ace-assign 0.64.0 → 0.66.1

data/lib/ace/assign/molecules/step_writer.rb

@@ -11,6 +11,10 @@ module Ace
       # Handles creation of new step files and updating existing ones,
       # including appending reports and updating frontmatter.
       class StepWriter
+        PRIVATE_MAX_BYTES = 1024 * 1024
+        def initialize(private_files: false)
+          @private_files = private_files
+        end
         # Create a new step file
         #
         # @param steps_dir [String] Path to steps directory
@@ -101,6 +105,8 @@ module Ace
 
           # Extract number and name from filename for report file
           filename_info = Atoms::StepFileParser.parse_filename(File.basename(file_path))
+          encoded_report = report_bytes(filename_info[:number], filename_info[:name], report_content)
+          validate_private_bytes!(encoded_report)
 
           # Update frontmatter only (status + completed_at)
           new_frontmatter = parsed[:frontmatter].merge({
@@ -119,7 +125,7 @@ module Ace
           )
           report_path = File.join(reports_dir, report_filename)
 
-          write_report(report_path, filename_info[:number], filename_info[:name], report_content)
+          write_report(report_path, filename_info[:number], filename_info[:name], report_content, encoded: encoded_report)
 
           file_path
         end
@@ -204,8 +210,15 @@ module Ace
         # Write content atomically using temp file + rename pattern.
         # Prevents partial writes if process crashes mid-write.
         def atomic_write(path, content)
+          validate_private_bytes!(content)
           temp_path = "#{path}.tmp.#{Process.pid}"
-          File.write(temp_path, content)
+          if @private_files
+            File.open(temp_path, File::WRONLY | File::CREAT | File::EXCL | File::NOFOLLOW, 0600) do |file|
+              file.write(content); file.flush; file.fsync
+            end
+          else
+            File.write(temp_path, content)
+          end
           File.rename(temp_path, path)
         end
 
@@ -230,15 +243,24 @@ module Ace
         # @param number [String] Step number
         # @param name [String] Step name
         # @param content [String] Report content
-        def write_report(report_path, number, name, content)
+        def write_report(report_path, number, name, content, encoded: nil)
+          atomic_write(report_path, encoded || report_bytes(number, name, content))
+        end
+
+        def report_bytes(number, name, content)
           frontmatter = {
             "step" => number,
             "name" => name,
             "completed_at" => Time.now.utc.iso8601
           }
           yaml = frontmatter.to_yaml
-          report_content = "#{yaml}---\n\n#{content}\n"
-          atomic_write(report_path, report_content)
+          "#{yaml}---\n\n#{content}\n"
+        end
+
+        def validate_private_bytes!(content)
+          if @private_files && (!content.is_a?(String) || !content.bytesize.between?(1, PRIVATE_MAX_BYTES))
+            raise ArgumentError, "private queue output exceeds captured text bound"
+          end
         end
       end
     end

