ace-assign 0.68.0 → 0.70.0

data/lib/ace/assign/authority/ordinary_progress.rb

@@ -0,0 +1,162 @@
+# frozen_string_literal: true
+
+module Ace
+  module Assign
+    module Authority
+      # Source-owned progress for the already accepted work. Queue completion
+      # remains a worker report, never a successful execution result or merge.
+      module OrdinaryProgress
+        PROGRESS_OPERATIONS = %w[queue_start queue_finish queue_fail assignment_snapshot].freeze
+        PROGRESS_TRANSFERS = {
+          "queue_finish" => {direction: :upload, purpose: :artifacts, roles: %i[worker supervisor]},
+          "assignment_snapshot" => {direction: :download, purpose: :assignment_snapshot, roles: %i[worker supervisor reviewer]}
+        }.freeze
+        PROGRESS_COMMON = %w[assignment_id attempt_id expected_generation pane].freeze
+
+        private
+
+        def validate_progress!(request)
+          params = request.fetch("params")
+          operation = request.fetch("operation")
+          if operation == "assignment_snapshot"
+            strict!(params, %w[assignment_id attempt_id kind])
+            token!(params.fetch("attempt_id")) unless params.fetch("attempt_id").nil?
+            unless request.fetch("mutation_id").nil? && %w[prepared_work queue].include?(params.fetch("kind"))
+              raise ArgumentError, "ordinary snapshot must be a read of accepted work or queue"
+            end
+          else
+            fields = case operation
+            when "queue_start" then %w[step]
+            when "queue_finish" then %w[step transfer]
+            when "queue_fail" then %w[message]
+            else raise ArgumentError, "unknown ordinary progress operation"
+            end
+            strict!(params, PROGRESS_COMMON + fields)
+            token!(params.fetch("attempt_id")); token!(request.fetch("mutation_id"))
+            unless params.fetch("expected_generation").is_a?(Integer) && params.fetch("expected_generation").positive?
+              raise ArgumentError, "ordinary progress generation is invalid"
+            end
+            if params.key?("step") && !params["step"].nil? &&
+                !(params["step"].is_a?(String) && params["step"].bytesize.between?(1, 128) && PreparedWork::SCOPE.match?(params["step"]))
+              raise ArgumentError, "ordinary progress step is invalid"
+            end
+            if params.key?("message") && !(params["message"].is_a?(String) && params["message"].bytesize.between?(1, 1024) && !params["message"].include?("\0"))
+              raise ArgumentError, "ordinary failure message is invalid"
+            end
+          end
+          token!(params.fetch("assignment_id"))
+        end
+
+        def assignment_snapshot(request, peer, role, deadline)
+          validate_progress!(request)
+          params = request.fetch("params")
+          commit = @journal.ref_value
+          registered = registration(params.fetch("assignment_id"), commit: commit)
+          raise AttemptErrors::NotFound, "ordinary assignment is not registered" unless registered
+          queue_record = current_queue_record(registered, commit)
+          selected_events = if params.fetch("attempt_id")
+            result_events(params, commit)
+          else
+            []
+          end
+          kind = params.fetch("kind")
+          source = kind == "prepared_work" ? registered : queue_record
+          path_key, digest_key, size = if kind == "prepared_work"
+            ["prepared_bundle_ref", "prepared_bundle_sha256", registered.fetch("prepared_bundle_bytes")]
+          else
+            ["queue_ref", "queue_sha256", PreparedWork::MAX_TOTAL]
+          end
+          bytes = @journal.bounded_blob(source.fetch(path_key), commit: commit, max_bytes: size)
+          unless Digest::SHA256.hexdigest(bytes) == source.fetch(digest_key)
+            raise AttemptErrors::EvidenceUnavailable, "ordinary snapshot bytes differ from accepted selection"
+          end
+          authorize!(request, peer, role, deadline)
+          {data: {"project_id" => @project, "assignment_id" => params.fetch("assignment_id"), "kind" => kind,
+            "attempt_id" => params.fetch("attempt_id"), "generation" => @journal.authority_generation(selected_events),
+            "scope" => selected_events.find { |event| event["type"] == "intent" }&.dig("payload", "scope"),
+            "journal_commit" => commit, "sha256" => source.fetch(digest_key), "bytes" => bytes.bytesize,
+            "prepared_work" => registered.fetch("prepared_work"), "definition_digest" => registered.fetch("definition_digest")},
+            transfer_parts: [bytes], replayed: false}
+        end
+
+        def progress(request, peer, role, deadline, transfer)
+          validate_progress!(request)
+          unless %i[supervisor worker].include?(role)
+            raise AttemptErrors::UnauthorizedIdentity, "ordinary progress requires its original worker"
+          end
+          params, operation = request.fetch("params"), request.fetch("operation")
