ace-assign 0.64.0 → 0.66.1

data/lib/ace/assign/authority/protected_assignment_context.rb

@@ -0,0 +1,226 @@
+# frozen_string_literal: true
+
+require_relative "deployment_history"
+require_relative "prepared_input"
+require_relative "prepared_queue"
+
+module Ace
+  module Assign
+    module Authority
+      # Installed and retained deployment owners determine protected principals.
+      # A removed original mapping never silently restores ordinary local mode.
+      class ProtectedAssignmentContext
+        attr_reader :uid
+
+        def self.load
+          paths = [Deployment::PATH, DeploymentHistory::PATH]
+          installed = paths.any? do |path|
+            begin
+              File.lstat(path)
+              true
+            rescue Errno::ENOENT
+              false
+            end
+          end
+          return new(deployment: nil, history: nil) unless installed
+          deployment = Deployment.load
+          history = DeploymentHistory.load
+          unless history.selects?(deployment)
+            raise AttemptErrors::EvidenceUnavailable, "installed protected descriptor is not retained"
+          end
+          new(deployment: deployment, history: history)
+        end
+
+        def initialize(deployment:, history:, uid: Process.uid, kernel: nil, env: ENV,
+          artifacts_factory: -> { Ace::Runtime::Molecules::ProtectedArtifactSet.new })
+          @deployment, @history, @uid, @kernel, @env = deployment, history, uid, kernel, env
+          @artifacts_factory = artifacts_factory
+        end
+
+        # A declared installed account never falls through to local authority.
+        # This is classification only; each wire operation still authenticates
+        # the current kernel peer and its exact permitted role.
+        def protected_participant?
+          return false unless @deployment
+          raise AttemptErrors::EvidenceUnavailable, "protected retained owners are unavailable" unless @history
+          [@deployment, *@history.descriptors].any? do |owner|
+            data = owner.data
+            principals = data.fetch("authorities").values.map { |authority| authority.fetch("uid") }
+            principals.concat(data.fetch("launch_mappings").values.flat_map { |map| map.values_at("launcher_uid", "worker_uid") })
+            data.fetch("projects").each_value do |project|
+              %w[launcher_uids reviewer_uids worker_uids service_executor_uids supervisor_uids].each do |key|
+                principals.concat(project.fetch(key, []))
+              end
+              principals.concat(project.fetch("service_receivers", {}).values.map { |receiver| receiver.fetch("executor_uid") })
+              principals.concat(project.fetch("inbox_contexts", {}).values.map { |context| context.fetch("owner_credentials").fetch("uid") })
+            end
+            principals.include?(@uid)
+          end
+        rescue KeyError, TypeError, NoMethodError
+          raise AttemptErrors::EvidenceUnavailable, "protected installed principal inventory is malformed"
+        end
+
+        # Read-only current selection; no role grant or private Inbox access.
+        def inbox_context_selection(project:, mapping:, inbox_context:)
+          unless installed? && [project, mapping, inbox_context].all? { |id| id.is_a?(String) && Deployment::TOKEN.match?(id) }
+            raise AttemptErrors::EvidenceUnavailable, "installed inbox selectors differ"
+          end
+          descriptor = @deployment.artifact_reference
+          history = @history.artifact_reference
+          unless descriptor && history && @history.selects?(@deployment)
+            raise AttemptErrors::EvidenceUnavailable, "installed inbox references are unavailable"
+          end
+          @artifacts_factory.call.with do |held|
+            held.read!(descriptor)
+            held.read!(history)
+            map = @deployment.mapping(mapping)
+            unless map.fetch("project_id") == project
+              raise AttemptErrors::EvidenceUnavailable, "installed inbox project differs"
+            end
+            selected = @deployment.inbox_context(mapping, inbox_context)
+            authority = @deployment.authority(map.fetch("authority_id"))
+            result = {"uid" => @uid, "project_id" => project, "mapping_id" => mapping,
+              "inbox_context_id" => inbox_context, "descriptor" => descriptor, "history" => history,
+              "context" => selected.slice("control_socket_path", "owner_credentials", "native_mapping_id"),
+              "authority" => authority.slice("socket_path", "uid", "gid", "groups")
+                .merge("authority_id" => map.fetch("authority_id"))}
+            held.verify_unchanged!
