, map, peer, role, commit)
-          box, registration, lineage = inbox_selection(events, params, map, peer, role)
-          verified_inbox_record(journal, events, params, map, commit, box: box, registration: registration, lineage: lineage)
-        end
-
-        def verified_inbox_record(journal, events, params, map, commit, box:, registration:, lineage:)
-          records = events.select { |event| event["type"] == "inbox_reconciliation" && event.dig("payload", "event_id") == params.fetch("event_id") }
-          replies = events.select { |event| event["type"] == "authority_mutation" &&
-            event.dig("payload", "operation") == "reconcile_inbox" && event.dig("payload", "data", "event_id") == params.fetch("event_id") }
-          unless replies.all? { |reply| records.any? { |record| inbox_projection(record.fetch("payload")) ==
-              reply.fetch("payload").fetch("data").slice(*inbox_projection(record.fetch("payload")).keys) } }
-            raise AttemptErrors::EvidenceUnavailable, "canonical inbox private provenance missing"
-          end
-          observed = box.retained_status(event: params.fetch("event_id"))
-          current_claim = observed.fetch("claim_generation")
-          unless records.all? { |record| record.fetch("payload").keys.sort == INBOX_PAYLOAD_FIELDS.sort &&
-              record.dig("payload", "claim_generation").is_a?(Integer) && record.dig("payload", "claim_generation").between?(0, current_claim) } &&
-              records.map { |record| record.dig("payload", "claim_generation") }.uniq.length == records.length
-            raise AttemptErrors::EvidenceUnavailable, "canonical inbox claim history differs"
-          end
-          current = records.find { |record| record.dig("payload", "claim_generation") == current_claim }
-          return nil unless current
-          payload = current.fetch("payload")
-          binding = payload.fetch("binding")
-          unless payload.keys.sort == INBOX_PAYLOAD_FIELDS.sort && payload["version"] == 1 && binding.keys.sort == INBOX_BINDING_FIELDS.sort &&
-              %w[receipt_sha256 signature_sha256].all? { |key| binding[key].is_a?(String) && DIGEST.match?(binding[key]) } &&
-              binding["submitter_uid"].is_a?(Integer) && binding["submitter_uid"] > 0 && %w[launcher supervisor].include?(binding["submitter_role"]) &&
-              payload.values_at("event_id", "attempt_id", "inbox_context_id") == params.values_at("event_id", "attempt_id", "inbox_context_id") &&
-              payload["registration"] == registration && payload["claim_generation"] == binding["claim_generation"]
-            raise AttemptErrors::EvidenceUnavailable, "canonical inbox fields differ"
-          end
-          retained_peer = {"uid" => binding.fetch("submitter_uid")}
-          expected = inbox_binding(params.merge("receipt_sha256" => binding.fetch("receipt_sha256"),
-            "signature_sha256" => binding.fetch("signature_sha256")), map, retained_peer, binding.fetch("submitter_role").to_sym,
-            registration, lineage, observed)
-          raise AttemptErrors::EvidenceUnavailable, "canonical inbox native/key context differs" unless binding == expected
-          canonical = Molecules::CanonicalEvidence.new(journal: journal)
-          raw = %w[receipt_ref signature_ref].map do |key|
-            ref = payload.fetch(key)
-            unless ref.is_a?(Hash) && ref.keys.sort == INBOX_REF_FIELDS.sort &&
-                ref["ref"] == "evidence/imports/#{ref['artifact_id']}" && ref["bytes"].is_a?(Integer) && ref["bytes"].between?(1, 16 * 1024)
-              raise AttemptErrors::EvidenceUnavailable, "canonical inbox reference differs"
-            end
-            bytes = canonical.read(ref.slice("ref", "sha256"), **inbox_context(binding), commit: commit)
-            raise AttemptErrors::EvidenceUnavailable, "canonical inbox byte count differs" unless bytes.bytesize == ref["bytes"]
-            bytes
-          end
-          unless raw.map { |bytes| Digest::SHA256.hexdigest(bytes) } == binding.values_at("receipt_sha256", "signature_sha256")
-            raise AttemptErrors::EvidenceUnavailable, "canonical inbox raw digests differ"
-          end
-          receipt = JSON.parse(raw.first)
-          inbox_native_lineage!(observed, lineage, receipt: receipt)
-          verified = box.verify_reconciliation(event: params.fetch("event_id"), receipt: receipt,
-            signed_bytes: raw.first, signature: raw.last, expected_registration: registration)
-          signed_state = receipt["outcome"] == "consumed" ? "completed" : "queued"
-          if verified["reconciliation_refusal"] || verified["state"] != payload["state"] || payload["state"] != signed_state
-            raise AttemptErrors::EvidenceUnavailable, "canonical inbox signature or settlement differs"
-          end
-          unless events.any? { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "reconcile_inbox" &&
