ace-assign 0.64.0 → 0.66.1

data/lib/ace/assign/authority/maintenance_workspace_retirement.rb

@@ -0,0 +1,229 @@
+# frozen_string_literal: true
+require_relative "../molecules/execution_scope_lineage"
+require "json"
+
+module Ace
+  module Assign
+    module Authority
+      # Source capabilities only. A serialized descriptor is not admission.
+      module MaintenanceWorkspaceRetirement
+        SCHEMA = "ace.maintenance-workspace-retirement/v1"
+        TARGET_FIELDS = %w[project_id mapping_id assignment_id attempt_id resource journal_commit binding_event_digest release_event_digest descriptor_sha256].freeze
+        INVOCATION_FIELDS = %w[request_id input_digest operation_owner_binding_digest dispatch_event_digest].freeze
+        REFERENCES = {
+          "captured" => %w[intent captured preservation],
+          "removed" => %w[intent captured preservation removal fence],
+          "completed" => %w[intent captured preservation removal fence receipt]
+        }.freeze
+
+        def self.immutable(value)
+          case value
+          when Hash then value.to_h { |key, item| [key.dup.freeze, immutable(item)] }.freeze
+          when Array then value.map { |item| immutable(item) }.freeze
+          when String then value.dup.freeze
+          else value.freeze
+          end
+        end
+
+        def self.unavailable!(message)
+          raise AttemptErrors::EvidenceUnavailable, message
+        end
+
+        class Evidence
+          attr_reader :descriptor, :owner
+
+          # Only the installed adapter mints this after validating its complete
+          # collection. Consumers additionally bind the exact adapter instance,
+          # original canonical projection and held operation before using it.
+          def self.mint!(owner:, descriptor:)
+            new(owner: owner, descriptor: descriptor)
+          end
+          private_class_method :new
+
+          def initialize(owner:, descriptor:)
+            @owner = owner
+            MaintenanceWorkspaceRetirement.unavailable!("retirement evidence descriptor is not an object") unless descriptor.is_a?(Hash)
+            @descriptor = MaintenanceWorkspaceRetirement.immutable(descriptor)
+            @thread = Thread.current
+            @consumption = nil
+            @expired = false
+            validate_descriptor!
+          rescue KeyError, TypeError, ArgumentError
+            MaintenanceWorkspaceRetirement.unavailable!("retirement evidence descriptor differs")
+          end
+
+          def verify!(owner:, target:, projection:, phase:, deadline:)
+            unless !@expired && @thread.equal?(Thread.current) && @owner.equal?(owner) && descriptor.fetch("target") == target &&
+                descriptor.fetch("phase") == phase && descriptor.fetch("resource") == projection.fetch("workspace_resource")
+              MaintenanceWorkspaceRetirement.unavailable!("retirement evidence original owner or selection differs")
+            end
+            identities = projection.fetch("resource_identities")
+            root = projection.fetch("worker_cwd")
+            expected = projection.fetch("parent_resource_declarations").filter_map do |declaration|
+              path = declaration.fetch("host_path")
+              next unless declaration.fetch("stage") == "parent" && (path == root || path.start_with?(root + "/"))
+              matches = identities.select { |row| row.values_at("host_path", "view_path") == declaration.values_at("host_path", "view_path") }
+              MaintenanceWorkspaceRetirement.unavailable!("retirement declared row has no unique original identity") unless matches.one?
+              matches.first
+            end.sort_by { |row| row.values_at("host_path", "view_path") }
+            unless descriptor.fetch("covered_resources").map { |row| row.fetch("original") } == expected
+              MaintenanceWorkspaceRetirement.unavailable!("retirement evidence covered resources are not exhaustive")
+            end
+            @owner.verify_retirement_evidence!(evidence: self, projection: projection, deadline: deadline)
+            true
+          end
+
+          def expire! = @expired = true
+
+          def covered_resource(path)
+            descriptor.fetch("covered_resources").find { |entry| entry.fetch("original").fetch("host_path") == path }
+          end
+
+          def verify_consumption!
+            unless !@expired && @consumption && @thread.equal?(Thread.current)
+              MaintenanceWorkspaceRetirement.unavailable!("retirement evidence is outside its held observation")
+            end
+            true
+          end
+
+          def with_consumption(verification)
+            MaintenanceWorkspaceRetirement.unavailable!("retirement observation cannot be nested") if @consumption
+            installed = true
+            @consumption = verification
+            verify_consumption!
+            verification.call
+            result = yield
+            verify_consumption!
+            verification.call
+            result
+          ensure
+            @consumption = nil if installed
+          end
+
+          private
+
+          def validate_descriptor!
