ace-assign 0.64.0 → 0.66.1

data/lib/ace/assign/authority/endcap_campaign_results.rb

@@ -0,0 +1,232 @@
+# frozen_string_literal: true
+
+module Ace
+  module Assign
+    module Authority
+      class Endcap
+        # Internal R1 dependency. The fixed authority consumer supplies the
+        # original expected linkage; no metadata document can attest execution.
+        # Raw imported artifacts are read at this same immutable prefix.
+        def with_campaign_execution_evidence!(journal:, commit:, params:, map:, receipt_digest:, execution_binding:)
+          raise ArgumentError, "campaign evidence requires a block" unless block_given?
+          begin
+            row = @launch.completion_terminal!(journal: journal, commit: commit, params: params, map: map)
+            unless row["canonical_state"] == "succeeded" && row["reservation_release_event_id"]
+              raise AttemptErrors::EvidenceUnavailable, "campaign execution is not succeeded and released"
+            end
+            definition = @launch.preview_attempt_definition!(journal: journal, commit: commit, params: params, map: map)
+            execution = definition.campaign_execution
+            raise AttemptErrors::EvidenceUnavailable, "campaign execution linkage is missing" unless execution
+            binding = execution.merge(params.slice("assignment_id", "attempt_id"),
+              "definition_digest" => row.fetch("definition_digest"), "binding_digest" => row.fetch("original_binding_digest"))
+            unless binding == execution_binding && binding["binding_digest"].is_a?(String)
+              raise AttemptErrors::EvidenceUnavailable, "campaign execution original linkage differs"
+            end
+            inventory = journal.canonical_event_inventory!(commit: commit)
+            accepted_commit = inventory.fetch("introductions").fetch(params.fetch("assignment_id"))
+              .fetch(row.fetch("terminal_event_id"))
+            events = @launch.preview_attempt_events!(journal: journal, commit: accepted_commit, params: params, map: map)
+            results = events.select { |event| event["type"] == "result_submitted" &&
+              event.dig("payload", "receipt_digest") == receipt_digest }
+            raise AttemptErrors::EvidenceUnavailable, "campaign execution result is ambiguous" unless results.one?
+            submitted = results.first.fetch("payload")
+            selected = params.merge(submitted.fetch("binding").slice("head", "candidate_generation"),
+              "result_id" => submitted.fetch("result_id"))
+            current = exact_candidate!(retained_candidate(events, selected.fetch("candidate_generation")), selected)
+            result = verified_result(journal, events, selected, map, retained_origin(events, selected), current, accepted_commit,
+              result_id: selected.fetch("result_id"))
+            unless result && result["receipt_digest"] == receipt_digest && result.dig("receipt", "verdict") == "succeeded"
+              raise AttemptErrors::EvidenceUnavailable, "campaign execution accepted receipt differs"
+            end
+            terminal = events.find { |event| event["digest"] == row.fetch("terminal_event_id") }
+            unless terminal && terminal["type"] == "receipt_accepted" && terminal.dig("payload", "receipt") == result.fetch("receipt")
+              raise AttemptErrors::EvidenceUnavailable, "campaign execution terminal receipt differs"
+            end
+            accepted = approved_review!(journal, events, selected, map, current, commit: accepted_commit)
+            campaign_finished_result!(journal: journal, commit: accepted_commit, events: events, params: selected, map: map,
+              result: result, accepted: accepted)
+            proof = result.fetch("receipt").merge("attempt_id" => params.fetch("attempt_id"),
+              "receipt_digest" => receipt_digest, "execution_binding" => binding, "journal_commit" => accepted_commit)
+            freeze_campaign_evidence!(proof)
+          rescue KeyError, TypeError, ArgumentError, AttemptErrors::ReceiptRejected
+            raise AttemptErrors::EvidenceUnavailable, "campaign execution evidence is unavailable"
+          end
+          active = true
+          thread = Thread.current
+          canonical = Molecules::CanonicalEvidence.new(journal: journal)
+          reader = ->(artifact) {
+            unless active && Thread.current.equal?(thread) && result.fetch("artifacts").include?(artifact)
+              raise AttemptErrors::EvidenceUnavailable, "campaign artifact read escaped its original evidence scope"
+            end
+            canonical.read({"ref" => artifact.fetch("path"), "sha256" => artifact.fetch("sha256")},
+              **result_context(result.fetch("binding")), commit: accepted_commit)
+          }
+          yield proof, reader
+        ensure
+          active = false
+        end
+
+        private
+
+        def campaign_execution_dependencies!(journal:, commit:, parent_params:, parent_map:)
+          # This closure belongs to one held original exclusion and immutable
+          # journal selection. Never retained across RPCs. Live/original source
+          # parent checks below still run on every callback; only fully verified raw
+          # canonical artifacts and their introduced-prefix proof are reused.
