ace-assign 0.64.0 → 0.66.1

data/lib/ace/assign/authority/endcap_services.rb

@@ -12,7 +12,18 @@ module Ace
         # exclusion; the immutable commit is the current CAS input, never a
         # caller-selected alternate evidence ref.
         def service_settlement_complete!(journal:, events:, params:, map:, commit:)
+          service_settlement_evidence!(journal: journal, events: events, params: params, map: map, commit: commit)
+          true
+        end
+
+        def service_settlement_evidence!(journal:, events:, params:, map:, commit:)
           protected_journal!(journal)
+          journal.verify_commit!(commit)
+          retained = journal.read_events(params.fetch("assignment_id"), commit: commit)
+            .select { |event| event["attempt_id"] == params.fetch("attempt_id") }
+          unless retained == events && Models::EvidenceEvent.chain_valid?(events)
+            raise AttemptErrors::EvidenceUnavailable, "service settlement requires exact canonical commit"
+          end
           references = events.select { |event| %w[service_claim service_transition].include?(event["type"]) }
             .map { |event| event.fetch("payload").fetch("request_id") }.uniq.sort
           records = journal.service_request_records(commit: commit).select do |record|
@@ -21,17 +32,48 @@ module Ace
           unless records.map { |record| record.fetch("request_id") }.uniq.sort == references
             raise AttemptErrors::EvidenceUnavailable, "canonical service request set is incomplete"
           end
-          records.each do |record|
-            unless record["project_id"] == map.fetch("project_id") && record["mapping_id"] == params.fetch("mapping_id") &&
-                %w[succeeded failed-settled].include?(record["state"])
+          pending = false
+          projected = records.sort_by { |record| record.fetch("request_id") }.map do |record|
+            unless record["project_id"] == map.fetch("project_id") && record["mapping_id"] == params.fetch("mapping_id")
               raise AttemptErrors::EvidenceUnavailable, "canonical service request is not settled for this scope"
             end
             # This existing reader verifies the accepted record digest and all
             # imported terminal/no-effect evidence against this exact commit.
-            journal.service_request(record.fetch("request_id"), commit: commit)
+            verified = journal.service_request(record.fetch("request_id"), commit: commit)
+            unless verified == record && %w[accepted uncertain rejected succeeded failed failed-settled].include?(verified.fetch("state"))
+              raise AttemptErrors::EvidenceUnavailable, "canonical service record differs"
+            end
+            if %w[no_effect_challenge challenge_generation challenge_event_digest].any? { |key| verified.key?(key) }
+              ServiceEvidence.new(journal: journal).challenge!(verified, pending: {commit: commit}, current: false)
+            end
+            unless %w[succeeded failed-settled].include?(verified.fetch("state"))
+              pending = true
+              next
+            end
+            transition = events.reverse.find { |event| %w[service_claim service_transition].include?(event["type"]) &&
+              event.dig("payload", "request_id") == record.fetch("request_id") }
+            receipt = verified.fetch("receipt")
+            unless transition && transition["type"] == "service_transition" &&
+                transition.dig("payload", "state") == verified.fetch("state") &&
+                transition.dig("payload", "record_digest") == Atoms::EvidenceDigest.digest(verified) &&
+                transition.dig("payload", "receipt_digest") == Atoms::EvidenceDigest.digest(receipt)
+              raise AttemptErrors::EvidenceUnavailable, "accepted service terminal transition differs"
+            end
+            {"request_id" => verified.fetch("request_id"), "state" => verified.fetch("state"),
+              "event_digest" => transition.fetch("digest"), "record_digest" => transition.dig("payload", "record_digest"),
+              "receipt_digest" => transition.dig("payload", "receipt_digest"),
+              "evidence_refs" => receipt.fetch("evidence").sort_by { |ref| ref.values_at("ref", "sha256") }}
           end
-          true
-        rescue KeyError, TypeError, ArgumentError, AttemptErrors::ReceiptRejected
+          projected.compact!
+          unless projected.empty?
