ace-assign 0.64.0 → 0.66.1

data/lib/ace/assign/authority/endcap_results.rb

@@ -100,6 +100,11 @@ module Ace
         end
 
         def authorize_result_transfer!(request:, peer:, role:)
+          params, map = result_request(request)
+          authorize_admitted_result_transfer!(request: request, peer: peer, role: role)
+        end
+
+        def authorize_admitted_result_transfer!(request:, peer:, role:)
           params, map = result_request(request)
           @launch.with_assignment(params: params, map: map) do |journal, _|
             protected_journal!(journal)
@@ -116,6 +121,11 @@ module Ace
         end
 
         def dispatch_result(request:, peer:, role:, transfer: nil)
+          params, map = result_request(request)
+          dispatch_admitted_result(request: request, peer: peer, role: role, transfer: transfer)
+        end
+
+        def dispatch_admitted_result(request:, peer:, role:, transfer: nil)
           params, map = result_request(request)
           admitted = if request.fetch("operation") == "submit_result"
             authorize_result_transfer!(request: request, peer: peer, role: role)
@@ -138,7 +148,9 @@ module Ace
                 raise AttemptErrors::EvidenceUnavailable, "result replay provenance differs"
               end
             end
-            result = journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
+            result = with_campaign_submission!(journal: journal, commit: commit, events: events, params: params,
+              map: map, admitted: admitted, replay: replay) do
+              journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
               mutation_id: request.fetch("mutation_id"), operation: "submit_result",
               parameters_digest: Atoms::EvidenceDigest.digest(params), expected_generation: params.fetch("expected_generation"),
               with_replay: true) do |fresh_events, fresh_commit, generation|
@@ -148,6 +160,7 @@ module Ace
                 raise AttemptErrors::Conflict, "candidate already has a result"
               end
               result_plan(journal, fresh_events, params, map, origin, current, admitted, fresh_commit, generation)
+              end
             end
             # A CAS loser may return a competing accepted same-ID reply. It
             # still needs exact canonical private provenance outside callback.
@@ -178,22 +191,26 @@ module Ace
             intent.fetch("payload"), events, "running")
         end
 
-        def verify_result_receipt(journal, events, params, map, head, receipt, reader)
+        def verify_result_receipt(journal, events, params, map, head, receipt, reader, commit:)
           unless receipt["producer"] == {"actor" => map.fetch("worker_actor"), "role" => "worker", "runtime" => "herdr"}
             raise AttemptErrors::ReceiptRejected, "result producer differs from mapped worker"
           end
-          raise AttemptErrors::EvidenceUnavailable, "protected campaigns require their canonical owner" if receipt["campaign"]
           allowed = Models::ExecutionReceipt.from_h(receipt).to_h.keys
           raise AttemptErrors::ReceiptRejected, "result receipt fields differ" unless (receipt.keys - allowed).empty?
           # Failed receipts can omit artifacts, but every declared artifact still
           # needs canonical byte/provenance validation.
           Array(receipt["artifacts"]).each { |artifact| reader.call(receipt, artifact) }
-          Molecules::ReceiptVerifier.new(artifact_reader: reader).verify_result!(receipt,
+          campaign_verifier = ->(data, result, _head) {
+            with_campaign_receipt!(journal: journal, commit: commit, events: events, params: params,
+              map: map, receipt: data, result: result, historical: true) { true }
+          }
+          Molecules::ReceiptVerifier.new(artifact_reader: reader, campaign_verifier: campaign_verifier).verify_result!(receipt,
             attempt: result_attempt(journal, events, params), live_head: head, repo_root: journal.repo_root)
         end
 
         def result_plan(journal, events, params, map, origin, current, admitted, commit, generation)
           receipt = admitted.fetch(:receipt)
+          campaign_child_result!(journal: journal, commit: commit, events: events, params: params, map: map, receipt: receipt)
           original = Models::ExecutionReceipt.from_h(receipt)
           unless original.digest == Atoms::EvidenceDigest.digest(original.digest_payload)
             raise AttemptErrors::ReceiptRejected, "original result digest differs"
@@ -211,10 +228,15 @@ module Ace
               admitted_after_event_digest: events.last.fetch("digest"))
           normalized = JSON.parse(JSON.generate(receipt)).except("digest", "recorded_at")
           normalized["artifacts"] = plan.fetch(:references).map { |ref| {"path" => ref.fetch("ref"), "sha256" => ref.fetch("sha256")} }
