ace-assign 0.64.0 → 0.66.1

data/lib/ace/assign/authority/candidate_transfer.rb

@@ -1,9 +1,11 @@
 # frozen_string_literal: true
 
 require "digest"
+require "json"
 require "fileutils"
 require "tmpdir"
-require "ace/herdr"
+require "tempfile"
+require "ace/herdr/molecules/bounded_process"
 require_relative "private_directory"
 
 module Ace
@@ -16,11 +18,103 @@ module Ace
         DEADLINE = 30
         SHA = /\A[0-9a-f]{40}\z/
 
+        class CampaignReadView
+          def initialize(owner:, repository:, base:, deadline:)
+            @owner, @repository, @base, @deadline = owner, repository, base, deadline
+            @thread, @active = Thread.current, true
+          end
+
+          def close = @active = false
+          def head = command("rev-parse", "HEAD").strip
+          def base
+            commit!(@base)
+            @base
+          end
+          def commit!(revision)
+            raise ArgumentError, "campaign revision is invalid" unless revision.is_a?(String) && revision.match?(SHA)
+            command("cat-file", "-e", "#{revision}^{commit}")
+            true
+          end
+          def full_diff?(base, head)
+            commit!(base)
+            commit!(head)
+            !command("diff", "--raw", "--no-ext-diff", "--no-textconv", base, head, "--").empty?
+          end
+          def clean?
+            command("status", "--porcelain", "-z", "--untracked-files=all").split("\0")
+              .all? { |entry| entry.start_with?("?? .ace-local/") }
+          end
+
+          private
+
+          def command(*arguments)
+            unless @active && Thread.current.equal?(@thread)
+              raise AttemptErrors::EvidenceUnavailable, "campaign Git read view escaped its source lifetime"
+            end
+            @owner.send(:git, @repository, @deadline, *arguments)
+          rescue Timeout::Error
+            raise AttemptErrors::EvidenceUnavailable, "campaign Git read deadline expired"
+          end
+        end
+
+        def with_campaign_repository(bytes:, sha256:, size:, head:, tree:, base:)
+          raise ArgumentError, "campaign repository requires a block" unless block_given?
+          deadline = monotonic + DEADLINE
+          materialized = materialize_repository(bytes: bytes, sha256: sha256, size: size, head: head, tree: tree, root: @root)
+          directory = materialized.fetch("directory")
+          reader = CampaignReadView.new(owner: self, repository: directory, base: base, deadline: deadline)
+          unless reader.head == head
+            raise AttemptErrors::EvidenceUnavailable, "campaign Git head differs from original candidate"
+          end
+          reader.base
+          yield reader
+        ensure
+          reader&.close
+          FileUtils.remove_entry(directory) if directory && File.directory?(directory)
+        end
+
         def initialize(root:)
           @root = File.expand_path(root)
           verify_root!
         end
 
