ace-assign 0.64.0 → 0.66.1

data/lib/ace/assign/authority/service_cleanup_dispatch.rb

@@ -0,0 +1,88 @@
+# frozen_string_literal: true
+
+module Ace
+  module Assign
+    module Authority
+      # Canonical-only original dispatch proof shared by status, root admission
+      # and initial/retained inspection imports. Installed peer policy stays in
+      # the fixed root transport owner.
+      module ServiceCleanupDispatch
+        CLEANUP_MUTABLE_SETTLEMENT_FIELDS = %w[state receipt reason claimed_at failed_at no_effect_challenge
+          challenge_generation challenge_event_digest completion_digest no_effect_completion_digest].freeze
+
+        def cleanup_dispatch_context!(record, commit:, selectors: nil, pending: nil)
+          unless @journal.evidence_mode == :protected &&
+              record.values_at("operation", "dispatch_phase") == ["prune-preserved-workspace", "dispatch_started"]
+            raise AttemptErrors::EvidenceUnavailable, "cleanup original dispatch is unavailable"
+          end
+          pending ||= {commit: commit}
+          @journal.verify_canonical_prefix!(commit: commit) unless service_read_view(pending)
+          # The existing index authenticates accepted record provenance without
+          # recursively asking this terminal collection to validate itself.
+          selected = @journal.service_request_records(commit: commit)
+            .select { |entry| entry["request_id"] == record.fetch("request_id") }
+          # Initial import receives the lower writer's proposed terminal
+          # replacement. Its settlement fields are validated by that writer
+          # and collection; the original immutable dispatch must still match.
+          unless selected.one? && selected.first.except(*CLEANUP_MUTABLE_SETTLEMENT_FIELDS) ==
+              record.except(*CLEANUP_MUTABLE_SETTLEMENT_FIELDS)
+            raise AttemptErrors::EvidenceUnavailable, "cleanup selected record differs"
+          end
+          context(record, pending: {commit: commit})
+          events = service_read_events(record, pending)
+          names = %w[request_event_digest dispatch_event_digest]
+          operations = %w[request_service begin_dispatch]
+          if selectors.nil?
+            selectors = names.zip(operations).to_h do |name, operation|
+              matches = events.select do |event|
+                event["type"] == "authority_mutation" && event.dig("payload", "operation") == operation &&
+                  event.dig("payload", "data", "request_id") == record.fetch("request_id") &&
+                  event.dig("payload", "data", "claim_binding") == record.fetch("claim_binding") &&
+                  event.dig("payload", "data", operation == "request_service" ? "claim" : "invocation") ==
+                    (operation == "request_service" ? "created" : "permitted")
+              end
+              raise AttemptErrors::EvidenceUnavailable, "cleanup original acceptance is ambiguous" unless matches.one?
+              [name, matches.first.fetch("digest")]
+            end
+          end
+          unless selectors.is_a?(Hash) && selectors.keys.sort == names.sort &&
+              selectors.values.all? { |value| value.is_a?(String) && value.match?(/\A[0-9a-f]{64}\z/) } && selectors.values.uniq.size == 2
+            raise AttemptErrors::EvidenceUnavailable, "cleanup original acceptance selectors differ"
+          end
+          introductions = service_read_introductions(record, selectors.values, pending)
+          dispatch_record = nil
+          names.zip(operations).each do |name, operation|
+            selector = selectors.fetch(name)
+            matches = events.select { |event| event.fetch("digest") == selector }
+            event = matches.one? && matches.first
+            payload = event && event.fetch("payload")
+            unless event && event.fetch("type") == "authority_mutation" && payload.fetch("operation") == operation &&
+                payload.slice("assignment_id", "attempt_id") == record.slice("assignment_id", "attempt_id") &&
+                payload.fetch("data").slice("request_id", "claim_binding") == record.slice("request_id", "claim_binding") &&
+                payload.fetch("data").fetch(operation == "request_service" ? "claim" : "invocation") ==
+                  (operation == "request_service" ? "created" : "permitted")
+              raise AttemptErrors::EvidenceUnavailable, "cleanup original acceptance differs"
+            end
+            prefix = @journal.read_events(record.fetch("assignment_id"), commit: introductions.fetch(selector))
+              .select { |entry| entry.fetch("attempt_id") == record.fetch("attempt_id") }
+            original = @journal.service_request(record.fetch("request_id"), commit: introductions.fetch(selector))
+            expected = operation == "request_service" ? original&.merge("dispatch_phase" => "dispatch_started",
+              "operation_owner_binding" => record.fetch("operation_owner_binding"),