+          if normalized["campaign"]
+            campaign_index = receipt.fetch("artifacts").index(receipt.fetch("campaign").fetch("result"))
+            raise AttemptErrors::ReceiptRejected, "campaign result artifact missing" unless campaign_index
+            normalized["campaign"]["result"] = normalized.fetch("artifacts").fetch(campaign_index)
+          end
           pending = journal.send(:chain_mutation_events, params.fetch("attempt_id"), events.last.fetch("digest"), plan.fetch(:events))
           reader = ->(_data, artifact) { canonical.read_pending({"ref" => artifact.fetch("path"), "sha256" => artifact.fetch("sha256")},
             **result_context(binding), current_events: events, pending_events: pending, blobs: plan.fetch(:blobs), commit: commit) }
-          verified = verify_result_receipt(journal, events, params, map, current.fetch("head"), normalized, reader)
+          verified = verify_result_receipt(journal, events, params, map, current.fetch("head"), normalized, reader, commit: commit)
           payload = {"version" => 1, "result_id" => id, "binding" => binding,
             "uploaded_receipt_sha256" => admitted.fetch(:receipt_sha256), "original_receipt_digest" => original.digest,
             "receipt_digest" => verified.digest, "receipt" => verified.to_h, "artifacts" => verified.artifacts}
@@ -256,10 +278,12 @@ module Ace
               replies.first.fetch("payload").fetch("data").slice(*RESULT_FIELDS) == result_projection(payload)
             raise AttemptErrors::EvidenceUnavailable, "private result provenance differs"
           end
+          campaign_child_result!(journal: journal, commit: commit, events: events, params: params, map: map,
+            receipt: payload.fetch("receipt"))
           canonical = Molecules::CanonicalEvidence.new(journal: journal)
           reader = ->(_data, artifact) { canonical.read({"ref" => artifact.fetch("path"), "sha256" => artifact.fetch("sha256")},
             **result_context(binding), commit: commit) }
-          receipt = verify_result_receipt(journal, events, params, map, current.fetch("head"), payload.fetch("receipt"), reader)
+          receipt = verify_result_receipt(journal, events, params, map, current.fetch("head"), payload.fetch("receipt"), reader, commit: commit)
           raise AttemptErrors::EvidenceUnavailable, "normalized result digest differs" unless receipt.digest == payload.fetch("receipt_digest")
           payload
         rescue KeyError, ArgumentError, TypeError, AttemptErrors::ReceiptRejected
@@ -275,8 +299,10 @@ module Ace
           when :launcher
             peer["uid"] == map.fetch("launcher_uid") && @kernel.same?(peer, origin.fetch("launcher_identity"))
           when :worker
-            kind == "result" && peer["uid"] == map.fetch("worker_uid") &&
-              @kernel.descendant?(peer, origin.fetch("process_binding").fetch("process_identity"))
+            peer["uid"] == map.fetch("worker_uid") &&
+              @kernel.descendant?(peer, origin.fetch("process_binding").fetch("process_identity")) &&
+              (kind == "result" || kind == "service" && record && record["caller_uid"] == peer["uid"] &&
+                record["request_id"] == purpose_id && @kernel.descendant?(peer, record.fetch("worker_process_binding")))
           when :reviewer
             review = assigned_review(events)
             %w[result review].include?(kind) && review && current && review["head"] == current["head"] &&
@@ -295,7 +321,7 @@ module Ace
           service_policy!.visible!(project: map.fetch("project_id"), uid: peer.fetch("uid"))
           origin = retained_origin(events, params)
           kind, id = params.values_at("kind", "purpose_id")
-          if (role == :worker && kind != "result") || (role == :reviewer && !%w[result review].include?(kind)) ||
+          if (role == :worker && !%w[result service].include?(kind)) || (role == :reviewer && !%w[result review].include?(kind)) ||
               (role == :executor && kind != "service")
             raise AttemptErrors::UnauthorizedIdentity, "canonical evidence kind is unauthorized"
           end
@@ -324,14 +350,6 @@ module Ace
               request_id_or_event_id: id, generation: review.fetch("candidate_generation")}
             verify_retained_review!(journal, events, params, map, current, review, ctx, commit)
             [ctx, review.fetch("review_receipt").fetch("artifacts")]
-          when "inbox"
-            registrations = events.select { |entry| entry["type"] == "inbox_binding" && entry.dig("payload", "event_id") == id }
-            raise AttemptErrors::NotFound, "inbox purpose not found" if registrations.empty?
-            raise AttemptErrors::EvidenceUnavailable, "inbox registration differs" unless registrations.one?