+            journal.event_commits!(assignment_id: params.fetch("assignment_id"),
+              event_digests: projected.map { |row| row.fetch("event_digest") }, commit: commit)
+          end
+          if pending
+            raise AttemptErrors::ServiceSettlementPending, "authenticated canonical service requests remain unsettled"
+          end
+          settlement_immutable({"commit" => commit, "services" => projected})
+        rescue KeyError, TypeError, ArgumentError, NoMethodError, AttemptErrors::ReceiptRejected
           raise AttemptErrors::EvidenceUnavailable, "canonical service settlement is unverifiable"
         end
 
@@ -39,8 +81,30 @@ module Ace
         # service writers. It never reacquires lifecycle/authority locks.
         def authorize_service_update!(journal:, existing:, replacement:, pending:)
           protected_journal!(journal)
+          if existing && existing.key?("executor_process_binding") &&
+              Atoms::EvidenceDigest.digest(existing.fetch("executor_process_binding")) != Atoms::EvidenceDigest.digest(replacement["executor_process_binding"])
+            raise AttemptErrors::InvalidState, "original cleanup executor cannot change"
+          end
+          if existing && existing.key?("operation_owner_binding") &&
+              Atoms::EvidenceDigest.digest(existing.fetch("operation_owner_binding")) != Atoms::EvidenceDigest.digest(replacement["operation_owner_binding"])
+            raise AttemptErrors::InvalidState, "original cleanup dispatch owner cannot change"
+          end
+          if existing && %w[no_effect_challenge challenge_generation challenge_event_digest].any? { |key| existing[key] != replacement[key] }
+            unless pending && pending[:operation] == "claim_service_settlement" &&
+                existing["state"] == replacement["state"] && existing["receipt"] == replacement["receipt"] &&
+                existing["dispatch_phase"] == replacement["dispatch_phase"]
+              raise AttemptErrors::InvalidState, "no-effect challenge requires its fixed source owner"
+            end
+            ServiceEvidence.new(journal: journal).challenge!(replacement, pending: pending)
+          end
           initial = existing.nil? && %w[accepted uncertain].include?(replacement["state"])
+          if initial && (replacement.key?("operation_owner_binding") || replacement.key?("executor_process_binding"))
+            raise AttemptErrors::InvalidState, "cleanup owner identity requires fresh dispatch admission"
+          end
           begin_dispatch = existing && existing["dispatch_phase"] == "issued" && replacement["dispatch_phase"] == "dispatch_started"
+          if existing && existing["operation"] == "publish" && pending && %w[publication_challenge publication_continue].include?(pending[:operation])
+            return authorize_publication_update!(journal: journal, existing: existing, replacement: replacement, pending: pending)
+          end
           if existing && existing["dispatch_phase"] != replacement["dispatch_phase"] && !begin_dispatch
             raise AttemptErrors::InvalidState, "invalid protected dispatch phase change"
           end
@@ -65,8 +129,22 @@ module Ace
           receiver = @deployment.project(map.fetch("project_id")).fetch("service_receivers").fetch(replacement.fetch("service_id"))
           raise AttemptErrors::UnauthorizedIdentity, "protected service executor differs" unless receiver.fetch("executor_uid") == replacement.fetch("executor_uid")
           current = exact_candidate!(candidate(events), params)
-          approved_review!(journal, events, params, map, current)
+          approved_review!(journal, events, params, map, current, service_operation: replacement.fetch("operation")) unless %w[create update].include?(replacement.fetch("operation"))
           service_policy!.prepare!(replacement, input_bytes: bytes)
+          if begin_dispatch && %w[prune-preserved-workspace publish].include?(replacement.fetch("operation"))
+            executor = replacement.fetch("executor_process_binding")
+            boot = replacement.fetch("worker_process_binding").fetch("started_at").split(":").fetch(1)
+            Molecules::ExecutionScopeLineage.validate_process_identity!(executor, boot_id: boot)
+            credentials = @deployment.project(map.fetch("project_id")).fetch("peer_credentials").fetch(receiver.fetch("executor_uid").to_s)