+            fields = %w[schema phase target resource covered_resources invocation refs]
+            target = descriptor.fetch("target")
+            invocation = descriptor.fetch("invocation")
+            phase = descriptor.fetch("phase")
+            unless descriptor.keys.sort == fields.sort && descriptor.fetch("schema") == SCHEMA && REFERENCES.key?(phase) &&
+                target.is_a?(Hash) && target.keys.sort == TARGET_FIELDS.sort &&
+                invocation.is_a?(Hash) && invocation.keys.sort == INVOCATION_FIELDS.sort
+              MaintenanceWorkspaceRetirement.unavailable!("retirement evidence is not a closed supported descriptor")
+            end
+            resource!(descriptor.fetch("resource"))
+            unless target.fetch("resource") == "workspace:#{target.fetch('project_id')}:#{target.fetch('mapping_id')}:#{target.fetch('assignment_id')}" &&
+                %w[project_id mapping_id assignment_id attempt_id].all? { |key| token?(target[key]) } &&
+                target.fetch("journal_commit").is_a?(String) && target.fetch("journal_commit").match?(/\A[0-9a-f]{40}\z/) &&
+                %w[binding_event_digest release_event_digest descriptor_sha256].all? { |key| digest?(target[key]) } &&
+                token?(invocation.fetch("request_id")) && (INVOCATION_FIELDS - ["request_id"]).all? { |key| digest?(invocation[key]) }
+              MaintenanceWorkspaceRetirement.unavailable!("retirement evidence selectors differ")
+            end
+            covered = descriptor.fetch("covered_resources")
+            unless covered.is_a?(Array) && covered.size.between?(1, 64)
+              MaintenanceWorkspaceRetirement.unavailable!("retirement evidence covered inventory differs")
+            end
+            covered.each do |entry|
+              unless entry.is_a?(Hash) && entry.keys.sort == %w[captured_host_path original] && path?(entry["captured_host_path"])
+                MaintenanceWorkspaceRetirement.unavailable!("retirement evidence covered row differs")
+              end
+              resource!(entry.fetch("original"))
+            end
+            unless covered.map { |entry| entry.fetch("original") }.uniq.size == covered.size &&
+                covered.map { |entry| entry.fetch("captured_host_path") }.uniq.size == covered.size
+              MaintenanceWorkspaceRetirement.unavailable!("retirement evidence covered rows repeat")
+            end
+            roots = covered.select { |entry| entry.fetch("original") == descriptor.fetch("resource") }
+            unless roots.one? && covered.all? { |entry|
+                original = entry.fetch("original").fetch("host_path")
+                root = descriptor.fetch("resource").fetch("host_path")
+                (original == root || original.start_with?(root + "/")) &&
+                  entry.fetch("captured_host_path") == roots.first.fetch("captured_host_path") + original.delete_prefix(root) }
+              MaintenanceWorkspaceRetirement.unavailable!("retirement evidence captured paths do not match exact relative resources")
+            end
+            refs = descriptor.fetch("refs")
+            unless refs.is_a?(Hash) && refs.keys.sort == REFERENCES.fetch(phase).sort
+              MaintenanceWorkspaceRetirement.unavailable!("retirement evidence reference set differs")
+            end
+            refs.each_value do |ref|
+              unless ref.is_a?(Hash) && ref.keys.sort == %w[bytes path sha256] && path?(ref["path"]) && digest?(ref["sha256"]) &&
+                  ref["bytes"].is_a?(Integer) && ref["bytes"].between?(1, 64 * 1024 * 1024)
+                MaintenanceWorkspaceRetirement.unavailable!("retirement evidence reference differs")
+              end
+            end
+          end
+
+          def token?(value) = value.is_a?(String) && value.match?(/\A[A-Za-z0-9][A-Za-z0-9._:-]{0,127}\z/)
+          def digest?(value) = value.is_a?(String) && value.match?(/\A[0-9a-f]{64}\z/)
+          def path?(value)
+            value.is_a?(String) && value.valid_encoding? && value.bytesize.between?(1, 4096) &&
+              value.start_with?("/") && !value.include?("\0") && File.expand_path(value) == value
+          end
+          def resource!(value)
+            unless value.is_a?(Hash) && value.keys.sort == Molecules::ExecutionScopeLineage::RESOURCE_FIELDS.sort &&
+                %w[host_path view_path].all? { |key| path?(value[key]) } &&
+                %w[mount_id device inode].all? { |key| value[key].is_a?(Integer) && value[key].positive? } &&
+                %w[uid gid].all? { |key| value[key].is_a?(Integer) && value[key] >= 0 } &&
+                %w[ext4 xfs btrfs tmpfs].include?(value["filesystem_type"])
+              MaintenanceWorkspaceRetirement.unavailable!("retirement evidence resource identity differs")
+            end
+          end
+        end
+        class Session
+          attr_reader :projection
+          def self.open!(**arguments) = new(**arguments)
+          private_class_method :new
+
+          def initialize(lifecycle:, mapping_id:, journal:, commit:, target:, projection:, evidence_owner:, deadline:, contexts:)
+            @lifecycle, @mapping_id, @journal, @commit = lifecycle, mapping_id, journal, commit
+            @target, @projection = MaintenanceWorkspaceRetirement.immutable(target), projection
+            @owner, @deadline, @contexts = evidence_owner, deadline, contexts
+            @thread, @active, @phase = Thread.current, true, nil
+            @evidences = []
+            @writer = @owner.retirement_workspace_writer!