-            selected = params.merge("event_id" => id, "inbox_context_id" => registrations.first.dig("payload", "inbox_context_id"))
-            retained = verified_inbox(journal, events, selected, map, peer, role, commit)
-            raise AttemptErrors::EvidenceUnavailable, "canonical inbox proof missing" unless retained
-            [inbox_context(retained.fetch("binding")), %w[receipt_ref signature_ref].map { |key| retained.fetch(key).slice("sha256").merge("path" => retained.fetch(key).fetch("ref")) }]
           when "service"
             record = journal.service_request(id, commit: commit)
             raise AttemptErrors::NotFound, "service purpose not found" unless record
@@ -369,7 +387,7 @@ module Ace
           end
           canonical = Molecules::CanonicalEvidence.new(journal: journal)
           reader = ->(_data, artifact) { canonical.read({"ref" => artifact.fetch("path"), "sha256" => artifact.fetch("sha256")}, **context, commit: commit) }
-          receipt = verify_result_receipt(journal, events, params, map, current.fetch("head"), accepted.fetch("review_receipt"), reader)
+          receipt = verify_result_receipt(journal, events, params, map, current.fetch("head"), accepted.fetch("review_receipt"), reader, commit: commit)
           unless receipt.operation == "review" && receipt.verdict == "succeeded" && receipt.digest == accepted.fetch("receipt_digest")
             raise AttemptErrors::EvidenceUnavailable, "retained review receipt differs"
           end

data/lib/ace/assign/authority/endcap_review_requests.rb

@@ -0,0 +1,183 @@
+# frozen_string_literal: true
+
+module Ace
+  module Assign
+    module Authority
+      class Endcap
+        private
+
+        def review_requester!(params, map, peer, role, recorded: nil)
+          @kernel.live!(peer)
+          current = @deployment.verify!(params.fetch("mapping_id"), kernel: @kernel, authority_state: true)
+          raise AttemptErrors::UnauthorizedIdentity, "review mapping changed" unless current == map
+          project = @deployment.project(map.fetch("project_id"))
+          credentials = project.fetch("peer_credentials")[peer.fetch("uid").to_s]
+          principal = peer.slice("uid", "gid", "groups").merge("role" => role.to_s)
+          unless role == :reviewer && project.fetch("reviewer_uids").include?(peer.fetch("uid")) &&
+              peer.fetch("uid") != map.fetch("worker_uid") && credentials &&
+              peer.values_at("gid", "groups") == credentials.values_at("gid", "groups") &&
+              (!recorded || Atoms::EvidenceDigest.digest(principal) == Atoms::EvidenceDigest.digest(recorded))
+            raise AttemptErrors::UnauthorizedIdentity, "review request requires its independently mapped principal"
+          end
+          principal
+        end
+
+        def request_review(request, params, map, peer, role, transfer)
+          raise ArgumentError, "review request forbids upload" unless transfer.nil?
+          unless request["mutation_id"].is_a?(String) && request["mutation_id"].match?(Molecules::JournalMutation::ID) &&
+              params["expected_generation"].is_a?(Integer) && params["expected_generation"] >= 0
+            raise ArgumentError, "review request mutation binding differs"
+          end
+          principal = review_requester!(params, map, peer, role)
+          digest = Atoms::EvidenceDigest.digest(params.merge("requester_process_binding" => peer))
+          channel = reservation = accepted = nil
+          prepared = @launch.with_assignment(params: params, map: map) do |journal, _registration|
+            protected_journal!(journal)
+            events = attempt_events(journal, params)
+            active_origin(events, params)
+            replay = journal.mutation_result(request.fetch("mutation_id"))
+            if replay
+              unless replay["operation"] == "request_review" && replay["parameters_digest"] == digest &&
+                  replay["assignment_id"] == params.fetch("assignment_id") && replay["attempt_id"] == params.fetch("attempt_id")
+                raise AttemptErrors::Conflict, "review mutation is already bound to different input"
+              end
+              accepted = {data: replay.fetch("data").merge("journal_commit" => replay.fetch("journal_commit")), replayed: true}
+            else
+              channel, reservation, original = @launch.reserve_review_dispatch!(events: events, params: params, map: map)
+              accepted = journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
+                mutation_id: request.fetch("mutation_id"), operation: "request_review", parameters_digest: digest,
+                expected_generation: params.fetch("expected_generation"), with_replay: true) do |fresh, _commit, _generation|
+                review_requester!(params, map, peer, role)
+                active_origin(fresh, params)
+                @launch.scope_open_for_effect!(events: fresh, params: params, map: map)
+                current = exact_candidate!(candidate(fresh), params)
+                if active_review_reservation(fresh, current)
+                  raise AttemptErrors::Conflict, "candidate review reservation is active"
+                end
+                unless channel.dispatch_reserved?(reservation) && @launch.review_original_reference!(events: fresh, params: params) == original
+                  raise AttemptErrors::EvidenceUnavailable, "original review channel reservation changed"
+                end
+                {data: current.slice("head", "candidate_generation").merge(
+                  "original_binding_digest" => original.fetch("binding_digest"), "requester" => principal,
+                  "reviewer_uid" => peer.fetch("uid"), "reviewer_process_binding" => peer)}
+              end
+            end
+            review_event_reply(journal, accepted, request, params, "request_event_id")
+          end
+          unless prepared.fetch(:replayed)
+            frame = {"version" => 1, "type" => "launch_review_delegate", "attempt_id" => params.fetch("attempt_id"),
+              "mutation_id" => request.fetch("mutation_id"), "request_event_id" => prepared.dig(:data, "request_event_id"),
+              "journal_commit" => prepared.dig(:data, "journal_commit"),
+              "original_binding_digest" => prepared.dig(:data, "original_binding_digest")}
+            begin
+              channel.dispatch_review(frame: frame, deadline: Ace::Runtime::Molecules::ProtectedSocket.deadline(30), reservation: reservation)
+            rescue Ace::Runtime::RuntimeUnavailableError, AttemptErrors::EvidenceUnavailable, IOError, SystemCallError
+              # The canonical assignment, not a transport ACK or its absence,
+              # decides whether the recorded first reply can name an assignment.
