ace-assign 0.68.0 → 0.70.0

data/lib/ace/assign/authority/server.rb

@@ -1,129 +1,29 @@
 # frozen_string_literal: true
-require "socket"
-require "fileutils"
+
 require_relative "deployment"
-require_relative "transfer_codec"
-require_relative "../molecules/evidence_journal"
+require_relative "socket_server"
 
 module Ace
   module Assign
     module Authority
-      # Existing assignment owner transport; kernel peers select roles, never argv.
-      class Server
-        CONNECTIONS = 16
+      # Protected admission is mandatory for this source-selected composition.
+      class Server < SocketServer
         def initialize(authority_id:, lifecycle:, deployment: Deployment.load,
-          kernel: Ace::Runtime::Molecules::ProtectedLinux.new, composition: "launch", hitl_service: nil)
-          @authority_id, @lifecycle, @deployment, @kernel = authority_id, lifecycle, deployment, kernel
-          @composition = composition
-          @hitl_service = hitl_service
+          kernel: Ace::Runtime::Molecules::ProtectedLinux.new, composition: "launch", services: [])
+          @authority_id, @deployment, @kernel, @composition = authority_id, deployment, kernel, composition
           deployment.verify_composition!(authority_id, composition: composition)
-          @service = deployment.authority(authority_id)
-          @mutex = Mutex.new
-          @connections = []
-          @handlers = []
-          @transfers = 0
-          @stopped = false
+          super(service: deployment.authority(authority_id), lifecycle: lifecycle, services: services)
         end
 
-        def serve
+        private
+
+        def verify_listener!
           @kernel.supported!
           me = @kernel.capture(Process.pid)
           unless principal?(me, @service, "uid", "gid", "groups")
             raise AttemptErrors::UnauthorizedIdentity, "listener principal differs from installed authority"
           end
           @deployment.verify_receiver_paths!(@authority_id)
-          directory = File.dirname(@service.fetch("socket_path"))
-          wire.root_path!(directory, directory: true, owner: @service.fetch("uid"))
-          lock = File.open(File.join(directory, "listener.lock"), File::RDWR | File::CREAT | File::NOFOLLOW, 0o600)
-          unless lock.flock(File::LOCK_EX | File::LOCK_NB)
-            raise AttemptErrors::Conflict, "assignment authority already owns its listener"
-          end
-          start_hitl_service!
-          path = @service.fetch("socket_path")
-          if File.exist?(path) || File.symlink?(path)
-            raise AttemptErrors::Conflict, "existing authority endpoint requires verified installer recovery"
-          end
-          @listener = UNIXServer.new(path)
-          File.chmod(0o660, path)
-          @endpoint = wire.socket_identity(path)
-          until @stopped
-            if @hitl_thread && !@hitl_thread.alive?
-              raise Ace::Runtime::RuntimeUnavailableError, "protected HITL boundary stopped before its authority"
-            end
-            ready = IO.select([@listener], nil, nil, 0.25)
-            next unless ready
-            socket = @listener.accept_nonblock(exception: false)
-            next if socket == :wait_readable
-            admitted = @mutex.synchronize do
-              if @connections.size < CONNECTIONS
-                @connections << socket
-                true
-              end
-            end
-            unless admitted
-              refusal(socket, "busy")
-              socket.close
-              next
-            end
-            @mutex.synchronize do
-              @handlers.reject! { |handler| !handler.alive? }
-              @handlers << Thread.new(socket) { |connection| receive(connection) }
-            end
-          end
-        rescue IOError, Errno::EBADF
-          raise unless @stopped
-        ensure
-          stop
-          stop_hitl_service!
-          # Closing a stream does not cancel a handler already inside dispatch.
-          # The owner lock and endpoint remain held until every handler ends.
-          @mutex.synchronize { @handlers.dup }.each(&:join)
-          @lifecycle.close if @endpoint && @lifecycle.respond_to?(:close)
-          if @endpoint && same_endpoint?(path)
-            File.unlink(path)
-          end
-          lock&.close
-        end
-
-        def request_stop
-          @stopped = true
-        end
-
-        def stop
-          @stopped = true
-          @listener&.close unless @listener&.closed?
-          @mutex.synchronize { @connections.each { |socket| socket.close unless socket.closed? } }
-        end
-
-        private
-
-        # The existing HITL boundary is a sibling owned by this listener's
-        # lifetime. It must be ready before assignment ingress is opened.
-        def start_hitl_service!
-          return unless @hitl_service
-          ready = Queue.new
-          @hitl_thread = Thread.new do
-            @hitl_service.run(on_ready: -> { ready << :ready })
-          rescue Exception => error
-            @hitl_failure = error
-            ready << error
-          end
-          @hitl_thread.report_on_exception = false
-          result = ready.pop(timeout: 5)
-          raise Ace::Runtime::RuntimeUnavailableError, "protected HITL boundary startup timed out" if result.nil?
-          raise result if result.is_a?(Exception)
-        end
-
-        def stop_hitl_service!
-          return unless @hitl_thread
-          @hitl_service.stop
-          @hitl_thread.join
-        end
-
-        def same_endpoint?(path)
-          wire.socket_identity(path) == @endpoint
-        rescue StandardError
-          false
         end
 