+            unless @writer.is_a?(Molecules::LifecycleExclusion::WorkspaceWriter) && @writer.projection == projection.fetch("workspace_exclusion")
+              MaintenanceWorkspaceRetirement.unavailable!("retirement session requires the original maintained workspace writer")
+            end
+            verify_held!
+          end
+
+          def verify_captured!(evidence:) = verify_phase!("captured", evidence)
+          def verify_removed!(evidence:) = verify_phase!("removed", evidence)
+          def close!
+            @active = false
+            @evidences.each(&:expire!)
+          end
+
+          private
+
+          def verify_held!
+            unless @active && @thread.equal?(Thread.current) &&
+                Thread.current[:ace_assign_maintenance_contexts]&.[](@lifecycle.object_id).equal?(@contexts)
+              MaintenanceWorkspaceRetirement.unavailable!("retirement session no longer owns complete maintenance contexts")
+            end
+            @lifecycle.send(:maintenance_deadline!, @deadline)
+            @lifecycle.send(:require_maintenance_context!, @mapping_id, @journal, @commit)
+            @writer.verify_unchanged!
+          end
+
+          def verify_phase!(phase, evidence)
+            unless evidence.is_a?(Evidence) && (phase == "captured" && @phase.nil? || phase == "removed" && @phase == "captured")
+              MaintenanceWorkspaceRetirement.unavailable!("retirement session phase or evidence differs")
+            end
+            @evidences << evidence
+            verify = -> {
+              verify_held!
+              evidence.verify!(owner: @owner, target: @target, projection: @projection, phase: phase, deadline: @deadline)
+            }
+            evidence.with_consumption(verify) do
+              @lifecycle.send(:verify_retirement_contexts!, evidence: evidence, deadline: @deadline)
+            end
+            @phase = phase
+            true
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/original_inbox_selection.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+module Ace
+  module Assign
+    module Authority
+      # Original descriptor selection shared by canonical Inbox consumers.
+      # The held historical manifest/key owner supplies the exact artifact.
+      class OriginalInboxSelection
+        def initialize(history:, authority_id:)
+          @history, @authority_id = history, authority_id
+        end
+
+        def load!(events:, params:, map:, journal:, commit:)
+          provisioning = events.select { |event| event["type"] == "scope_provisioning" }
+          reservations = events.select { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "reserve_attempt" }
+          unless provisioning.one? && reservations.one?
+            raise AttemptErrors::EvidenceUnavailable, "context completion original selection is ambiguous"
+          end
+          identity = provisioning.first.fetch("payload")
+          reserved = reservations.first.fetch("payload").fetch("data")
+          original = @history.descriptor!(sha256: identity.fetch("descriptor_sha256"))
+          selected = original.mapping(params.fetch("mapping_id"))
+          unless identity.keys.sort == %w[deployment_digest descriptor_sha256 reservation_generation slot_id] &&
+              reserved.values_at("project_id", "assignment_id", "attempt_id", "mapping_id") ==
+                [map.fetch("project_id"), params.fetch("assignment_id"), params.fetch("attempt_id"), params.fetch("mapping_id")] &&
+              identity.fetch("reservation_generation") == reserved.fetch("reservation_generation") &&
+              identity.fetch("deployment_digest") == original.mapping_digest(params.fetch("mapping_id")) &&
+              selected.fetch("project_id") == map.fetch("project_id") && selected.fetch("authority_id") == @authority_id &&
+              identity.fetch("slot_id") == selected.fetch("execution_scope").fetch("slot_id") &&
+              original.project(selected.fetch("project_id")).values_at("journal_repository", "evidence_git_ref", "evidence_checkout_root") ==
+                [journal.repo_root, journal.ref, journal.checkout_root]
+            raise AttemptErrors::EvidenceUnavailable, "context completion original association differs"
+          end
+          journal.event_commit!(assignment_id: params.fetch("assignment_id"), event_digest: provisioning.first.fetch("digest"), commit: commit)
+          [original, selected]
+        end
+
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/posix_acl.rb