+            end
+          end
+          finish_review_reply(request, params, map, peer, role, prepared)
+        ensure
+          channel&.release_dispatch!(reservation) if reservation
+        end
+
+        def review_request_event!(journal, events, params, commit: journal.ref_value)
+          accepted = journal.mutation_result(params.fetch("mutation_id"), commit: commit)
+          unless accepted && accepted["operation"] == "request_review" &&
+              accepted["assignment_id"] == params.fetch("assignment_id") && accepted["attempt_id"] == params.fetch("attempt_id")
+            raise AttemptErrors::NotFound, "canonical review request is unavailable"
+          end
+          event = events.find { |item| item["type"] == "authority_mutation" && item.dig("payload", "mutation_id") == params.fetch("mutation_id") }
+          unless event && event.fetch("payload") == accepted.except("journal_commit")
+            raise AttemptErrors::EvidenceUnavailable, "canonical review request differs"
+          end
+          [event, accepted]
+        end
+
+        def review_assignment_observation(journal, events, params, event, commit: journal.ref_value)
+          mutation = "review-delegate.#{event.fetch('digest')}"
+          accepted = journal.mutation_result(mutation, commit: commit)
+          return nil unless accepted
+          source = event.fetch("payload").fetch("data")
+          expected = params.slice("mapping_id", "assignment_id", "attempt_id").merge(
+            source.slice("head", "candidate_generation", "reviewer_uid", "reviewer_process_binding"),
+            "expected_generation" => source.fetch("generation"))
+          actual = events.find { |item| item["type"] == "authority_mutation" && item.dig("payload", "mutation_id") == mutation }
+          data = accepted.fetch("data")
+          unless accepted["operation"] == "assign_review" && accepted["assignment_id"] == params.fetch("assignment_id") &&
+              accepted["attempt_id"] == params.fetch("attempt_id") && actual && actual.fetch("payload") == accepted.except("journal_commit") &&
+              accepted["parameters_digest"] == Atoms::EvidenceDigest.digest(expected) &&
+              data.keys.sort == %w[candidate_generation generation head review_id reviewer_actor reviewer_process_binding reviewer_uid] &&
+              data["generation"].is_a?(Integer) && data.fetch("generation") == source.fetch("generation") + 1 &&
+              data["review_id"].is_a?(String) && data["review_id"].match?(/\A[0-9a-f]{32}\z/) &&
+              data["reviewer_actor"] == "uid-#{source.fetch('reviewer_uid')}" &&
+              Atoms::EvidenceDigest.digest(data.slice("head", "candidate_generation", "reviewer_uid", "reviewer_process_binding")) ==
+                Atoms::EvidenceDigest.digest(source.slice("head", "candidate_generation", "reviewer_uid", "reviewer_process_binding"))
+            raise AttemptErrors::EvidenceUnavailable, "canonical delegated assignment differs"
+          end
+          data.merge("assignment_event_id" => actual.fetch("digest"), "journal_commit" => accepted.fetch("journal_commit"))
+        end
+
+        def finish_review_reply(request, params, map, peer, role, prepared)
+          @launch.with_assignment(params: params, map: map) do |journal, _registration|
+            events = attempt_events(journal, params)
+            selectors = params.slice("mapping_id", "assignment_id", "attempt_id").merge("mutation_id" => request.fetch("mutation_id"))
+            event, = review_request_event!(journal, events, selectors)
+            review_requester!(params, map, peer, role, recorded: event.dig("payload", "data", "requester"))
+            reply_id = "review-reply.#{event.fetch('digest')}"
+            result = journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
+              mutation_id: reply_id, operation: "review_reply", parameters_digest: Atoms::EvidenceDigest.digest(selectors),
+              expected_generation: journal.authority_generation(events), with_replay: true) do |fresh, selected, _generation|
+              assignment = review_assignment_observation(journal, fresh, params, event, commit: selected)
+              {data: {"request_event_id" => event.fetch("digest"), "request_commit" => prepared.dig(:data, "journal_commit"),
+                "state" => assignment ? "assigned" : "uncertain", "assignment" => assignment,
+                "required_action" => assignment ? nil : "inspect_review_status"}}
+            end
+            result.merge(replayed: prepared.fetch(:replayed) || result.fetch(:replayed))
+          end
+        end
+
+        def review_status(request, peer, role, transfer)
+          raise ArgumentError, "review status forbids upload" unless transfer.nil?