+        # Export the already validated prepared tree using the same isolated Git
+        # boundary as admission. The returned bytes are retained by the producer;
+        # registration must not rebuild them after a lost response.
+        def export_prepared(work:)
+          require_relative "prepared_work"
+          reject!("Prepared export requires validated work") unless work.is_a?(PreparedWork)
+          verify_root!
+          deadline = monotonic + DEADLINE
+          Dir.mktmpdir("prepared-export-", @root) do |directory|
+            File.chmod(0700, directory)
+            repository = File.join(directory, "repository")
+            git(directory, deadline, "init", "--template=", "--initial-branch=prepared", repository)
+            work.files.each do |path, bytes|
+              target = File.join(repository, path)
+              FileUtils.mkdir_p(File.dirname(target), mode: 0700)
+              File.open(target, File::WRONLY | File::CREAT | File::EXCL | File::NOFOLLOW, 0600) do |file|
+                file.write(bytes)
+              end
+            end
+            git(repository, deadline, "add", "--", ".")
+            git(repository, deadline, "-c", "user.name=ACE prepared input", "-c", "user.email=prepared@ace.invalid",
+              "-c", "commit.gpgSign=false", "commit", "--no-verify", "-m", "Prepared assignment input")
+            head = git(repository, deadline, "rev-parse", "HEAD").strip
+            tree = git(repository, deadline, "rev-parse", "HEAD^{tree}").strip
+            bundle = File.join(directory, "prepared.bundle")
+            git(repository, deadline, "bundle", "create", bundle, "refs/heads/prepared")
+            bytes = read_bundle(bundle).freeze
+            {"head" => head.freeze, "tree" => tree.freeze, "bundle" => bytes,
+              "bytes" => bytes.bytesize, "sha256" => Digest::SHA256.hexdigest(bytes).freeze,
+              "definition_bytes" => work.definition_bytes(head: head, tree: tree)}.freeze
+          end
+        rescue Timeout::Error
+          reject!("Prepared export deadline exceeded")
+        rescue SystemCallError
+          reject!("Prepared export filesystem is unavailable")
+        end
+
         def admit(bytes:, sha256:, size:, head:, &consumer)
           unless bytes.is_a?(String) && size.is_a?(Integer) && size.positive? && size <= MAX_BYTES &&
               size == bytes.bytesize && sha256.is_a?(String) &&
@@ -70,7 +164,7 @@ module Ace
             destination = Dir.mktmpdir("candidate-", root)
             File.chmod(0700, destination)
             begin
-              entries = git(repository, deadline, "ls-tree", "-r", "-z", head, limit: MAX_BYTES).split("\0")
+              entries = git(repository, deadline, "ls-tree", "-r", "-z", head, limit: MAX_BYTES).b.split("\0")
               total = 0
               links = []
               entries.each do |entry|
@@ -98,6 +192,7 @@ module Ace
                   File.open(target, File::WRONLY | File::CREAT | File::EXCL | File::NOFOLLOW,
                     mode == "100755" ? 0700 : 0600) { |file| file.write(content) }
                 end
+                yield(path.freeze, mode.freeze, oid.freeze, content.freeze) if block_given?
               end
               links.each { |target, content| File.symlink(content, target) }
               links.each do |target, _content|
@@ -116,8 +211,80 @@ module Ace
           reject!("Candidate filesystem materialization is unverifiable")
         end
 
+        # Executing campaign children need local Git history as well as files.
+        # Create only our own empty administration; no uploader configuration,
+        # checkout filters or hooks enter this private repository.
+        def materialize_repository(bytes:, sha256:, size:, head:, tree:, root:)
+          deadline = monotonic + DEADLINE
+          result = materialize(bytes: bytes, sha256: sha256, size: size, head: head, tree: tree, root: root)
+          directory = result.fetch("directory")
+          Tempfile.create(["campaign-candidate-", ".bundle"], root) do |file|
+            file.binmode
+            file.write(bytes); file.flush
+            git(directory, deadline, "init", "--template=", "--initial-branch=work")
+            git(directory, deadline, "fetch", "--no-tags", file.path, "#{head}:refs/heads/candidate")
+            git(directory, deadline, "symbolic-ref", "HEAD", "refs/heads/candidate")
+            git(directory, deadline, "read-tree", head)
+            reject!("Campaign private repository differs") unless git(directory, deadline, "rev-parse", "HEAD^{tree}").strip == tree
+          end
+          result
+        rescue Exception
+          FileUtils.remove_entry(directory) if directory && File.directory?(directory) && !File.symlink?(directory)
+          raise
+        end
+
+        # Full immutable review input comes from the same admitted Git objects
+        # used for materialization, never a second read of the scratch checkout.
+        def review_snapshot(bytes:, sha256:, size:, head:, tree:, root:)
+          subject = JSON.generate("schema" => "ace.candidate-review-snapshot/v1", "head" => head, "tree" => tree)
+            .delete_suffix("}") + ',"files":['
+          first = true
+          result = materialize(bytes: bytes, sha256: sha256, size: size, head: head, tree: tree, root: root) do |path, mode, oid, content|
+            entry = JSON.generate("path" => review_bytes(path), "mode" => mode, "oid" => oid, "content" => review_bytes(content))
+            separator = first ? "" : ","
+            reject!("Complete candidate review snapshot is oversized") if subject.bytesize + separator.bytesize + entry.bytesize + 2 > MAX_BYTES
+            subject << separator << entry
+            first = false
+          end
+          subject << "]}"
+          result.merge("subject" => subject.freeze)
+        end
+
+        # Prepared instructions have a narrower tree contract than candidates:
+        # no executable entries or symlinks, and bounded UTF-8 files. Read only
+        # verified Git objects; never run checkout filters or reopen uploader paths.
+        def prepared_files(repository:, deadline:, head:)
+          entries = git(repository, deadline, "ls-tree", "-r", "-z", head, limit: MAX_BYTES).b.split("\0")
+          reject!("Prepared file inventory is oversized") unless entries.size.between?(4, 4096)
+          total = 0
+          files = entries.to_h do |entry|
+            metadata, path = entry.split("\t", 2)
+            mode, kind, oid = metadata.to_s.split(" ")
+            unless path && mode == "100644" && kind == "blob" && oid.match?(SHA) &&
+                !path.start_with?("/") && path.split("/", -1).none? { |part| part.empty? || %w[. .. .git].include?(part.downcase) }
+              reject!("Prepared tree contains unsafe entry")
+            end
+            size = git(repository, deadline, "cat-file", "-s", oid).strip
+            reject!("Prepared text is oversized") unless size.match?(/\A[0-9]+\z/) && size.to_i.between?(1, 1024 * 1024)
+            total += size.to_i
+            reject!("Prepared expanded content is oversized") if total > MAX_BYTES
+            [path, git(repository, deadline, "cat-file", "blob", oid, limit: 1024 * 1024).b]
+          end
+          reject!("Prepared inventory has duplicate paths") unless files.size == entries.size
+          files
+        end
+
         private
 