+            unless executor.slice("uid", "gid", "groups") == credentials.slice("gid", "groups").merge("uid" => receiver.fetch("executor_uid"))
+              raise AttemptErrors::UnauthorizedIdentity, "original cleanup executor credentials differ"
+            end
+            @kernel.live!(executor)
+            unless replacement["operation"] != "prune-preserved-workspace" || Atoms::EvidenceDigest.digest(service_policy!.dispatch_owner_binding!(replacement)) ==
+                Atoms::EvidenceDigest.digest(replacement.fetch("operation_owner_binding"))
+              raise AttemptErrors::UnauthorizedIdentity, "fixed cleanup owner changed before dispatch acceptance"
+            end
+          end
           true
         rescue KeyError
           raise AttemptErrors::UnauthorizedIdentity, "protected service admission context is incomplete"
@@ -74,6 +152,15 @@ module Ace
 
         private
 
+        def settlement_immutable(value)
+          case value
+          when Hash then value.each_with_object({}) { |(key, item), result| result[key.dup.freeze] = settlement_immutable(item) }.freeze
+          when Array then value.map { |item| settlement_immutable(item) }.freeze
+          when String then value.dup.freeze
+          else value.freeze
+          end
+        end
+
         def authorize_service_transfer!(request, params, map, peer, role)
           service_policy!
           service_policy!.visible!(project: map.fetch("project_id"), uid: map.fetch("worker_uid")) unless request.fetch("operation") == "complete_service"
@@ -100,20 +187,71 @@ module Ace
           true
         end
 
+        # Receiver identity and forwarded worker identity are independent checks.
+        # This immutable observation grants no service claim or dispatch permit.
+        def workspace_prune_preview_context(_request, params, map, peer, role, transfer)
+          raise ArgumentError, "preview context forbids upload" unless transfer.nil?
+          @launch.with_assignment(params: params, map: map) do |journal, _registration|
+            {data: workspace_prune_preview_context_at!(journal: journal, params: params, map: map, peer: peer, role: role), replayed: false}
+          end
+        end
+
+        # Only source composition supplies this fixed journal/snapshot owner.
+        # Both ordinary admission and the root read-only view use the same
+        # original registration, process and candidate proof implementation.
+        public
+
+        def workspace_prune_preview_context_at!(journal:, params:, map:, peer:, role:)
+          service_policy!.visible!(project: map.fetch("project_id"), uid: map.fetch("worker_uid"))
+          protected_journal!(journal)
+          commit = journal.ref_value
+          events = @launch.preview_attempt_events!(journal: journal, commit: commit, params: params, map: map)
+          origin = active_origin(events, params)
+          worker_or_launcher!(params.fetch("worker_process_binding"), :worker, map, origin)
+          receiver = service_receiver!(peer, role, map, params.fetch("service_id"))
+          service_policy!.workspace_prune_receiver!(project: map.fetch("project_id"), uid: map.fetch("worker_uid"),
+            service_id: params.fetch("service_id"), executor_uid: receiver.fetch("executor_uid"))
+          selected = candidate(events)
+          unless selected && selected["head"].is_a?(String) && selected["head"].match?(CandidateTransfer::SHA) &&
+              selected["candidate_generation"].is_a?(Integer) && selected["candidate_generation"].positive?
+            raise AttemptErrors::EvidenceUnavailable, "preview candidate is unavailable"
+          end
+          data = {
+            "journal_commit" => commit,
+            "maintenance" => params.slice("mapping_id", "assignment_id", "attempt_id").merge("project_id" => map.fetch("project_id")),
+            "head" => selected.fetch("head"), "candidate_generation" => selected.fetch("candidate_generation"),
+            "worker_process_binding" => origin.fetch("process_binding").fetch("process_identity"),
+            "caller_process_binding" => params.fetch("worker_process_binding")
+          }
+          raise AttemptErrors::Conflict, "preview canonical selection changed" unless journal.ref_value == commit
+          raise AttemptErrors::EvidenceUnavailable, "preview context exceeds bound" if JSON.generate(data).bytesize > 16_384
+          Atoms::EvidenceDigest.digest(data) # Reject unsupported transport values before copying.
