ace-assign 0.64.0 → 0.66.1

data/lib/ace/assign/authority/inbox_context_original.rb

@@ -0,0 +1,113 @@
+# frozen_string_literal: true
+
+require_relative "original_inbox_selection"
+require_relative "../molecules/original_launch_binding"
+require_relative "../molecules/execution_scope_lineage"
+
+module Ace
+  module Assign
+    module Authority
+      # Canonical original identity only. No native thread, effect permission,
+      # live process observation, context lock or journal mutation is returned.
+      class InboxContextOriginal
+        OPERATIONS = ["inbox_context_original"].freeze
+        PARAMETERS = %w[assignment_id attempt_id event_id inbox_context_id mapping_id payload_sha256 purpose].freeze
+        NATIVE_FIELDS = %w[scope_generation scope_binding_event_id service_invocation_id server_identity socket_identity workspace_id].freeze
+        TOKEN = /\A[A-Za-z0-9][A-Za-z0-9._-]{0,127}\z/
+        SHA = /\A[0-9a-f]{64}\z/
+
+        def initialize(deployment:, history:, authority_id:, journals:,
+          kernel: Ace::Runtime::Molecules::ProtectedLinux.new)
+          @deployment, @history, @authority_id, @journals, @kernel = deployment, history, authority_id, journals, kernel
+        end
+
+        def dispatch(request:, peer:, role:)
+          unless request.is_a?(Hash) && request.keys.sort == %w[mutation_id operation params project_id version] &&
+              request["version"].is_a?(Integer) && request["version"] == 1 && request["operation"] == OPERATIONS.first &&
+              request["mutation_id"].nil? && role == :context_owner && request["params"].is_a?(Hash) &&
+              request["params"].keys.sort == PARAMETERS
+            raise AttemptErrors::UnauthorizedIdentity, "original inbox query differs"
+          end
+          params = request.fetch("params")
+          unless %w[assignment_id attempt_id event_id inbox_context_id mapping_id].all? { |key| params[key].is_a?(String) && TOKEN.match?(params[key]) } &&
+              %w[payload_sha256].all? { |key| params[key].is_a?(String) && SHA.match?(params[key]) } &&
+              %w[enqueue deliver].include?(params["purpose"])
+            raise AttemptErrors::UnauthorizedIdentity, "original inbox selectors differ"
+          end
+          map = @deployment.mapping(params.fetch("mapping_id"))
+          context = @deployment.inbox_context(params.fetch("mapping_id"), params.fetch("inbox_context_id"))
+          unless map.values_at("authority_id", "project_id") == [@authority_id, request.fetch("project_id")] &&
+              context.fetch("owner_credentials").values_at("uid", "gid", "groups") == peer.values_at("uid", "gid", "groups")
+            raise AttemptErrors::UnauthorizedIdentity, "original inbox query requires its fixed owner"
+          end
+          @kernel.live!(peer)
+          journal = @journals.fetch(map.fetch("project_id"))
+          project = @deployment.project(map.fetch("project_id"))
+          unless journal.evidence_mode == :protected && project.values_at("journal_repository", "evidence_git_ref", "evidence_checkout_root") ==
+              [journal.repo_root, journal.ref, journal.checkout_root]
+            raise AttemptErrors::EvidenceUnavailable, "original inbox journal association differs"
+          end
+          commit = journal.ref_value
+          journal.verify_commit!(commit)
+          events = journal.read_events(params.fetch("assignment_id"), commit: commit).select { |event| event["attempt_id"] == params.fetch("attempt_id") }
+          original, original_map = OriginalInboxSelection.new(history: @history, authority_id: @authority_id)
+            .load!(events: events, params: params, map: map, journal: journal, commit: commit)
+          original_context = original.inbox_context(params.fetch("mapping_id"), params.fetch("inbox_context_id"))
+          unless original_context.fetch("native_mapping_id") == params.fetch("mapping_id")
+            raise AttemptErrors::EvidenceUnavailable, "original inbox native mapping differs"
+          end
+          lineage = Molecules::ExecutionScopeLineage.new(events: events, project_id: original_map.fetch("project_id"),
+            assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"), mapping_id: params.fetch("mapping_id"))