@@ -7,12 +7,15 @@ module Ace
       # Linux POSIX access ACL evaluation for a fixed unprivileged principal.
       # No credential switching; unsupported or unreadable policy refuses admission.
       class PosixAcl
-        def entries(path)
+        def entries(path, attribute: "system.posix_acl_access")
+          unless %w[system.posix_acl_access system.posix_acl_default].include?(attribute)
+            raise ArgumentError, "unsupported POSIX ACL attribute"
+          end
           raise Ace::Runtime::RuntimeUnavailableError, "receiver ACL inspection requires Linux" unless RUBY_PLATFORM.include?("linux")
           function = Fiddle::Function.new(Fiddle::Handle::DEFAULT["lgetxattr"],
             [Fiddle::TYPE_VOIDP, Fiddle::TYPE_VOIDP, Fiddle::TYPE_VOIDP, Fiddle::TYPE_SIZE_T], Fiddle::TYPE_SSIZE_T)
           buffer = Fiddle::Pointer.malloc(8192, Fiddle::RUBY_FREE)
-          count = function.call(path, "system.posix_acl_access", buffer, 8192)
+          count = function.call(path, attribute, buffer, 8192)
           return nil if count == -1 && Fiddle.last_error == Errno::ENODATA::Errno
           raise Ace::Runtime::RuntimeUnavailableError, "receiver access ACL is unreadable" if count < 4 || (count - 4) % 8 != 0
           bytes = buffer[0, count]

data/lib/ace/assign/authority/prepared_input.rb

@@ -0,0 +1,130 @@
+# frozen_string_literal: true
+
+require "shellwords"
+require_relative "client"
+require_relative "prepared_work"
+
+module Ace
+  module Assign
+    module Authority
+      # One authenticated original fetch and one immutable verified work graph.
+      # Caller identifiers select; the maintained Client/Endcap authenticates.
+      class PreparedInput
+        attr_reader :descriptor, :work, :working_directory
+
+        def self.fetch(client:, assignment_id:, attempt_id:)
+          reply = client.call("evidence_fetch", {"assignment_id" => assignment_id, "attempt_id" => attempt_id,
+            "kind" => "prepared_work", "purpose_id" => "original_prepared_work", "artifact_id" => "prepared_bundle"},
+            download: true, purpose: :candidate, timeout: 30)
+          new(reply: reply, candidate_loader: -> {
+            client.call("evidence_fetch", {"assignment_id" => assignment_id, "attempt_id" => attempt_id,
+              "kind" => "campaign_candidate", "purpose_id" => "original_campaign_candidate", "artifact_id" => "candidate_bundle"},
+              download: true, purpose: :candidate, timeout: 30)
+          })
+        end
+
+        def initialize(reply:, candidate_reply: nil, candidate_loader: nil)
+          @descriptor = reply.data.fetch("descriptor")
+          Molecules::LifecycleExclusion.workspace_reader(projection: descriptor.fetch("workspace_exclusion"))
+          unless descriptor.dig("workspace_exclusion", "root_resource", "view_path") ==
+              "/run/ace/lifecycle-exclusion/#{descriptor.fetch('mapping_id')}"
+            raise AttemptErrors::EvidenceUnavailable, "prepared_input_unavailable: original lifecycle mapping differs"
+          end
+          unless reply.parts.is_a?(Array) && reply.parts.one?
+            raise AttemptErrors::EvidenceUnavailable, "prepared_input_unavailable: one original bundle required"
+          end
+          root = PrivateDirectory.verify!(descriptor.fetch("original_worker_scratch_root"))
+          @work = PreparedWork.admit(bytes: reply.parts.first, head: descriptor.fetch("prepared_head"),
+            tree: descriptor.fetch("prepared_tree"), sha256: descriptor.fetch("sha256"), size: descriptor.fetch("bytes"), root: root)
+          expected = work.reference(head: descriptor.fetch("prepared_head"), tree: descriptor.fetch("prepared_tree"))
+          definition = work.definition_bytes(head: descriptor.fetch("prepared_head"), tree: descriptor.fetch("prepared_tree"))
+          unless expected == descriptor.slice(*expected.keys) &&
+              descriptor.values_at("assignment_id", "project_id") == work.manifest.values_at("assignment_id", "project_id") &&
+              Digest::SHA256.hexdigest(definition) == descriptor.fetch("definition_digest")
+            raise AttemptErrors::EvidenceUnavailable, "prepared_input_mismatch: original graph association"
+          end
+          execution = work.definition["campaign_execution"]
+          if execution
+            candidate_reply ||= candidate_loader&.call
+            candidate = candidate_reply&.data&.fetch("descriptor")
+            unless candidate.is_a?(Hash) && candidate.keys.sort == %w[head tree bytes sha256 candidate_generation campaign_execution mapping_id assignment_id attempt_id project_id original_worker_identity original_worker_scratch_root original_binding_digest].sort &&
+                candidate.slice("mapping_id", "assignment_id", "attempt_id", "project_id", "original_worker_identity", "original_worker_scratch_root", "original_binding_digest") ==
+                  descriptor.slice("mapping_id", "assignment_id", "attempt_id", "project_id", "original_worker_identity", "original_worker_scratch_root", "original_binding_digest") &&
+                candidate.fetch("campaign_execution") == execution && candidate.fetch("head") == execution.fetch("head") &&
+                candidate.fetch("candidate_generation") == execution.fetch("parent_candidate_generation") &&
+                candidate_reply.parts.is_a?(Array) && candidate_reply.parts.one?