-              event.fetch("payload").fetch("data").slice(*inbox_projection(payload).keys) == inbox_projection(payload) }
-            raise AttemptErrors::EvidenceUnavailable, "canonical inbox owner reply missing"
-          end
-          payload
-        rescue KeyError, TypeError, ArgumentError, JSON::ParserError, Ace::Herdr::Error
-          raise AttemptErrors::EvidenceUnavailable, "canonical inbox evidence is unverifiable"
-        end
       end
     end
   end

data/lib/ace/assign/authority/endcap_prepared_work.rb

@@ -0,0 +1,80 @@
+# frozen_string_literal: true
+
+module Ace
+  module Assign
+    module Authority
+      class Endcap
+
+        def prepared_fetch?(request)
+          request["operation"] == "evidence_fetch" && %w[prepared_work campaign_candidate].include?(request.dig("params", "kind"))
+        end
+
+        def dispatch_prepared_fetch(request:, peer:, role:, body: true)
+          params = request.fetch("params")
+          unless request.fetch("mutation_id").nil? && params.is_a?(Hash) && params.keys.sort == PARAMETERS.fetch("evidence_fetch").sort &&
+              [%w[prepared_work original_prepared_work prepared_bundle],
+                %w[campaign_candidate original_campaign_candidate candidate_bundle]].include?(params.values_at("kind", "purpose_id", "artifact_id"))
+            raise ArgumentError, "prepared fetch envelope differs"
+          end
+          %w[mapping_id assignment_id attempt_id].each { |key| result_id!(params.fetch(key)) }
+          map = @deployment.mapping(params.fetch("mapping_id"))
+          raise AttemptErrors::UnauthorizedIdentity, "prepared project differs" unless map.fetch("project_id") == request.fetch("project_id")
+          raise AttemptErrors::UnauthorizedIdentity, "prepared fetch requires original worker" unless role == :worker
+          @kernel.live!(peer)
+          service_policy!.visible!(project: map.fetch("project_id"), uid: peer.fetch("uid"))
+          journal = @launch.send(:journal_for, map)
+          protected_journal!(journal)
+          commit = journal.ref_value
+          selected = @launch.original_prepared_registration!(journal: journal, params: params, commit: commit) do |original_map, state|
+            unless peer.values_at("uid", "gid", "groups") == original_map.values_at("worker_uid", "worker_gid", "worker_groups")
+              raise AttemptErrors::UnauthorizedIdentity, "prepared worker principal differs"
+            end
+            binding = state.fetch("process_binding")
+            @kernel.live!(binding.fetch("process_identity"))
+            @kernel.live!(binding.fetch("native_origin").fetch("server_identity"))
+            worker_or_launcher!(peer, role, original_map, state)
+          end
+          original_map = selected.fetch(:map)
+          registration = selected.fetch(:registration)
+          if params.fetch("kind") == "campaign_candidate"
+            definition = @launch.preview_attempt_definition!(journal: journal, commit: commit, params: params, map: original_map)
+            execution = definition.campaign_execution
+            raise AttemptErrors::UnauthorizedIdentity, "original worker is not a campaign child" unless execution
+            descriptor, candidate_bytes = campaign_prepared_candidate!(journal: journal, commit: commit, execution: execution, map: original_map)
+            return true unless body
+            unless journal.ref_value == commit
+              raise AttemptErrors::Conflict, "campaign original candidate selection advanced"
+            end
+            descriptor = descriptor.merge(params.slice("mapping_id", "assignment_id", "attempt_id"),
+              "project_id" => original_map.fetch("project_id"),
+              "original_worker_identity" => selected.fetch(:state).fetch("process_binding").fetch("process_identity"),
+              "original_worker_scratch_root" => selected.fetch(:original_worker_scratch_root),
+              "original_binding_digest" => selected.fetch(:original_binding_digest))
+            return {data: {"descriptor" => descriptor, "generation" => journal.authority_generation(selected.fetch(:events)),
+              "journal_commit" => commit}, replayed: false, transfer_parts: [candidate_bytes]}
+          end
+          return true unless body
+          reference = registration.fetch("prepared_work")
+          bytes = journal.bounded_blob(registration.fetch("prepared_bundle_ref"), commit: selected.fetch(:registration_commit), max_bytes: CandidateTransfer::MAX_BYTES)
+          unless bytes.is_a?(String) && bytes.bytesize == registration.fetch("prepared_bundle_bytes") &&
+              bytes.bytesize.between?(1, CandidateTransfer::MAX_BYTES) && Digest::SHA256.hexdigest(bytes) == registration.fetch("prepared_bundle_sha256")
+            raise AttemptErrors::EvidenceUnavailable, "original prepared bundle differs"
+          end