+          child = lineage.child_event&.dig("payload", "original_process_binding")
+          records = events.select { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "record_launch" }
+          raise AttemptErrors::EvidenceUnavailable, "original inbox launch missing" unless records.one? && child
+          state = records.first.fetch("payload").fetch("data")
+          raise AttemptErrors::EvidenceUnavailable, "original inbox child differs" unless state.fetch("process_binding") == child
+          guarded = Molecules::OriginalLaunchBinding.verify!(events: events, state: state, params: params)
+          registration = {"event_id" => params.fetch("event_id"), "attempt_id" => params.fetch("attempt_id"),
+            "payload_sha256" => params.fetch("payload_sha256")}
+          bindings = events.select { |event| event["type"] == "inbox_binding" && event.dig("payload", "event_id") == params.fetch("event_id") }
+          unless bindings.size <= 1 && (params.fetch("purpose") == "enqueue" || bindings.one?) && bindings.all? { |event|
+            event.fetch("payload") == {"attempt_id" => params.fetch("attempt_id"), "event_id" => params.fetch("event_id"),
+              "inbox_context_id" => params.fetch("inbox_context_id"), "registration" => registration} }
+            raise AttemptErrors::EvidenceUnavailable, "original inbox registration differs"
+          end
+          digests = [guarded.fetch("binding_digest"), lineage.native_event.fetch("digest"), lineage.child_event.fetch("digest")] + bindings.map { |event| event.fetch("digest") }
+          journal.event_commits!(assignment_id: params.fetch("assignment_id"), event_digests: digests, commit: commit)
+          @kernel.live!(peer)
+          channel = original_map.fetch("native")
+          server = lineage.native_event.fetch("payload").fetch("server_identity")
+          path = channel.fetch("socket_path")
+          unless path.is_a?(String) && path.valid_encoding? && path.bytesize.between?(1, 107) &&
+              path.start_with?("/") && !path.include?("\0") && File.expand_path(path) == path &&
+              channel.fetch("version") == "0.9.3" && channel.fetch("protocol") == 22 &&
+              channel.fetch("workspace_id") == lineage.native_event.fetch("payload").fetch("workspace_id") &&
+              server.values_at("uid", "gid", "groups") == original_map.values_at("worker_uid", "worker_gid", "worker_groups")
+            raise AttemptErrors::EvidenceUnavailable, "original inbox native channel differs"
+          end
+          data = params.slice("assignment_id", "attempt_id", "event_id", "inbox_context_id", "mapping_id", "purpose")
+            .merge("schema" => "ace.assign.inbox-context-original/v1", "project_id" => map.fetch("project_id"),
+              "commit" => commit, "registration" => registration, "registered" => bindings.one?,
+              "original_binding_digest" => guarded.fetch("binding_digest"), "process_binding" => child,
+              "guarded_origin" => guarded.fetch("origin"), "native_binding" => lineage.native_event.fetch("payload").slice(*NATIVE_FIELDS),
+              "native_channel" => channel.slice("socket_path", "version"))
+          raise AttemptErrors::EvidenceUnavailable, "original inbox projection exceeds bound" if JSON.generate(data).bytesize > 15_360
+          {data: immutable(data), replayed: false}
+        rescue KeyError, TypeError, ArgumentError, NoMethodError, Ace::Herdr::Error, Ace::Runtime::RuntimeUnavailableError
+          raise AttemptErrors::EvidenceUnavailable, "original inbox evidence is unavailable"
+        end
+
+        private
+
+        def immutable(value)
+          case value
+          when Hash then value.to_h { |key, item| [key.dup.freeze, immutable(item)] }.freeze
+          when Array then value.map { |item| immutable(item) }.freeze
+          when String then value.dup.freeze
+          else value.freeze
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/launch_attempt_consumers.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+module Ace
+  module Assign
+    module Authority
+      class LaunchLifecycle
+        # Caller owns the existing slot/assignment exclusion. This verifies
+        # an already accepted closure; it never seals, stops or observes anew.