+            value = yield result
+            held.verify_unchanged!
+            value
+          end
+        rescue ArgumentError, KeyError, TypeError, Ace::Runtime::Error
+          raise AttemptErrors::EvidenceUnavailable, "installed inbox selection is unavailable"
+        end
+
+        def protected_worker?
+          return false unless @deployment
+          [@deployment, *@history.descriptors].any? do |owner|
+            owner.data.fetch("projects").values.any? { |project| project.fetch("worker_uids").include?(@uid) }
+          end
+        end
+
+        def installed?
+          !@deployment.nil? && !@history.nil?
+        end
+
+        def refuse_graph_mutation!(options:)
+          selected = options.values_at(:mapping, :attempt).any? { |value| value && !value.to_s.empty? } ||
+            %w[ACE_ASSIGN_LAUNCH_MAPPING ACE_ASSIGN_ATTEMPT_ID].any? { |key| !@env[key].to_s.empty? }
+          if protected_worker? || selected
+            raise AttemptErrors::EvidenceUnavailable, "protected queue graph changes require a reviewed new prepared version and attempt"
+          end
+        end
+
+        def resolve(options:, assignment_id:, scope:)
+          selected = options.values_at(:mapping, :attempt).any? { |value| value && !value.to_s.empty? } ||
+            %w[ACE_ASSIGN_LAUNCH_MAPPING ACE_ASSIGN_ATTEMPT_ID].any? { |key| !@env[key].to_s.empty? }
+          return nil unless protected_worker? || selected
+          unless @deployment && assignment_id && scope && scope.match?(PreparedWork::SCOPE)
+            raise AttemptErrors::EvidenceUnavailable, "prepared_input_unavailable: explicit scoped assignment required"
+          end
+          attempt = selected_hint(options[:attempt], "ACE_ASSIGN_ATTEMPT_ID")
+          hint = @env["ACE_ASSIGN_ASSIGNMENT_ID"].to_s
+          unless hint.empty? || hint == assignment_id
+            raise AttemptErrors::EvidenceUnavailable, "prepared assignment hint differs"
+          end
+          @kernel ||= Ace::Runtime::Molecules::ProtectedLinux.new
+          input = PreparedInput.fetch(client: client(options: options),
+            assignment_id: assignment_id, attempt_id: attempt)
+          unless input.descriptor.fetch("scope") == scope
+            raise AttemptErrors::EvidenceUnavailable, "prepared_input_mismatch: scoped CLI selection"
+          end
+          input
+        rescue KeyError
+          raise AttemptErrors::EvidenceUnavailable, "prepared_input_unavailable: original installed mapping is unavailable"
+        end
+
+        def verify_attempt_hints!(assignment_id:, attempt_id:)
+          selected_hint(assignment_id, "ACE_ASSIGN_ASSIGNMENT_ID")
+          selected_hint(attempt_id, "ACE_ASSIGN_ATTEMPT_ID")
+          true
+        end
+
+        def client(options:)
+          raise AttemptErrors::EvidenceUnavailable, "protected installed authority is unavailable" unless @deployment
+          mapping = selected_hint(options[:mapping], "ACE_ASSIGN_LAUNCH_MAPPING")
+          @kernel ||= Ace::Runtime::Molecules::ProtectedLinux.new
+          Client.new(mapping_id: mapping, deployment: @deployment, kernel: @kernel)
+        end
+
+        def mapping_hint?
+          !@env["ACE_ASSIGN_LAUNCH_MAPPING"].to_s.empty?
+        end
+
+        # Observer/signer commands reuse the installed selection and held
+        # descriptor pair. This grants no effect; endpoints authorize the peer.
+        def with_inbox_workflow(options:)
+          mapping = selected_hint(options[:mapping], "ACE_ASSIGN_LAUNCH_MAPPING")
+          project, inbox_context = options.values_at(:project, :inbox_context)
+          inbox_context_selection(project: project, mapping: mapping, inbox_context: inbox_context) do |_selection|
+            @kernel ||= Ace::Runtime::Molecules::ProtectedLinux.new
+            yield @deployment, @kernel, @deployment.mapping(mapping)
+          end
+        end
+
+        # Consumers call only after original PreparedInput admission. These
+        # existing owners select transport; they do not confer a new grant.