data/lib/ace/assign/molecules/terminal_scope_receipt.rb

@@ -0,0 +1,88 @@
+# frozen_string_literal: true
+require_relative "receipt_verifier"
+require_relative "canonical_evidence"
+
+module Ace
+  module Assign
+    module Molecules
+      # Pure reader over already accepted terminal owner evidence. A submitted
+      # result alone carries no terminal authority; local filesystem artifacts
+      # are never substituted for its imported protected bytes.
+      class TerminalScopeReceipt
+        BINDING_FIELDS = %w[mapping_id project_id assignment_id attempt_id result_id worker_uid worker_actor
+          launch_ticket process_binding head candidate_generation uploaded_receipt_sha256 original_receipt_digest].freeze
+        PAYLOAD_FIELDS = %w[version result_id binding uploaded_receipt_sha256 original_receipt_digest receipt_digest receipt artifacts].freeze
+
+        def self.verify!(events:, lineage:, journal:, commit:, mapping:)
+          raise AttemptErrors::EvidenceUnavailable, "terminal receipt chain differs" unless Models::EvidenceEvent.chain_valid?(events)
+          terminal = events.select { |event| event["type"] == "receipt_accepted" &&
+            %w[succeeded failed].include?(event.dig("payload", "receipt", "verdict")) }
+          raise AttemptErrors::EvidenceUnavailable, "no unique accepted terminal receipt" unless terminal.size == 1
+          accepted = terminal.first
+          receipt = accepted.fetch("payload").fetch("receipt")
+          before = events.take_while { |event| event.fetch("digest") != accepted.fetch("digest") }
+          submitted = before.select { |event| event["type"] == "result_submitted" &&
+            event.dig("payload", "receipt_digest") == receipt.fetch("digest") }
+          raise AttemptErrors::EvidenceUnavailable, "accepted terminal result provenance differs" unless submitted.size == 1
+          payload = submitted.first.fetch("payload")
+          binding = payload.fetch("binding")
+          reservation = before.find { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "reserve_attempt" }
+          origin = reservation.fetch("payload").fetch("data")
+          expected = {"mapping_id" => origin.fetch("mapping_id"), "project_id" => mapping.fetch("project_id"),
+            "assignment_id" => origin.fetch("assignment_id"), "attempt_id" => accepted.fetch("attempt_id"),
+            "worker_uid" => mapping.fetch("worker_uid"), "worker_actor" => mapping.fetch("worker_actor"),
+            "launch_ticket" => origin.fetch("launch_ticket"), "process_binding" => lineage.child_event.fetch("payload").fetch("original_process_binding")}
+          candidates = before.select { |event| event["type"] == "authority_mutation" &&
+            event.dig("payload", "operation") == "submit_candidate" &&
+            event.dig("payload", "data", "candidate_generation") == binding.fetch("candidate_generation") }
+          candidate = candidates.one? && candidates.first.dig("payload", "data")
+          unless payload.keys.sort == PAYLOAD_FIELDS.sort && binding.keys.sort == BINDING_FIELDS.sort &&
+              payload["version"] == 1 && expected.all? { |key, value| binding[key] == value } &&
+              candidate && candidate["head"] == binding["head"] && receipt["head"] == binding["head"] &&
+              payload["result_id"] == binding["result_id"] && payload["uploaded_receipt_sha256"] == binding["uploaded_receipt_sha256"] &&
+              payload["original_receipt_digest"] == binding["original_receipt_digest"] &&
+              Models::ExecutionReceipt.from_h(payload.fetch("receipt")).digest_payload == Models::ExecutionReceipt.from_h(receipt).digest_payload &&
+              (receipt.keys - Models::ExecutionReceipt.from_h(receipt).to_h.keys).empty? &&
+              payload["artifacts"] == receipt["artifacts"] &&
+              receipt["producer"] == {"actor" => mapping.fetch("worker_actor"), "role" => "worker", "runtime" => "herdr"} &&
+              journal.canonical_attempt_state(events) == receipt.fetch("verdict")
+            raise AttemptErrors::EvidenceUnavailable, "accepted terminal receipt selectors differ"
+          end
+          model = Models::ExecutionReceipt.from_h(receipt)
+          unless model.digest == Atoms::EvidenceDigest.digest(model.digest_payload) && model.digest == payload.fetch("receipt_digest")
+            raise AttemptErrors::EvidenceUnavailable, "accepted terminal receipt digest differs"
+          end
+          finishes = events.select { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "finish" }
+          unless finishes.empty?
+            transition = events[events.index(accepted) + 1]
+            finish = events[events.index(accepted) + 2]
+            expected_reply = binding.slice("attempt_id", "result_id", "head", "candidate_generation").merge(
+              "receipt_digest" => payload.fetch("receipt_digest"), "state" => receipt.fetch("verdict"))
+            unless finishes.one? && finishes.first == finish && transition && transition["type"] == "transition" &&
+                transition.fetch("payload") == {"from" => "running", "to" => receipt.fetch("verdict"), "reason" => "protected_result_accepted"} &&
+                finish.dig("payload", "data").except("generation") == expected_reply &&
+                finish.dig("payload", "data", "generation") == events.take(events.index(finish) + 1).count { |event| event["type"] == "authority_mutation" }
+              raise AttemptErrors::EvidenceUnavailable, "accepted finish reply or terminal transition differs"
+            end
+          end
+          canonical = CanonicalEvidence.new(journal: journal)
+          context = {kind: "result", project_id: binding.fetch("project_id"), assignment_id: binding.fetch("assignment_id"),
+            attempt_id: binding.fetch("attempt_id"), peer_uid: binding.fetch("worker_uid"), binding: binding,
+            request_id_or_event_id: binding.fetch("result_id"), generation: binding.fetch("candidate_generation")}
+          reader = ->(_data, artifact) { canonical.read({"ref" => artifact.fetch("path"), "sha256" => artifact.fetch("sha256")},
+            **context, commit: commit) }
+          Array(receipt["artifacts"]).each { |artifact| reader.call(receipt, artifact) }
+          intent = before.find { |event| event["type"] == "intent" }
+          attempt = journal.send(:build_attempt, binding.fetch("assignment_id"), binding.fetch("attempt_id"),
+            intent.fetch("payload"), before, "running")
+          verifier = ReceiptVerifier.new(artifact_reader: reader)
+          verifier.verify_result!(receipt, attempt: attempt, live_head: binding.fetch("head"), repo_root: journal.repo_root)
+          verifier.verify_accepted_evidence!(receipt, live_head: binding.fetch("head"), repo_root: journal.repo_root, historical: true)
+          accepted
+        rescue KeyError, TypeError, ArgumentError, NoMethodError, AttemptErrors::ReceiptRejected
+          raise AttemptErrors::EvidenceUnavailable, "authenticated terminal scope receipt unavailable"
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/organisms/assignment_executor.rb