+          descriptor = reference.slice("task_id", "scope", "selection_sha256", "prepared_head", "prepared_tree", "manifest_bytes", "manifest_sha256").merge(
+            params.slice("mapping_id", "assignment_id", "attempt_id"), "version" => 1, "kind" => "prepared_work", "purpose" => "original_prepared_work", "artifact" => "prepared_bundle",
+            "project_id" => original_map.fetch("project_id"), "definition_digest" => registration.fetch("definition_digest"),
+            "task_context_entry" => registration.fetch("task_context_entry"),
+            "original_worker_identity" => selected.fetch(:state).fetch("process_binding").fetch("process_identity"),
+            "original_worker_scratch_root" => selected.fetch(:original_worker_scratch_root),
+            "workspace_exclusion" => selected.fetch(:workspace_exclusion),
+            "registration_generation" => registration.fetch("generation"), "registration_commit" => selected.fetch(:registration_commit),
+            "original_binding_digest" => selected.fetch(:original_binding_digest), "ref" => registration.fetch("prepared_bundle_ref"), "bytes" => bytes.bytesize,
+            "sha256" => registration.fetch("prepared_bundle_sha256"))
+          {data: {"descriptor" => descriptor, "generation" => journal.authority_generation(selected.fetch(:events)), "journal_commit" => commit}, replayed: false, transfer_parts: [bytes]}
+        rescue KeyError, TypeError
+          raise AttemptErrors::EvidenceUnavailable, "original prepared input is unavailable"
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/endcap_publication.rb

@@ -0,0 +1,207 @@
+# frozen_string_literal: true
+
+module Ace
+  module Assign
+    module Authority
+      class Endcap
+        # The same held assignment owner authenticates the receiver and current
+        # candidate both before transfer and inside each canonical CAS attempt.
+        # Ordinary HITL uses this same original launch and project journal;
+        # no local assignment cache or caller-selected coordinator participates.
+        def with_worker_hitl!(assignment:, attempt:, project:, requester_uid:, peer: nil)
+          selected = @deployment.data.fetch("launch_mappings").select do |_id, map|
+            map.fetch("project_id") == project && map.fetch("worker_uid") == requester_uid
+          end
+          raise AttemptErrors::UnauthorizedIdentity, "HITL worker mapping is missing or ambiguous" unless selected.size == 1
+          mapping_id, map = selected.first
+          params = {"mapping_id" => mapping_id, "assignment_id" => assignment, "attempt_id" => attempt}
+          @launch.with_assignment(params: params, map: map) do |journal, _registration|
+            protected_journal!(journal)
+            events = attempt_events(journal, params)
+            origin = active_origin(events, params)
+            @launch.scope_open_for_effect!(events: events, params: params, map: map)
+            if peer
+              unless peer.values_at("uid", "gid", "groups") == map.values_at("worker_uid", "worker_gid", "worker_groups")
+                raise AttemptErrors::UnauthorizedIdentity, "HITL requester credentials differ"
+              end
+              @kernel.live!(peer)
+              worker_or_launcher!(peer, :worker, map, origin)
+            end
+            reverse = origin.fetch("process_binding").slice("session", "pane")
+            unless reverse.values.all? { |value| value.is_a?(String) && !value.empty? } && reverse.size == 2
+              raise AttemptErrors::EvidenceUnavailable, "HITL native reverse is unavailable"
+            end
+            yield settlement_immutable(reverse.merge("schema" => "ace.hitl.ref/v1"))
+          end
+        end
+
+        def publication_executor_identity?(project:, uid:)
+          @deployment.project(project).fetch("service_executor_uids").include?(uid)
+        end
+
+        def with_publication_hitl!(binding:, project:, peer:)
+          params = binding.slice("mapping_id", "assignment_id", "attempt_id", "request_id", "claim_binding", "input_digest", "candidate_generation", "head")
+          map = @deployment.mapping(params.fetch("mapping_id"))
+          raise AttemptErrors::UnauthorizedIdentity, "publication project differs" unless map.fetch("project_id") == project
+          @launch.with_assignment(params: params, map: map) do |journal, _registration|
+            protected_journal!(journal)
+            record = publication_record!(journal, params, map, peer, :executor)
+            unless record["dispatch_phase"] == "otp_pending" && record["publication_challenge_digest"] == binding.fetch("challenge_digest")
+              raise AttemptErrors::Conflict, "publication HITL challenge is no longer pending"
+            end
+            ServiceEvidence.new(journal: journal).publication_challenge!(record)
+            selection = settlement_immutable({"executor_process_binding" => record.fetch("executor_process_binding"),
+              "challenge_ref" => record.fetch("publication_challenge_ref").fetch("ref")})