+          verified = {}
+          selected_rows = {}
+          inventory = nil
+          read = lambda do |reference, phase:, head:, artifacts: nil, name: nil, producer: nil, reviewer: nil, historical: false|
+            unless reference.is_a?(Hash) && reference.keys.sort == %w[attempt_id digest] &&
+                reference["digest"].is_a?(String) && reference["digest"].match?(DIGEST)
+              raise AttemptErrors::EvidenceUnavailable, "campaign child receipt reference differs"
+            end
+            selection_key = Atoms::EvidenceDigest.digest("commit" => commit, "reference" => reference,
+              "phase" => phase, "head" => head, "name" => name)
+            params, map, execution, row = selected_rows[selection_key] ||= begin
+              inventory ||= journal.canonical_event_inventory!(commit: commit)
+              matches = inventory.fetch("events").filter_map do |assignment, events|
+                next unless events.any? { |event| event["attempt_id"] == reference["attempt_id"] }
+                registration = events.reverse.find { |event| event.dig("payload", "operation") == "register_assignment" }&.dig("payload", "data")
+                next unless registration
+                descriptor = @launch.send(:control_original_descriptor!, registration.fetch("lifecycle_control"))
+                child_map = descriptor.mapping(registration.fetch("mapping_id"))
+                params = {"assignment_id" => assignment, "attempt_id" => reference.fetch("attempt_id"),
+                  "mapping_id" => registration.fetch("mapping_id")}
+                definition = @launch.preview_attempt_definition!(journal: journal, commit: commit, params: params, map: child_map)
+                execution = definition.campaign_execution
+                next unless execution && execution.values_at("parent_assignment_id", "parent_attempt_id", "phase", "head") ==
+                  parent_params.values_at("assignment_id", "attempt_id") + [phase, head]
+                next unless child_map["project_id"] == parent_map.fetch("project_id")
+                next if name && execution["check_name"] != name
+                [params, child_map, execution]
+              end
+              raise AttemptErrors::EvidenceUnavailable, "campaign child receipt linkage is ambiguous" unless matches.one?
+              params, map, execution = matches.first
+              row = @launch.completion_terminal!(journal: journal, commit: commit, params: params, map: map)
+              [params.freeze, map, freeze_campaign_evidence!(JSON.parse(JSON.generate(execution))),
+                freeze_campaign_evidence!(JSON.parse(JSON.generate(row)))]
+            end
+            binding = execution.merge(params.slice("assignment_id", "attempt_id"),
+              "definition_digest" => row.fetch("definition_digest"), "binding_digest" => row.fetch("original_binding_digest"))
+            unless historical
+              campaign_parent_candidate!(journal: journal, commit: commit, params: parent_params.merge(
+                "scope" => execution.fetch("parent_scope"), "head" => head, "base" => execution.fetch("base"),
+                "candidate_generation" => execution.fetch("parent_candidate_generation")), map: parent_map)
+            end
+            key = Atoms::EvidenceDigest.digest("journal" => journal.object_id, "commit" => commit,
+              "binding" => binding, "receipt" => reference, "phase" => phase, "head" => head,
+              "name" => name, "producer" => producer, "reviewer" => reviewer, "artifacts" => artifacts)
+            proof = verified[key] ||= with_campaign_execution_evidence!(journal: journal, commit: commit, params: params, map: map,
+              receipt_digest: reference.fetch("digest"), execution_binding: binding) do |canonical, reader|
+              canonical.fetch("artifacts").each do |artifact|
+                unless Digest::SHA256.hexdigest(reader.call(artifact)) == artifact.fetch("sha256")
+                  raise AttemptErrors::EvidenceUnavailable, "canonical campaign artifact bytes differ"
+                end
+              end
+              freeze_campaign_evidence!(JSON.parse(JSON.generate(canonical)))