+        def completion_scope!(journal:, events:, params:, map:, commit:)
+          lineage = Molecules::ExecutionScopeLineage.new(events: events, project_id: map.fetch("project_id"),
+            assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
+            mapping_id: params.fetch("mapping_id"))
+          unless lineage.proof_event && !pending_prompt_issuers?(events, journal, commit)
+            raise AttemptErrors::EvidenceUnavailable, "Original scope closure is unavailable"
+          end
+          scope_observer_for(params.fetch("mapping_id")).verify_closed!(lineage)
+          lineage
+        end
+
+        # Reuse the complete immutable inventory/terminal/release owner for
+        # recovery and finish replay; no current process grants terminality.
+        def completion_terminal!(journal:, commit:, params:, map:)
+          entries = inventory_index!(journal, commit, params.fetch("mapping_id"), map).select do |entry|
+            entry.fetch(:selector).values_at("assignment_id", "attempt_id") == params.values_at("assignment_id", "attempt_id")
+          end
+          raise AttemptErrors::NotFound, "Canonical attempt is missing" if entries.empty?
+          raise AttemptErrors::EvidenceUnavailable, "Canonical attempt is ambiguous" unless entries.one?
+          inventory_row!(journal, commit, entries.first)
+        end
+
+        def recovery_observation!(journal:, events:, params:, map:, commit:)
+          state = origin(events, **params.slice("assignment_id", "attempt_id", "mapping_id").transform_keys(&:to_sym))
+          return {"liveness" => "unknown"} unless %w[bound issued].include?(state["phase"])
+          original, original_map = inventory_original_deployment!(journal, events, params.fetch("mapping_id"), map)
+          lineage = Molecules::ExecutionScopeLineage.new(events: events, project_id: original_map.fetch("project_id"),
+            assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"), mapping_id: params.fetch("mapping_id"))
+          return {"liveness" => "unknown"} if lineage.sealed?
+          # Disposable local cache is not a checkpoint authority. Authenticate
+          # the retained original prepared selection with the existing owner.
+          if state.fetch("phase") == "issued"
+            original_prepared_registration!(journal: journal, params: params, commit: commit)
+          else
+            original_bound_prepared_registration!(journal: journal, params: params, commit: commit)
+          end
+          Molecules::AttemptReconciler.protected_observation(kernel: @kernel, binding: state.fetch("process_binding"),
+            observer: maintenance_scope_observer_for(original, params.fetch("mapping_id")), lineage: lineage)
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/launch_campaign_registration.rb

@@ -0,0 +1,214 @@
+# frozen_string_literal: true
+require "ace/review/organisms/campaign_manager"
+require_relative "campaign_consumer_policy"
+
+module Ace
+  module Assign
+    module Authority
+      class LaunchLifecycle
+        # Called by the terminal owner at its selected CAS prefix. Discover
+        # children from canonical registration; no caller list can omit one.
+        def campaign_children_settled!(journal:, commit:, params:, map:)
+          parent = preview_attempt_definition!(journal: journal, commit: commit, params: params, map: map)
+          return true unless parent.review_campaign
+          inventory = journal.canonical_event_inventory!(commit: commit)
+          inventory.fetch("events").each do |assignment, events|
+            next if assignment == params.fetch("assignment_id")
+            registrations = events.select { |event| event.dig("payload", "operation") == "register_assignment" }
+            next if registrations.empty?