+          params = request.fetch("params")
+          unless request["mutation_id"].nil? && params.is_a?(Hash) && params.keys.sort == %w[assignment_id attempt_id mapping_id mutation_id] &&
+              params.values.all? { |value| value.is_a?(String) && value.match?(Molecules::JournalMutation::ID) }
+            raise ArgumentError, "invalid review status selectors"
+          end
+          map = @deployment.mapping(params.fetch("mapping_id"))
+          raise AttemptErrors::UnauthorizedIdentity, "review project differs" unless map.fetch("project_id") == request.fetch("project_id")
+          @launch.with_assignment(params: params, map: map) do |journal, _registration|
+            protected_journal!(journal)
+            commit = journal.ref_value
+            events = journal.read_events(params.fetch("assignment_id"), commit: commit).select { |event| event["attempt_id"] == params.fetch("attempt_id") }
+            event, = review_request_event!(journal, events, params, commit: commit)
+            review_requester!(params, map, peer, role, recorded: event.dig("payload", "data", "requester"))
+            assignment = review_assignment_observation(journal, events, params, event, commit: commit)
+            cancellation = events.find { |item| item["type"] == "authority_mutation" && item.dig("payload", "operation") == "cancel_review" &&
+              item.dig("payload", "data", "review_event_id") == event.fetch("digest") }
+            acceptance = assignment && events.reverse.find do |item|
+              item["type"] == "authority_mutation" && item.dig("payload", "operation") == "accept_review" &&
+                item.dig("payload", "data", "review_id") == assignment.fetch("review_id")
+            end
+            current = candidate(events)
+            state = if cancellation
+              "cancelled"
+            elsif !current || current.values_at("head", "candidate_generation") != event.dig("payload", "data").values_at("head", "candidate_generation")
+              "candidate_replaced"
+            elsif assignment
+              "assigned"
+            else
+              "requested"
+            end
+            first = journal.mutation_result("review-reply.#{event.fetch('digest')}", commit: commit)
+            {data: {"request_event_id" => event.fetch("digest"), "assignment" => assignment, "state" => state,
+              "accepted_review_event_id" => acceptance&.fetch("digest"),
+              "first_reply" => first && first.fetch("data").merge("journal_commit" => first.fetch("journal_commit")),
+              "cancellation_event_id" => cancellation&.fetch("digest"), "generation" => journal.authority_generation(events),
+              "journal_commit" => commit}, replayed: false}
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/endcap_reviews.rb

@@ -0,0 +1,130 @@
+# frozen_string_literal: true
+
+module Ace
+  module Assign
+    module Authority
+      class Endcap
+        private
+
+        # Historical assignment lookup stays separate: revocation removes
+        # permission, never the original receipt or response.
+        def active_review_reservation(events, current)
+          reservation = events.reverse.find do |event|
+            event["type"] == "authority_mutation" &&
+              %w[request_review assign_review].include?(event.dig("payload", "operation")) &&
+              !event.dig("payload", "mutation_id").to_s.start_with?("review-delegate.") &&
+              event.dig("payload", "data", "head") == current.fetch("head") &&
+              event.dig("payload", "data", "candidate_generation") == current.fetch("candidate_generation")
+          end
+          return unless reservation
+          cancelled = events.any? do |event|
+            event["type"] == "authority_mutation" && event.dig("payload", "operation") == "cancel_review" &&
+              event.dig("payload", "data", "review_event_id") == reservation.fetch("digest")
+          end
+          reservation unless cancelled
+        end
+
+        def active_review_event(events, current)
+          reservation = active_review_reservation(events, current)
+          return unless reservation
+          return reservation if reservation.dig("payload", "operation") == "assign_review"
+          events.find do |event|
+            event["type"] == "authority_mutation" && event.dig("payload", "operation") == "assign_review" &&
+              event.dig("payload", "mutation_id") == "review-delegate.#{reservation.fetch('digest')}"
+          end
+        end
+
+        # Reserved spelling is not authorization. Reconstruct the immutable
+        # request through the original-launcher reader before historical replay,
+        # then separately check the active reservation for a fresh mutation.
+        def delegated_review_request!(journal, events, request, params, peer, role)
+          mutation = request.fetch("mutation_id")
+          return unless mutation.is_a?(String) && mutation.start_with?("review-delegate.")
+          digest = mutation.delete_prefix("review-delegate.")