+          report = if operation == "queue_finish"
+            raise ArgumentError, "ordinary progress report needs one bounded part" unless transfer && transfer.count == 1
+            bytes = transfer.bytes.dup.force_encoding(Encoding::UTF_8)
+            unless bytes.bytesize.between?(1, 65_536) && bytes.valid_encoding? && !bytes.include?("\0")
+              raise ArgumentError, "ordinary progress report must be bounded UTF-8"
+            end
+            bytes
+          elsif transfer
+            raise ArgumentError, "ordinary progress operation forbids transfer"
+          end
+          commit = @journal.ref_value
+          registered = registration(params.fetch("assignment_id"), commit: commit)
+          raise AttemptErrors::NotFound, "ordinary work is not registered" unless registered
+          work = registered_work(registered, commit, deadline)
+          digest = Atoms::EvidenceDigest.digest({"params" => params, "project_id" => @project, "peer_uid" => peer.fetch("uid")})
+          keys = [@exclusion.task_key(registered.fetch("task_id")), @exclusion.assignment_key(params.fetch("assignment_id"))]
+          @exclusion.with_shared_multi(keys, deadline: deadline) do
+            authorize!(request, peer, role, deadline)
+            @journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
+              mutation_id: request.fetch("mutation_id"), operation: operation, parameters_digest: digest,
+              expected_generation: params.fetch("expected_generation"), with_replay: true, deadline: deadline,
+              replay_authorizer: -> { authorize_start_replay!(request, peer, role, deadline) }) do |events, prefix, _generation|
+              authorize_start_replay!(request, peer, role, deadline)
+              unless Molecules::CanonicalAttemptState.derive(events) == "running"
+                raise AttemptErrors::Conflict, "ordinary progress requires the original running attempt"
+              end
+              record = current_queue_record(registered, prefix)
+              scope = events.find { |event| event["type"] == "intent" }.fetch("payload").fetch("scope")
+              queue = OrdinaryQueue.new(work: work, root: @input_root, bytes: queue_bytes(record, prefix))
+              next_queue = case operation
+              when "queue_start" then queue.transition(operation: :start, scope: scope, step: params.fetch("step"))
+              when "queue_finish" then queue.transition(operation: :finish, scope: scope, step: params.fetch("step"), report: report)
+              when "queue_fail" then queue.transition(operation: :fail, scope: scope, message: params.fetch("message"))
+              end
+              sha = Digest::SHA256.hexdigest(next_queue.bytes)
+              path = "execution/definitions/#{params.fetch('assignment_id')}-queue-#{sha}.json"
+              {events: [], blobs: {path => next_queue.bytes}, data: {
+                "authority" => "ordinary", "assignment_id" => params.fetch("assignment_id"), "attempt_id" => params.fetch("attempt_id"),
+                "project_id" => @project, "scope" => scope, "queue_ref" => path, "queue_sha256" => sha, "state" => "running",
+                "queue_complete" => next_queue.status.subtree_complete?(scope)}}
+            end
+          end
+        end
+
+        def current_queue_record(registered, commit)
+          assignment = registered.fetch("assignment_id")
+          events = @journal.read_events(assignment, commit: commit)
+          events.group_by { |event| event.fetch("attempt_id") }.each_value do |chain|
+            raise AttemptErrors::EvidenceUnavailable, "ordinary queue history is corrupt" unless Models::EvidenceEvent.chain_valid?(chain)
+          end
+          updates = events.select do |entry|
+            entry["type"] == "authority_mutation" &&
+              %w[start_attempt queue_start queue_finish queue_fail].include?(entry.dig("payload", "operation"))
+          end
+          return registered if updates.empty?
+          event = @journal.latest_event!(assignment_id: assignment, event_digests: updates.map { |entry| entry.fetch("digest") }, commit: commit)
+          record = event.dig("payload", "data")
+          unless record && record.values_at("authority", "assignment_id", "attempt_id", "project_id") ==
+              ["ordinary", assignment, event.fetch("attempt_id"), @project]
+            raise AttemptErrors::EvidenceUnavailable, "ordinary canonical queue is unavailable"
+          end
+          record
+        end
+
+        def queue_bytes(record, commit)
+          bytes = @journal.bounded_blob(record.fetch("queue_ref"), commit: commit, max_bytes: PreparedWork::MAX_TOTAL)
+          unless Digest::SHA256.hexdigest(bytes) == record.fetch("queue_sha256")
+            raise AttemptErrors::EvidenceUnavailable, "ordinary canonical queue bytes differ"
+          end
+          bytes
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/ordinary_queue.rb