+            end
+            if producer && (proof.dig("producer", "actor") != producer || proof.dig("review", "reviewer", "actor") != reviewer)
+              raise AttemptErrors::EvidenceUnavailable, "campaign approval original actors differ"
+            end
+            if artifacts && artifacts.any? { |artifact| !proof.fetch("artifacts").any? { |ref| ref["sha256"] == artifact.fetch("sha256") } }
+              raise AttemptErrors::EvidenceUnavailable, "campaign artifact differs from canonical child bytes"
+            end
+            proof.merge("artifacts" => artifacts || proof.fetch("artifacts"), "historical" => historical)
+          end
+          {check_evidence: ->(reference, head:, name:, historical: false) {
+            read.call(reference, phase: "check", head: head, name: name, historical: historical)
+          }, review_evidence: ->(reference, head:, artifacts:, historical: false) {
+            read.call(reference, phase: "collection", head: head, artifacts: artifacts, historical: historical)
+          }, approval_evidence: ->(reference, head:, artifacts:, producer:, reviewer:, historical: false) {
+            read.call(reference, phase: "approval", head: head, artifacts: artifacts, producer: producer, reviewer: reviewer, historical: historical)
+          }}.freeze
+        end
+
+        def freeze_campaign_evidence!(value)
+          case value
+          when Hash then value.each { |key, item| freeze_campaign_evidence!(key); freeze_campaign_evidence!(item) }
+          when Array then value.each { |item| freeze_campaign_evidence!(item) }
+          end
+          value.freeze
+        end
+
+        # The ordinary result is still campaign-free. Its phase comes only
+        # from the authenticated original registered child definition.
+        def campaign_child_result!(journal:, commit:, events:, params:, map:, receipt:)
+          definition = @launch.preview_attempt_definition!(journal: journal, commit: commit,
+            params: params, map: map)
+          execution = definition.campaign_execution
+          return unless execution
+          CampaignExecution.validate!(execution, parent: definition.parent,
+            policy: campaign_original_parent_policy!(journal, commit, execution, map))
+          intent = events.find { |event| event["type"] == "intent" }&.fetch("payload")
+          CampaignExecution.validate_result!(execution, receipt: receipt, base: intent&.fetch("base_head"))
+          execution
+        rescue KeyError, TypeError, ArgumentError
+          raise AttemptErrors::ReceiptRejected, "campaign child result binding is incomplete"
+        end
+
+        def campaign_finished_result!(journal:, commit:, events:, params:, map:, result:, accepted:)
+          execution = campaign_child_result!(journal: journal, commit: commit, events: events, params: params, map: map,
+            receipt: result.fetch("receipt"))
+          return unless execution
+          CampaignExecution.validate_finished_review!(execution, receipt: result.fetch("receipt"),
+            accepted_review: accepted.fetch("review_receipt"))
+        rescue KeyError, ArgumentError, TypeError
+          raise AttemptErrors::ReceiptRejected, "campaign independent review differs from executed result"
+        end
+
+        def campaign_original_parent_policy!(journal, commit, execution, map)
+          campaign_original_parent_context!(journal, commit, execution, map).fetch(:selected).fetch("policy")
+        end
+
+        def campaign_original_parent_context!(journal, commit, execution, map)
+          parent = {"assignment_id" => execution.fetch("parent_assignment_id"),
+            "attempt_id" => execution.fetch("parent_attempt_id")}
+          inventory = journal.canonical_event_inventory!(commit: commit)
+          events = inventory.fetch("events").fetch(parent.fetch("assignment_id"))
+          reservations = events.select { |event| event["attempt_id"] == parent.fetch("attempt_id") &&
+            event.dig("payload", "operation") == "reserve_attempt" }
+          raise AttemptErrors::EvidenceUnavailable, "campaign parent original reservation differs" unless reservations.one?