+            registration = registrations.last.fetch("payload").fetch("data")
+            child = inventory_definition!(journal, commit,
+              {selector: {"assignment_id" => assignment, "attempt_id" => nil}, registration: registration})
+            execution = child.campaign_execution
+            next unless execution && execution.values_at("parent_assignment_id", "parent_attempt_id") ==
+              params.values_at("assignment_id", "attempt_id")
+            original = control_original_descriptor!(registration.fetch("lifecycle_control"))
+            mapping_id = registration.fetch("mapping_id")
+            child_map = original.mapping(mapping_id)
+            authenticate_inventory_registration!(journal, assignment, events, registration, mapping_id,
+              child_map, commit, inventory.fetch("introductions").fetch(assignment))
+            rows = inventory_index!(journal, commit, mapping_id, child_map).select { |entry|
+              entry.fetch(:selector).fetch("assignment_id") == assignment }
+            unless !rows.empty? && rows.all? { |entry|
+                row = inventory_row!(journal, commit, entry)
+                %w[succeeded failed stopped].include?(row["canonical_state"]) &&
+                  row["terminal_event_id"] && row["reservation_release_event_id"] }
+              raise AttemptErrors::Conflict, "campaign parent has an unsettled registered child"
+            end
+          end
+          true
+        rescue KeyError, TypeError
+          raise AttemptErrors::EvidenceUnavailable, "campaign child completion provenance is unavailable"
+        end
+
+        private
+
+        # Resolve both immutable canonical owners before entering exclusions.
+        def campaign_child_context!(params, context, map, journal)
+          value = if params.key?("definition_bytes")
+            JSON.parse(params.fetch("definition_bytes"))
+          elsif context.fetch(:registration)
+            registration = context.fetch(:registration)
+            bytes = journal.blob(registration.fetch("definition_ref"), commit: context.fetch(:commit))
+            unless bytes.is_a?(String) && bytes.bytesize <= 32_768 &&
+                Digest::SHA256.hexdigest(bytes) == registration.fetch("definition_digest")
+              raise AttemptErrors::EvidenceUnavailable, "campaign definition content differs"
+            end
+            decoded = JSON.parse(bytes, create_additions: false, max_nesting: 32, allow_duplicate_key: false, allow_comments: false)
+            return context unless decoded.is_a?(Hash) && decoded.key?("campaign_execution")
+            inventory_definition!(journal, context.fetch(:commit),
+              {selector: {"assignment_id" => params.fetch("assignment_id"), "attempt_id" => params["attempt_id"]},
+                registration: registration}).to_h
+          else
+            return context
+          end
+          return context unless value.key?("campaign_execution")
+          execution = value.fetch("campaign_execution")
+          unless execution.is_a?(Hash) && execution.keys.sort == CampaignExecution::FIELDS
+            raise ArgumentError, "campaign execution fields differ"
+          end
+          parent_id, attempt = execution.values_at("parent_assignment_id", "parent_attempt_id")
+          token!(parent_id); token!(attempt)
+          raise ArgumentError, "campaign child cannot be its own parent" if parent_id == params.fetch("assignment_id")
+          inventory = journal.canonical_event_inventory!(commit: context.fetch(:commit))
+          reserves = inventory.fetch("events").fetch(parent_id).select { |event|
+            event["attempt_id"] == attempt && event.dig("payload", "operation") == "reserve_attempt" }
+          raise AttemptErrors::EvidenceUnavailable, "campaign parent reservation differs" unless reserves.one?