+              raise AttemptErrors::EvidenceUnavailable, "campaign original candidate input differs"
+            end
+            materialized = CandidateTransfer.new(root: root).materialize_repository(bytes: candidate_reply.parts.first,
+              sha256: candidate.fetch("sha256"), size: candidate.fetch("bytes"), head: candidate.fetch("head"),
+              tree: candidate.fetch("tree"), root: root)
+            @working_directory = materialized.fetch("directory").freeze
+          elsif candidate_reply
+            raise AttemptErrors::EvidenceUnavailable, "ordinary prepared input forbids a campaign candidate"
+          end
+          @descriptor = JSON.parse(JSON.generate(descriptor))
+          pending = [@descriptor]
+          until pending.empty?
+            value = pending.pop
+            pending.concat(value.values) if value.is_a?(Hash)
+            pending.concat(value) if value.is_a?(Array)
+            value.freeze
+          end
+          freeze
+        end
+
+        def render(text)
+          values = descriptor.slice("mapping_id", "assignment_id", "scope", "attempt_id")
+          rendered = +""
+          cursor = 0
+          # Only an opening delimiter introduces a token. Closing braces in
+          # literal JSON are preserved; inserted selector values are not parsed.
+          while (opening = text.index("{{", cursor))
+            rendered << text[cursor...opening]
+            closing = text.index("}}", opening + 2)
+            unless closing
+              raise AttemptErrors::EvidenceUnavailable, "prepared_input_invalid: unresolved instruction token"
+            end
+            token = text[(opening + 2)...closing]
+            if token.include?("{") || token.include?("}")
+              raise AttemptErrors::EvidenceUnavailable, "prepared_input_invalid: unresolved instruction token"
+            end
+            field = token.delete_prefix("admitted.")
+            unless token == "admitted." + field && values.key?(field)
+              raise AttemptErrors::EvidenceUnavailable, "prepared_input_invalid: unknown instruction token"
+            end
+            rendered << Shellwords.escape(values.fetch(field))
+            cursor = closing + 2
+          end
+          rendered << text[cursor..]
+          rendered.freeze
+        end
+
+        def drive_prompt
+          target = Shellwords.escape(descriptor.fetch("assignment_id") + "@" + descriptor.fetch("scope"))
+          selectors = "--assignment #{target} --mapping #{Shellwords.escape(descriptor.fetch('mapping_id'))} --attempt #{Shellwords.escape(descriptor.fetch('attempt_id'))}"
+          instructions = ["Drive the authenticated captured assignment subtree. Use ace-assign status #{selectors}, step #{selectors}, start #{selectors}, finish #{selectors} --message REPORT, and fail #{selectors} --message REASON. Do not fork-run, add, retry, renumber, or expand another graph."]
+          if (execution = work.definition["campaign_execution"])
+            instructions << "This is a registered campaign #{execution.fetch('phase')} child. The provider working directory is the private authenticated parent candidate repository at #{Shellwords.escape(execution.fetch('head'))}, with original base #{Shellwords.escape(execution.fetch('base'))}. Do not edit or advance that candidate. Execute the captured #{Shellwords.escape(execution.fetch('operation'))} phase and retain its actual #{Shellwords.escape(execution.fetch('check_name'))} check and report artifacts. Submit an ordinary campaign-free result (campaign null), operation #{Shellwords.escape(execution.fetch('operation'))}, exact original head/base, and actual check outcome. The existing independent reviewer must validate those same artifact bytes; an approval child must retain the exact canonical independent review actor/verdict. No session metadata or completed queue step counts as a settled R1 campaign round."