+          parent["mapping_id"] = reservations.first.dig("payload", "data", "mapping_id")
+          prefix = inventory.fetch("introductions").fetch(parent.fetch("assignment_id"))
+            .fetch(reservations.first.fetch("digest"))
+          registration = @launch.send(:definition, journal, parent.fetch("assignment_id"), commit: prefix)
+          descriptor = @launch.send(:control_original_descriptor!, registration.fetch("lifecycle_control"))
+          original = @launch.send(:control_registration_context!, parent,
+            descriptor.mapping(parent.fetch("mapping_id")), journal, commit: commit)
+          unless original.fetch(:map).fetch("project_id") == map.fetch("project_id")
+            raise AttemptErrors::EvidenceUnavailable, "campaign child original project differs"
+          end
+          definition = @launch.preview_attempt_definition!(journal: journal, commit: commit,
+            params: parent, map: original.fetch(:map))
+          selected = CampaignExecution.validate_parent!(definition.review_campaign)
+          unless selected.values_at("campaign_id", "subject", "contract_identity") ==
+              execution.values_at("campaign_id", "subject", "contract_identity")
+            raise AttemptErrors::EvidenceUnavailable, "campaign child original parent differs"
+          end
+          {params: parent, map: original.fetch(:map), definition: definition, selected: selected}.freeze
+        end
+
+        def campaign_prepared_candidate!(journal:, commit:, execution:, map:)
+          original = campaign_original_parent_context!(journal, commit, execution, map)
+          CampaignExecution.validate!(execution, parent: original.fetch(:definition).id,
+            policy: original.fetch(:selected).fetch("policy"))
+          params = original.fetch(:params).merge("scope" => execution.fetch("parent_scope"),
+            "base" => execution.fetch("base"), "head" => execution.fetch("head"),
+            "candidate_generation" => execution.fetch("parent_candidate_generation"))
+          campaign_parent_candidate!(journal: journal, commit: commit, params: params, map: original.fetch(:map))
+          events = @launch.preview_attempt_events!(journal: journal, commit: commit, params: params, map: original.fetch(:map))
+          selected = exact_candidate!(candidate(events), params)
+          bytes = journal.bounded_blob(selected.fetch("bundle_ref"), commit: commit, max_bytes: CandidateTransfer::MAX_BYTES)
+          unless bytes.is_a?(String) && bytes.bytesize == selected.fetch("bytes") &&
+              Digest::SHA256.hexdigest(bytes) == selected.fetch("sha256")
+            raise AttemptErrors::EvidenceUnavailable, "campaign original candidate bundle differs"
+          end
+          [selected.slice("head", "tree", "bytes", "sha256", "candidate_generation").merge("campaign_execution" => execution), bytes]
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/endcap_campaign_rounds.rb

@@ -0,0 +1,266 @@
+# frozen_string_literal: true
+require_relative "campaign_round_transfer"
+
+module Ace
+  module Assign
+    module Authority
+      class Endcap
+        private
+
+        def campaign_round_request!(request)
+          params = request.fetch("params")
+          unless params.is_a?(Hash) && params.keys.sort == PARAMETERS.fetch("campaign_record_round").sort &&
+              params["head"].is_a?(String) && params["head"].match?(CandidateTransfer::SHA) &&
+              params["candidate_generation"].is_a?(Integer) && params["candidate_generation"].positive? &&
+              params["input_sha256"].is_a?(String) && params["input_sha256"].match?(DIGEST)
+            raise ArgumentError, "campaign round request differs"
+          end
+          %w[mapping_id assignment_id attempt_id].each { |key| result_id!(params.fetch(key)) }
+          result_id!(request.fetch("mutation_id"))
+          map = @deployment.mapping(params.fetch("mapping_id"))
+          raise AttemptErrors::UnauthorizedIdentity, "campaign project differs" unless map["project_id"] == request.fetch("project_id")
+          [params, map]
+        end
+
+        def authorize_campaign_round!(request:, peer:, role:)
+          params, map = campaign_round_request!(request)
+          @launch.with_assignment(params: params, map: map) do |journal, registration|
+            protected_journal!(journal)