+          original = events.find { |event| event["digest"] == digest && event["type"] == "authority_mutation" &&
+            event.dig("payload", "operation") == "request_review" }
+          raise AttemptErrors::UnauthorizedIdentity, "delegation requires a canonical request" unless original
+          accepted = journal.mutation_result(original.dig("payload", "mutation_id"))
+          selectors = params.slice("mapping_id", "assignment_id", "attempt_id").merge(
+            "mutation_id" => original.dig("payload", "mutation_id"), "request_event_id" => digest,
+            "journal_commit" => accepted.fetch("journal_commit"),
+            "original_binding_digest" => original.dig("payload", "data", "original_binding_digest"))
+          intent = @launch.launch_review_intent!(request: request.merge("operation" => "launch_review_intent",
+            "mutation_id" => nil, "params" => selectors), peer: peer, role: role)
+          unless Atoms::EvidenceDigest.digest(intent.dig(:data, "assignment_params")) == Atoms::EvidenceDigest.digest(params)
+            raise AttemptErrors::UnauthorizedIdentity, "delegation differs from exact canonical request"
+          end
+          original
+        end
+
+        def cancel_review(request, params, map, peer, role, transfer)
+          raise ArgumentError, "review cancellation forbids upload" unless transfer.nil?
+          unless params["review_event_id"].is_a?(String) && params["review_event_id"].match?(/\A[0-9a-f]{64}\z/)
+            raise ArgumentError, "review cancellation selector differs"
+          end
+          @launch.with_assignment(params: params, map: map) do |journal, _registration|
+            protected_journal!(journal)
+            events = attempt_events(journal, params)
+            authenticate_review_cancellation!(events, params, map, peer, role)
+            result = journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
+              mutation_id: request.fetch("mutation_id"), operation: "cancel_review",
+              parameters_digest: Atoms::EvidenceDigest.digest(params), expected_generation: params.fetch("expected_generation"),
+              with_replay: true) do |current_events, _commit, _generation|
+              authenticate_review_cancellation!(current_events, params, map, peer, role)
+              current = exact_candidate!(candidate(current_events), params)
+              reservation = active_review_reservation(current_events, current)
+              unless reservation && reservation.fetch("digest") == params.fetch("review_event_id")
+                raise AttemptErrors::Conflict, "review reservation is no longer active"
+              end
+              {data: current.slice("head", "candidate_generation").merge(
+                "review_event_id" => reservation.fetch("digest"),
+                "review_id" => active_review_event(current_events, current)&.dig("payload", "data", "review_id"), "state" => "cancelled")}
+            end
+            review_event_reply(journal, result, request, params, "cancellation_event_id")
+          end
+        end
+
+        def review_event_reply(journal, result, request, params, field)
+          accepted = journal.read_events(params.fetch("assignment_id"), commit: result.fetch(:data).fetch("journal_commit")).find do |event|
+            event["attempt_id"] == params.fetch("attempt_id") && event["type"] == "authority_mutation" &&
+              event.dig("payload", "operation") == request.fetch("operation") &&
+              event.dig("payload", "mutation_id") == request.fetch("mutation_id")
+          end
+          raise AttemptErrors::EvidenceUnavailable, "accepted review event is unavailable" unless accepted
+          result.merge(data: result.fetch(:data).merge(field => accepted.fetch("digest")))
+        end
+
+        def authenticate_review_cancellation!(events, params, map, peer, role)
+          origin = active_origin(events, params)
+          @kernel.live!(peer)
+          original = events.find { |event| event["digest"] == params.fetch("review_event_id") }
+          unless original && original["type"] == "authority_mutation" &&
+              %w[request_review assign_review].include?(original.dig("payload", "operation")) &&
+              !original.dig("payload", "mutation_id").to_s.start_with?("review-delegate.") &&
+              original.dig("payload", "data", "head") == params.fetch("head") &&
+              original.dig("payload", "data", "candidate_generation") == params.fetch("candidate_generation")
+            raise AttemptErrors::UnauthorizedIdentity, "review cancellation requires the exact reservation root"
+          end
+          if role == :launcher
+            unless @kernel.same?(origin.fetch("launcher_identity"), peer)
+              raise AttemptErrors::UnauthorizedIdentity, "cancellation requires original launcher birth"
+            end
+            worker_or_launcher!(peer, role, map, origin, launcher_only: true)
+          elsif role == :reviewer && original.dig("payload", "operation") == "request_review"
+            project = @deployment.project(map.fetch("project_id"))
+            credentials = project.fetch("peer_credentials")[peer.fetch("uid").to_s]
+            principal = peer.slice("uid", "gid", "groups").merge("role" => "reviewer")
+            unless project.fetch("reviewer_uids").include?(peer.fetch("uid")) && peer.fetch("uid") != map.fetch("worker_uid") &&
+                credentials && peer.values_at("gid", "groups") == credentials.values_at("gid", "groups") &&
+                Atoms::EvidenceDigest.digest(principal) == Atoms::EvidenceDigest.digest(original.dig("payload", "data", "requester"))