+          parent_mapping = reserves.first.fetch("payload").fetch("data").fetch("mapping_id")
+          parent_params = {"assignment_id" => parent_id, "attempt_id" => attempt, "mapping_id" => parent_mapping,
+            "scope" => execution.fetch("parent_scope"), "base" => execution.fetch("base"), "head" => execution.fetch("head"),
+            "candidate_generation" => execution.fetch("parent_candidate_generation")}.freeze
+          parent_map = @deployment.mapping(parent_mapping)
+          parent_context = control_registration_context!(parent_params, parent_map, journal, commit: context.fetch(:commit))
+          original_map = parent_context.fetch(:map)
+          parent = preview_attempt_definition!(journal: journal, commit: context.fetch(:commit), params: parent_params, map: original_map)
+          selected = CampaignExecution.validate_parent!(parent.review_campaign)
+          unless value["parent"] == parent_id && value["task_id"] == parent.task_id && value["project_id"] == parent.project_id &&
+              parent.project_id == map.fetch("project_id") &&
+              parent_context.fetch(:selection).fetch("root_identity") == context.fetch(:selection).fetch("root_identity") &&
+              original_map.fetch("authority_id") == context.fetch(:map).fetch("authority_id")
+            raise AttemptErrors::EvidenceUnavailable, "campaign parent task or control owner differs"
+          end
+          CampaignExecution.validate!(execution, parent: parent_id, policy: selected.fetch("policy"))
+          context.merge(campaign: {params: parent_params, map: parent_map, context: parent_context,
+            definition: parent, selected: selected, execution: execution, child_assignment: params.fetch("assignment_id")}.freeze).freeze
+        rescue KeyError, TypeError
+          raise AttemptErrors::EvidenceUnavailable, "campaign parent canonical registration is unavailable"
+        end
+
+        def recheck_campaign_parent!(context, journal, commit: journal.ref_value)
+          campaign = context.fetch(:campaign)
+          parent = campaign.fetch(:context)
+          recheck_control_registration!(parent, campaign.fetch(:params), campaign.fetch(:map), journal,
+            commit: commit, held_exclusion: context.fetch(:exclusion))
+          unless @result_owner&.respond_to?(:campaign_parent_candidate!)
+            raise AttemptErrors::EvidenceUnavailable, "campaign parent candidate owner is unavailable"
+          end
+          @result_owner.campaign_parent_candidate!(journal: journal, commit: commit,
+            params: campaign.fetch(:params), map: parent.fetch(:map))
+          true
+        end
+
+        # Called inside the existing lifecycle exclusions and authority mutex,
+        # before entering the journal mutation; the store lock spans CAS retries.
+        def with_parent_campaign_registration(params, context, replay:)
+          # A stored mutation remains a historical observation after supersession.
+          # The journal still verifies its operation and exact parameters below.
+          return yield if replay
+          if context[:campaign]
+            return with_child_campaign_registration(params, context) { |guard| yield guard }
+          end
+          return yield unless params.key?("definition_bytes")
+          definition = JSON.parse(params.fetch("definition_bytes"))
+          return yield unless definition.key?("review_campaign")
+          selected = CampaignExecution.validate_parent!(definition.fetch("review_campaign"))
+          manager = campaign_manager_for!(context)
+          manager.with_campaign_registration!(selected.fetch("campaign_id"), subject: selected.fetch("subject"),
+            contract_identity: selected.fetch("contract_identity"), policy: selected.fetch("policy")) { yield }
+        rescue KeyError, TypeError, JSON::ParserError, Ace::Review::Atoms::CampaignContract::Invalid
+          raise AttemptErrors::EvidenceUnavailable, "registered parent campaign is unavailable"
+        end
+
+        def campaign_manager_for!(context, **evidence)
+          descriptor = context.fetch(:descriptor)
+          map = context.fetch(:map)
+          project = descriptor.project(map.fetch("project_id"))
+          service = descriptor.authority(map.fetch("authority_id"))
+          %w[campaign_repository campaign_store_root].each do |key|
+            path = project.fetch(key)
+            wire.root_path!(path, directory: true, owner: service.fetch("uid"))
+            unless (File.stat(path).mode & 0o077).zero?