+            descriptor = @launch.send(:control_original_descriptor!, registration.fetch("lifecycle_control"))
+            original_map = descriptor.mapping(params.fetch("mapping_id"))
+            events = @launch.preview_attempt_events!(journal: journal, commit: journal.ref_value, params: params, map: original_map)
+            finish_identity!(events, params, original_map, peer, role)
+            definition = @launch.preview_attempt_definition!(journal: journal, commit: journal.ref_value, params: params, map: original_map)
+            CampaignExecution.validate_parent!(definition.review_campaign)
+          end
+          true
+        end
+
+        def with_campaign_receipt!(journal:, commit:, events:, params:, map:, receipt:, result:, historical:)
+          unless result.is_a?(Hash) && result["schema"] == "ace.review.accepted-result/v1" &&
+              receipt["campaign"].is_a?(Hash) && receipt["campaign"].keys.sort == %w[id result] &&
+              receipt["operation"] == "review" && receipt["verdict"] == "succeeded"
+            raise AttemptErrors::ReceiptRejected, "parent campaign receipt differs"
+          end
+          context = @launch.send(:control_registration_context!, params, map, journal, commit: commit)
+          original_map = context.fetch(:map)
+          descriptor = context.fetch(:descriptor)
+          selected = CampaignExecution.validate_parent!(@launch.preview_attempt_definition!(journal: journal,
+            commit: commit, params: params, map: original_map).review_campaign)
+          unless receipt.dig("campaign", "id") == selected.fetch("campaign_id") && result["campaign_id"] == selected.fetch("campaign_id")
+            raise AttemptErrors::ReceiptRejected, "parent campaign identity differs"
+          end
+          origin = retained_origin(events, params)
+          parent = params.merge("scope" => origin.fetch("scope"), "base" => origin.fetch("base_head"), "head" => receipt.fetch("head"))
+          current = exact_candidate!(retained_candidate(events, params.fetch("candidate_generation")), parent)
+          project = descriptor.project(original_map.fetch("project_id"))
+          root = File.join(project.fetch("campaign_repository"), ".ace-local", "review", "candidate-views")
+          FileUtils.mkdir_p(root, mode: 0o700)
+          bundle = journal.bounded_blob(current.fetch("bundle_ref"), commit: commit, max_bytes: CandidateTransfer::MAX_BYTES)
+          CandidateTransfer.new(root: root).with_campaign_repository(bytes: bundle, sha256: current.fetch("sha256"),
+            size: current.fetch("bytes"), head: current.fetch("head"), tree: current.fetch("tree"), base: parent.fetch("base")) do |candidate_reader|
+            manager = @launch.send(:campaign_manager_for!, context,
+              **campaign_execution_dependencies!(journal: journal, commit: commit, parent_params: parent, parent_map: original_map),
+              candidate_reader: candidate_reader)
+            binding = selected.slice("subject", "contract_identity", "policy").transform_keys(&:to_sym).merge(
+              result: result, head: receipt.fetch("head"), base: parent.fetch("base"),
+              producer: receipt.fetch("producer").fetch("actor"), reviewer: receipt.fetch("review").fetch("reviewer").fetch("actor"))
+            if historical
+              manager.verify_retained_result!(**binding)
+              yield
+            else
+              deployment_sha = @launch.send(:protected_descriptor_sha256!)
+              CampaignConsumerPolicy.new.with(@deployment.project(original_map.fetch("project_id")).fetch("campaign_policy")) do |profiles, held|
+                manager.with_verified_result!(**binding, consumer_profiles: profiles) do |_verified, snapshot|
+                  unless result == snapshot
+                    raise AttemptErrors::ReceiptRejected, "exported campaign result bytes differ from verified owner"
+                  end
+                  held.verify_unchanged!
+                  campaign_parent_candidate!(journal: journal, commit: commit, params: parent, map: original_map)
+                  unless @launch.send(:protected_descriptor_sha256!) == deployment_sha
+                    raise AttemptErrors::Conflict, "campaign consumer policy descriptor advanced"
+                  end
+                  value = yield
+                  held.verify_unchanged!