+              "executor_process_binding" => record.fetch("executor_process_binding")) : original
+            unless expected&.except(*CLEANUP_MUTABLE_SETTLEMENT_FIELDS) == record.except(*CLEANUP_MUTABLE_SETTLEMENT_FIELDS) &&
+                prefix.last == event && prefix[-2] &&
+                prefix[-2].fetch("type") == (operation == "request_service" ? "service_claim" : "service_transition") &&
+                prefix[-2].dig("payload", "record_digest") == Atoms::EvidenceDigest.digest(original) &&
+                event.fetch("previous_digest") == prefix[-2].fetch("digest")
+              raise AttemptErrors::EvidenceUnavailable, "cleanup acceptance is not its original canonical introduction"
+            end
+            dispatch_record = original if operation == "begin_dispatch"
+          end
+          freeze_projection(JSON.parse(JSON.generate(selectors.merge("commit" => commit, "dispatch_record" => dispatch_record))))
+        rescue KeyError, TypeError, ArgumentError
+          raise AttemptErrors::EvidenceUnavailable, "cleanup original dispatch proof is incomplete"
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/service_cleanup_evidence.rb

@@ -0,0 +1,180 @@
+# frozen_string_literal: true
+
+require "ace/runtime/molecules/protected_artifact_set"
+require_relative "cleanup_result_protection"
+
+module Ace
+  module Assign
+    module Authority
+      # The existing service evidence owner authenticates this complete pair.
+      # Root-private archives remain outside the authority evidence graph.
+      module ServiceCleanupEvidence
+        ROOT_SELECTION_SCHEMA = "ace.protected-workspace-prune-root-selection/v1"
+        ROOT_RECEIPT_SCHEMA = "ace.protected-workspace-prune-receipt/v1"
+        ROOT_SELECTION_FIELDS = %w[schema request_id input_digest operation_owner_binding_digest receipt_ref].freeze
+        ROOT_INSPECTION_SELECTION_SCHEMA = "ace.protected-workspace-prune-inspection-selection/v1"
+        ROOT_INSPECTION_SELECTION_FIELDS = %w[schema request_id input_digest operation_owner_binding_digest inspection_ref].freeze
+        ROOT_RECEIPT_FIELDS = %w[schema request_id input_digest maintenance target publication canonical_snapshots preservation removal].freeze
+
+        # Pre-import decoding reuses the collection validator. Only the lower
+        # writer's pending collection can authenticate protected storage and
+        # accept a terminal update.
+        def cleanup_inspection_inputs!(contents, record, challenge)
+          unless record["operation"] == "prune-preserved-workspace" && contents.is_a?(Array) && contents.size == 2
+            raise AttemptErrors::ReceiptRejected, "cleanup inspection requires its complete pair"
+          end
+          cleanup_documents!(contents, record, no_effect: true, challenge: challenge)
+          true
+        rescue KeyError, TypeError, JSON::ParserError, JSON::GeneratorError
+          raise AttemptErrors::ReceiptRejected, "cleanup inspection pair is unavailable"
+        end
+
+        private
+
+        def cleanup_collection!(references, record, state, pending)
+          unless record["operation"] == "prune-preserved-workspace" && %w[succeeded failed-settled].include?(state) && references.size == 2
+            raise AttemptErrors::ReceiptRejected, "cleanup completion requires its complete original evidence pair"
+          end
+          no_effect = state == "failed-settled"
+          challenge = no_effect ? challenge!(record, pending: pending) : nil
+          expected = no_effect ? context_for_challenge(record, challenge) : context(record)
+          proof = cleanup_dispatch_context!(record, commit: pending && pending[:commit] || @journal.ref_value, pending: pending)
+          contents = references.map do |reference|
+            if pending && pending[:pending_events]
+              @canonical.read_pending(reference, **expected, **pending.slice(:current_events, :pending_events, :blobs, :commit))
+            else
+              @canonical.read(reference, **expected, commit: pending && pending[:commit] || @journal.ref_value)
+            end
+          end
+          reference, operation_bytes = cleanup_documents!(contents, record, no_effect: no_effect,
+            challenge: challenge)
+          path = reference.fetch("path")
+          # The lower writer supplies its pending import transaction. Historical
+          # consumers have only a pinned commit and never reopen mutable storage.
+          if pending && pending[:pending_events]
+            selected_artifacts = @cleanup_artifacts || Ace::Runtime::Molecules::ProtectedArtifactSet.new(
+              protection: CleanupResultProtection.new(result_path: path, authority_gid: Process.egid))
+            selected_artifacts.with do |artifacts|
+              unless artifacts.read!(reference) == operation_bytes
+                raise AttemptErrors::ReceiptRejected, "cleanup retained result bytes differ"
+              end
+              artifacts.verify_unchanged!