@@ -0,0 +1,115 @@
+# frozen_string_literal: true
+
+require "tmpdir"
+require "fileutils"
+require_relative "prepared_work"
+require_relative "private_directory"
+require_relative "../organisms/assignment_executor"
+
+module Ace
+  module Assign
+    module Authority
+      # A disposable projection for the existing queue engine. Only bytes read
+      # from (or about to be committed to) the canonical execution ref enter it.
+      # No files left by an earlier coordinator are recovery input.
+      class OrdinaryQueue
+        attr_reader :bytes
+
+        def initialize(work:, root:, bytes: nil)
+          raise ArgumentError, "ordinary queue requires prepared work" unless work.is_a?(PreparedWork)
+          @work, @root = work, PrivateDirectory.verify!(root)
+          value = if bytes
+            invalid! unless bytes.is_a?(String) && bytes.bytesize.between?(1, PreparedWork::MAX_TOTAL)
+            JSON.parse(bytes)
+          else
+            {"version" => 1, "steps" => work.manifest.fetch("steps").to_h { |step|
+              name = step.fetch("filename"); [name, work.files.fetch("steps/#{name}")]
+            }, "reports" => {}}
+          end
+          validate!(value, initial: bytes.nil?)
+          @bytes = Atoms::EvidenceDigest.canonical_json(value).freeze
+        rescue JSON::ParserError
+          invalid!
+        end
+
+        def status
+          value = JSON.parse(@bytes)
+          assignment = Models::Assignment.from_h(@work.definition, cache_dir: File.join(@root, @work.manifest.fetch("assignment_id")))
+          Molecules::QueueScanner.new.scan_captured(steps: value.fetch("steps"), reports: value.fetch("reports"), assignment: assignment)
+        end
+
+        # This returns proposed bytes only. The lifecycle owns authorization,
+        # generation, replay and publication together with its attempt events.
+        def transition(operation:, scope: @work.manifest.fetch("scope"), step: nil, report: nil, message: nil)
+          invalid! unless @work.manifest.fetch("steps").any? { |entry| entry.fetch("number") == scope }
+          value = JSON.parse(@bytes)
+          Dir.mktmpdir("ordinary-queue-", @root) do |scratch|
+            File.chmod(0o700, scratch)
+            directory = File.join(scratch, @work.manifest.fetch("assignment_id"))
+            %w[steps reports].each { |name| FileUtils.mkdir_p(File.join(directory, name), mode: 0700) }
+            assignment = Models::Assignment.from_h(@work.definition, cache_dir: directory)
+            write(File.join(directory, "assignment.yaml"), assignment.to_h.to_yaml)
+            write(File.join(directory, "job.yaml"), @work.files.fetch("job.yaml"))
+            %w[steps reports].each do |group|
+              value.fetch(group).each { |filename, content| write(File.join(directory, group, filename), content) }
+            end
+            executor = Organisms::AssignmentExecutor.new(cache_base: scratch, selected_assignment: assignment)
+            case operation
+            when :activate
+              state = executor.status.fetch(:state)
+              invalid! unless state.find_by_number(scope)&.status == :pending
+              executor.step_writer.mark_active(state.find_by_number(scope).file_path)
+            when :start
+              executor.start_step(step_number: step, fork_root: scope)
+            when :finish
+              executor.finish_step(report_content: report, step_number: step, fork_root: scope)
+            when :fail
+              executor.fail(message, fork_root: scope)
+            else
+              raise ArgumentError, "unknown ordinary queue transition"
+            end
+            result = {"version" => 1}
+            %w[steps reports].each do |group|
+              result[group] = Dir.children(File.join(directory, group)).to_h do |filename|
+                [filename, File.binread(File.join(directory, group, filename)).force_encoding(Encoding::UTF_8)]
+              end
+            end
+            self.class.new(work: @work, root: @root, bytes: Atoms::EvidenceDigest.canonical_json(result))
+          end
+        end
+
+        private
+
+        def validate!(value, initial:)
+          invalid! unless value.is_a?(Hash) && value.keys.sort == %w[reports steps version] && value["version"].is_a?(Integer) && value["version"] == 1 &&
+            value["steps"].is_a?(Hash) && value["reports"].is_a?(Hash)
+          expected = @work.manifest.fetch("steps").map { |step| step.fetch("filename") }
+          invalid! unless value.fetch("steps").keys.sort == expected.sort
+          reports = []
+          value.fetch("steps").each do |filename, content|
+            parsed = @work.parse_queue_step!(content)
+            progress = parsed.fetch(:frontmatter).keys & PreparedWork::PROGRESS
+            allowed = initial ? %w[status] : %w[status started_at completed_at error stall_reason]
+            invalid! unless (progress - allowed).empty?
+            original = @work.files.fetch("steps/#{filename}")
+            invalid! unless PreparedWork.work_projection(content) == PreparedWork.work_projection(original) &&
+              %w[pending active done failed].include?(parsed.fetch(:frontmatter).fetch("status", "pending"))
+            info = Atoms::StepFileParser.parse_filename(filename)
+            reports << Atoms::StepFileParser.generate_report_filename(info.fetch(:number), info.fetch(:name))
+          end
+          invalid! unless (value.fetch("reports").keys - reports).empty?
+          value.fetch("reports").each_value { |content| @work.parse_queue_step!(content) }
+          invalid! if Atoms::EvidenceDigest.canonical_json(value).bytesize > PreparedWork::MAX_TOTAL
+        end
+
+        def write(path, content)
+          File.open(path, File::WRONLY | File::CREAT | File::EXCL | File::NOFOLLOW, 0600) { |file| file.write(content) }
+        end
+
+        def invalid!
+          raise AttemptErrors::EvidenceUnavailable, "ordinary canonical queue differs from its accepted work"
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/ordinary_results.rb