@@ -37,10 +37,10 @@ module Ace
           end
         end
 
-        def initialize(cache_base: nil, skill_source_resolver: nil, step_catalog: nil)
-          @assignment_manager = Molecules::AssignmentManager.new(cache_base: cache_base)
-          @queue_scanner = Molecules::QueueScanner.new
-          @step_writer = Molecules::StepWriter.new
+        def initialize(cache_base: nil, skill_source_resolver: nil, step_catalog: nil, selected_assignment: nil, queue_scanner: nil)
+          @assignment_manager = Molecules::AssignmentManager.new(cache_base: cache_base, selected_assignment: selected_assignment)
+          @queue_scanner = queue_scanner || Molecules::QueueScanner.new
+          @step_writer = Molecules::StepWriter.new(private_files: !selected_assignment.nil?)
           @skill_source_resolver = skill_source_resolver || Molecules::SkillAssignSourceResolver.new
           @step_catalog = nil
           @step_catalog_from_fixture = step_catalog

data/lib/ace/assign/organisms/attempt_coordinator.rb

@@ -4,7 +4,10 @@ require "digest"
 require "json"
 require "open3"
 require "pathname"
-require "ace/herdr"
+require "ace/herdr/errors"
+require "ace/herdr/models/delivery_record"
+require "ace/herdr/molecules/delivery_record_store"
+require_relative "../molecules/canonical_attempt_state"
 