+            end
+          end
+          if (view = service_read_view(pending))
+            view.projection = settlement_projection(record, pending, challenge, proof)
+          end
+          contents.freeze
+        rescue KeyError, TypeError, JSON::ParserError, JSON::GeneratorError, Ace::Runtime::RuntimeUnavailableError
+          raise AttemptErrors::ReceiptRejected, "cleanup original evidence is unavailable"
+        end
+
+        def cleanup_documents!(contents, record, no_effect:, challenge:)
+          documents = contents.map { |bytes| cleanup_json!(bytes) }
+          selection_schema = no_effect ? ROOT_INSPECTION_SELECTION_SCHEMA : ROOT_SELECTION_SCHEMA
+          selection_fields = no_effect ? ROOT_INSPECTION_SELECTION_FIELDS : ROOT_SELECTION_FIELDS
+          selection_index = documents.each_index.select { |index| documents[index]["schema"] == selection_schema }
+          receipt_index = documents.each_index.select do |index|
+            no_effect ? documents[index].keys.sort == ServiceEvidence::INSPECTION_FIELDS.sort : documents[index]["schema"] == ROOT_RECEIPT_SCHEMA
+          end
+          unless selection_index.one? && receipt_index.one?
+            raise AttemptErrors::ReceiptRejected, "cleanup original evidence selection is ambiguous"
+          end
+          selection = documents.fetch(selection_index.first)
+          receipt = documents.fetch(receipt_index.first)
+          closed_cleanup!(selection, selection_fields)
+          closed_cleanup!(receipt, no_effect ? ServiceEvidence::INSPECTION_FIELDS : ROOT_RECEIPT_FIELDS)
+          unless [selection, receipt].all? { |value| value["request_id"] == record.fetch("request_id") && value["input_digest"] == record.fetch("input_digest") } &&
+              selection["operation_owner_binding_digest"] == Atoms::EvidenceDigest.digest(record.fetch("operation_owner_binding"))
+            raise AttemptErrors::ReceiptRejected, "cleanup original owner or request differs"
+          end
+          reference = selection.fetch(no_effect ? "inspection_ref" : "receipt_ref")
+          closed_cleanup!(reference, %w[path bytes sha256])
+          path = reference.fetch("path")
+          operation_bytes = contents.fetch(receipt_index.first)
+          unless path.is_a?(String) && path.bytesize <= 4096 && path.valid_encoding? && !path.include?("\0") &&
+              path.start_with?("/") && File.expand_path(path) == path &&
+              reference["bytes"].is_a?(Integer) && reference["bytes"].between?(1, 65_536) &&
+              reference["bytes"] == operation_bytes.bytesize && reference["sha256"] == Digest::SHA256.hexdigest(operation_bytes)
+            raise AttemptErrors::ReceiptRejected, "cleanup retained result reference differs"
+          end
+          if no_effect
+            inspection_projection!(receipt, record, challenge)
+          else
+            cleanup_receipt_projection!(receipt, record)
+          end
+          [reference, operation_bytes]
+        end
+
+        def cleanup_json!(bytes)
+          unless bytes.is_a?(String) && bytes.bytesize.between?(1, 65_536)
+            raise AttemptErrors::ReceiptRejected, "cleanup evidence exceeds bounds"
+          end
+          text = bytes.dup.force_encoding(Encoding::UTF_8)
+          raise AttemptErrors::ReceiptRejected, "cleanup evidence is invalid UTF8" unless text.valid_encoding? && !text.include?("\0")
+          value = JSON.parse(text, create_additions: false, max_nesting: 16, allow_duplicate_key: false, allow_comments: false)
+          raise AttemptErrors::ReceiptRejected, "cleanup evidence is not an object" unless value.is_a?(Hash)
+          value
+        end
+
+        def closed_cleanup!(value, fields)
+          unless value.is_a?(Hash) && value.keys.sort == fields.sort
+            raise AttemptErrors::ReceiptRejected, "cleanup evidence fields differ"
+          end
+        end
+
+        def cleanup_receipt_projection!(receipt, record)
+          preservation = receipt.fetch("preservation")
+          closed_cleanup!(preservation, %w[head branch destinations manifest_sha256 inventory_sha256 file_count total_bytes private_manifest_sha256 archives_sha256])
+          unless preservation["file_count"].is_a?(Integer) && preservation["file_count"].between?(0, 4096) &&
+              preservation["total_bytes"].is_a?(Integer) && preservation["total_bytes"].between?(0, 256 * 1024 * 1024) &&
+              %w[manifest_sha256 inventory_sha256 private_manifest_sha256 archives_sha256].all? { |key| cleanup_sha?(preservation[key]) } &&
+              preservation.values_at("manifest_sha256", "inventory_sha256", "private_manifest_sha256").uniq.one?