+        def review_bytes(bytes)
+          text = bytes.dup.force_encoding(Encoding::UTF_8)
+          if text.valid_encoding? && !text.include?("\0")
+            {"encoding" => "utf-8", "bytes" => text}
+          else
+            {"encoding" => "base64", "bytes" => [bytes].pack("m0")}
+          end
+        end
+
         def verify_root!
           PrivateDirectory.verify!(@root)
         end

data/lib/ace/assign/authority/cleanup_result_protection.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+require "fiddle"
+require "ace/runtime/molecules/protected_artifact_set"
+
+module Ace
+  module Assign
+    module Authority
+      # Extends the existing held artifact protection solely for the bounded
+      # root result view. Private archive storage is never admitted here.
+      class CleanupResultProtection < Ace::Runtime::Molecules::ProtectedArtifactSet::Protection
+        class LinuxACL
+          def absent!(handle, attribute)
+            unless RUBY_PLATFORM.include?("linux")
+              raise Ace::Runtime::RuntimeUnavailableError, "cleanup result ACL evidence requires Linux"
+            end
+            function = Fiddle::Function.new(Fiddle::Handle::DEFAULT["fgetxattr"],
+              [Fiddle::TYPE_INT, Fiddle::TYPE_VOIDP, Fiddle::TYPE_VOIDP, Fiddle::TYPE_SIZE_T], Fiddle::TYPE_SSIZE_T)
+            size = function.call(handle.fileno, attribute, 0, 0)
+            error = Fiddle.last_error
+            unless size == -1 && error == Errno::ENODATA::Errno
+              raise Ace::Runtime::RuntimeUnavailableError, "cleanup result ACL protection is unavailable"
+            end
+          rescue Fiddle::DLError
+            raise Ace::Runtime::RuntimeUnavailableError, "cleanup result ACL reader is unavailable"
+          end
+        end
+
+        def initialize(result_path:, authority_gid:, acl: LinuxACL.new, **options)
+          unless result_path.is_a?(String) && result_path.start_with?("/") && !result_path.include?("\0") &&
+              File.expand_path(result_path) == result_path && authority_gid.is_a?(Integer) && authority_gid.positive?
+            raise ArgumentError, "invalid fixed cleanup result view"
+          end
+          super(**options)
+          @result_path, @parent, @authority_gid, @acl = result_path.dup.freeze, File.dirname(result_path).freeze, authority_gid, acl
+        end
+
+        def verify!(path, handle, directory:)
+          super
+          return unless path == @result_path || path == @parent
+          parent = path == @parent
+          stat = handle.stat
+          unless directory == parent && stat.gid == @authority_gid &&
+              (stat.mode & 0o7777) == (parent ? 0o2750 : 0o640)
+            raise Ace::Runtime::RuntimeUnavailableError, "cleanup result view mode or group differs"
+          end
+          @acl.absent!(handle, "system.posix_acl_access")
+          @acl.absent!(handle, "system.posix_acl_default") if parent
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/client.rb