@@ -0,0 +1,196 @@
+# frozen_string_literal: true
+
+require_relative "receipt_transfer"
+require_relative "../molecules/canonical_evidence"
+
+module Ace
+  module Assign
+    module Authority
+      # A worker submits an attributable result. This never accepts a terminal
+      # outcome, an independent review, or an external delivery effect.
+      module OrdinaryResults
+        RESULT_OPERATIONS = %w[submit_result result_status result_snapshot].freeze
+        RESULT_TRANSFERS = {
+          "submit_result" => {direction: :upload, purpose: :receipt_artifacts, roles: %i[worker supervisor]},
+          "result_snapshot" => {direction: :download, purpose: :receipt_artifacts, roles: %i[worker supervisor]}
+        }.freeze
+        RESULT_KEYS = %w[assignment_id attempt_id expected_generation pane head receipt_sha256 transfer].freeze
+
+        private
+
+        def validate_result!(request)
+          params = request.fetch("params")
+          if request.fetch("operation") != "submit_result"
+            snapshot = request.fetch("operation") == "result_snapshot"
+            strict!(params, %w[assignment_id attempt_id] + (snapshot ? ["result_id"] : []))
+            token!(params.fetch("result_id")) if snapshot
+            raise ArgumentError, "ordinary result status mutation must be null" unless request.fetch("mutation_id").nil?
+          else
+            strict!(params, RESULT_KEYS)
+            token!(request.fetch("mutation_id"))
+            unless params.fetch("expected_generation").is_a?(Integer) && params.fetch("expected_generation").positive? &&
+                params.fetch("head").is_a?(String) && params.fetch("head").match?(/\A[0-9a-f]{40}\z/) &&
+                params.fetch("receipt_sha256").is_a?(String) && params.fetch("receipt_sha256").match?(/\A[0-9a-f]{64}\z/)
+              raise ArgumentError, "ordinary result selection is invalid"
+            end
+          end
+          %w[assignment_id attempt_id].each { |key| token!(params.fetch(key)) }
+        end
+
+        def ordinary_result(request, peer, role, deadline, transfer)
+          validate_result!(request)
+          params = request.fetch("params")
+          commit = @journal.ref_value
+          registered = registration(params.fetch("assignment_id"), commit: commit)
+          raise AttemptErrors::NotFound, "ordinary work is not registered" unless registered
+          if request.fetch("operation") != "submit_result"
+            events = result_events(params, commit)
+            result = retained_ordinary_result(params, events, commit)
+            if request.fetch("operation") == "result_snapshot"
+              unless result && result.fetch("result_id") == params.fetch("result_id")
+                raise AttemptErrors::NotFound, "ordinary exact result is unavailable"
+              end
+              receipt = result.fetch("receipt")
+              canonical = Molecules::CanonicalEvidence.new(journal: @journal)
+              parts = [JSON.generate(receipt)] + receipt.fetch("artifacts").map { |artifact|
+                canonical.read({"ref" => artifact.fetch("path"), "sha256" => artifact.fetch("sha256")},
+                  **ordinary_result_context(result.fetch("binding")), commit: commit)
+              }
+              authorize!(request, peer, role, deadline)
+              return {data: ordinary_result_projection(result).merge("journal_commit" => commit), transfer_parts: parts, replayed: false}
+            end
+            authorize!(request, peer, role, deadline)
+            return {data: {"assignment_id" => params.fetch("assignment_id"), "attempt_id" => params.fetch("attempt_id"),
+              "journal_commit" => commit, "generation" => @journal.authority_generation(events),
+              "state" => Molecules::CanonicalAttemptState.derive(events), "submitted_result" => result && ordinary_result_projection(result)}, replayed: false}
+          end
+          unless %i[worker supervisor].include?(role)
+            raise AttemptErrors::UnauthorizedIdentity, "ordinary result requires its original worker"
+          end
+          authorize_start_replay!(request, peer, role, deadline)
+          admitted = ReceiptTransfer.decode(input: transfer, receipt_sha256: params.fetch("receipt_sha256"),
+            artifact_field: "artifacts", reference_key: "path")