+                  unless @launch.send(:protected_descriptor_sha256!) == deployment_sha
+                    raise AttemptErrors::Conflict, "campaign consumer policy descriptor advanced"
+                  end
+                  value
+                end
+              end
+            end
+          end
+        rescue Ace::Review::Atoms::CampaignContract::Invalid, KeyError, TypeError, ArgumentError
+          raise AttemptErrors::ReceiptRejected, "canonical parent campaign evidence is unavailable"
+        end
+
+        def with_campaign_submission!(journal:, commit:, events:, params:, map:, admitted:, replay:)
+          receipt = admitted.fetch(:receipt)
+          return yield unless receipt["campaign"]
+          definition = @launch.preview_attempt_definition!(journal: journal, commit: commit, params: params, map: map)
+          unless definition.review_campaign
+            raise AttemptErrors::EvidenceUnavailable, "protected campaigns require their canonical owner"
+          end
+          reference = receipt.fetch("campaign").fetch("result")
+          index = receipt.fetch("artifacts").index(reference)
+          raise AttemptErrors::ReceiptRejected, "campaign result is not an uploaded artifact" unless index
+          result = JSON.parse(admitted.fetch(:artifacts).fetch(index), create_additions: false,
+            max_nesting: 64, allow_duplicate_key: false, allow_comments: false)
+          with_campaign_receipt!(journal: journal, commit: commit, events: events, params: params, map: map,
+            receipt: receipt, result: result, historical: !replay.nil?) { yield }
+        rescue JSON::ParserError
+          raise AttemptErrors::ReceiptRejected, "campaign result JSON is malformed"
+        end
+
+        # Service callers already retain with_assignment's original control SH
+        # and authority mutex through CAS. Round writers take the same keys EX
+        # before R1, so this read cannot invert with an admitted round writer.
+        def campaign_service_checks!(journal:, commit:, events:, params:, map:, current:)
+          definition = @launch.preview_attempt_definition!(journal: journal, commit: commit, params: params, map: map)
+          return true unless definition.review_campaign
+          parent = params.merge("head" => current.fetch("head"), "candidate_generation" => current.fetch("candidate_generation"))
+          result = verified_result(journal, events, parent, map, retained_origin(events, parent), current, commit)
+          unless result&.dig("receipt", "campaign") && result.dig("receipt", "verdict") == "succeeded"
+            raise AttemptErrors::ReceiptRejected, "ready or merge requires its canonical parent campaign result and executed checks"
+          end
+          with_campaign_finish!(journal: journal, commit: commit, events: events,
+            params: parent.merge("result_id" => result.fetch("result_id")), map: map) { true }
+        end
+
+        def with_campaign_finish!(journal:, commit:, events:, params:, map:)
+          record = events.find { |event| event["type"] == "result_submitted" && event.dig("payload", "result_id") == params["result_id"] }
+          return yield unless record&.dig("payload", "receipt", "campaign")
+          current = exact_candidate!(candidate(events), params)
+          payload = verified_result(journal, events, params, map, retained_origin(events, params), current, commit,
+            result_id: params.fetch("result_id"))
+          reference = payload.fetch("receipt").fetch("campaign").fetch("result")
+          canonical = Molecules::CanonicalEvidence.new(journal: journal)
+          bytes = canonical.read({"ref" => reference.fetch("path"), "sha256" => reference.fetch("sha256")},
+            **result_context(payload.fetch("binding")), commit: commit)
+          result = JSON.parse(bytes, create_additions: false, max_nesting: 64, allow_duplicate_key: false, allow_comments: false)
+          with_campaign_receipt!(journal: journal, commit: commit, events: events, params: params, map: map,
+            receipt: payload.fetch("receipt"), result: result, historical: false) { yield }
+        rescue JSON::ParserError
+          raise AttemptErrors::ReceiptRejected, "canonical campaign result JSON is malformed"
+        end
+
+        def dispatch_campaign_export(request:, peer:, role:, body: true)
+          params = request.fetch("params")
+          unless params.is_a?(Hash) && params.keys.sort == PARAMETERS.fetch("campaign_export_result").sort &&
+              params["head"].is_a?(String) && params["head"].match?(CandidateTransfer::SHA) &&
+              params["candidate_generation"].is_a?(Integer) && params["candidate_generation"].positive? && request["mutation_id"].nil?