 module Ace
   module Assign
@@ -46,6 +49,59 @@ module Ace
 
         attr_reader :store
 
+        # Pure producer plan. The protected lifecycle authenticates the original
+        # proof and both exhaustive owner projections anew at each CAS prefix.
+        # No caller receipt, cache state, native wait or store mutation enters it.
+        def self.stopped_transition_plan(events:, selection:, service_evidence:, commit:)
+          Atoms::AttemptStateMachine.proof_stopped_transition!(Molecules::CanonicalAttemptState.derive(events))
+          payload = Molecules::CanonicalAttemptState.stopped_payload!(events: events, selection: selection,
+            service_evidence: service_evidence, commit: commit)
+          {events: [{type: "attempt_stopped", payload: payload}], blobs: {}}
+        end
+
+        # The protected result owner authenticates imported bytes, candidate,
+        # closure and independent settlements at the same CAS prefix.
+        def self.finished_transition_plan(events:, receipt:)
+          state = Molecules::CanonicalAttemptState.derive(events)
+          unless state == "running" && %w[succeeded failed].include?(receipt.fetch("verdict"))
+            raise AttemptErrors::Conflict, "Result finish requires a running attempt"
+          end
+          Atoms::AttemptStateMachine.transition!(state, receipt.fetch("verdict"))
+          {events: [{type: "receipt_accepted", payload: {"receipt" => receipt}},
+            {type: "transition", payload: {"from" => state, "to" => receipt.fetch("verdict"), "reason" => "protected_result_accepted"}}], blobs: {}}
+        end
+
+        def self.protected_recovery_decision(state:, effects_pending:, bound:, live:, checkpoint:)
+          return ["restart-required", "terminal_attempt"] if %w[succeeded failed stopped].include?(state)
+          reason = if effects_pending
+            "unresolved_effect"
+          elsif state == "uncertain"
+            "attempt_uncertain"
+          elsif !bound
+            "launch_unbound"
+          elsif !checkpoint
+            "checkpoint_unavailable"
+          elsif !live
+            "scope_unverifiable"
+          end
+          reason ? ["reconcile-required", reason] : ["adopt", "live_owner"]
+        end
+
+        def self.protected_recovery_plan(events:, decision:, reason:, observation:)
+          state = Molecules::CanonicalAttemptState.derive(events)
+          if %w[succeeded failed stopped].include?(state)
+            raise AttemptErrors::Conflict, "Terminal recovery is read-only"
+          end
+          planned = [{type: "recovery_observation", payload: {"decision" => decision,
+            "recovery_reason" => reason, "observation" => observation}}]
+          if state == "running" && decision != "adopt"
+            Atoms::AttemptStateMachine.transition!(state, "uncertain")
+            planned << {type: "transition", payload: {"from" => state, "to" => "uncertain", "reason" => reason}}
+            state = "uncertain"
+          end
+          {events: planned, blobs: {}, state: state}
+        end
+
         # Read-only exact native reverse binding from accepted history. A PID
         # supplied by a trusted boundary must be kernel-derived; no command
         # flag, environment address or local cache grants this authority.
@@ -572,14 +628,10 @@ input:#{Regexp.escape(request.fetch("input_digest"))} outcome:(\S+)( no-effect:(
           recovered = attempts.sort_by { |attempt| [attempt.binding.created_at, attempt.attempt_id] }.map do |attempt|
             observation = reconciler.observation(attempt)
             blocked = unresolved.any? { |request| request["attempt_id"] == attempt.attempt_id }
-            inbox_blocked = inbox_records.any? do |record|
-              [nil, attempt.attempt_id].include?(record["attempt_id"]) &&
-                %w[unknown claimed uncertain delivered].include?(record["state"])
-            end
             unstarted = !reconciler.process_started?(attempt)
-            decision, reason = if blocked || inbox_blocked || attempt.uncertain?
+            decision, reason = if blocked || attempt.uncertain?
               ["reconcile-required", blocked ? "unresolved external effect" :
-                (inbox_blocked ? "inbox outcome requires signed native observation" : "attempt remains uncertain")]
+                "attempt remains uncertain"]
             elsif attempt.terminal?
               ["restart-required", "attempt ended; restart requires a new attributable attempt"]
             elsif unstarted
@@ -657,60 +709,7 @@ input:#{Regexp.escape(request.fetch("input_digest"))} outcome:(\S+)( no-effect:(
         # Inbox delivery is transport evidence, never business-effect proof.
         # Herdr owns signature, pinned key, generation and native identity
         # verification; this consumer records only its verified references.
-        def reconcile_inbox(attempt_id:, event_id:, receipt_path:, inbox:, identity: nil)
-          identity ||= @identity_resolver.resolve
-          unless @identity_resolver.trusted?(identity)
-            raise AttemptErrors::UnauthorizedIdentity, "Inbox recovery requires a trusted supervisor"
-          end
-          attempt = @store.find(attempt_id) || recover_managed_attempt(nil, attempt_id)
-          raise AttemptErrors::NotFound, "Attempt '#{attempt_id}' not found" unless attempt
 