         def receive(socket)
@@ -200,40 +100,7 @@ module Ace
             raise AttemptErrors::UnauthorizedIdentity, "gate readiness requires worker peer" unless role == :worker
             @lifecycle.gate_ready(request: request, peer: peer, socket: socket, deadline: deadline)
           else
-            Molecules::EvidenceJournal.with_event_read_operation do
-              binding = @lifecycle.transfer_binding(request) if @lifecycle.respond_to?(:transfer_binding)
-              if binding
-                raise AttemptErrors::UnauthorizedIdentity, "transfer role differs" unless binding.fetch(:roles).include?(role)
-                raise ArgumentError, "transfer control header is oversized" if frame.fetch(:bytesize) > 16_384
-                @lifecycle.authorize_transfer!(request: request, peer: peer, role: role)
-                admitted_transfer = @mutex.synchronize do
-                  if @transfers < 2
-                    @transfers += 1
-                    true
-                  end
-                end
-                raise AttemptErrors::Conflict, "transfer capacity is busy" unless admitted_transfer
-                codec = transfer_codec
-                if binding.fetch(:direction) == :upload
-                  result = codec.receive(socket, descriptor: params.fetch("transfer"), purpose: binding.fetch(:purpose), deadline: deadline) do |input|
-                    @lifecycle.dispatch(request: request, peer: peer, role: role, transfer: input)
-                  end
-                else
-                  result = @lifecycle.dispatch(request: request, peer: peer, role: role)
-                  parts = result.fetch(:transfer_parts)
-                  descriptor = codec.descriptor(parts, purpose: binding.fetch(:purpose))
-                  result = result.merge(data: result.fetch(:data).merge("transfer" => descriptor))
-                end
-              else
-                raise ArgumentError, "unexpected transfer descriptor" if params.key?("transfer")
-                result = @lifecycle.dispatch(request: request, peer: peer, role: role)
-              end
-              wire.write(socket, {"status" => "ok", "data" => result.fetch(:data),
-                "transport" => {"replayed" => result.fetch(:replayed, false)}}, deadline: deadline, limit: 16_384)
-              if binding && binding.fetch(:direction) == :download
-                codec.send(socket, parts: parts, descriptor: descriptor, purpose: binding.fetch(:purpose), deadline: deadline)
-              end
-            end
+            dispatch_request(socket, request, peer, role, deadline, frame_bytes: frame.fetch(:bytesize))
           end
         rescue ArgumentError, KeyError, AttemptErrors::MalformedTransfer
           refusal(socket, "invalid_input")
@@ -255,45 +122,9 @@ module Ace
           end
         end
 