+        def with_installed_selection(options:, input:)
+          raise AttemptErrors::EvidenceUnavailable, "protected installed authority is unavailable" unless @deployment
+          mapping = selected_hint(options[:mapping], "ACE_ASSIGN_LAUNCH_MAPPING")
+          begin
+            map = @deployment.mapping(mapping)
+            unless input && input.descriptor.fetch("mapping_id") == mapping &&
+                input.descriptor.fetch("project_id") == map.fetch("project_id")
+              raise AttemptErrors::EvidenceUnavailable, "original prepared installed selection differs"
+            end
+          rescue KeyError
+            raise AttemptErrors::EvidenceUnavailable, "original installed mapping is unavailable"
+          end
+          @kernel ||= Ace::Runtime::Molecules::ProtectedLinux.new
+          yield @deployment, @kernel, mapping
+        end
+
+        private
+
+        def selected_hint(explicit, key)
+          hint = @env[key].to_s
+          value = explicit || hint
+          unless value.is_a?(String) && value.match?(PreparedWork::TOKEN) && (hint.empty? || hint == value)
+            raise AttemptErrors::EvidenceUnavailable, "prepared selector hint differs"
+          end
+          value
+        end
+      end
+
+      # Each supported operation holds the existing private queue exclusion and
+      # consumes its authenticated held snapshot. No graph-changing API exists.
+      class PreparedExecutor
+        def initialize(input)
+          @queue = PreparedQueue.new(work: input.work, descriptor: input.descriptor)
+          @scope = input.descriptor.fetch("scope")
+        end
+
+        def status
+          @queue.with_executor(&:status)
+        end
+
+        %i[start_step finish_step fail].each do |operation|
+          define_method(operation) do |*args, **options|
+            unless options[:fork_root] == @scope && (!options[:step_number] ||
+                options[:step_number] == @scope || options[:step_number].start_with?(@scope + "."))
+              raise AttemptErrors::EvidenceUnavailable, "prepared operation scope differs"
+            end
+            @queue.with_executor { |executor| executor.public_send(operation, *args, **options) }
+          end
+        end
+
+        def method_missing(*)
+          raise AttemptErrors::EvidenceUnavailable, "prepared queue graph changes require a reviewed new prepared version and attempt"
+        end
+
+        def respond_to_missing?(*); false; end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/readiness_hook.rb

@@ -0,0 +1,120 @@
+# frozen_string_literal: true
+require "ace/runtime/molecules/execution_network_selection"
+require "socket"
+require_relative "../errors"
+require "ace/runtime/molecules/readiness_configuration"
+require "ace/runtime/molecules/server_resource_observation"
+require "ace/runtime/molecules/protected_linux"
+require "ace/runtime/molecules/protected_socket"
+require_relative "transfer_codec"
+
+module Ace
+  module Assign
+    module Authority
+      # Fixed ExecStartPost action, deliberately independent of Deployment.load.
+      class ReadinessHook
+        class Files
+          def boundary_manifest!(config)
+            bytes = nil
+            Ace::Runtime::Molecules::ProtectedArtifactSet.new.with do |reader|
+              bytes, = reader.read_path!(config.dig("boundary_manifest", "path"), limit: 65_536)
+              unless Digest::SHA256.hexdigest(bytes) == config.dig("boundary_manifest", "sha256")
+                raise AttemptErrors::EvidenceUnavailable, "readiness boundary bytes differ"
+              end
+              reader.verify_unchanged!
+            end
+            bytes = bytes.dup.force_encoding(Encoding::UTF_8)
+            raise AttemptErrors::EvidenceUnavailable, "readiness boundary encoding differs" unless bytes.valid_encoding?