-          lifecycle_exclusion.with_exclusive(lifecycle_exclusion.assignment_key(attempt.binding.assignment_id)) do
-            @store.with_lock(attempt.binding.assignment_id) do
-              attempt = attempt.managed? ? recover_managed_attempt(attempt.binding.assignment_id, attempt_id) :
-                @store.load(attempt.binding.assignment_id, attempt_id)
-              record = inbox.status(event: event_id)
-              unless record["attempt_id"] == attempt_id
-                raise AttemptErrors::ReceiptRejected, "Inbox event does not belong to this attempt"
-              end
-              registered = reconciler.events(attempt).find do |event|
-                event["type"] == "inbox_binding" && event.dig("payload", "event_id") == event_id
-              end
-              expected = record.slice("event_id", "attempt_id", "payload_sha256", "receipt_key_sha256")
-              unless registered && registered["payload"] == expected
-                raise AttemptErrors::ReceiptRejected, "Inbox event does not match its registered binding"
-              end
-              bytes = File.binread(receipt_path)
-              receipt = JSON.parse(bytes)
-              result = inbox.reconcile(event: event_id, receipt: receipt,
-                expected_registration: registered.fetch("payload"),
-                signed_bytes: bytes, signature: File.binread("#{receipt_path}.sig"))
-              return result if result["reconciliation_refusal"]
-
-              payload = result.slice("event_id", "attempt_id", "claim_generation", "payload_sha256",
-                "receipt_key_sha256", "binding", "state")
-                .merge("receipt_sha256" => Digest::SHA256.hexdigest(bytes),
-                  "receipt_ref" => File.expand_path(receipt_path),
-                  "outcome" => receipt["outcome"], "observer" => receipt["observer"],
-                  "evidence" => receipt["evidence"].slice("kind", "native_reference"))
-              accepted = reconciler.events(attempt).any? do |event|
-                event["type"] == "inbox_reconciliation" &&
-                  event["payload"].reject { |key, _| %w[receipt_ref receipt_sha256].include?(key) } ==
-                    payload.reject { |key, _| %w[receipt_ref receipt_sha256].include?(key) }
-              end
-              unless accepted
-                event = Models::EvidenceEvent.build(type: "inbox_reconciliation", attempt_id: attempt_id,
-                  payload: payload, previous_digest: last_event_digest(attempt))
-                @store.save(append_events(attempt, [event]))
-              end
-              result
-            end
-          end
-        rescue JSON::ParserError, SystemCallError => e
-          raise AttemptErrors::ReceiptRejected, "Inbox proof unavailable (#{e.class})"
-        rescue Ace::Herdr::Error => e
-          raise AttemptErrors::ReceiptRejected, "Inbox proof rejected: #{e.message}"
-        end
 
         # Register a transport reference in the existing attempt journal so
         # a missing delivery record cannot be mistaken for no pending effect.
@@ -730,7 +729,7 @@ input:#{Regexp.escape(request.fetch("input_digest"))} outcome:(\S+)( no-effect:(
               unless record["attempt_id"] == attempt_id
                 raise AttemptErrors::ReceiptRejected, "Inbox event does not belong to this attempt"
               end
-              payload = record.slice("event_id", "attempt_id", "payload_sha256", "receipt_key_sha256")
+              payload = record.slice("event_id", "attempt_id", "payload_sha256")
               existing = reconciler.events(attempt).find do |event|
                 event["type"] == "inbox_binding" && event.dig("payload", "event_id") == event_id
               end
@@ -859,6 +858,9 @@ input:#{Regexp.escape(request.fetch("input_digest"))} outcome:(\S+)( no-effect:(
         end
 