+              raise AttemptErrors::UnauthorizedIdentity, "cancellation requires the original mapped requester"
+            end
+          else
+            raise AttemptErrors::UnauthorizedIdentity, "review reservation cancellation is unauthorized"
+          end
+          original
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/endcap_service_settlement.rb

@@ -0,0 +1,152 @@
+# frozen_string_literal: true
+
+module Ace
+  module Assign
+    module Authority
+      class Endcap
+        private
+
+        def authorize_service_settlement!(request, params, map, peer, role)
+          @launch.with_assignment(params: params, map: map) do |journal, _registration|
+            protected_journal!(journal)
+            service_settlement_record!(journal, params, map, peer, role)
+          end
+          true
+        end
+
+        def service_settlement_record!(journal, params, map, peer, role, record: nil)
+          record ||= journal.service_request(params.fetch("request_id"))
+          raise AttemptErrors::NotFound, "canonical service request is missing" unless record
+          service_executor!(peer, role, record)
+          receiver = service_receiver!(peer, role, map, record.fetch("service_id"))
+          credentials = @deployment.project(map.fetch("project_id")).fetch("peer_credentials").fetch(peer.fetch("uid").to_s)
+          unless peer["gid"] == credentials.fetch("gid") && peer["groups"] == credentials.fetch("groups") &&
+              receiver.fetch("executor_uid") == record.fetch("executor_uid") &&
+              %w[assignment_id attempt_id mapping_id].all? { |key| record[key] == params[key] } &&
+              record["project_id"] == map.fetch("project_id") && record["candidate_head"] == params.fetch("head") &&
+              record["candidate_generation"] == params.fetch("candidate_generation") &&
+              %w[issued dispatch_started].include?(record["dispatch_phase"])
+            raise AttemptErrors::UnauthorizedIdentity, "original service settlement identity differs"
+          end
+          # The normal protected binding validates original ticket/claim, even
+          # while effect policy, worker liveness or current candidate changed.
+          ServiceEvidence.new(journal: journal).context(record)
+          record
+        rescue KeyError
+          raise AttemptErrors::EvidenceUnavailable, "original service settlement binding is incomplete"
+        end
+
+        def dispatch_service_settlement(request, params, map, peer, role, transfer)
+          authorize_service_settlement!(request, params, map, peer, role)
+          completion = request.fetch("operation") == "complete_no_effect"
+          admitted = completion && ReceiptTransfer.decode(input: transfer, receipt_sha256: params.fetch("receipt_sha256"),
+            artifact_field: "evidence", reference_key: "ref")
+          @launch.with_assignment(params: params, map: map) do |journal, _registration|
+            record = service_settlement_record!(journal, params, map, peer, role)
+            no_effect_completion_binding!(record, params, admitted) if completion
+            journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
+              mutation_id: request.fetch("mutation_id"), operation: request.fetch("operation"),
+              parameters_digest: Atoms::EvidenceDigest.digest(params),
+              expected_generation: completion ? nil : params.fetch("expected_generation"),
+              generation_mode: completion ? :recorded_completion : :expected, with_replay: true) do |events, commit, generation|
+              current = service_settlement_record!(journal, params, map, peer, role)
+              if completion
+                no_effect_completion_plan(journal, events, current, params, admitted)
+              else
+                service_challenge_plan(journal, events, current, params, map, generation, commit)
+              end
+            end
+          end
+        end
+
+        def service_challenge_projection(record)
+          record.slice("request_id", "state", "dispatch_ticket_id", "claim_binding", "dispatch_phase").merge(
+            "reconciliation_challenge" => %w[succeeded failed-settled].include?(record.fetch("state")) ? nil :
+              record.slice("no_effect_challenge", "challenge_generation", "challenge_event_digest"))
+        end
+
+        def service_challenge_plan(journal, events, record, params, map, generation, commit)
+          lineage = Molecules::ExecutionScopeLineage.new(events: events, project_id: map.fetch("project_id"),
+            assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"), mapping_id: params.fetch("mapping_id"))
+          unless lineage.sealed? && lineage.binding && record["reservation_generation"] == lineage.binding.fetch("reservation_generation")
+            raise AttemptErrors::Conflict, "original service generation is not sealed"
+          end
+          return {data: service_challenge_projection(record)} if %w[succeeded failed-settled].include?(record.fetch("state"))
+          unless %w[uncertain failed].include?(record.fetch("state"))
+            raise AttemptErrors::EvidenceUnavailable, "original protected request has no uncertainty outcome"
+          end
+          if record["challenge_event_digest"]
+            begin
+              ServiceEvidence.new(journal: journal).challenge!(record, pending: {commit: commit})
+              return {data: service_challenge_projection(record)}
+            rescue AttemptErrors::EvidenceUnavailable
+              # Only a positively authenticated later failure may supersede a
+              # challenge. Corrupt/missing old history never becomes freshness.