+            JSON.parse(bytes, create_additions: false, max_nesting: 8, allow_duplicate_key: false, allow_comments: false)
+          end
+
+          def verify_native!(server, config)
+            File.open("/proc/#{server.fetch('pid')}/exe", File::RDONLY) do |executable|
+              unless Digest::SHA256.hexdigest(executable.read(268_435_457)) == config.dig("native", "executable_sha256") &&
+                  File.read("/proc/#{server.fetch('pid')}/cmdline", 16_385).split("\0") == [config.dig("native", "executable"), "server"]
+                raise AttemptErrors::EvidenceUnavailable, "readiness native executable differs"
+              end
+            end
+          end
+        end
+
+        def initialize(slot:, configuration: nil, kernel: Ace::Runtime::Molecules::ProtectedLinux.new,
+          resources: nil, wire: Ace::Runtime::Molecules::ProtectedSocket, files: Files.new)
+          @configuration = configuration || Ace::Runtime::Molecules::ReadinessConfiguration.load(slot: slot)
+          @kernel, @wire = kernel, wire
+          @files = files
+          @resources = resources || Ace::Runtime::Molecules::ServerResourceObservation.new(kernel: kernel)
+        end
+
+        def run
+          config = @configuration.data
+          @kernel.supported!
+          hook = @kernel.capture(Process.pid)
+          expected = config.fetch("worker")
+          unless hook.values_at("uid", "gid", "groups") == expected.values_at("uid", "gid", "groups")
+            raise AttemptErrors::UnauthorizedIdentity, "readiness hook principal differs"
+          end
+          deadline = @wire.deadline(10)
+          authority = config.fetch("authority")
+          path = authority.fetch("socket_path")
+          @wire.root_path!(File.dirname(path), directory: true, owner: authority.fetch("uid"))
+          endpoint = @wire.socket_identity(path)
+          @wire.connect(path) do |socket|
+            peer = @kernel.peer(socket)
+            unless peer.values_at("uid", "gid", "groups") == authority.values_at("uid", "gid", "groups") &&
+                @wire.socket_identity(path) == endpoint
+              raise AttemptErrors::UnauthorizedIdentity, "readiness authority peer differs"
+            end
+            @wire.write(socket, {"version" => 1, "operation" => "native_readiness", "mutation_id" => nil,
+              "project_id" => config.fetch("project_id"), "params" => {"mapping_id" => config.fetch("mapping_id")}},
+              deadline: deadline, limit: 16_384)
+            challenge = @wire.read(socket, deadline: deadline, limit: 16_384)
+            unless challenge.is_a?(Hash) && challenge.keys.sort == %w[challenge_id server_identity version] &&
+                challenge["version"] == 1 && challenge["challenge_id"].is_a?(String) &&
+                challenge["challenge_id"].match?(/\A[0-9a-f]{64}\z/)
+              raise AttemptErrors::EvidenceUnavailable, "private readiness challenge differs"
+            end
+            manifest = @files.boundary_manifest!(config)
+            unless manifest.is_a?(Hash) && manifest.keys.sort == %w[network_installation resources schema slot_id] &&
+                manifest["schema"] == "ace.execution-boundary-manifest/v1" && manifest["slot_id"] == config.fetch("slot_id") &&
+                manifest["resources"].is_a?(Array) && manifest["resources"].size.between?(1, 64)
+              raise AttemptErrors::EvidenceUnavailable, "readiness boundary shape differs"
+            end
+            Ace::Runtime::Molecules::ExecutionNetworkSelection.validate_static!(manifest.fetch("network_installation"), slot_id: config.fetch("slot_id"))
+            manifest.fetch("resources").each do |entry|
+              paths = entry.is_a?(Hash) ? entry.values_at("host_path", "view_path") : []
+              unless entry.is_a?(Hash) && entry.keys.sort == %w[host_path read_only stage view_path worker_visible] &&
+                  paths.size == 2 && paths.all? { |path| path.is_a?(String) && path.bytesize.between?(1, 4096) && path.start_with?("/") && !path.include?("\0") && File.expand_path(path) == path } &&
+                  %w[parent native].include?(entry["stage"]) && [true, false].include?(entry["worker_visible"]) && [true, false].include?(entry["read_only"])
+                raise AttemptErrors::EvidenceUnavailable, "readiness resource declaration differs"
+              end
+            end