+            raise ArgumentError, "campaign result selectors differ"
+          end
+          %w[mapping_id assignment_id attempt_id].each { |key| result_id!(params.fetch(key)) }
+          map = @deployment.mapping(params.fetch("mapping_id"))
+          raise AttemptErrors::UnauthorizedIdentity, "campaign project differs" unless map["project_id"] == request.fetch("project_id")
+          @launch.with_assignment(params: params, map: map, exclusive: true) do |journal, registration|
+            protected_journal!(journal)
+            commit = journal.ref_value
+            descriptor = @launch.send(:control_original_descriptor!, registration.fetch("lifecycle_control"))
+            original_map = descriptor.mapping(params.fetch("mapping_id"))
+            context = @launch.send(:control_registration_context!, params, original_map, journal, commit: commit)
+            events = @launch.preview_attempt_events!(journal: journal, commit: commit, params: params, map: original_map)
+            origin = active_origin(events, params)
+            role == :worker ? worker_or_launcher!(peer, role, original_map, origin) : finish_identity!(events, params, original_map, peer, role)
+            selected = CampaignExecution.validate_parent!(@launch.preview_attempt_definition!(journal: journal,
+              commit: commit, params: params, map: original_map).review_campaign)
+            return true unless body
+            parent = params.merge("scope" => origin.fetch("scope"), "base" => origin.fetch("base_head"))
+            campaign_parent_candidate!(journal: journal, commit: commit, params: parent, map: original_map)
+            current = exact_candidate!(candidate(events), params)
+            bundle = journal.bounded_blob(current.fetch("bundle_ref"), commit: commit, max_bytes: CandidateTransfer::MAX_BYTES)
+            project = descriptor.project(original_map.fetch("project_id"))
+            root = File.join(project.fetch("campaign_repository"), ".ace-local", "review", "candidate-views")
+            FileUtils.mkdir_p(root, mode: 0o700)
+            CandidateTransfer.new(root: root).with_campaign_repository(bytes: bundle, sha256: current.fetch("sha256"),
+              size: current.fetch("bytes"), head: current.fetch("head"), tree: current.fetch("tree"), base: parent.fetch("base")) do |candidate_reader|
+              manager = @launch.send(:campaign_manager_for!, context,
+                **campaign_execution_dependencies!(journal: journal, commit: commit, parent_params: parent, parent_map: original_map),
+                candidate_reader: candidate_reader)
+              result = manager.accepted_result_snapshot(selected.fetch("campaign_id"))
+              deployment_sha = @launch.send(:protected_descriptor_sha256!)
+              CampaignConsumerPolicy.new.with(@deployment.project(original_map.fetch("project_id")).fetch("campaign_policy")) do |profiles, held|
+              manager.with_verified_result!(result: result, **selected.slice("subject", "contract_identity", "policy").transform_keys(&:to_sym),
+                head: params.fetch("head"), base: parent.fetch("base"), producer: result.fetch("producer"), reviewer: result.fetch("reviewer"),
+                consumer_profiles: profiles) do
+                held.verify_unchanged!
+                unless @launch.send(:protected_descriptor_sha256!) == deployment_sha
+                  raise AttemptErrors::Conflict, "campaign export policy descriptor advanced"
+                end
+                campaign_parent_candidate!(journal: journal, commit: commit, params: parent, map: original_map)
+                bytes = JSON.generate(result).b
+                raise AttemptErrors::EvidenceUnavailable, "campaign result exceeds artifact bound" if bytes.bytesize > 64 * 1024
+                {data: {"campaign_id" => selected.fetch("campaign_id"), "result_identity" => result.fetch("result_identity"),
+                  "sha256" => Digest::SHA256.hexdigest(bytes), "bytes" => bytes.bytesize, "head" => params.fetch("head"),
+                  "candidate_generation" => params.fetch("candidate_generation"), "journal_commit" => commit},
+                  replayed: false, transfer_parts: [bytes]}
+              end
+              end
+            end
+          end
+        rescue Ace::Review::Atoms::CampaignContract::Invalid, KeyError, TypeError
+          raise AttemptErrors::EvidenceUnavailable, "canonical campaign result is unavailable"
+        end
+
+        def dispatch_campaign_round(request:, peer:, role:, transfer:)
+          params, map = campaign_round_request!(request)
+          admitted = CampaignRoundTransfer.decode(input: transfer, sha256: params.fetch("input_sha256"))
+          input = admitted.fetch(:round)
+          unless input["attempt_id"] == request.fetch("mutation_id") && input["head"] == params.fetch("head")
+            raise AttemptErrors::Conflict, "campaign round stable request or head differs"
+          end
+          @launch.with_assignment(params: params, map: map, exclusive: true) do |journal, registration|
+            protected_journal!(journal)