-        # These closed read operations have no request body. Half-close proves
-        # framing completion before status or artifact data can be exposed.
-        def bodyless_read!(socket, deadline)
-          loop do
-            remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
-            raise ArgumentError, "read request framing is incomplete" unless remaining.positive? && IO.select([socket], nil, nil, remaining)
-            bytes = socket.read_nonblock(1, exception: false)
-            next if bytes == :wait_readable
-            raise ArgumentError, "unexpected read request body" unless bytes.nil?
-            return
-          end
-        end
-
-        def transfer_codec
-          @mutex.synchronize do
-            @transfer_codec ||= begin
-              root = @service.fetch("state_root")
-              PrivateDirectory.verify!(root)
-              spool = File.join(root, "transfers")
-              Dir.mkdir(spool, 0o700) unless File.exist?(spool) || File.symlink?(spool)
-              TransferCodec.new(root: spool)
-            end
-          end
-        end
-
         def principal?(identity, mapping, uid, gid, groups)
           identity["uid"] == mapping[uid] && identity["gid"] == mapping[gid] && identity["groups"] == mapping[groups]
         end
-
-        def refusal(socket, code)
-          wire.write(socket, {"status" => "error", "error" => {"code" => code, "message" => "Protected authority refused #{code}"}},
-            deadline: wire.deadline(0.1))
-        rescue StandardError
-          nil
-        end
-
-        def wire
-          Ace::Runtime::Molecules::ProtectedSocket
-        end
       end
     end
   end