+            entries = manifest.fetch("resources").select { |entry| entry.fetch("worker_visible") }
+            server = challenge.fetch("server_identity")
+            @files.verify_native!(server, config)
+            report = @resources.observe!(server: server, entries: entries, authority_socket: path)
+            report = report.merge("version" => 1, "challenge_id" => challenge.fetch("challenge_id"),
+              "server_identity" => challenge.fetch("server_identity"), "resource_observer_identity" => hook)
+            bytes = JSON.generate(report)
+            codec = TransferCodec.new
+            transfer = codec.descriptor([bytes], purpose: :scope_boundary_observation)
+            @wire.write(socket, {"version" => 1, "challenge_id" => challenge.fetch("challenge_id"), "transfer" => transfer},
+              deadline: deadline, limit: 16_384)
+            codec.send(socket, parts: [bytes], descriptor: transfer, purpose: :scope_boundary_observation, deadline: deadline)
+            socket.shutdown(Socket::SHUT_WR)
+            acknowledgment = @wire.read(socket, deadline: deadline, limit: 16_384)
+            unless acknowledgment == {"version" => 1, "challenge_id" => challenge.fetch("challenge_id"), "status" => "ready"}
+              raise AttemptErrors::EvidenceUnavailable, "private readiness acknowledgement differs"
+            end
+            @kernel.live!(hook)
+            @kernel.live!(peer)
+            raise AttemptErrors::EvidenceUnavailable, "readiness endpoint changed" unless @wire.socket_identity(path) == endpoint
+          end
+          true
+        rescue SystemCallError, IOError, JSON::ParserError, KeyError, TypeError
+          raise AttemptErrors::EvidenceUnavailable, "private readiness observation unavailable"
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/router.rb

@@ -17,34 +17,56 @@ module Ace
         end
 
         def dispatch(request:, peer:, role:, transfer: nil)
+          validate_review_namespace!(request)
           handler = @routes.fetch(request.fetch("operation")) { raise ArgumentError, "unknown authority operation" }
           options = {request: request, peer: peer, role: role}
           options[:transfer] = transfer if transfer
           handler.dispatch(**options)
         end
 
-        def transfer_binding(operation)
+        def transfer_binding(request)
+          validate_review_namespace!(request)
+          operation = request.fetch("operation")
           handler = @routes.fetch(operation) { raise ArgumentError, "unknown authority operation" }
           return nil unless handler.class.const_defined?(:TRANSFER_OPERATIONS, false)
           binding = handler.class::TRANSFER_OPERATIONS[operation]
+          if operation == "evidence_fetch" && %w[prepared_work campaign_candidate].include?(request.dig("params", "kind"))
+            binding = {direction: :download, purpose: :candidate, roles: [:worker]}
+          end
           return nil unless binding
           unless binding.is_a?(Hash) && binding.keys.sort == %i[direction purpose roles] &&
               %i[upload download].include?(binding[:direction]) && TransferCodec::LIMITS.key?(binding[:purpose]) &&
-              binding[:roles].is_a?(Array) && binding[:roles].all? { |role| %i[worker launcher reviewer executor supervisor].include?(role) }
+              binding[:roles].is_a?(Array) && binding[:roles].all? { |role| %i[worker launcher reviewer executor supervisor observer signer].include?(role) }
             raise ArgumentError, "invalid source transfer binding"
           end
           binding
         end
 
         def authorize_transfer!(request:, peer:, role:)
+          validate_review_namespace!(request)
           handler = @routes.fetch(request.fetch("operation"))
           handler.authorize_transfer!(request: request, peer: peer, role: role)
         end
 
+        def validate_review_namespace!(request)
+          if request["mutation_id"].is_a?(String) && request["mutation_id"].start_with?("review-reply.")
+            raise ArgumentError, "reserved review reply namespace"
+          end
+          if request["mutation_id"].is_a?(String) && request["mutation_id"].start_with?("review-delegate.") &&
+              request["operation"] != "assign_review"
+            raise ArgumentError, "reserved review delegation namespace"
+          end
+        end
+        private :validate_review_namespace!