+          digest = Atoms::EvidenceDigest.digest({"params" => params, "project_id" => @project, "peer_uid" => peer.fetch("uid")})
+          keys = [@exclusion.task_key(registered.fetch("task_id")), @exclusion.assignment_key(params.fetch("assignment_id"))]
+          @exclusion.with_shared_multi(keys, deadline: deadline) do
+            @journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
+              mutation_id: request.fetch("mutation_id"), operation: "submit_result", parameters_digest: digest,
+              expected_generation: params.fetch("expected_generation"), with_replay: true, deadline: deadline,
+              replay_authorizer: -> { authorize_start_replay!(request, peer, role, deadline) }) do |events, prefix, generation|
+              authorize_start_replay!(request, peer, role, deadline)
+              unless Molecules::CanonicalAttemptState.derive(events) == "running"
+                raise AttemptErrors::Conflict, "ordinary result requires the original running attempt"
+              end
+              raise AttemptErrors::Conflict, "ordinary attempt already submitted its result" if retained_ordinary_result(params, events, prefix)
+              observed = @admission.execution!(peer: peer, pane: params.fetch("pane"), head: params.fetch("head"), deadline: deadline)
+              start_replay_owner!(params, observed.fetch(:identity))
+              ordinary_result_plan(params, peer, admitted, observed, events, prefix, generation + 1)
+            end
+          end
+        end
+
+        def result_events(params, commit)
+          events = @journal.read_events(params.fetch("assignment_id"), commit: commit)
+            .select { |event| event.fetch("attempt_id") == params.fetch("attempt_id") }
+          unless Models::EvidenceEvent.chain_valid?(events) && events.one? { |event| event["type"] == "process_start" }
+            raise AttemptErrors::EvidenceUnavailable, "ordinary result attempt evidence is unavailable"
+          end
+          events
+        end
+
+        def ordinary_result_plan(params, peer, admitted, observed, events, commit, generation)
+          original = admitted.fetch(:receipt)
+          original_receipt = Models::ExecutionReceipt.from_h(original)
+          unless original_receipt.digest == Atoms::EvidenceDigest.digest(original_receipt.digest_payload)
+            raise AttemptErrors::ReceiptRejected, "ordinary original result digest differs"
+          end
+          identity = observed.fetch(:identity)
+          expected_producer = {"actor" => identity.actor, "role" => identity.role, "runtime" => identity.runtime}
+          validate_ordinary_result_receipt!(original, expected_producer)
+          id = SecureRandom.hex(16)
+          binding = params.slice("assignment_id", "attempt_id", "head").merge("authority" => "ordinary", "project_id" => @project,
+            "result_id" => id, "worker_uid" => peer.fetch("uid"), "producer" => expected_producer,
+            "runtime_binding" => identity.runtime_binding, "checkout" => observed.fetch(:checkout),
+            "generation" => generation, "uploaded_receipt_sha256" => admitted.fetch(:receipt_sha256),
+            "original_receipt_digest" => original_receipt.digest)
+          canonical = Molecules::CanonicalEvidence.new(journal: @journal)
+          plan = admitted.fetch(:artifacts).empty? ? {events: [], blobs: {}, references: []} :
+            canonical.import_plan(**ordinary_result_context(binding), artifacts: admitted.fetch(:artifacts),
+              admitted_after_event_digest: events.last.fetch("digest"))
+          receipt = original.except("digest", "recorded_at").merge("artifacts" => plan.fetch(:references).map { |reference|
+            {"path" => reference.fetch("ref"), "sha256" => reference.fetch("sha256")}
+          })
+          pending = @journal.send(:chain_mutation_events, params.fetch("attempt_id"), events.last.fetch("digest"), plan.fetch(:events))
+          reader = ->(_data, artifact) { canonical.read_pending({"ref" => artifact.fetch("path"), "sha256" => artifact.fetch("sha256")},
+            **ordinary_result_context(binding), current_events: events, pending_events: pending, blobs: plan.fetch(:blobs), commit: commit) }
+          verified = verify_ordinary_result_receipt(params, receipt, binding, commit, reader)