+            yield selection
+          end
+        end
+
+        def authorize_publication_update!(journal:, existing:, replacement:, pending:)
+          operation = pending.fetch(:operation)
+          allowed = ServicePublicationEvidence::PUBLICATION_FIELDS + ["dispatch_phase"]
+          unless existing.except(*allowed) == replacement.except(*allowed) && existing["state"] == "uncertain"
+            raise AttemptErrors::InvalidState, "publication transition changed original binding"
+          end
+          owner = ServiceEvidence.new(journal: journal)
+          if operation == "publication_challenge"
+            unless %w[dispatch_started issuing].include?(existing["dispatch_phase"]) && replacement["dispatch_phase"] == "otp_pending" &&
+                replacement["publication_issuing_event_digest"] == existing["publication_issuing_event_digest"]
+              raise AttemptErrors::InvalidState, "publication need has no source-owned rejected push"
+            end
+            need = owner.publication_challenge!(replacement, pending: pending)
+            unless need["previous_challenge_digest"] == existing["publication_challenge_digest"]
+              raise AttemptErrors::InvalidState, "publication need predecessor differs"
+            end
+          elsif operation == "publication_continue"
+            unless existing["dispatch_phase"] == "otp_pending" && replacement["dispatch_phase"] == "issuing" &&
+                (allowed - %w[dispatch_phase publication_issuing_event_digest]).all? { |key| existing[key] == replacement[key] }
+              raise AttemptErrors::InvalidState, "publication continuation is not a unique pending challenge"
+            end
+            owner.publication_challenge!(replacement, pending: pending)
+            events = pending.fetch(:current_events) + pending.fetch(:pending_events)
+            event = events.find { |row| row["digest"] == replacement["publication_issuing_event_digest"] }
+            unless event && event["type"] == "service_publication_issuing" &&
+                %w[request_id input_digest claim_binding publication_challenge_digest].all? { |key| event.dig("payload", key) == replacement[key] }
+              raise AttemptErrors::EvidenceUnavailable, "publication issuing event is unavailable"
+            end
+          else
+            raise AttemptErrors::InvalidState, "publication transition has no fixed source owner"
+          end
+          true
+        end
+
+        def publication_record!(journal, params, map, peer, role, events: nil)
+          record = journal.service_request(params.fetch("request_id"))
+          unless record && record["operation"] == "publish" && record["state"] == "uncertain" &&
+              %w[dispatch_started otp_pending issuing].include?(record["dispatch_phase"]) &&
+              %w[claim_binding input_digest candidate_generation].all? { |key| record[key] == params[key] } &&
+              record["candidate_head"] == params["head"] && record["mapping_id"] == params["mapping_id"]
+            raise AttemptErrors::Conflict, "publication original tuple or phase differs"
+          end
+          service_executor!(peer, role, record)
+          service_ticket!(record, params, map, peer)
+          events ||= attempt_events(journal, params)
+          current = exact_candidate!(candidate(events), params)
+          origin = active_origin(events, params)
+          worker_or_launcher!(record.fetch("worker_process_binding"), :worker, map, origin)
+          approved_review!(journal, events, params, map, current)
+          @launch.scope_open_for_effect!(events: events, params: params, map: map)
+          service_policy!.authorize!(record)
+          ServiceEvidence.new(journal: journal).context(record)
+          record
+        end
+
+        def authorize_publication_transfer!(request, params, map, peer, role)
+          @launch.with_assignment(params: params, map: map) do |journal, _registration|
+            protected_journal!(journal)
+            publication_record!(journal, params, map, peer, role)
+          end
+          true
+        end
+
+        def dispatch_publication(request, params, map, peer, role, transfer)
+          authorize_publication_transfer!(request, params, map, peer, role)
+          challenge = request.fetch("operation") == "publication_challenge"
+          bytes = nil
+          if challenge
+            unless transfer && transfer.count == 1
+              raise ArgumentError, "publication need requires one bounded artifact"
+            end
+            bytes = transfer.bytes.dup.freeze
+            unless Digest::SHA256.hexdigest(bytes) == params.fetch("receipt_sha256")
+              raise AttemptErrors::ReceiptRejected, "publication need transfer digest differs"
+            end
+          elsif transfer
+            raise ArgumentError, "publication continuation forbids upload"
+          end