+
         def close
           @launch.close
         end
 
+        def serve_launch_control!(**options)
+          @launch.serve_launch_control!(**options)
+        end
+
         def gate_ready(**options)
           @launch.gate_ready(**options)
         end

data/lib/ace/assign/authority/server.rb

@@ -3,6 +3,7 @@ require "socket"
 require "fileutils"
 require_relative "deployment"
 require_relative "transfer_codec"
+require_relative "../molecules/evidence_journal"
 
 module Ace
   module Assign
@@ -11,9 +12,10 @@ module Ace
       class Server
         CONNECTIONS = 16
         def initialize(authority_id:, lifecycle:, deployment: Deployment.load,
-          kernel: Ace::Runtime::Molecules::ProtectedLinux.new, composition: "launch")
+          kernel: Ace::Runtime::Molecules::ProtectedLinux.new, composition: "launch", hitl_service: nil)
           @authority_id, @lifecycle, @deployment, @kernel = authority_id, lifecycle, deployment, kernel
           @composition = composition
+          @hitl_service = hitl_service
           deployment.verify_composition!(authority_id, composition: composition)
           @service = deployment.authority(authority_id)
           @mutex = Mutex.new
@@ -36,6 +38,7 @@ module Ace
           unless lock.flock(File::LOCK_EX | File::LOCK_NB)
             raise AttemptErrors::Conflict, "assignment authority already owns its listener"
           end
+          start_hitl_service!
           path = @service.fetch("socket_path")
           if File.exist?(path) || File.symlink?(path)
             raise AttemptErrors::Conflict, "existing authority endpoint requires verified installer recovery"
@@ -44,6 +47,9 @@ module Ace
           File.chmod(0o660, path)
           @endpoint = wire.socket_identity(path)
           until @stopped
+            if @hitl_thread && !@hitl_thread.alive?
+              raise Ace::Runtime::RuntimeUnavailableError, "protected HITL boundary stopped before its authority"
+            end
             ready = IO.select([@listener], nil, nil, 0.25)
             next unless ready
             socket = @listener.accept_nonblock(exception: false)
@@ -68,6 +74,7 @@ module Ace
           raise unless @stopped
         ensure
           stop
+          stop_hitl_service!
           # Closing a stream does not cancel a handler already inside dispatch.
           # The owner lock and endpoint remain held until every handler ends.
           @mutex.synchronize { @handlers.dup }.each(&:join)
@@ -90,6 +97,29 @@ module Ace
 
         private
 
+        # The existing HITL boundary is a sibling owned by this listener's
+        # lifetime. It must be ready before assignment ingress is opened.
+        def start_hitl_service!
+          return unless @hitl_service
+          ready = Queue.new
+          @hitl_thread = Thread.new do
+            @hitl_service.run(on_ready: -> { ready << :ready })
+          rescue Exception => error
+            @hitl_failure = error
+            ready << error
+          end
+          @hitl_thread.report_on_exception = false
+          result = ready.pop(timeout: 5)
+          raise Ace::Runtime::RuntimeUnavailableError, "protected HITL boundary startup timed out" if result.nil?
+          raise result if result.is_a?(Exception)
+        end
+
+        def stop_hitl_service!
+          return unless @hitl_thread
+          @hitl_service.stop
+          @hitl_thread.join
+        end
+
         def same_endpoint?(path)
           wire.socket_identity(path) == @endpoint
         rescue StandardError
@@ -102,16 +132,45 @@ module Ace
           frame = wire.read(socket, deadline: [deadline, wire.deadline(5)].min, with_size: true)
           request = frame.fetch(:data)
           unless request.is_a?(Hash) && request.keys.sort == %w[mutation_id operation params project_id version] &&
-              request["version"] == 1 && request["operation"].is_a?(String) && request["params"].is_a?(Hash)
+              request["version"].is_a?(Integer) && request["version"] == 1 && request["operation"].is_a?(String) && request["params"].is_a?(Hash)
             raise ArgumentError, "invalid authority envelope"
           end
-          deadline = wire.deadline(90) if %w[reserve_attempt close_execution_scope].include?(request.fetch("operation"))
+          deadline = wire.deadline(90) if %w[reserve_attempt close_execution_scope stop_attempt].include?(request.fetch("operation"))
           params = request.fetch("params")
           map = @deployment.verify!(params.fetch("mapping_id"), kernel: @kernel, authority_state: true)
           unless map["authority_id"] == @authority_id && map["project_id"] == request["project_id"]
             raise AttemptErrors::UnauthorizedIdentity, "mapping belongs to another authority or project"
           end
-          role = if principal?(peer, map, "launcher_uid", "launcher_gid", "launcher_groups")
+          project = @deployment.project(map.fetch("project_id"))
+          owner_contexts = project.fetch("inbox_contexts", {}).select do |_id, context|
+            context.fetch("native_mapping_id") == params.fetch("mapping_id") &&
+              context.fetch("owner_credentials").values_at("uid", "gid", "groups") == peer.values_at("uid", "gid", "groups")
+          end
+          context_query = %w[inbox_context_original].include?(request["operation"])
+          if context_query || !owner_contexts.empty?