@@ -2,7 +2,10 @@
 require "securerandom"
 require_relative "deployment"
 require_relative "transfer_codec"
+require_relative "campaign_execution"
+require_relative "candidate_transfer"
 require_relative "../molecules/canonical_evidence"
+require_relative "../molecules/execution_scope_lineage"
 
 module Ace
   module Assign
@@ -17,22 +20,32 @@ module Ace
         end
 
         def call(operation, params, mutation_id: nil, timeout: nil, upload_parts: nil, download: false, purpose: nil)
-          if operation == "evidence_fetch" && (!download || purpose != :artifacts || upload_parts)
-            raise ArgumentError, "evidence fetch requires fixed artifacts download"
+          if operation == "register_assignment" && (!upload_parts || purpose != :candidate || download)
+            raise ArgumentError, "prepared registration requires fixed candidate upload"
+          end
+          if operation == "evidence_fetch" && (!download || purpose != (%w[prepared_work campaign_candidate].include?(params["kind"]) ? :candidate : :artifacts) || upload_parts)
+            raise ArgumentError, "evidence fetch requires source-fixed kind download"
           end
           if operation == "submit_result" && (!upload_parts || purpose != :receipt_artifacts || download)
             raise ArgumentError, "result submission requires fixed receipt upload"
           end
+          if operation == "campaign_export_result" && (!download || purpose != :artifacts || upload_parts || mutation_id)
+            raise ArgumentError, "campaign result requires fixed read-only artifact download"
+          end
+          if operation == "campaign_record_round" && (!upload_parts || purpose != :receipt_artifacts || download)
+            raise ArgumentError, "campaign round requires fixed bounded upload"
+          end
           @deployment.verify!(mapping_id, kernel: @kernel)
           wire = Ace::Runtime::Molecules::ProtectedSocket
           path = @service.fetch("socket_path")
           before = wire.socket_identity(path)
           raise Ace::Runtime::RuntimeUnavailableError, "authority endpoint owner differs" unless before.last == @service.fetch("uid")
           raise ArgumentError, "cannot upload and download on one request" if upload_parts && download
-          codec = transfer_codec if upload_parts || download
+          prepared_download = operation == "evidence_fetch" && %w[prepared_work campaign_candidate].include?(params["kind"])
+          codec = transfer_codec if upload_parts || download && !prepared_download
           descriptor = codec.descriptor(upload_parts, purpose: purpose) if upload_parts
           parameters = upload_parts ? params.merge("transfer" => descriptor) : params
-          cap = %w[reserve_attempt close_execution_scope].include?(operation) ? 90 : 30
+          cap = %w[reserve_attempt close_execution_scope stop_attempt].include?(operation) ? 90 : 30
           duration = timeout || (cap == 90 ? 90 : 5)
           unless duration.is_a?(Numeric) && duration.positive? && duration.finite?
             raise ArgumentError, "authority timeout must be finite and positive"
@@ -47,7 +60,7 @@ module Ace
             wire.write(socket, {"version" => 1, "operation" => operation,
               "mutation_id" => mutation_id, "project_id" => @map.fetch("project_id"),
               "params" => parameters.merge("mapping_id" => mapping_id)}, deadline: deadline, limit: upload_parts || download ? 16_384 : wire::LIMIT)
-            if %w[evidence_fetch observe_execution_scope close_execution_scope].include?(operation) || (operation == "attempt_status" && params.key?("result_candidate_generation"))