+          end
+          original = "--mapping #{Shellwords.escape(descriptor.fetch('mapping_id'))} --assignment #{Shellwords.escape(descriptor.fetch('assignment_id'))} --attempt #{Shellwords.escape(descriptor.fetch('attempt_id'))}"
+          instructions << "Before the original worker exits, explicitly submit its tested candidate and real execution result through the protected authority. Queue completion is not candidate/result acceptance. Read ace-assign authority status #{original}; persist its authority_generation with the complete next command arguments and ordered byte inputs. For each NEW operation use a new explicit mutation and a newly selected generation; for exact retries preserve the original generation, mutation and bytes."
+          instructions << "Submit one prepared Git bundle: ace-assign submit-candidate #{original} --head HEAD --candidate-generation CURRENT_CANDIDATE --expected-generation G --mutation CANDIDATE_MUTATION --bundle FILE. Select CURRENT_CANDIDATE from status result_candidate_generation, using 0 when null. Persist the returned candidate_generation and head as REVIEWED_CANDIDATE and HEAD; never derive the next counter by arithmetic or from queue completion."
+          instructions << "Have an independent installed reviewer run ace-overseer review --project #{Shellwords.escape(descriptor.fetch('project_id'))} --agent #{Shellwords.escape(descriptor.fetch('mapping_id'))} --assignment #{Shellwords.escape(descriptor.fetch('assignment_id'))} --attempt #{Shellwords.escape(descriptor.fetch('attempt_id'))} --head HEAD --candidate-generation REVIEWED_CANDIDATE --expected-generation G --mutation REVIEW_REQUEST --accept-mutation REVIEW_ACCEPT. Do not impersonate that principal. The review consumer owns actual candidate export, independent checks and canonical acceptance. After review, read authority status again before the first result submission."
+          instructions << "Produce the real receipt with Ace::Assign::Models::ExecutionReceipt.new/to_h: original assignment/attempt/project and scope #{Shellwords.escape(descriptor.fetch('scope'))}, exact tested candidate head, installed worker actor/role worker/runtime herdr, actual operation/verdict/executed checks and ordered artifact path/SHA256 pairs. No invented successful check or queue-to-receipt conversion. Submit JSON bytes and matching ordered artifact files with ace-assign submit-result #{original} --head HEAD --candidate-generation REVIEWED_CANDIDATE --expected-generation G --mutation RESULT_MUTATION --receipt FILE --artifact FILE ... . Failed empty artifacts use no --artifact; succeeded requires evidence. Supervisor finish is separate and revalidates result, independent review and no-writer/settlement proof."
+          instructions << "For an authorized merge step captured INSIDE this subtree, use the protected delivery rule in wfi://assign/drive. Never execute an outer preset step or expand this graph. Retain the exact approved candidate, structured input bytes, authorization and request ID before the first request; select authority_generation for that new request only."
+          service = "--project #{Shellwords.escape(descriptor.fetch('project_id'))} #{original} --scope #{Shellwords.escape(descriptor.fetch('scope'))} --candidate-head HEAD --candidate-generation REVIEWED_CANDIDATE"
+          instructions << "Request the uniquely installed authorized merge receiver: ace-lab service request #{service} --service SERVICE --operation merge --authorization AUTHORIZATION --request-id REQUEST --expected-generation G --input INPUT_FILE. Credentials alone are not authorization. Persist the returned original input_digest and target with all request arguments. Lost/uncertain replies never permit another effect or refreshed-generation retry."
+          instructions << "Inspect the same request: ace-lab service status #{service} --request REQUEST --input-digest INPUT_DIGEST --target TARGET. Only canonical succeeded evidence permits ace-assign delivery #{original} --scope #{Shellwords.escape(descriptor.fetch('scope'))} --operation merge --service-request REQUEST --candidate-head HEAD --candidate-generation REVIEWED_CANDIDATE --input-digest INPUT_DIGEST --target TARGET. This consumption verifies the imported receipt and never executes merge. Refusal, unavailable or uncertain leaves the active delivery step unfinished; report its exact blocker. Finish the queue step only after succeeded canonical delivery."
+          work.manifest.fetch("context").each do |entry|
+            instructions << render(work.files.fetch(entry.fetch("text").fetch("filename")))
+          end
+          work.manifest.fetch("steps").each do |entry|
+            instructions << "Step #{entry.fetch('number')}:\n" + render(work.parse_queue_step!(work.files.fetch("steps/" + entry.fetch("filename"))).fetch(:body))
+          end
+          instructions.join("\n\n").freeze
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/prepared_queue.rb

@@ -0,0 +1,185 @@
+# frozen_string_literal: true
+
+require "fileutils"
+require "securerandom"
+require "yaml"
+require_relative "prepared_work"
+require_relative "private_directory"
+require_relative "../molecules/lifecycle_exclusion"
+require_relative "../organisms/assignment_executor"
+
+module Ace
+  module Assign
+    module Authority
+      # Existing assignment/progress files, rooted only in the authenticated
+      # original worker scratch. This cache never supplies authority or a graph.