+            unless context_query && @composition == "services" && request["mutation_id"].nil? &&
+                owner_contexts.key?(params.fetch("inbox_context_id")) && frame.fetch(:bytesize) <= 16_384
+              raise AttemptErrors::UnauthorizedIdentity, "context owner is exclusive to its fixed read-only inbox queries"
+            end
+            role = :context_owner
+          end
+          if request["operation"] == "native_readiness"
+            unless @composition == "launch" && request["mutation_id"].nil? && params.keys == ["mapping_id"] &&
+                frame.fetch(:bytesize) <= 16_384
+              raise ArgumentError, "private readiness envelope differs"
+            end
+            admitted_transfer = @mutex.synchronize do
+              if @transfers < 2
+                @transfers += 1
+                true
+              end
+            end
+            raise AttemptErrors::Conflict, "readiness transfer capacity is busy" unless admitted_transfer
+            @lifecycle.native_readiness!(mapping_id: params.fetch("mapping_id"), peer: peer, socket: socket,
+              codec: transfer_codec, deadline: wire.deadline(10))
+            return
+          end
+          role ||= if principal?(peer, map, "launcher_uid", "launcher_gid", "launcher_groups")
             :launcher
           elsif principal?(peer, map, "worker_uid", "worker_gid", "worker_groups")
             :worker
@@ -126,55 +185,66 @@ module Ace
             end
           end
           raise AttemptErrors::UnauthorizedIdentity, "unmapped kernel peer" unless role
-          if %w[observe_execution_scope close_execution_scope].include?(request["operation"]) ||
-              @composition == "services" && %w[attempt_status evidence_fetch].include?(request["operation"])
+          if request["operation"] == "launch_control"
+            raise AttemptErrors::UnauthorizedIdentity, "Private launcher control requires launcher peer" unless role == :launcher
+            raise ArgumentError, "Private launcher header is oversized" unless frame.fetch(:bytesize) <= 16_384
+            @lifecycle.serve_launch_control!(request: request, peer: peer, socket: socket, codec: transfer_codec, deadline: deadline)
+            return
+          end
+          if %w[bind_inbox finish recover request_review review_status launch_review_intent cancel_review evidence_fetch assignment_inventory observe_execution_scope close_execution_scope stop_attempt prompt_status launch_input_inhibit_selection launch_input_inhibit_completion launch_prompt_intent launch_prompt_completion claim_service_settlement workspace_prune_preview_context].include?(request["operation"]) ||
+              @composition == "services" && %w[attempt_status inbox_context_original].include?(request["operation"])
+            raise ArgumentError, "review control header is oversized" if %w[request_review review_status cancel_review launch_review_intent].include?(request["operation"]) && frame.fetch(:bytesize) > 16_384
             bodyless_read!(socket, deadline)
           end
           if request["operation"] == "gate_ready"
             raise AttemptErrors::UnauthorizedIdentity, "gate readiness requires worker peer" unless role == :worker
             @lifecycle.gate_ready(request: request, peer: peer, socket: socket, deadline: deadline)
           else
-            binding = @lifecycle.transfer_binding(request.fetch("operation")) if @lifecycle.respond_to?(:transfer_binding)
-            if binding
-              raise AttemptErrors::UnauthorizedIdentity, "transfer role differs" unless binding.fetch(:roles).include?(role)
-              raise ArgumentError, "transfer control header is oversized" if frame.fetch(:bytesize) > 16_384
-              @lifecycle.authorize_transfer!(request: request, peer: peer, role: role)
-              admitted_transfer = @mutex.synchronize do
-                if @transfers < 2
-                  @transfers += 1
-                  true
+            Molecules::EvidenceJournal.with_event_read_operation do