+              raise AttemptErrors::EvidenceUnavailable, "campaign owner root must remain private"
+            end
+          end
+          store = Ace::Review::Molecules::CampaignStore.new(root: project.fetch("campaign_store_root"))
+          Ace::Review::Organisms::CampaignManager.new(repo_root: project.fetch("campaign_repository"), store: store, **evidence)
+        end
+
+        def with_child_campaign_registration(params, context)
+          campaign = context.fetch(:campaign)
+          recheck_campaign_parent!(context, journals.fetch(context.fetch(:map).fetch("project_id")))
+          manager = campaign_manager_for!(campaign.fetch(:context))
+          deployment = @deployment
+          descriptor_sha = protected_descriptor_sha256!
+          policy_ref = deployment.project(context.fetch(:map).fetch("project_id")).fetch("campaign_policy")
+          CampaignConsumerPolicy.new.with(policy_ref) do |profiles, artifacts|
+            manager.with_execution_round!(campaign.fetch(:execution).fetch("campaign_id"),
+              round_id: campaign.fetch(:execution).fetch("round_id"), consumer_profiles: profiles) do |round, round_guard|
+              selected = campaign.fetch(:selected)
+              unless round.slice("campaign_id", "subject", "contract_identity", "policy") == selected.reject { |key, _| key == "version" }
+                raise AttemptErrors::EvidenceUnavailable, "campaign child differs from original parent contract"
+              end
+              CampaignExecution.validate_round!(campaign.fetch(:execution), parent: campaign.fetch(:definition).id, round: round)
+              guard = lambda do |journal, commit|
+                unless @deployment.equal?(deployment) && protected_descriptor_sha256! == descriptor_sha
+                  raise AttemptErrors::Conflict, "current campaign policy descriptor changed"
+                end
+                artifacts.verify_unchanged!
+                round_guard.call
+                recheck_campaign_parent!(context, journal, commit: commit)
+                unique_campaign_child!(context, journal, commit) if params.key?("definition_bytes")
+              end
+              yield guard
+            end
+          end
+        rescue KeyError, TypeError, Ace::Review::Atoms::CampaignContract::Invalid, Ace::Runtime::RuntimeUnavailableError
+          raise AttemptErrors::EvidenceUnavailable, "campaign child pinned round is unavailable"
+        end
+
+        # One immutable phase definition, discovered from the existing canonical
+        # registration owner. A caller-provided child list cannot omit a sibling.
+        def unique_campaign_child!(context, journal, commit)
+          selected = context.fetch(:campaign).fetch(:execution)
+          fields = %w[parent_assignment_id parent_attempt_id parent_candidate_generation round_id phase]
+          fields += case selected.fetch("phase")
+          when "collection" then ["review_scope"]
+          when "check" then ["check_name"]
+          else []
+          end
+          inventory = journal.canonical_event_inventory!(commit: commit)
+          inventory.fetch("events").each do |assignment, events|
+            next if assignment == context.fetch(:campaign).fetch(:definition).id
+            events.select { |event| event.dig("payload", "operation") == "register_assignment" }.each do |event|
+              registration = event.fetch("payload").fetch("data")
+              entry = {selector: {"assignment_id" => assignment, "attempt_id" => nil}, registration: registration}
+              definition = inventory_definition!(journal, commit, entry)
+              child = definition.campaign_execution
+              next unless child && child.slice(*fields) == selected.slice(*fields)
+              # Re-registration of this exact child is permitted; a distinct
+              # assignment cannot replace the retained phase owner.
+              current_assignment = context.fetch(:campaign).fetch(:child_assignment)
+              next if assignment == current_assignment
+              original = control_original_descriptor!(registration.fetch("lifecycle_control"))
+              map_id = registration.fetch("mapping_id")
+              authenticate_inventory_registration!(journal, assignment, events, registration, map_id,
+                original.mapping(map_id), commit, inventory.fetch("introductions").fetch(assignment))
+              raise AttemptErrors::Conflict, "campaign phase already has a registered child"
+            end
+          end
+          true
+        end
+      end
+    end
+  end
+end