data/lib/ace/assign/authority/socket_server.rb

@@ -0,0 +1,255 @@
+# frozen_string_literal: true
+
+require "socket"
+require "fileutils"
+require_relative "transfer_codec"
+require_relative "../molecules/evidence_journal"
+
+module Ace
+  module Assign
+    module Authority
+      # Shared endpoint lifetime and bounded wire protocol. Concrete source
+      # compositions authenticate their own installed principals before dispatch.
+      # Protected deployment/kernel requirements remain in Server.
+      class SocketServer
+        CONNECTIONS = 16
+
+        def initialize(service:, lifecycle:, services: [])
+          unless services.is_a?(Array) && services.uniq.size == services.size &&
+              services.all? { |owned| owned.respond_to?(:run) && owned.respond_to?(:stop) }
+            raise ArgumentError, "authority services require distinct source-owned run/stop lifetimes"
+          end
+          @service, @lifecycle, @services = service, lifecycle, services.dup.freeze
+          @service_threads = []
+          @activation_gates = []
+          @mutex = Mutex.new
+          @connections = []
+          @handlers = []
+          @transfers = 0
+          @stopped = false
+        end
+
+        def serve
+          verify_listener!
+          directory = File.dirname(@service.fetch("socket_path"))
+          wire.root_path!(directory, directory: true, owner: @service.fetch("uid"))
+          lock = File.open(File.join(directory, "listener.lock"), File::RDWR | File::CREAT | File::NOFOLLOW, 0o600)
+          unless lock.flock(File::LOCK_EX | File::LOCK_NB)
+            raise AttemptErrors::Conflict, "assignment authority already owns its listener"
+          end
+          path = @service.fetch("socket_path")
+          if File.exist?(path) || File.symlink?(path)
+            raise AttemptErrors::Conflict, "existing authority endpoint requires verified installer recovery"
+          end
+          @listener = UNIXServer.new(path)
+          @endpoint = wire.socket_identity(path)
+          File.chmod(0o660, path)
+          start_services!
+          verify_services!
+          @activation_gates.each { |gate| gate << :activate }
+          until @stopped
+            verify_services!
+            ready = IO.select([@listener], nil, nil, 0.25)
+            next unless ready
+            socket = @listener.accept_nonblock(exception: false)
+            next if socket == :wait_readable
+            admitted = @mutex.synchronize do
+              if @connections.size < CONNECTIONS
+                @connections << socket
+                true
+              end
+            end
+            unless admitted
+              refusal(socket, "busy")
+              socket.close
+              next
+            end
+            @mutex.synchronize do
+              @handlers.reject! { |handler| !handler.alive? }
+              @handlers << Thread.new(socket) { |connection| receive(connection) }
+            end
+          end
+        rescue IOError, Errno::EBADF
+          raise unless @stopped
+        ensure
+          begin
+            stop
+            stop_services!
+          ensure
+            # Closing a stream does not cancel an admitted transaction. Hold
+            # the owner lock and endpoint until every handler has ended.
+            begin
+              @mutex.synchronize { @handlers.dup }.each(&:join)
+              @lifecycle.close if @endpoint && @lifecycle.respond_to?(:close)
+            ensure
+              begin
+                File.unlink(path) if @endpoint && same_endpoint?(path)
+              ensure
+                lock&.close
+              end
+            end
+          end
+        end
+
+        def request_stop
+          @stopped = true
+        end
+
+        def stop
+          @stopped = true
+          @listener&.close unless @listener&.closed?
+          @mutex.synchronize { @connections.each { |socket| socket.close unless socket.closed? } }
+        end
+
+        private
+
+        # Installed HITL and merge listeners share the assignment owner lock.
+        # Every selected boundary must be ready before assignment ingress opens;
+        # a stopped boundary closes admission until the complete owner restarts.
+        def start_services!
+          @services.each do |owned|
+            ready = Queue.new
+            activation = Queue.new
+            @activation_gates << activation
+            thread = Thread.new do
+              owned.run(on_ready: lambda do
+                ready << :ready
+                unless activation.pop == :activate
+                  raise Ace::Runtime::RuntimeUnavailableError, "authority startup was cancelled"
+                end
+              end)
+            rescue Exception => error
+              ready << error
+            ensure
+              ready << :stopped
+            end
+            thread.report_on_exception = false
+            @service_threads << [owned, thread]
+            result = ready.pop(timeout: 5)
+            raise Ace::Runtime::RuntimeUnavailableError, "authority service startup did not become ready" unless result == :ready || result.is_a?(Exception)
+            raise result if result.is_a?(Exception)
+          end
+        end
+
+        def verify_services!
+          unless @service_threads.all? { |_, thread| thread.alive? }
+            raise Ace::Runtime::RuntimeUnavailableError, "an owned service stopped before its authority"
+          end
+        end
+
+        def stop_services!
+          errors = []
+          @activation_gates.each { |gate| gate << :cancel }
+          @service_threads.reverse_each do |owned, _|
+            owned.stop
+          rescue Exception => error
+            errors << error
+          end
+          @service_threads.each do |_, thread|
+            thread.join
+          rescue Exception => error
+            errors << error
+          end
+          raise errors.first unless errors.empty?
+        end
+
+        def same_endpoint?(path)
+          wire.socket_identity(path) == @endpoint
+        rescue StandardError
+          false
+        end
+
+        def verify_listener!
+          raise NotImplementedError, "source composition must verify its installed listener"
+        end
+
+        def dispatch_request(socket, request, peer, role, deadline, frame_bytes:)
+          params = request.fetch("params")
+          admitted_transfer = false
+          Molecules::EvidenceJournal.with_event_read_operation do
+            binding = @lifecycle.transfer_binding(request) if @lifecycle.respond_to?(:transfer_binding)
+            if binding
+              raise AttemptErrors::UnauthorizedIdentity, "transfer role differs" unless binding.fetch(:roles).include?(role)
+              raise ArgumentError, "transfer control header is oversized" if frame_bytes > 16_384
+              authorize_transfer!(request: request, peer: peer, role: role, deadline: deadline)
+              admitted_transfer = @mutex.synchronize do
+                if @transfers < 2
+                  @transfers += 1
+                  true
+                end
+              end
+              raise AttemptErrors::Conflict, "transfer capacity is busy" unless admitted_transfer
+              codec = transfer_codec
+              if binding.fetch(:direction) == :upload
+                result = codec.receive(socket, descriptor: params.fetch("transfer"), purpose: binding.fetch(:purpose), deadline: deadline) do |input|
+                  dispatch_lifecycle(request: request, peer: peer, role: role, transfer: input, deadline: deadline)
+                end
+              else
+                result = dispatch_lifecycle(request: request, peer: peer, role: role, deadline: deadline)
+                parts = result.fetch(:transfer_parts)
+                descriptor = codec.descriptor(parts, purpose: binding.fetch(:purpose))
+                result = result.merge(data: result.fetch(:data).merge("transfer" => descriptor))
+              end
+            else
+              raise ArgumentError, "unexpected transfer descriptor" if params.key?("transfer")
+              result = dispatch_lifecycle(request: request, peer: peer, role: role, deadline: deadline)
+            end
+            wire.write(socket, {"status" => "ok", "data" => result.fetch(:data),
+              "transport" => {"replayed" => result.fetch(:replayed, false)}}, deadline: deadline, limit: 16_384)
+            if binding && binding.fetch(:direction) == :download
+              codec.send(socket, parts: parts, descriptor: descriptor, purpose: binding.fetch(:purpose), deadline: deadline)
+            end
+          end
+        ensure
+          @mutex.synchronize { @transfers -= 1 } if admitted_transfer
+        end
+
+        def authorize_transfer!(request:, peer:, role:, deadline:)
+          @lifecycle.authorize_transfer!(request: request, peer: peer, role: role)
+        end
+
+        def dispatch_lifecycle(request:, peer:, role:, deadline:, transfer: nil)
+          options = {request: request, peer: peer, role: role}
+          options[:transfer] = transfer if transfer
+          @lifecycle.dispatch(**options)
+        end
+
+        # These closed read operations have no request body. Half-close proves
+        # framing completion before status or artifact data can be exposed.
+        def bodyless_read!(socket, deadline)
+          loop do
+            remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+            raise ArgumentError, "read request framing is incomplete" unless remaining.positive? && IO.select([socket], nil, nil, remaining)
+            bytes = socket.read_nonblock(1, exception: false)
+            next if bytes == :wait_readable
+            raise ArgumentError, "unexpected read request body" unless bytes.nil?
+            return
+          end
+        end
+
+        def transfer_codec
+          @mutex.synchronize do
+            @transfer_codec ||= begin
+              root = @service.fetch("state_root")
+              PrivateDirectory.verify!(root)
+              spool = File.join(root, "transfers")
+              Dir.mkdir(spool, 0o700) unless File.exist?(spool) || File.symlink?(spool)
+              TransferCodec.new(root: spool)
+            end
+          end
+        end
+
+        def refusal(socket, code)
+          wire.write(socket, {"status" => "error", "error" => {"code" => code, "message" => "Protected authority refused #{code}"}},
+            deadline: wire.deadline(0.1))
+        rescue StandardError
+          nil
+        end
+
+        def wire
+          Ace::Runtime::Molecules::ProtectedSocket
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/transfer_codec.rb