         def recovery_inboxes(attempts)
+          # Ordinary local recovery selects Herdr's configuration only here;
+          # protected launch admission must not initialize that broad entry.
+          require "ace/herdr"
           root = File.expand_path(Ace::Herdr.config["deliveries_dir"] || ".ace-local/herdr/deliveries", @repo_root)
           entries = Ace::Herdr::Molecules::DeliveryRecordStore.list_records(root)
           registrations = attempts.flat_map do |attempt|
@@ -869,21 +871,9 @@ input:#{Regexp.escape(request.fetch("input_digest"))} outcome:(\S+)( no-effect:(
             record = Ace::Herdr::Molecules::DeliveryRecordStore.load(root, payload["event_id"])
             attributed = record && record.inbox && record.event_id == payload["event_id"] &&
               record.inbox["attempt_id"] == attempt.attempt_id && payload["attempt_id"] == attempt.attempt_id &&
-              record.answer_digest == payload["payload_sha256"] &&
-              record.inbox["receipt_key_sha256"] == payload["receipt_key_sha256"]
-            verified = attributed && reconciler.events(attempt).any? do |event|
-              next false unless event["type"] == "inbox_reconciliation"
-              proof = event["payload"]
-              proof["event_id"] == record.event_id && proof["claim_generation"] == record.inbox["claim_generation"] &&
-                proof["payload_sha256"] == record.answer_digest && proof["binding"] == record.inbox["binding"] &&
-                proof["receipt_key_sha256"] == record.inbox["receipt_key_sha256"] && proof["state"] == record.state
-            end
-            state = if !attributed || ((record.state == "completed" || record.state == "queued" && record.inbox["reconciliation"]) && !verified)
-              "unknown"
-            else
-              record.state
-            end
-            payload.slice("event_id", "attempt_id", "receipt_key_sha256").merge("state" => state)
+              record.answer_digest == payload["payload_sha256"]
+            state = attributed ? record.state : "unknown"
+            payload.slice("event_id", "attempt_id").merge("state" => state)
           rescue JSON::ParserError, ArgumentError, SystemCallError
             payload.slice("event_id", "attempt_id").merge("state" => "unknown")
           end