+          JSON.parse(JSON.generate(data))
+        end
+
+        private
+
         def service_status(_request, params, map, peer, role)
           @launch.with_assignment(params: params, map: map) do |journal, _registration|
             protected_journal!(journal)
-            record = journal.service_request(params.fetch("request_id"))
+            commit = journal.ref_value
+            read = role == :executor && journal.service_settlement_read(params.fetch("request_id"), commit: commit)
+            record = read ? read.fetch(:record) : journal.service_request(params.fetch("request_id"), commit: commit)
             unless record && record["assignment_id"] == params["assignment_id"] && record["attempt_id"] == params["attempt_id"] &&
                 record["project_id"] == map["project_id"] && record["candidate_head"] == params["head"] &&
                 record["candidate_generation"] == params["candidate_generation"]
               raise AttemptErrors::UnauthorizedIdentity, "service status binding differs"
             end
-            events = attempt_events(journal, params)
+            if role != :executor && %w[no_effect_challenge challenge_generation challenge_event_digest].any? { |key| record.key?(key) }
+              ServiceEvidence.new(journal: journal).challenge!(record, pending: {commit: commit}, current: false)
+            end
+            selected = read ? read.fetch(:read_view).inventory.fetch("events").fetch(params.fetch("assignment_id")) :
+              journal.read_events(params.fetch("assignment_id"), commit: commit)
+            events = selected.select { |event| event.fetch("attempt_id") == params.fetch("attempt_id") }
             @kernel.live!(peer)
             service_policy!.visible!(project: map.fetch("project_id"), uid: peer.fetch("uid"))
             if role == :executor
-              service_executor!(peer, role, record)
+              record = service_settlement_record!(journal, params, map, peer, role, record: record)
             else
               authorized = case role
               when :worker
@@ -129,8 +267,19 @@ module Ace
               end
               raise AttemptErrors::UnauthorizedIdentity, "service status purpose differs" unless authorized
             end
-            {data: service_projection(record).merge("generation" => journal.authority_generation(events),
-              "journal_commit" => journal.ref_value), replayed: false}
+            data = service_projection(record).merge("generation" => journal.authority_generation(events),
+              "journal_commit" => commit)
+            data["input_digest"] = record.fetch("input_digest") if %w[create update ready merge].include?(record["operation"])
+            if %w[create update ready merge].include?(record["operation"]) && record["state"] == "succeeded"
+              event = ServiceDeliveryEvidence.new(journal: journal).verified(record: record, events: events, commit: commit)
+              data.merge!(record.slice("input_digest", "authorization", "executor_uid", "completion_digest", "receipt"))
+              data["delivery_event"] = event
+            end
+            if role == :executor
+              data["settlement_context"] = read.fetch(:settlement_context) ||
+                ServiceEvidence.new(journal: journal).settlement_context(record, commit: commit, read_view: read.fetch(:read_view))
+            end
+            {data: data, replayed: false}
           end
         end
 
@@ -158,7 +307,7 @@ module Ace
               raise AttemptErrors::Conflict, "authorization candidate changed"
             end
             service_receiver!(peer, role, map, record.fetch("service_id"))
-            approved_review!(journal, events, params, map, current)
+            approved_review!(journal, events, params, map, current, service_operation: record.fetch("operation")) unless %w[create update].include?(record.fetch("operation"))
             prepared = service_policy!.prepare!(record, input_bytes: bytes)
             data = params.slice("request_id", "claim_binding", "head", "candidate_generation").merge(
               "policy_digest" => prepared.fetch(:policy_digest), "operation_digest" => prepared.fetch(:operation_digest))
@@ -183,7 +332,7 @@ module Ace
               # Only body binding is checked here; current effect policy stays
               # inside each fresh CAS callback.
               service_policy!.input_binding(admitted, expected_digest: input_record.fetch("input_digest"),
-                expected_target: input_record.fetch("target"))
+                expected_target: input_record.fetch("target"), operation: input_record.fetch("operation"))