+          @launch.with_assignment(params: params, map: map) do |journal, _registration|
+            publication_record!(journal, params, map, peer, role)
+            result = journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
+              mutation_id: request.fetch("mutation_id"), operation: request.fetch("operation"),
+              parameters_digest: Atoms::EvidenceDigest.digest(params), expected_generation: params.fetch("expected_generation"),
+              with_replay: true) do |events, _commit, generation|
+              record = publication_record!(journal, params, map, peer, role, events: events)
+              if challenge
+                publication_challenge_plan(journal, events, record, params, bytes, generation)
+              else
+                publication_continue_plan(journal, events, record, params, generation)
+              end
+            end
+            if !challenge && result.fetch(:replayed)
+              result = result.merge(data: result.fetch(:data).merge("invocation" => "already_issued"))
+            end
+            result
+          end
+        end
+
+        def publication_challenge_plan(journal, events, record, params, bytes, generation)
+          owner = ServiceEvidence.new(journal: journal)
+          digest = Digest::SHA256.hexdigest(bytes)
+          if record["dispatch_phase"] == "otp_pending"
+            owner.publication_challenge!(record)
+            raise AttemptErrors::Conflict, "publication pending challenge differs" unless record["publication_challenge_digest"] == digest
+            return {data: service_projection(record).merge("challenge" => "retained")}
+          end
+          unless %w[dispatch_started issuing].include?(record["dispatch_phase"])
+            raise AttemptErrors::InvalidState, "publication has no rejected push"
+          end
+          previous = record["publication_challenge_digest"]
+          owner.publication_challenge!(record) if previous
+          owner.publication_need!(bytes, record, previous: previous)
+          payload = record.slice("request_id", "input_digest", "claim_binding").merge(
+            "challenge_digest" => digest, "previous_challenge_digest" => previous, "generation" => generation + 1)
+          time = Time.now.utc
+          event = Models::EvidenceEvent.build(type: "service_publication_challenge", attempt_id: record.fetch("attempt_id"),
+            payload: payload, previous_digest: events.last&.fetch("digest"), recorded_at: time)
+          plan = Molecules::CanonicalEvidence.new(journal: journal).import_plan(**owner.context(record),
+            artifacts: [bytes], admitted_after_event_digest: event.fetch("digest"))
+          replacement = record.merge("dispatch_phase" => "otp_pending", "publication_challenge_digest" => digest,
+            "publication_challenge_ref" => plan.fetch(:references).fetch(0),
+            "publication_challenge_event_digest" => event.fetch("digest"), "publication_challenge_generation" => generation + 1)
+          plan.merge(events: [{type: "service_publication_challenge", payload: payload, recorded_at: time}] + plan.fetch(:events),
+            data: service_projection(replacement).merge("challenge" => "created"), service_updates: [{request_id: record.fetch("request_id"),
+              expected: record, replacement: replacement, event_type: "service_transition"}])
+        end
+
+        def publication_continue_plan(journal, events, record, params, generation)
+          ServiceEvidence.new(journal: journal).publication_challenge!(record)
+          unless record["publication_challenge_digest"] == params.fetch("challenge_digest")
+            raise AttemptErrors::Conflict, "publication continuation challenge differs"
+          end
+          if record["dispatch_phase"] == "issuing"
+            return {data: service_projection(record).merge("invocation" => "already_issued")}
+          end
+          raise AttemptErrors::InvalidState, "publication is not pending" unless record["dispatch_phase"] == "otp_pending"
+          payload = record.slice("request_id", "input_digest", "claim_binding", "publication_challenge_digest").merge("generation" => generation + 1)
+          time = Time.now.utc
+          event = Models::EvidenceEvent.build(type: "service_publication_issuing", attempt_id: record.fetch("attempt_id"),
+            payload: payload, previous_digest: events.last&.fetch("digest"), recorded_at: time)
+          replacement = record.merge("dispatch_phase" => "issuing", "publication_issuing_event_digest" => event.fetch("digest"))
+          {events: [{type: "service_publication_issuing", payload: payload, recorded_at: time}],
+            data: service_projection(replacement).merge("invocation" => "permitted"), service_updates: [{request_id: record.fetch("request_id"),
+              expected: record, replacement: replacement, event_type: "service_transition"}]}
+        end
+      end
+    end
+  end
+end