@@ -16,7 +16,7 @@ module Ace
         LIMITS = {prompt_text: [16_384, 1, 16_384], scope_boundary_observation: [65_536, 1, 65_536], candidate: [64 * 1024 * 1024, 1, 64 * 1024 * 1024],
                   artifacts: [256 * 1024, 16, 64 * 1024],
                   receipt_artifacts: [272 * 1024, 17, 64 * 1024],
-                  service_input: [64 * 1024, 1, 64 * 1024]}.freeze
+                  service_input: [64 * 1024, 1, 64 * 1024], assignment_snapshot: [64 * 1024 * 1024, 1, 64 * 1024 * 1024]}.freeze
         SHA256 = /\A[0-9a-f]{64}\z/
 
         class Input
@@ -149,7 +149,7 @@ module Ace
                 part["bytes"].is_a?(Integer) && part["bytes"].between?(0, each) &&
                 part["sha256"].is_a?(String) && part["sha256"].match?(SHA256) } &&
               descriptor["bytes"] == descriptor["parts"].sum { |part| part["bytes"] } &&
-              (!%i[candidate service_input prompt_text].include?(purpose) || descriptor["bytes"].positive?)
+              (!%i[candidate service_input prompt_text assignment_snapshot].include?(purpose) || descriptor["bytes"].positive?)
             reject!("Invalid or oversized transfer descriptor")
           end
           if purpose == :receipt_artifacts

data/lib/ace/assign/cli/commands/attempt/evidence.rb

@@ -7,12 +7,12 @@ module Ace
         module Attempt
           class Evidence < Ace::Support::Cli::Command
             include Attempt::Base
-            desc "Read coordinator-accepted live execution or historical review authority"
+            desc "Read coordinator-accepted live execution or historical execution authority"
             option :attempt, required: true, desc: "Accepted execution attempt ID"
             option :receipt_digest, required: true, desc: "Accepted receipt digest"
             option :kind, default: "check", desc: "Evidence purpose: check, review-collection or review-approval"
             option :check_name, default: "tests", desc: "Required check name (tests binds operation test)"
-            option :historical_head, desc: "Recorded collection/approval head for historical authority only"
+            option :historical_head, desc: "Exact recorded head for historical authority only (never current-head evidence)"
             option :format, default: "json", desc: "JSON evidence projection"
 
             def call(**options)