+            if %w[bind_inbox finish recover request_review review_status launch_review_intent cancel_review assignment_inventory evidence_fetch observe_execution_scope close_execution_scope stop_attempt prompt_status launch_input_inhibit_selection launch_input_inhibit_completion launch_prompt_intent launch_prompt_completion claim_service_settlement workspace_prune_preview_context].include?(operation) || (operation == "attempt_status" && params.key?("result_candidate_generation"))
               socket.shutdown(Socket::SHUT_WR)
             end
             if upload_parts
@@ -57,14 +70,21 @@ module Ace
             result = wire.read(socket, deadline: deadline, limit: 16_384)
             unless result.is_a?(Hash) && result["status"] == "ok" && result["data"].is_a?(Hash)
               code = result.is_a?(Hash) ? result.dig("error", "code") : nil
+              raise AttemptErrors::BoundedResultUnavailable, "protected authority result exceeds frame bound" if code == "bounded_result"
               raise AttemptErrors::EvidenceUnavailable, "protected authority refused (#{code || 'invalid_response'})"
             end
             transport = result.fetch("transport")
             unless transport.is_a?(Hash) && transport.keys == ["replayed"] && [true, false].include?(transport["replayed"])
               raise AttemptErrors::EvidenceUnavailable, "authority replay metadata is unavailable"
             end
-            validate_evidence_download!(result.fetch("data"), params) if operation == "evidence_fetch"
+            if operation == "evidence_fetch"
+              if %w[prepared_work campaign_candidate].include?(params["kind"]) && transport.fetch("replayed")
+                raise AttemptErrors::EvidenceUnavailable, "prepared fetch cannot replay a mutation"
+              end
+              validate_evidence_download!(result.fetch("data"), params)
+            end
             parts = if download
+              codec = prepared_transfer_codec(result.fetch("data").fetch("descriptor")) if prepared_download
               codec.receive(socket, descriptor: result.fetch("data").fetch("transfer"), purpose: purpose, deadline: deadline) do |input|
                 Array.new(input.count) { |index| input.bytes(index: index) }
               end
@@ -74,10 +94,56 @@ module Ace
         rescue SystemCallError, IOError
           raise AttemptErrors::EvidenceUnavailable, "protected authority connection unavailable; no local fallback"
         end
+
+
+        # Fixed original-launcher stream. Public calls retain their existing
+        # complete-upload EOF contract; no caller-selected framing flag exists.
+        def with_launch_control(state:)
+          @deployment.verify!(mapping_id, kernel: @kernel)
+          wire = Ace::Runtime::Molecules::ProtectedSocket
+          path = @service.fetch("socket_path")
+          before = wire.socket_identity(path)
+          raise Ace::Runtime::RuntimeUnavailableError, "Authority endpoint owner differs" unless before.last == @service.fetch("uid")
+          deadline = wire.deadline(30)
+          wire.connect(path, deadline: deadline) do |socket|
+            peer = @kernel.peer(socket)
+            unless peer.values_at("uid", "gid", "groups") == @service.values_at("uid", "gid", "groups") && wire.socket_identity(path) == before
+              raise AttemptErrors::UnauthorizedIdentity, "Authority stream peer changed"
+            end
+            wire.write(socket, {"version" => 1, "operation" => "launch_control", "mutation_id" => nil,
+              "project_id" => @map.fetch("project_id"), "params" => state.slice("assignment_id", "attempt_id").merge("mapping_id" => mapping_id)},
+              deadline: deadline, limit: 16_384)
+            ready = wire.read(socket, deadline: deadline, limit: 16_384)
+            validate_launch_control_ready!(ready, state)
+            yield socket, transfer_codec, ready
+          end
+        rescue IOError, SystemCallError
+          raise AttemptErrors::EvidenceUnavailable, "Original launch control connection is unavailable"
+        end
+
         private
 