             end
             # Admission also runs outside mutate: an exact mutation replay
             # skips its callback and cannot bypass the authenticated ticket.
@@ -234,10 +383,40 @@ module Ace
               data["claim"] = retained || result.fetch(:replayed) || result.dig(:data, "claim") == "retained" ? "retained" : "created"
               result = result.merge(data: data)
             end
+            if %w[request_service begin_dispatch].include?(request.fetch("operation")) &&
+                %w[prune-preserved-workspace publish].include?(result.fetch(:data).fetch("operation"))
+              selector = request.fetch("operation") == "request_service" ? "request_event_digest" : "dispatch_event_digest"
+              digest = cleanup_service_mutation_event!(journal, request, params, result.fetch(:data).fetch("journal_commit"))
+              result = result.merge(data: result.fetch(:data).merge(selector => digest))
+            end
             result
           end
         end
 
+        # Selectors refer to the actual accepted mutation, never a caller's
+        # pathname or the latest service record. They are derived after CAS,
+        # avoiding a self-reference in the persisted mutation reply.
+        def cleanup_service_mutation_event!(journal, request, params, commit)
+          events = journal.read_events(params.fetch("assignment_id"), commit: commit)
+            .select { |event| event["attempt_id"] == params.fetch("attempt_id") }
+          unless Models::EvidenceEvent.chain_valid?(events)
+            raise AttemptErrors::EvidenceUnavailable, "cleanup service mutation chain is unavailable"
+          end
+          selected = events.select do |event|
+            event["type"] == "authority_mutation" && event.dig("payload", "mutation_id") == request.fetch("mutation_id")
+          end
+          event = selected.one? && selected.first
+          unless event && event.dig("payload", "operation") == request.fetch("operation") &&
+              event.dig("payload", "parameters_digest") == Atoms::EvidenceDigest.digest(params) &&
+              event.dig("payload", "assignment_id") == params.fetch("assignment_id") &&
+              event.dig("payload", "attempt_id") == params.fetch("attempt_id") &&
+              event.dig("payload", "data", "request_id") == params.fetch("request_id") &&
+              journal.event_commit!(assignment_id: params.fetch("assignment_id"), event_digest: event.fetch("digest"), commit: commit) == commit
+            raise AttemptErrors::EvidenceUnavailable, "cleanup service mutation introduction is unavailable"
+          end
+          event.fetch("digest")
+        end
+
         def service_policy!
           @service_policy || raise(ArgumentError, "full-service authority requires its installed policy owner")
         end
@@ -246,6 +425,9 @@ module Ace
           unless record && role == :executor && peer["uid"] == record.fetch("executor_uid")
             raise AttemptErrors::UnauthorizedIdentity, "completion requires the recorded executor"
           end
+          if record["operation"] == "publish" && record["dispatch_phase"] != "issued" && peer != record["executor_process_binding"]
+            raise AttemptErrors::UnauthorizedIdentity, "publication requires its original receiver birth"
+          end
           @kernel.live!(peer)
           true
         end
@@ -269,7 +451,7 @@ module Ace
           worker = params.fetch("worker_process_binding")
           worker_or_launcher!(worker, :worker, map, origin)
           current = exact_candidate!(candidate(events), params)
-          approved_review!(journal, events, params, map, current)
+          approved_review!(journal, events, params, map, current, service_operation: params.fetch("operation")) unless %w[create update].include?(params.fetch("operation"))
           receiver = service_receiver!(peer, role, map, params.fetch("service_id"))
           binding = params.slice("request_id", "assignment_id", "attempt_id", "operation", "input_digest", "target",
             "authorization", "service_id").merge("project_id" => map.fetch("project_id"),
@@ -315,9 +497,15 @@ module Ace
           unless record["candidate_head"] == current["head"] && record["candidate_generation"] == current["candidate_generation"]
             raise AttemptErrors::Conflict, "dispatch candidate changed"
           end