+      class PreparedQueue
+        attr_reader :cache_base, :directory, :work, :descriptor
+
+        def initialize(work:, descriptor:)
+          @work, @descriptor = work, descriptor
+          @scratch = PrivateDirectory.verify!(descriptor.fetch("original_worker_scratch_root"))
+          %w[mapping_id attempt_id assignment_id].each do |field|
+            value = descriptor.fetch(field)
+            unavailable!("queue identity") unless value.is_a?(String) && value.match?(PreparedWork::TOKEN)
+          end
+          @cache_base = File.join(@scratch, "prepared-queues", descriptor.fetch("mapping_id"), descriptor.fetch("attempt_id"))
+          @directory = File.join(cache_base, descriptor.fetch("assignment_id"))
+          definition = JSON.parse(work.definition_bytes(head: descriptor.fetch("prepared_head"), tree: descriptor.fetch("prepared_tree")))
+          unavailable!("captured assignment metadata") unless %w[name source_config created_at].all? do |field|
+            definition[field].is_a?(String) && !definition[field].empty?
+          end
+          validate_timestamp!(definition.fetch("created_at"))
+          validate_timestamp!(definition["updated_at"]) if definition.key?("updated_at")
+          @metadata = Models::Assignment.from_h(definition, cache_dir: directory).to_h
+          lock_root = File.join(@scratch, "prepared-queue-exclusion")
+          private_directory!(lock_root, create: true)
+          @exclusion = Molecules::LifecycleExclusion.new(root: lock_root)
+          @key = @exclusion.assignment_key(descriptor.values_at("mapping_id", "attempt_id", "assignment_id").join(":"))
+        end
+
+        # Called ONLY after the fixed adapter proves actual original self. Later
+        # CLI consumers use with_executor and cannot recreate a missing queue.
+        def activate_original!
+          @exclusion.with_exclusive(@key) do
+            publish_initial! unless File.exist?(directory) || File.symlink?(directory)
+            executor = verified_executor
+            result = executor.status
+            state = result.fetch(:state)
+            unavailable!("selected queue has failed progress") unless state.failed.empty?
+            return nil if state.subtree_complete?(descriptor.fetch("scope"))
+            unless state.steps.all? { |step| step.status == :pending }
+              unavailable!("original adapter has already activated queue progress")
+            end
+            root = state.find_by_number(descriptor.fetch("scope"))
+            unavailable!("original selected fork root") unless root && root.fork?
+            executor.step_writer.mark_active(root.file_path)
+            # Same held-byte consumer validates the resulting progress before
+            # returning to the adapter that may now start its provider.
+            executor.status
+            root
+          end
+        end
+
+        def with_executor
+          @exclusion.with_exclusive(@key) do
+            unavailable!("published queue is unavailable; no reconstruction") unless File.directory?(directory)
+            yield verified_executor
+          end
+        end
+
+        private
+
+        def verified_executor
+          private_directory!(directory)
+          private_directory!(File.join(directory, "steps"))
+          private_directory!(File.join(directory, "reports"))
+          metadata = work.parse_queue_metadata!(held_read(File.join(directory, "assignment.yaml"), PreparedWork::MAX_MANIFEST))
+          unavailable!("queue assignment metadata differs") unless metadata.is_a?(Hash) &&
+            metadata.reject { |key, _| key == "updated_at" } == @metadata.reject { |key, _| key == "updated_at" }
+          validate_timestamp!(metadata["updated_at"]) if metadata.key?("updated_at")
+          unavailable!("queue job differs") unless held_read(File.join(directory, "job.yaml"), PreparedWork::MAX_TEXT) == work.files.fetch("job.yaml")
+          owner = self
+          scanner = Molecules::QueueScanner.new
+          parser = scanner.method(:scan_captured)
+          scanner.define_singleton_method(:scan) do |steps_dir, assignment:|
+            raise AttemptErrors::EvidenceUnavailable, "prepared queue scanner path differs" unless steps_dir == File.join(owner.directory, "steps")
+            steps, reports = owner.send(:captured_queue)
+            parser.call(steps: steps, assignment: assignment, reports: reports)
+          end
+          Organisms::AssignmentExecutor.new(cache_base: cache_base,
+            selected_assignment: Models::Assignment.from_h(metadata, cache_dir: directory), queue_scanner: scanner)
+        end
+
+        def captured_queue
+          expected = work.manifest.fetch("steps").map { |entry| entry.fetch("filename") }