+              binding = @lifecycle.transfer_binding(request) if @lifecycle.respond_to?(:transfer_binding)
+              if binding
+                raise AttemptErrors::UnauthorizedIdentity, "transfer role differs" unless binding.fetch(:roles).include?(role)
+                raise ArgumentError, "transfer control header is oversized" if frame.fetch(:bytesize) > 16_384
+                @lifecycle.authorize_transfer!(request: request, peer: peer, role: role)
+                admitted_transfer = @mutex.synchronize do
+                  if @transfers < 2
+                    @transfers += 1
+                    true
+                  end
                 end
-              end
-              raise AttemptErrors::Conflict, "transfer capacity is busy" unless admitted_transfer
-              codec = transfer_codec
-              if binding.fetch(:direction) == :upload
-                result = codec.receive(socket, descriptor: params.fetch("transfer"), purpose: binding.fetch(:purpose), deadline: deadline) do |input|
-                  @lifecycle.dispatch(request: request, peer: peer, role: role, transfer: input)
+                raise AttemptErrors::Conflict, "transfer capacity is busy" unless admitted_transfer
+                codec = transfer_codec
+                if binding.fetch(:direction) == :upload
+                  result = codec.receive(socket, descriptor: params.fetch("transfer"), purpose: binding.fetch(:purpose), deadline: deadline) do |input|
+                    @lifecycle.dispatch(request: request, peer: peer, role: role, transfer: input)
+                  end
+                else
+                  result = @lifecycle.dispatch(request: request, peer: peer, role: role)
+                  parts = result.fetch(:transfer_parts)
+                  descriptor = codec.descriptor(parts, purpose: binding.fetch(:purpose))
+                  result = result.merge(data: result.fetch(:data).merge("transfer" => descriptor))
                 end
               else
+                raise ArgumentError, "unexpected transfer descriptor" if params.key?("transfer")
                 result = @lifecycle.dispatch(request: request, peer: peer, role: role)
-                parts = result.fetch(:transfer_parts)
-                descriptor = codec.descriptor(parts, purpose: binding.fetch(:purpose))
-                result = result.merge(data: result.fetch(:data).merge("transfer" => descriptor))
               end
-            else
-              raise ArgumentError, "unexpected transfer descriptor" if params.key?("transfer")
-              result = @lifecycle.dispatch(request: request, peer: peer, role: role)
-            end
-            wire.write(socket, {"status" => "ok", "data" => result.fetch(:data),
-              "transport" => {"replayed" => result.fetch(:replayed, false)}}, deadline: deadline, limit: 16_384)
-            if binding && binding.fetch(:direction) == :download
-              codec.send(socket, parts: parts, descriptor: descriptor, purpose: binding.fetch(:purpose), deadline: deadline)
+              wire.write(socket, {"status" => "ok", "data" => result.fetch(:data),
+                "transport" => {"replayed" => result.fetch(:replayed, false)}}, deadline: deadline, limit: 16_384)
+              if binding && binding.fetch(:direction) == :download
+                codec.send(socket, parts: parts, descriptor: descriptor, purpose: binding.fetch(:purpose), deadline: deadline)
+              end
             end
           end
         rescue ArgumentError, KeyError, AttemptErrors::MalformedTransfer
           refusal(socket, "invalid_input")
-        rescue AttemptErrors::UnauthorizedIdentity
+        rescue AttemptErrors::UnauthorizedIdentity, SecurityError
           refusal(socket, "unauthorized")
         rescue AttemptErrors::Conflict
           refusal(socket, "conflict")
         rescue AttemptErrors::NotFound
           refusal(socket, "missing")
+        rescue AttemptErrors::BoundedResultUnavailable
+          refusal(socket, "bounded_result")
         rescue StandardError
           refusal(socket, "evidence_unavailable")
         ensure