+          if JSON.generate(verified.to_h).bytesize > 16_384
+            raise AttemptErrors::ReceiptRejected, "canonical ordinary receipt exceeds its transfer limit"
+          end
+          payload = {"authority" => "ordinary", "result_id" => id, "binding" => binding, "receipt" => verified.to_h}
+          plan.merge(events: plan.fetch(:events) + [{type: "result_submitted", payload: payload}],
+            data: ordinary_result_projection(payload))
+        end
+
+        def ordinary_result_projection(payload)
+          payload.slice("result_id").merge(payload.fetch("binding").slice("head", "generation"),
+            "receipt_digest" => payload.fetch("receipt").fetch("digest"), "verdict" => payload.fetch("receipt").fetch("verdict"),
+            "state" => "running", "authority" => "ordinary")
+        end
+
+        def ordinary_result_context(binding)
+          {kind: "result", project_id: @project, assignment_id: binding.fetch("assignment_id"), attempt_id: binding.fetch("attempt_id"),
+            peer_uid: binding.fetch("worker_uid"), binding: binding, request_id_or_event_id: binding.fetch("result_id"), generation: binding.fetch("generation")}
+        end
+
+        def validate_ordinary_result_receipt!(receipt, producer)
+          unless receipt["producer"] == producer && (receipt.keys - Models::ExecutionReceipt.from_h(receipt).to_h.keys).empty? &&
+              !receipt["campaign"] && !receipt["review"] && receipt["operation"] != "review" &&
+              !Molecules::ReceiptVerifier::EXTERNAL_EFFECT_OPERATIONS.include?(receipt["operation"])
+            raise AttemptErrors::ReceiptRejected, "ordinary result producer or operation requires another evidence owner"
+          end
+        end
+
+        def verify_ordinary_result_receipt(params, receipt, binding, commit, reader)
+          validate_ordinary_result_receipt!(receipt, binding.fetch("producer"))
+          attempt = @journal.derived_attempts(params.fetch("assignment_id"), commit: commit).find { |item| item.attempt_id == params.fetch("attempt_id") }
+          raise AttemptErrors::EvidenceUnavailable, "ordinary result attempt is unavailable" unless attempt
+          Array(receipt["artifacts"]).each { |artifact| reader.call(receipt, artifact) }
+          Molecules::ReceiptVerifier.new(artifact_reader: reader).verify_result!(receipt,
+            attempt: attempt, live_head: binding.fetch("head"), repo_root: @journal.repo_root)
+        end
+
+        def retained_ordinary_result(params, events, commit)
+          raise AttemptErrors::EvidenceUnavailable, "ordinary result chain is corrupt" unless Models::EvidenceEvent.chain_valid?(events)
+          records = events.select { |event| event["type"] == "result_submitted" }
+          replies = events.select { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "submit_result" }
+          return nil if records.empty? && replies.empty?
+          unless records.one? && replies.one?
+            raise AttemptErrors::EvidenceUnavailable, "ordinary result provenance is missing or duplicated"
+          end
+          payload = records.first.fetch("payload")
+          binding = payload.fetch("binding")
+          start = events.find { |event| event["type"] == "process_start" }.fetch("payload")
+          unless payload.keys.sort == %w[authority binding receipt result_id] && payload["authority"] == "ordinary" &&
+              payload["result_id"].is_a?(String) && payload["result_id"].match?(/\A[0-9a-f]{32}\z/) &&
+              binding.keys.sort == %w[assignment_id attempt_id authority checkout generation head original_receipt_digest producer project_id result_id runtime_binding uploaded_receipt_sha256 worker_uid] &&
+              binding["authority"] == "ordinary" && binding["result_id"] == payload["result_id"] &&
+              binding["head"] == binding.dig("checkout", "head") &&
+              binding.values_at("project_id", "assignment_id", "attempt_id", "runtime_binding") ==
+              [@project, params.fetch("assignment_id"), params.fetch("attempt_id"), start.fetch("runtime_binding")] &&
+              binding.fetch("producer") == start.slice("actor", "role", "runtime") &&
+              binding.fetch("worker_uid") == start.dig("runtime_binding", "process_identity", "uid") &&