+              old = ServiceEvidence.new(journal: journal).challenge!(record, pending: {commit: commit}, current: false)
+              raise unless events.drop_while { |event| event["digest"] != old.fetch("digest") }.drop(1).any? do |event|
+                %w[service_claim service_transition].include?(event["type"]) && event.dig("payload", "request_id") == record.fetch("request_id") &&
+                  %w[uncertain failed].include?(event.dig("payload", "state"))
+              end
+            end
+          end
+          failure = events.reverse.find { |event| %w[service_claim service_transition].include?(event["type"]) &&
+            event.dig("payload", "request_id") == record.fetch("request_id") && %w[uncertain failed].include?(event.dig("payload", "state")) }
+          raise AttemptErrors::EvidenceUnavailable, "canonical service failure is missing" unless failure
+          failure_prefix = events.take_while { |event| event["digest"] != failure.fetch("digest") }
+          payload = record.slice("request_id", "input_digest", "claim_binding", "dispatch_ticket_id").merge(
+            "version" => 1, "no_effect_challenge" => SecureRandom.hex(16), "challenge_generation" => generation + 1,
+            "failure_event_digest" => failure.fetch("digest"), "failure_generation" => journal.authority_generation(failure_prefix) + 1)
+          recorded_at = Time.now.utc
+          challenge = Models::EvidenceEvent.build(type: "service_no_effect_challenge", attempt_id: params.fetch("attempt_id"),
+            payload: payload, previous_digest: events.last&.fetch("digest"), recorded_at: recorded_at)
+          replacement = record.merge(payload.slice("no_effect_challenge", "challenge_generation"), "challenge_event_digest" => challenge.fetch("digest"))
+          {events: [{type: "service_no_effect_challenge", payload: payload, recorded_at: recorded_at}],
+            data: service_challenge_projection(replacement), service_updates: [{request_id: record.fetch("request_id"),
+              expected: record, replacement: replacement, event_type: "service_challenge"}]}
+        end
+
+        def no_effect_completion_binding!(record, params, admitted)
+          selector = params.fetch("reconciliation_challenge")
+          unless selector.is_a?(Hash) && selector.keys.sort == %w[no_effect_challenge challenge_generation challenge_event_digest].sort &&
+              selector["no_effect_challenge"].is_a?(String) && selector["no_effect_challenge"].match?(/\A[0-9a-f]{32}\z/) &&
+              selector["challenge_generation"].is_a?(Integer) && selector["challenge_generation"].positive? &&
+              selector["challenge_event_digest"].is_a?(String) && selector["challenge_event_digest"].match?(/\A[0-9a-f]{64}\z/)
+            raise ArgumentError, "no-effect challenge selector is malformed"
+          end
+          unless selector.all? { |key, value| record[key] == value } && record["claim_binding"] == params.fetch("claim_binding")
+            raise AttemptErrors::Conflict, "no-effect challenge or claim differs"
+          end
+          receipt = admitted.fetch(:receipt)
+          unless receipt.keys.sort == Molecules::EvidenceJournal::TERMINAL_RECEIPT_FIELDS.sort && receipt["outcome"] == "failed" &&
+              Molecules::EvidenceJournal::TERMINAL_BINDING_FIELDS.all? { |field| receipt[field] == record[field] }
+            raise AttemptErrors::ReceiptRejected, "no-effect receipt original binding differs"
+          end
+          digest = Atoms::EvidenceDigest.digest("challenge" => selector, "receipt_sha256" => admitted.fetch(:receipt_sha256),
+            "artifacts" => admitted.fetch(:artifacts).map { |bytes| Digest::SHA256.hexdigest(bytes) })
+          if record["state"] == "succeeded" || record["no_effect_completion_digest"] && record["no_effect_completion_digest"] != digest
+            raise AttemptErrors::Conflict, "no-effect completion contradicts retained outcome"
+          end
+          digest
+        end
+
+        def no_effect_completion_plan(journal, events, record, params, admitted)
+          digest = no_effect_completion_binding!(record, params, admitted)
+          return {data: service_projection(record)} if record["no_effect_completion_digest"]
+          owner = ServiceEvidence.new(journal: journal)
+          challenge = owner.challenge!(record)
+          if record["operation"] == "prune-preserved-workspace"
+            owner.cleanup_inspection_inputs!(admitted.fetch(:artifacts), record, challenge)
+          else
+            admitted.fetch(:artifacts).each { |bytes| owner.inspection!(bytes, record, challenge) }
+          end
+          plan = Molecules::CanonicalEvidence.new(journal: journal).import_plan(**owner.context(record, no_effect: true),
+            artifacts: admitted.fetch(:artifacts), admitted_after_event_digest: challenge.fetch("digest"))
+          receipt = admitted.fetch(:receipt).merge("evidence" => plan.fetch(:references))
+          replacement = record.merge("state" => "failed-settled", "receipt" => receipt, "no_effect_completion_digest" => digest)
+          plan.merge(data: service_projection(replacement), service_updates: [{request_id: record.fetch("request_id"),
+            expected: record, replacement: replacement, event_type: "service_transition"}])
+        end
+      end
+    end
+  end
+end