data/lib/ace/assign/organisms/prepared_work_builder.rb

@@ -0,0 +1,194 @@
+# frozen_string_literal: true
+
+require "ace/bundle"
+require_relative "task_assignment_creator"
+require_relative "../authority/prepared_work"
+
+module Ace
+  module Assign
+    module Organisms
+      # Captures managed preparation once. This owner neither registers nor
+      # launches work; callers retain its exact output across uncertain replies.
+      class PreparedWorkBuilder
+        def initialize(export_root:, task_manager: nil, executor: nil, bundle_loader: nil)
+          @tasks = task_manager || Ace::Task::Organisms::TaskManager.new
+          @executor = executor || AssignmentExecutor.new
+          @bundles = bundle_loader || Ace::Bundle::Organisms::BundleLoader.new
+          @transfer = Authority::CandidateTransfer.new(root: export_root)
+        end
+
+        def call(task_ref:, project_id:, dependency_reports:)
+          token!(project_id)
+          @reads = {}
+          @inventories = {}
+          tasks = closure(task_ref)
+          selected = tasks.fetch(task_ref)
+          refuse!("selected task is not a reviewed leaf") unless
+            %w[pending in-progress].include?(selected.status.to_s) && Array(selected.subtasks).empty?
+          contexts = tasks.sort.to_h do |id, task|
+            refuse!("task still needs review") unless task.metadata.fetch("needs_review", false) == false
+            [id, capture_context(task)]
+          end
+          reports = capture_reports(dependency_reports, tasks, task_ref, project_id)
+          result = TaskAssignmentCreator.new(task_manager: @tasks, executor: @executor)
+            .call(task_refs: [task_ref], primary_task_ref: task_ref, project_id: project_id)
+          assignment = result.fetch(:assignment)
+          refuse!("managed association changed") unless assignment.task_id == task_ref && assignment.project_id == project_id
+          job = read(assignment.source_config)
+          read(assignment.assignment_file)
+          inventory = inventory(assignment.steps_dir)
+          step_files = inventory.to_h { |name| [name, read(File.join(assignment.steps_dir, name))] }
+          roots = step_files.filter_map do |name, bytes|
+            fm = Atoms::StepFileParser.parse(bytes).fetch(:frontmatter)
+            Atoms::StepFileParser.parse_filename(name).fetch(:number) if fm["context"] == "fork" && fm["taskref"] == task_ref
+          end
+          refuse!("selected fork root is not unique") unless roots.one? && roots.first
+          scope = roots.first
+          files = {"definition.json" => JSON.generate(assignment.to_h), "job.yaml" => job}
+          selected_steps = step_files.filter_map do |name, bytes|
+            number = Atoms::StepFileParser.parse_filename(name).fetch(:number)
+            refuse!("unexpected queue entry") unless number && name.end_with?(".st.md")
+            next unless number == scope || number.start_with?(scope + ".")
+            files["steps/#{name}"] = bytes
+            record(name, bytes).merge("number" => number)
+          end.sort_by { |entry| number_key(entry.fetch("number")) }
+          context = contexts.map do |id, captured|
+            spec_path = "context/#{id}/spec.md"
+            text_path = "context/#{id}/bundle.txt"
+            files[spec_path], files[text_path] = captured.values_at(:spec, :text)
+            selected_reports = reports.fetch(id, []).map do |report|
+              path = "context/#{id}/reports/#{report.fetch(:assignment_id)}/#{report.fetch(:number)}.r.md"
+              files[path] = report.fetch(:bytes)
+              {"assignment_id" => report.fetch(:assignment_id), "number" => report.fetch(:number),
+                "file" => record(path, report.fetch(:bytes))}
+            end
+            {"uri" => "task://#{id}", "task_id" => id, "spec" => record(spec_path, files.fetch(spec_path)),
+              "text" => record(text_path, files.fetch(text_path)), "reports" => selected_reports}
+          end
+          manifest = {"version" => 1, "assignment_id" => assignment.id, "project_id" => project_id,
+            "task_id" => task_ref, "scope" => scope, "job" => record("job.yaml", job),
+            "steps" => selected_steps, "context" => context}
+          files["manifest.json"] = Authority::PreparedWork.canonical_manifest(manifest) + "\n"
+          work = Authority::PreparedWork.new(files: files)
+          current = closure(task_ref)
+          refuse!("task dependency inventory changed") unless current.keys.sort == tasks.keys.sort
+          refuse!("selected task expanded during capture") unless Array(current.fetch(task_ref).subtasks).empty?
+          current.each { |id, task| refuse!("task context changed") unless capture_context(task) == contexts.fetch(id) }
+          @inventories.each { |path, names| refuse!("input inventory changed") unless Dir.children(path).sort == names }
+          @reads.each { |path, bytes| refuse!("captured input changed") unless read_bytes(path) == bytes }
+          @transfer.export_prepared(work: work).merge("assignment_id" => assignment.id,
+            "scope" => scope.freeze, "selection_sha256" => work.selection_sha256).freeze
+        ensure
+          @reads = nil
+          @inventories = nil
+        end
+
+        private
+
+        def closure(ref)
+          found = {}; visiting = []
+          walk = lambda do |id|
+            token!(id)