+              payload.fetch("receipt").fetch("producer") == binding.fetch("producer") &&
+              replies.first.dig("payload", "data").slice(*ordinary_result_projection(payload).keys) == ordinary_result_projection(payload)
+            raise AttemptErrors::EvidenceUnavailable, "ordinary result owner differs"
+          end
+          canonical = Molecules::CanonicalEvidence.new(journal: @journal)
+          reader = ->(_data, artifact) { canonical.read({"ref" => artifact.fetch("path"), "sha256" => artifact.fetch("sha256")},
+            **ordinary_result_context(binding), commit: commit) }
+          verify_ordinary_result_receipt(params, payload.fetch("receipt"), binding, commit, reader)
+          payload
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/ordinary_server.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+require_relative "socket_server"
+
+module Ace
+  module Assign
+    module Authority
+      # Explicit ordinary admission over Assign's existing wire/transfer owner.
+      # The Lab composition supplies a trusted installed admission object and
+      # closed handlers. No protected Deployment or kernel adapter is replaced.
+      class OrdinaryServer < SocketServer
+        def initialize(admission:, lifecycle:, services: [])
+          @admission = admission
+          super(service: admission.service, lifecycle: lifecycle, services: services)
+        end
+
+        private
+
+        def verify_listener!
+          @admission.verify_listener!
+        end
+
+        def authorize_transfer!(request:, peer:, role:, deadline:)
+          @lifecycle.authorize_transfer!(request: request, peer: peer, role: role, deadline: deadline)
+        end
+
+        def dispatch_lifecycle(request:, peer:, role:, deadline:, transfer: nil)
+          @lifecycle.dispatch(request: request, peer: peer, role: role, deadline: deadline, transfer: transfer)
+        end
+
+        def receive(socket)
+          deadline = wire.deadline(30)
+          peer = @admission.peer(socket, deadline: deadline)
+          ingress = Ace::Runtime::Molecules::ProtectedSocket::Ingress.new(socket)
+          frame = wire.read(ingress, deadline: [deadline, wire.deadline(5)].min, limit: 16_384, with_size: true)
+          request = frame.fetch(:data)
+          unless request.is_a?(Hash) && request.keys.sort == %w[mutation_id operation params project_id version] &&
+              request["version"].is_a?(Integer) && request["version"] == 1 &&
+              request["operation"].is_a?(String) && request["params"].is_a?(Hash)
+            raise ArgumentError, "invalid ordinary authority envelope"
+          end
+          role = @admission.authorize!(request: request, peer: peer, deadline: deadline)
+          binding = @lifecycle.transfer_binding(request)
+          bodyless_read!(ingress, deadline) unless binding && binding.fetch(:direction) == :upload
+          # Both binary bodies and EOF use ancillary-rejecting reads. Replies
+          # use the original duplex socket through the wrapper below.
+          dispatch_request(Duplex.new(socket, ingress), request, peer, role, deadline, frame_bytes: frame.fetch(:bytesize))
+        rescue ArgumentError, KeyError, AttemptErrors::MalformedTransfer
+          refusal(socket, "invalid_input")
+        rescue AttemptErrors::UnauthorizedIdentity, SecurityError
+          refusal(socket, "unauthorized")
+        rescue AttemptErrors::Conflict
+          refusal(socket, "conflict")
+        rescue AttemptErrors::NotFound
+          refusal(socket, "missing")
+        rescue AttemptErrors::BoundedResultUnavailable
+          refusal(socket, "bounded_result")
+        rescue StandardError
+          refusal(socket, "evidence_unavailable")
+        ensure
+          socket.close unless socket.closed?
+          @mutex.synchronize { @connections.delete(socket) }
+        end
+
+        class Duplex
+          def initialize(socket, ingress) = (@socket, @ingress = socket, ingress)
+          def to_io = @socket
+          def read_nonblock(*args, **options) = @ingress.read_nonblock(*args, **options)
+          def write_nonblock(*args, **options) = @socket.write_nonblock(*args, **options)
+        end
+        private_constant :Duplex
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/prepared_work.rb