+            raise AttemptErrors::ReceiptRejected, "cleanup preservation observation differs"
+          end
+          input = receipt.slice("maintenance", "target", "publication").merge("schema" => "ace.protected-workspace-prune/v1",
+            "preservation" => preservation.slice("head", "branch", "destinations", "manifest_sha256"))
+          unless Atoms::EvidenceDigest.digest(input) == record.fetch("input_digest") &&
+              receipt.fetch("maintenance") == record.slice("project_id", "mapping_id", "assignment_id", "attempt_id")
+            raise AttemptErrors::ReceiptRejected, "cleanup original input differs"
+          end
+          snapshots = receipt.fetch("canonical_snapshots")
+          unless snapshots.is_a?(Array) && snapshots.size.between?(1, 256)
+            raise AttemptErrors::ReceiptRejected, "cleanup canonical snapshots exceed bounds"
+          end
+          snapshots.each do |snapshot|
+            closed_cleanup!(snapshot, %w[mapping_id journal_commit binding_event_digest release_event_digest proof_event_digest])
+            unless snapshot["mapping_id"].is_a?(String) && snapshot["mapping_id"].match?(Molecules::JournalMutation::ID) &&
+                snapshot["journal_commit"].is_a?(String) && snapshot["journal_commit"].match?(/\A(?:[0-9a-f]{40}|[0-9a-f]{64})\z/) &&
+                %w[binding_event_digest release_event_digest proof_event_digest].all? { |key| cleanup_sha?(snapshot[key]) }
+              raise AttemptErrors::ReceiptRejected, "cleanup canonical snapshot differs"
+            end
+          end
+          ids = snapshots.map { |snapshot| snapshot.fetch("mapping_id") }
+          raise AttemptErrors::ReceiptRejected, "cleanup canonical snapshots are not uniquely ordered" unless ids == ids.uniq.sort
+          removal = receipt.fetch("removal")
+          closed_cleanup!(removal, %w[original captured outcome fence_digest])
+          unless removal["outcome"] == "removed" && cleanup_sha?(removal["fence_digest"])
+            raise AttemptErrors::ReceiptRejected, "cleanup has no positive removal observation"
+          end
+          %w[original captured].each do |key|
+            object = removal.fetch(key)
+            closed_cleanup!(object, %w[device inode worktree_admin_id head branch])
+            unless %w[device inode].all? { |field| object[field].is_a?(Integer) && object[field].positive? } &&
+                object["worktree_admin_id"].is_a?(String) && object["worktree_admin_id"].bytesize.between?(1, 200) &&
+                object["worktree_admin_id"].match?(/\A[a-zA-Z0-9_.-]+\z/) &&
+                object["head"] == preservation["head"] && object["branch"] == preservation["branch"]
+              raise AttemptErrors::ReceiptRejected, "cleanup captured object differs"
+            end
+          end
+          unless removal.fetch("original") == removal.fetch("captured")
+            raise AttemptErrors::ReceiptRejected, "cleanup replaced object cannot attest removal"
+          end
+          true
+        end
+
+        def cleanup_sha?(value) = value.is_a?(String) && value.match?(/\A[0-9a-f]{64}\z/)
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/service_delivery_evidence.rb

@@ -0,0 +1,101 @@
+# frozen_string_literal: true
+require "ace/git/atoms/service_merge_evidence"
+require "ace/git/atoms/service_pr_evidence"
+require_relative "service_evidence"
+
+module Ace
+  module Assign
+    module Authority
+      # The existing service completion/import transaction owns delivery writes.