+        def validate_launch_control_ready!(ready, state)
+          unless ready.is_a?(Hash) && ready.keys.sort == %w[attempt_id generation journal_commit original_binding_digest type version] &&
+              ready["version"].is_a?(Integer) && ready["version"] == 1 && ready["type"] == "launch_control_ready" &&
+              ready["attempt_id"] == state.fetch("attempt_id") && ready["generation"].is_a?(Integer) && ready["generation"].positive? &&
+              ready["journal_commit"].is_a?(String) && ready["journal_commit"].match?(/\A(?:[0-9a-f]{40}|[0-9a-f]{64})\z/) &&
+              ready["original_binding_digest"].is_a?(String) && ready["original_binding_digest"].match?(/\A[0-9a-f]{64}\z/)
+            raise AttemptErrors::EvidenceUnavailable, "Original launch control admission is unavailable"
+          end
+          true
+        end
+
         def validate_evidence_download!(data, params)
           descriptor, transfer = data.values_at("descriptor", "transfer")
+          if params["kind"] == "prepared_work"
+            validate_prepared_download!(data, params)
+            return
+          end
+          if params["kind"] == "campaign_candidate"
+            validate_campaign_candidate_download!(data, params)
+            return
+          end
           unless data.keys.sort == %w[descriptor generation journal_commit transfer] &&
               Molecules::CanonicalEvidence.valid_descriptor?(descriptor) &&
               descriptor["project_id"] == @map.fetch("project_id") &&
@@ -101,6 +167,90 @@ module Ace
           end
           TransferCodec.new(root: installed.fetch("scratch_root"))
         end
+
+        def validate_prepared_download!(data, params)
+          descriptor, transfer = data.values_at("descriptor", "transfer")
+          fields = %w[version kind purpose artifact project_id mapping_id assignment_id attempt_id task_id scope definition_digest selection_sha256 prepared_head prepared_tree manifest_bytes manifest_sha256 registration_generation registration_commit original_binding_digest ref bytes sha256 task_context_entry original_worker_identity original_worker_scratch_root workspace_exclusion].sort
+          valid = data.keys.sort == %w[descriptor generation journal_commit transfer] && descriptor.is_a?(Hash) && descriptor.keys.sort == fields &&
+            descriptor["version"].is_a?(Integer) && descriptor["version"] == 1 &&
+            params.values_at("kind", "purpose_id", "artifact_id") == %w[prepared_work original_prepared_work prepared_bundle] &&
+            descriptor.values_at("kind", "purpose", "artifact") == %w[prepared_work original_prepared_work prepared_bundle] &&
+            descriptor["project_id"] == @map.fetch("project_id") && descriptor["mapping_id"] == mapping_id &&
+            %w[assignment_id attempt_id].all? { |key| descriptor[key] == params[key] } &&
+            descriptor["task_id"].is_a?(String) && descriptor["task_id"].match?(Deployment::TOKEN) &&
+            descriptor["scope"].is_a?(String) && descriptor["scope"].bytesize.between?(1, 128) && descriptor["scope"].match?(/\A[0-9]+(?:\.[0-9]+)*\z/) &&
+            %w[definition_digest selection_sha256 manifest_sha256 original_binding_digest sha256].all? { |key| descriptor[key].is_a?(String) && descriptor[key].match?(/\A[0-9a-f]{64}\z/) } &&
+            %w[prepared_head prepared_tree].all? { |key| descriptor[key].is_a?(String) && descriptor[key].match?(/\A[0-9a-f]{40}\z/) } &&
+            descriptor["manifest_bytes"].is_a?(Integer) && descriptor["manifest_bytes"].between?(1, 32_768) &&
+            descriptor["registration_generation"].is_a?(Integer) && descriptor["registration_generation"].positive? &&
+            descriptor["bytes"].is_a?(Integer) && descriptor["bytes"].between?(1, TransferCodec::LIMITS.fetch(:candidate).first) &&
+            descriptor["registration_commit"].is_a?(String) && descriptor["registration_commit"].match?(/\A(?:[0-9a-f]{40}|[0-9a-f]{64})\z/) &&
+            descriptor["ref"] == "execution/prepared/#{params.fetch('assignment_id')}-#{descriptor['sha256']}.bundle" &&
+            data["generation"].is_a?(Integer) && data["generation"].positive? &&
+            data["journal_commit"].is_a?(String) && data["journal_commit"].match?(/\A(?:[0-9a-f]{40}|[0-9a-f]{64})\z/) &&
+            transfer.is_a?(Hash) && transfer.keys.sort == %w[bytes parts sha256 version] && transfer["version"].is_a?(Integer) && transfer["version"] == 1 &&
+            transfer.values_at("bytes", "sha256") == descriptor.values_at("bytes", "sha256") && transfer["parts"] == [descriptor.slice("bytes", "sha256")]
+          raise AttemptErrors::EvidenceUnavailable, "original prepared download descriptor differs" unless valid