+            commit = journal.ref_value
+            descriptor = @launch.send(:control_original_descriptor!, registration.fetch("lifecycle_control"))
+            original_map = descriptor.mapping(params.fetch("mapping_id"))
+            context = @launch.send(:control_registration_context!, params, original_map, journal, commit: commit)
+            events = @launch.preview_attempt_events!(journal: journal, commit: commit, params: params, map: original_map)
+            origin = finish_identity!(events, params, original_map, peer, role)
+            selected = CampaignExecution.validate_parent!(@launch.preview_attempt_definition!(journal: journal,
+              commit: commit, params: params, map: original_map).review_campaign)
+            parent_params = params.merge("scope" => origin.fetch("scope"), "base" => input.fetch("base"))
+            project = descriptor.project(original_map.fetch("project_id"))
+            paths = CampaignRoundTransfer.materialize(admitted: admitted, repository: project.fetch("campaign_repository"),
+              request_id: request.fetch("mutation_id"))
+            dependencies = campaign_execution_dependencies!(journal: journal, commit: commit,
+              parent_params: parent_params, parent_map: original_map)
+            current = exact_candidate!(retained_candidate(events, params.fetch("candidate_generation")), params)
+            bundle = journal.bounded_blob(current.fetch("bundle_ref"), commit: commit, max_bytes: CandidateTransfer::MAX_BYTES)
+            quarantine = File.join(project.fetch("campaign_repository"), ".ace-local", "review", "candidate-views")
+            FileUtils.mkdir_p(quarantine, mode: 0o700)
+            transfer_owner = CandidateTransfer.new(root: quarantine)
+            transfer_owner.with_campaign_repository(bytes: bundle, sha256: current.fetch("sha256"), size: current.fetch("bytes"),
+              head: current.fetch("head"), tree: current.fetch("tree"), base: input.fetch("base")) do |candidate_reader|
+              manager = @launch.send(:campaign_manager_for!, context, **dependencies, artifact_paths: paths, candidate_reader: candidate_reader)
+              deployment_sha = @launch.send(:protected_descriptor_sha256!)
+              CampaignConsumerPolicy.new.with(@deployment.project(original_map.fetch("project_id")).fetch("campaign_policy")) do |profiles, held|
+                # The existing R1 store checks exact replay before fresh policy,
+                # and binds the complete supplied frame in its input_digest.
+                data = manager.record_round(selected.fetch("campaign_id"), input, source_digest: admitted.fetch(:sha256),
+                  expected_campaign: selected.reject { |key, _| key == "version" }, consumer_profiles: profiles,
+                  before_record: -> {
+                    held.verify_unchanged!
+                    campaign_parent_candidate!(journal: journal, commit: commit, params: parent_params, map: original_map)
+                    unless @launch.send(:protected_descriptor_sha256!) == deployment_sha
+                      raise AttemptErrors::Conflict, "campaign policy descriptor advanced"
+                    end
+                  })
+                held.verify_unchanged!
+                unless journal.ref_value == commit && @launch.send(:protected_descriptor_sha256!) == deployment_sha
+                  raise AttemptErrors::Conflict, "campaign round canonical selection advanced"
+                end
+                reply = data.slice("campaign_id", "recorded_complete", "completed_rounds", "accepted", "result_identity", "replayed")
+                  .merge("request_id" => request.fetch("mutation_id"), "round_id" => input.fetch("round_id"))
+                {data: reply, replayed: data["replayed"] == true}
+              end
+            end
+          end
+        rescue Ace::Review::Atoms::CampaignContract::Invalid, KeyError, TypeError
+          raise AttemptErrors::EvidenceUnavailable, "canonical campaign round is unavailable"
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/endcap_contexts.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+require "ace/herdr/molecules/inbox_context_client"
+
+module Ace
+  module Assign
+    module Authority
+      class Endcap
+        private
+
+        def with_inbox_context(params, map, mutation_id:)
+          context = @deployment.inbox_context(params.fetch("mapping_id"), params.fetch("inbox_context_id"))
+          @deployment.verify_inbox_context!(params.fetch("mapping_id"), params.fetch("inbox_context_id"))
+          client = @inbox_context_clients&.fetch(params.fetch("inbox_context_id"))
+          client ||= Ace::Herdr::Molecules::InboxContextClient.selected(context_id: params.fetch("inbox_context_id"),
+            socket_path: context.fetch("control_socket_path"), owner_credentials: context.fetch("owner_credentials"), kernel: @kernel)
+          yield client
+        rescue Ace::Runtime::RuntimeUnavailableError, Ace::Herdr::Error
+          raise AttemptErrors::EvidenceUnavailable, "protected inbox context is unavailable"
+        end
+      end
+    end
+  end
+end