+          steps_dir = File.join(directory, "steps")
+          unavailable!("queue step inventory differs") unless Dir.children(steps_dir).sort == expected.sort
+          steps = expected.to_h do |filename|
+            bytes = held_read(File.join(steps_dir, filename), PreparedWork::MAX_TEXT)
+            parsed = work.parse_queue_step!(bytes)
+            accepted = work.parse_queue_step!(work.files.fetch("steps/" + filename))
+            projection = ->(value) { value.fetch(:frontmatter).reject { |key, _| PreparedWork::PROGRESS.include?(key) } }
+            unless projection.call(parsed) == projection.call(accepted) && parsed.fetch(:body) == accepted.fetch(:body) &&
+                %w[pending active done failed].include?(parsed.fetch(:frontmatter).fetch("status", "pending"))
+              unavailable!("queue work-bearing input differs")
+            end
+            [filename, bytes]
+          end
+          reports_dir = File.join(directory, "reports")
+          allowed = work.manifest.fetch("steps").map do |entry|
+            name = work.parse_queue_step!(work.files.fetch("steps/" + entry.fetch("filename"))).fetch(:frontmatter).fetch("name")
+            Atoms::StepFileParser.generate_report_filename(entry.fetch("number"), name)
+          end
+          reports = Dir.children(reports_dir).to_h do |filename|
+            unavailable!("queue report inventory differs") unless allowed.include?(filename)
+            bytes = held_read(File.join(reports_dir, filename), PreparedWork::MAX_TEXT)
+            work.parse_queue_step!(bytes)
+            [filename, bytes]
+          end
+          [steps.freeze, reports.freeze]
+        end
+
+        def publish_initial!
+          private_directory!(File.join(@scratch, "prepared-queues"), create: true)
+          private_directory!(File.dirname(cache_base), create: true)
+          private_directory!(cache_base, create: true)
+          stage = File.join(cache_base, ".prepared-#{SecureRandom.hex(12)}")
+          Dir.mkdir(stage, 0700)
+          %w[steps reports].each { |name| Dir.mkdir(File.join(stage, name), 0700) }
+          durable_write(File.join(stage, "assignment.yaml"), @metadata.to_yaml)
+          durable_write(File.join(stage, "job.yaml"), work.files.fetch("job.yaml"))
+          work.manifest.fetch("steps").each do |entry|
+            name = entry.fetch("filename")
+            durable_write(File.join(stage, "steps", name), work.files.fetch("steps/" + name))
+          end
+          %w[steps reports].each { |name| File.open(File.join(stage, name), File::RDONLY) { |file| file.fsync } }
+          File.open(stage, File::RDONLY) { |file| file.fsync }
+          unavailable!("queue publication collision") if File.exist?(directory) || File.symlink?(directory)
+          File.rename(stage, directory)
+          File.open(cache_base, File::RDONLY) { |file| file.fsync }
+        ensure
+          FileUtils.remove_entry(stage) if stage && File.directory?(stage) && !File.symlink?(stage)
+        end
+
+        def private_directory!(path, create: false)
+          Dir.mkdir(path, 0700) if create && !File.exist?(path) && !File.symlink?(path)
+          PrivateDirectory.verify!(path)
+        end
+
+        def durable_write(path, bytes)
+          File.open(path, File::WRONLY | File::CREAT | File::EXCL | File::NOFOLLOW, 0600) do |file|
+            file.write(bytes); file.flush; file.fsync
+          end
+        end
+
+        def held_read(path, limit)
+          File.open(path, File::RDONLY | File::NOFOLLOW | File::NONBLOCK) do |file|
+            before = file.stat
+            unavailable!("queue held file kind/size") unless before.file? && before.uid == Process.uid &&
+              (before.mode & 0077).zero? && before.size.between?(1, limit)
+            bytes = file.read(limit + 1).force_encoding(Encoding::UTF_8)
+            after = file.stat
+            unavailable!("queue held file changed") unless bytes.valid_encoding? && !bytes.include?("\0") &&
+              bytes.bytesize == before.size && [before.dev, before.ino, before.size, before.mtime, before.ctime] ==
+                [after.dev, after.ino, after.size, after.mtime, after.ctime]
+            bytes.freeze
+          end
+        rescue SystemCallError
+          unavailable!("queue held file unavailable")
+        end
+
+        def unavailable!(reason)
+          raise AttemptErrors::EvidenceUnavailable, "prepared_input_unavailable: #{reason}"
+        end
+
+        def validate_timestamp!(value)
+          unavailable!("captured assignment timestamp") unless value.is_a?(String)
+          Time.iso8601(value)
+        rescue ArgumentError
+          unavailable!("captured assignment timestamp")
+        end
+      end
+    end
+  end
+end