+          TaskContextEntry.validate!(descriptor.fetch("task_context_entry"))
+          Molecules::LifecycleExclusion.workspace_reader(projection: descriptor.fetch("workspace_exclusion"))
+          unless descriptor.dig("workspace_exclusion", "root_resource", "view_path") ==
+              "/run/ace/lifecycle-exclusion/#{descriptor.fetch('mapping_id')}"
+            raise AttemptErrors::EvidenceUnavailable, "original prepared lifecycle mapping differs"
+          end
+          identity = descriptor.fetch("original_worker_identity")
+          birth = identity.is_a?(Hash) && identity["started_at"]
+          boot = birth.is_a?(String) && birth.split(":", -1)[1]
+          Molecules::ExecutionScopeLineage.validate_process_identity!(identity, boot_id: boot)
+          root = descriptor.fetch("original_worker_scratch_root")
+          unless root.is_a?(String) && root.valid_encoding? && root.bytesize.between?(2, 4096) &&
+              root.start_with?("/") && !root.include?("\0") && File.expand_path(root) == root
+            raise AttemptErrors::EvidenceUnavailable, "original prepared scratch root differs"
+          end
+        rescue ArgumentError, KeyError
+          raise AttemptErrors::EvidenceUnavailable, "original prepared download descriptor differs"
+        end
+
+        def validate_campaign_candidate_download!(data, params)
+          descriptor, transfer = data.values_at("descriptor", "transfer")
+          fields = %w[head tree bytes sha256 candidate_generation campaign_execution mapping_id assignment_id attempt_id
+            project_id original_worker_identity original_worker_scratch_root original_binding_digest].sort
+          unless data.keys.sort == %w[descriptor generation journal_commit transfer] &&
+              descriptor.is_a?(Hash) && descriptor.keys.sort == fields &&
+              params.values_at("purpose_id", "artifact_id") == %w[original_campaign_candidate candidate_bundle] &&
+              descriptor["mapping_id"] == mapping_id && descriptor["project_id"] == @map.fetch("project_id") &&
+              %w[assignment_id attempt_id].all? { |key| descriptor[key] == params[key] } &&
+              %w[head tree].all? { |key| descriptor[key].is_a?(String) && descriptor[key].match?(CandidateTransfer::SHA) } &&
+              %w[sha256 original_binding_digest].all? { |key| descriptor[key].is_a?(String) && descriptor[key].match?(/\A[0-9a-f]{64}\z/) } &&
+              descriptor["candidate_generation"].is_a?(Integer) && descriptor["candidate_generation"].positive? &&
+              descriptor["bytes"].is_a?(Integer) && descriptor["bytes"].between?(1, CandidateTransfer::MAX_BYTES) &&
+              descriptor["campaign_execution"].is_a?(Hash) && descriptor["campaign_execution"].keys.sort == CampaignExecution::FIELDS &&
+              data["generation"].is_a?(Integer) && data["generation"].positive? &&
+              data["journal_commit"].is_a?(String) && data["journal_commit"].match?(/\A(?:[0-9a-f]{40}|[0-9a-f]{64})\z/) &&
+              transfer.is_a?(Hash) && transfer.keys.sort == %w[bytes parts sha256 version] && transfer["version"] == 1 &&
+              transfer["version"].is_a?(Integer) &&
+              transfer.values_at("bytes", "sha256") == descriptor.values_at("bytes", "sha256") && transfer["parts"] == [descriptor.slice("bytes", "sha256")]
+            raise AttemptErrors::EvidenceUnavailable, "original campaign candidate download differs"
+          end
+          identity = descriptor.fetch("original_worker_identity")
+          birth = identity.is_a?(Hash) && identity["started_at"]
+          Molecules::ExecutionScopeLineage.validate_process_identity!(identity, boot_id: birth.to_s.split(":", -1)[1])
+          root = descriptor.fetch("original_worker_scratch_root")
+          unless root.is_a?(String) && root.valid_encoding? && root.bytesize.between?(2, 4096) &&
+              root.start_with?("/") && !root.include?("\0") && File.expand_path(root) == root
+            raise AttemptErrors::EvidenceUnavailable, "original campaign scratch root differs"
+          end
+        rescue ArgumentError, KeyError
+          raise AttemptErrors::EvidenceUnavailable, "original campaign candidate download differs"
+        end
+
+        def prepared_transfer_codec(descriptor)
+          peer = @kernel.capture(Process.pid)
+          original = descriptor.fetch("original_worker_identity")
+          unless peer.values_at("uid", "gid", "groups") == original.values_at("uid", "gid", "groups")
+            raise AttemptErrors::UnauthorizedIdentity, "original prepared scratch principal differs"
+          end
+          TransferCodec.new(root: descriptor.fetch("original_worker_scratch_root"))
+        end
       end
     end
   end