@@ -69,9 +69,9 @@ module Ace
         # The existing transport verifies complete Git objects before this
         # shared byte contract parses anything. Preserve the original input for
         # the eventual registration journal; CandidateTransfer may reexport it.
-        def self.admit(bytes:, head:, tree:, sha256:, size:, root:)
+        def self.admit(bytes:, head:, tree:, sha256:, size:, root:, deadline: nil)
           transfer = CandidateTransfer.new(root: root)
-          transfer.admit(bytes: bytes, head: head, sha256: sha256, size: size) do |repository, deadline, result|
+          transfer.admit(bytes: bytes, head: head, sha256: sha256, size: size, deadline: deadline) do |repository, deadline, result|
             raise ArgumentError, "prepared_input_invalid: Git tree differs" unless result.fetch("tree") == tree
             new(files: transfer.prepared_files(repository: repository, deadline: deadline, head: head))
           end

data/lib/ace/assign/authority/protected_assignment_context.rb

@@ -12,7 +12,7 @@ module Ace
       class ProtectedAssignmentContext
         attr_reader :uid
 
-        def self.load
+        def self.load(uid: Process.uid)
           paths = [Deployment::PATH, DeploymentHistory::PATH]
           installed = paths.any? do |path|
             begin
@@ -22,13 +22,13 @@ module Ace
               false
             end
           end
-          return new(deployment: nil, history: nil) unless installed
+          return new(deployment: nil, history: nil, uid: uid) unless installed
           deployment = Deployment.load
           history = DeploymentHistory.load
           unless history.selects?(deployment)
             raise AttemptErrors::EvidenceUnavailable, "installed protected descriptor is not retained"
           end
-          new(deployment: deployment, history: history)
+          new(deployment: deployment, history: history, uid: uid)
         end
 
         def initialize(deployment:, history:, uid: Process.uid, kernel: nil, env: ENV,

data/lib/ace/assign/authority/router.rb

@@ -4,10 +4,10 @@ module Ace
     module Authority
       # Source-owned handlers share one listener. Requests never name a method.
       class Router
-        def initialize(launch:, handlers: [])
+        def initialize(launch: nil, handlers: [])
           @launch = launch
           @routes = {}
-          ([launch] + handlers).each do |handler|
+          ([launch].compact + handlers).each do |handler|
             handler.class::OPERATIONS.each do |operation|
               raise ArgumentError, "duplicate authority operation" if @routes.key?(operation)
               @routes[operation] = handler
@@ -16,11 +16,12 @@ module Ace
           @routes.freeze
         end
 
-        def dispatch(request:, peer:, role:, transfer: nil)
+        def dispatch(request:, peer:, role:, transfer: nil, deadline: nil)
           validate_review_namespace!(request)
           handler = @routes.fetch(request.fetch("operation")) { raise ArgumentError, "unknown authority operation" }
           options = {request: request, peer: peer, role: role}
           options[:transfer] = transfer if transfer
+          options[:deadline] = deadline if deadline
           handler.dispatch(**options)
         end
 
@@ -42,10 +43,12 @@ module Ace
           binding
         end
 
-        def authorize_transfer!(request:, peer:, role:)
+        def authorize_transfer!(request:, peer:, role:, deadline: nil)
           validate_review_namespace!(request)
           handler = @routes.fetch(request.fetch("operation"))
-          handler.authorize_transfer!(request: request, peer: peer, role: role)
+          options = {request: request, peer: peer, role: role}
+          options[:deadline] = deadline if deadline
+          handler.authorize_transfer!(**options)
         end
 
         def validate_review_namespace!(request)
@@ -60,14 +63,16 @@ module Ace
         private :validate_review_namespace!
 
         def close
-          @launch.close
+          @routes.values.uniq.each { |handler| handler.close if handler.respond_to?(:close) }
         end
 
         def serve_launch_control!(**options)
+          raise AttemptErrors::EvidenceUnavailable, "launch control is unavailable in this composition" unless @launch
           @launch.serve_launch_control!(**options)
         end
 
         def gate_ready(**options)
+          raise AttemptErrors::EvidenceUnavailable, "launch gate is unavailable in this composition" unless @launch
           @launch.gate_ready(**options)
         end
       end