+            refuse!("dependency cycle: #{(visiting + [id]).join(' -> ')}") if visiting.include?(id)
+            return if found.key?(id)
+            refuse!("too many task contexts") if found.size >= 256
+            task = @tasks.show(id)
+            refuse!("missing or noncanonical task") unless task && task.id == id
+            found[id] = task
+            visiting << id
+            Array(task.dependencies).each { |dependency| walk.call(dependency) }
+            visiting.pop
+          end
+          walk.call(ref)
+          found
+        end
+
+        def capture_context(task)
+          spec = read(task.file_path)
+          bundle = @bundles.load_file(task.file_path)
+          errors = bundle.metadata.values_at(:error, :errors, "error", "errors").flatten.compact
+          refuse!("unresolvable task context") unless errors.empty?
+          text = bounded_text(bundle.content)
+          # Deep-copy owner inventories; a loader may reuse mutable objects.
+          {spec: spec, text: text, path: task.file_path,
+            inventory: Marshal.dump([bundle.files, bundle.source_files])}
+        end
+
+        def capture_reports(selections, tasks, selected, project)
+          refuse!("report selections must be explicit") unless selections.is_a?(Array) && selections.size <= 4096
+          seen = {}; grouped = Hash.new { |hash, key| hash[key] = [] }
+          selections.each do |selection|
+            refuse!("report selector") unless selection.is_a?(Hash) && selection.keys.sort == %w[assignment_id number task_id]
+            id, assignment_id, number = selection.values_at("task_id", "assignment_id", "number")
+            token!(id); token!(assignment_id)
+            refuse!("report scope") unless number.is_a?(String) && number.match?(Authority::PreparedWork::SCOPE)
+            refuse!("report is not a dependency") unless id != selected && tasks.key?(id)
+            identity = [id, assignment_id, number]
+            refuse!("duplicate report") if seen[identity]
+            seen[identity] = true
+            assignment = @executor.assignment_manager.load(assignment_id)
+            refuse!("report assignment association") unless assignment && assignment.task_id == id && assignment.project_id == project
+            metadata = read(assignment.assignment_file)
+            parsed_metadata = YAML.safe_load(metadata, permitted_classes: [Time, Date])
+            refuse!("report assignment changed") unless parsed_metadata["session_id"] == assignment_id &&
+              parsed_metadata["task_id"] == id && parsed_metadata["project_id"] == project
+            inventory(assignment.reports_dir)
+            matches = inventory(assignment.steps_dir).select do |name|
+              name.end_with?(".st.md") && Atoms::StepFileParser.parse_filename(name)[:number] == number
+            end
+            refuse!("report step association") unless matches.one?
+            step = matches.first
+            read(File.join(assignment.steps_dir, step))
+            parsed = Atoms::StepFileParser.parse_filename(step)
+            filename = Atoms::StepFileParser.generate_report_filename(number, parsed.fetch(:name))
+            grouped[id] << {assignment_id: assignment_id, number: number,
+              bytes: read(File.join(assignment.reports_dir, filename))}
+          end
+          grouped.each_value { |entries| entries.sort_by! { |entry| [entry.fetch(:assignment_id), number_key(entry.fetch(:number))] } }
+          grouped
+        end
+
+        def record(path, bytes)
+          {"filename" => path, "bytes" => bytes.bytesize, "sha256" => Digest::SHA256.hexdigest(bytes)}
+        end
+
+        def read(path)
+          bytes = read_bytes(path)
+          refuse!("captured input changed") if @reads.key?(path) && @reads.fetch(path) != bytes
+          @reads[path] = bytes
+          refuse!("capture inventory bound") if @reads.size > 4096 || @reads.values.sum(&:bytesize) > Authority::PreparedWork::MAX_TOTAL
+          bytes
+        end
+
+        def inventory(path)
+          names = Dir.children(path).sort.freeze
+          refuse!("capture inventory bound") if names.size > 4096
+          refuse!("input inventory changed") if @inventories.key?(path) && @inventories.fetch(path) != names
+          @inventories[path] = names
+        end
+
+        def read_bytes(path)
+          File.open(path, File::RDONLY | File::NOFOLLOW | File::NONBLOCK) do |file|
+            refuse!("input is not a bounded regular file") unless file.stat.file? && file.stat.size <= Authority::PreparedWork::MAX_TEXT
+            bounded_text(file.read(Authority::PreparedWork::MAX_TEXT + 1))
+          end
+        rescue SystemCallError
+          refuse!("input unavailable")
+        end
+
+        def bounded_text(bytes)
+          refuse!("input text bound") unless bytes.is_a?(String) && bytes.bytesize.between?(1, Authority::PreparedWork::MAX_TEXT)
+          text = bytes.dup.force_encoding(Encoding::UTF_8)
+          refuse!("input encoding") unless text.valid_encoding? && !text.include?("\0")
+          text.freeze
+        end
+
+        def number_key(number) = number.split(".").map(&:to_i)
+        def token!(value)
+          refuse!("invalid identity") unless value.is_a?(String) && value.match?(Authority::PreparedWork::TOKEN)
+        end
+        def refuse!(message) = raise(AttemptErrors::ReceiptRejected, "prepared_input_invalid: #{message}")
+      end
+    end
+  end
+end