+      class ServiceDeliveryEvidence
+        def initialize(journal:)
+          @journal = journal
+        end
+
+        def completion_event(record:, receipt:, completion_digest:, artifacts:)
+          unless artifacts.length == 1
+            raise AttemptErrors::ReceiptRejected, "merge completion requires its one fixed evidence artifact"
+          end
+          proof = validate_artifact!(record, artifacts.first)
+          {type: "delivery", payload: payload(record, receipt, completion_digest, proof)}
+        end
+
+        def verified(record:, events:, commit:)
+          unless %w[create update ready merge].include?(record["operation"]) && record["state"] == "succeeded" &&
+              record.fetch("receipt").fetch("evidence").length == 1
+            raise AttemptErrors::EvidenceUnavailable, "canonical merge completion is unavailable"
+          end
+          receipt = record.fetch("receipt")
+          reference = receipt.fetch("evidence").first
+          bytes = Molecules::CanonicalEvidence.new(journal: @journal).read(reference,
+            **ServiceEvidence.new(journal: @journal).context(record), commit: commit)
+          expected = payload(record, receipt, record.fetch("completion_digest"), validate_artifact!(record, bytes))
+          results = events.select { |event| event["type"] == "delivery" && event.dig("payload", "service_request_id") == record.fetch("request_id") }
+          unless results.one? && Atoms::EvidenceDigest.digest(results.first.fetch("payload")) == Atoms::EvidenceDigest.digest(expected)
+            raise AttemptErrors::EvidenceUnavailable, "canonical merge delivery result differs"
+          end
+          transitions = events.select { |event| event["type"] == "service_transition" &&
+            event.dig("payload", "request_id") == record.fetch("request_id") && event.dig("payload", "state") == "succeeded" &&
+            event.dig("payload", "record_digest") == Atoms::EvidenceDigest.digest(record) &&
+            event.dig("payload", "receipt_digest") == Atoms::EvidenceDigest.digest(receipt) }
+          imports = events.select { |event| event["type"] == "evidence_import" &&
+            "evidence/imports/#{event.dig('payload', 'artifact_id')}" == reference.fetch("ref") }
+          unless transitions.one? && imports.one?
+            raise AttemptErrors::EvidenceUnavailable, "canonical merge completion introduction differs"
+          end
+          # The first completion's authority mutation immediately follows its
+          # terminal transition. Later identical completion observations may
+          # have their own mutation IDs; they cannot replace this introduction.
+          completion = events[events.index(transitions.first) + 1]
+          unless completion && completion["type"] == "authority_mutation" &&
+              completion.dig("payload", "operation") == "complete_service" &&
+              completion.dig("payload", "data", "request_id") == record.fetch("request_id")
+            raise AttemptErrors::EvidenceUnavailable, "original merge completion mutation differs"
+          end
+          selected = [results.first, transitions.first, completion, imports.first]
+          introductions = @journal.event_commits!(assignment_id: record.fetch("assignment_id"),
+            event_digests: selected.map { |event| event.fetch("digest") }, commit: commit)
+          unless introductions.values.uniq.length == 1
+            raise AttemptErrors::EvidenceUnavailable, "merge delivery result was not atomically imported and completed"
+          end
+          results.first
+        rescue KeyError, TypeError, ArgumentError, AttemptErrors::ReceiptRejected
+          raise AttemptErrors::EvidenceUnavailable, "canonical merge delivery evidence is unverifiable"
+        end
+
+        private
+
+        def validate_artifact!(record, bytes)
+          options = {request_id: record.fetch("request_id"), input_digest: record.fetch("input_digest"),
+            target: record.fetch("target"), head: record.fetch("candidate_head")}
+          proof = if record.fetch("operation") == "merge"
+            Ace::Git::Atoms::ServiceMergeEvidence.validate(bytes, **options)
+          else
+            Ace::Git::Atoms::ServicePrEvidence.validate(bytes, operation: record.fetch("operation"), **options)
+          end
+          unless Atoms::EvidenceDigest.digest(proof.fetch(:input)) == record.fetch("input_digest")
+            raise AttemptErrors::ReceiptRejected, "merge evidence does not reconstruct the originally accepted input"
+          end
+          proof
+        rescue ArgumentError, KeyError
+          raise AttemptErrors::ReceiptRejected, "merge evidence original input or outcome differs"
+        end
+
+        def payload(record, receipt, completion_digest, proof)
+          self.class.payload(record, receipt, completion_digest, proof)
+        end
+
+        # Pure result shape shared with the read-only worker consumer. This
+        # function creates no evidence or authorization on its own.
+        def self.payload(record, receipt, completion_digest, proof)
+          {"stage" => "result", "operation" => record.fetch("operation"), "head" => record.fetch("candidate_head"), "outcome" => "succeeded",
+            "intent_digest" => nil, "intent_attempt_id" => nil,
+            "pr" => proof.fetch(:pr).slice("number", "url", "head_sha", "draft", "state", "merge_commit_sha"),
+            "service_request_id" => record.fetch("request_id"), "service_completion_digest" => completion_digest,
+            "service_receipt_digest" => Atoms::EvidenceDigest.digest(receipt), "service_evidence" => receipt.fetch("evidence"),
+            "producer" => {"actor" => "service:#{record.fetch('executor_uid')}", "role" => "service", "runtime" => "herdr"}}
+        end
+      end
+    end
+  end
+end