-          approved_review!(journal, events, params, map, current)
+          approved_review!(journal, events, params, map, current, service_operation: record.fetch("operation")) unless %w[create update].include?(record.fetch("operation"))
           service_policy!.prepare!(record, input_bytes: input_bytes)
           replacement = record.merge("dispatch_phase" => "dispatch_started")
+          if record.fetch("operation") == "prune-preserved-workspace"
+            replacement["operation_owner_binding"] = service_policy!.dispatch_owner_binding!(record)
+          end
+          if %w[prune-preserved-workspace publish].include?(record.fetch("operation"))
+            replacement["executor_process_binding"] = JSON.parse(JSON.generate(peer))
+          end
           {data: service_projection(replacement).merge("invocation" => "permitted"),
             service_inputs: {record.fetch("request_id") => input_bytes},
             service_updates: [{request_id: record.fetch("request_id"), expected: record,
@@ -355,6 +543,12 @@ module Ace
             return {data: service_projection(record)}
           end
           receipt = admitted.fetch(:receipt)
+          if record["operation"] == "publish"
+            unless admitted.fetch(:artifacts).size == 1
+              raise AttemptErrors::ReceiptRejected, "publication requires its one exact result"
+            end
+            ServiceEvidence.new(journal: journal).publication_result!(admitted.fetch(:artifacts).first, record, state: receipt.fetch("outcome"))
+          end
           owner = ServiceEvidence.new(journal: journal)
           canonical = Molecules::CanonicalEvidence.new(journal: journal)
           plan = canonical.import_plan(**owner.context(record), artifacts: admitted.fetch(:artifacts),
@@ -362,6 +556,11 @@ module Ace
           normalized = JSON.parse(JSON.generate(receipt)).merge("evidence" => plan.fetch(:references))
           replacement = record.merge("state" => receipt.fetch("outcome"), "receipt" => normalized, "completion_digest" => digest)
           replacement["failed_at"] = Time.now.utc.iso8601(9) if receipt["outcome"] == "failed"
+          if %w[create update ready merge].include?(replacement["operation"]) && replacement["state"] == "succeeded"
+            event = ServiceDeliveryEvidence.new(journal: journal).completion_event(record: replacement,
+              receipt: normalized, completion_digest: digest, artifacts: admitted.fetch(:artifacts))
+            plan = plan.merge(events: plan.fetch(:events) + [event])
+          end
           plan.merge(data: service_projection(replacement), service_updates: [{request_id: record.fetch("request_id"),
             expected: record, replacement: replacement, event_type: "service_transition"}])
         end
@@ -379,7 +578,7 @@ module Ace
           unless receipt.keys.sort == Molecules::EvidenceJournal::TERMINAL_RECEIPT_FIELDS.sort &&
               Molecules::EvidenceJournal::TERMINAL_BINDING_FIELDS.all? { |field| receipt[field] == record[field] } &&
               %w[succeeded failed].include?(receipt["outcome"]) &&
-              (receipt["outcome"] != "succeeded" || record["dispatch_phase"] == "dispatch_started")
+              (receipt["outcome"] != "succeeded" || record["dispatch_phase"] == "dispatch_started" || (record["operation"] == "publish" && record["dispatch_phase"] == "issuing"))
             raise AttemptErrors::ReceiptRejected, "completion must attest the exact dispatched request"
           end
           digest
@@ -387,7 +586,11 @@ module Ace
 
         def service_projection(record)
           record.slice("request_id", "assignment_id", "attempt_id", "project_id", "operation", "service_id", "target",
-            "candidate_head", "candidate_generation", "state", "dispatch_ticket_id", "claim_binding", "claim_generation", "dispatch_phase", "policy_digest")
+            "candidate_head", "candidate_generation", "state", "dispatch_ticket_id", "claim_binding", "claim_generation", "dispatch_phase", "policy_digest", "operation_owner_binding", "executor_process_binding", *ServicePublicationEvidence::PUBLICATION_FIELDS).tap do |projection|
+              if record["operation"] == "publish" && %w[succeeded failed].include?(record["state"])
+                projection.merge!(record.slice("receipt", "completion_digest", "authorization", "input_digest"))
+              end
+            end
         end
       end
     end