data/lib/ace/assign/molecules/canonical_read_commands.rb

@@ -0,0 +1,84 @@
+# frozen_string_literal: true
+
+module Ace
+  module Assign
+    module Molecules
+      # Closed bounded read dialect shared by isolated protected snapshots and
+      # trusted installed journals. Neither boundary can dispatch a Git write.
+      module CanonicalReadCommands
+        BYTE_LIMIT = 256 * 1_048_576
+        OID = /\A[0-9a-f]{40}\z/
+
+        attr_reader :commit
+
+        # EvidenceJournal uses this only as its existing read command boundary.
+        def call(argv, stdin_data: "", output_limit: BYTE_LIMIT)
+          refuse!("read_outside_snapshot") unless @view && @commit
+          unless read_command?(argv, stdin_data)
+            refuse!("write_or_unsupported_command")
+          end
+          result = read_result(argv, stdin_data: stdin_data, limit: [output_limit, BYTE_LIMIT].min)
+          [result.stdout.to_s.strip, result.stderr.to_s.strip, result.status]
+        end
+
+        def blob_batch(entries, output_limit:)
+          refuse!("read_outside_snapshot") unless @view && @commit
+          unless entries.is_a?(Array) && entries.all? { |oid| oid.is_a?(String) && oid.match?(OID) }
+            refuse!("unsupported_command")
+          end
+          result = run!(["cat-file", "--batch"], stdin_data: entries.join("\n") + "\n",
+            limit: [output_limit, BYTE_LIMIT].min)
+          result.stdout.to_s.b
+        end
+
+        def history_diff(commits, paths, output_limit:)
+          refuse!("read_outside_snapshot") unless @view && @commit
+          unless commits.is_a?(Array) && commits.size.between?(1, 64) && commits.uniq.size == commits.size &&
+              commits.all? { |commit| commit.is_a?(String) && commit.match?(OID) } &&
+              paths.is_a?(Array) && !paths.empty? && paths.uniq.size == paths.size &&
+              (paths == ["execution/"] || paths.all? { |path| path.is_a?(String) && path.match?(%r{\Aexecution/[a-zA-Z0-9_.:-]+/events/\z}) }) &&
+              output_limit.is_a?(Integer) && output_limit.positive?
+            refuse!("unsupported_command")
+          end
+          result = run!(%w[diff-tree --stdin --always --root -r --raw -z --no-renames --no-ext-diff
+            --no-textconv --no-abbrev --] + paths, stdin_data: commits.join("\n") + "\n",
+            limit: [output_limit, BYTE_LIMIT].min)
+          result.stdout.to_s.b
+        end
+
+        def blob_sizes(oids)
+          refuse!("read_outside_snapshot") unless @view && @commit
+          unless oids.is_a?(Array) && oids.size.between?(1, 64) && oids.all? { |oid| oid.is_a?(String) && oid.match?(OID) }
+            refuse!("unsupported_command")
+          end
+          run!(%w[cat-file --batch-check], stdin_data: oids.join("\n") + "\n", limit: oids.size * 128).stdout.to_s.b
+        end
+
+        def blob(path, commit:, max_bytes:)
+          refuse!("read_outside_snapshot") unless @view && @commit
+          unless commit.is_a?(String) && commit.match?(OID) && max_bytes.is_a?(Integer) && max_bytes.positive?
+            refuse!("unsupported_command")
+          end
+          result = run!(["cat-file", "blob", "#{commit}:#{path}"], limit: [max_bytes, BYTE_LIMIT].min)
+          result.stdout.to_s.b
+        end
+
+        private
+
+        def read_result(argv, **options)
+          run!(argv, **options)
+        end
+
+        def read_command?(argv, stdin)
+          return false unless argv.is_a?(Array) && argv.all? { |item| item.is_a?(String) && !item.include?("\0") } && stdin.empty?
+          allowed = {"rev-parse" => %w[--verify --quiet --git-dir], "cat-file" => %w[-t -s blob],
+            "rev-list" => %w[--first-parent --parents], "ls-tree" => %w[-r -l -d --name-only --],
+            "show" => [], "log" => %w[--diff-filter=A -1 --format=%H --]}
+          flags = allowed[argv.first]
+          flags && argv.drop(1).all? { |item| !item.start_with?("-") || flags.include?(item) || item == "--max-count=100001" }
+        end
+
+      end
+    end
+  end
+end