ace-assign 0.68.0 → 0.70.0

data/lib/ace/assign/molecules/canonical_read_snapshot.rb

@@ -5,6 +5,7 @@ require "fileutils"
 require "tmpdir"
 require "ace/herdr/molecules/bounded_process"
 require_relative "evidence_journal"
+require_relative "canonical_read_commands"
 require_relative "../authority/private_directory"
 
 module Ace
@@ -13,6 +14,7 @@ module Ace
       # Isolates read-only Git from an installed authority's live configuration.
       # The copied view never publishes evidence or mutates the source journal.
       class CanonicalReadSnapshot
+        include CanonicalReadCommands
         class Unavailable < AttemptErrors::EvidenceUnavailable; end
         BYTE_LIMIT = 256 * 1_048_576
         ENTRY_LIMIT = 4096
@@ -94,60 +96,6 @@ module Ace
         end
         private :with_snapshot
 
-        attr_reader :commit
-
-        # EvidenceJournal uses this only as its existing read command boundary.
-        def call(argv, stdin_data: "", output_limit: BYTE_LIMIT)
-          refuse!("read_outside_snapshot") unless @view && @commit
-          unless read_command?(argv, stdin_data)
-            refuse!("write_or_unsupported_command")
-          end
-          result = run!(argv, stdin_data: stdin_data, limit: [output_limit, BYTE_LIMIT].min)
-          [result.stdout.to_s.strip, result.stderr.to_s.strip, result.status]
-        end
-
-        def blob_batch(entries, output_limit:)
-          refuse!("read_outside_snapshot") unless @view && @commit
-          unless entries.is_a?(Array) && entries.all? { |oid| oid.is_a?(String) && oid.match?(OID) }
-            refuse!("unsupported_command")
-          end
-          result = run!(["cat-file", "--batch"], stdin_data: entries.join("\n") + "\n",
-            limit: [output_limit, BYTE_LIMIT].min)
-          result.stdout.to_s.b
-        end
-
-        def history_diff(commits, paths, output_limit:)
-          refuse!("read_outside_snapshot") unless @view && @commit
-          unless commits.is_a?(Array) && commits.size.between?(1, 64) && commits.uniq.size == commits.size &&
-              commits.all? { |commit| commit.is_a?(String) && commit.match?(OID) } &&
-              paths.is_a?(Array) && !paths.empty? && paths.uniq.size == paths.size &&
-              (paths == ["execution/"] || paths.all? { |path| path.is_a?(String) && path.match?(%r{\Aexecution/[a-zA-Z0-9_.:-]+/events/\z}) }) &&
-              output_limit.is_a?(Integer) && output_limit.positive?
-            refuse!("unsupported_command")
-          end
-          result = run!(%w[diff-tree --stdin --always --root -r --raw -z --no-renames --no-ext-diff
-            --no-textconv --no-abbrev --] + paths, stdin_data: commits.join("\n") + "\n",
-            limit: [output_limit, BYTE_LIMIT].min)
-          result.stdout.to_s.b
-        end
-
-        def blob_sizes(oids)
-          refuse!("read_outside_snapshot") unless @view && @commit
-          unless oids.is_a?(Array) && oids.size.between?(1, 64) && oids.all? { |oid| oid.is_a?(String) && oid.match?(OID) }
-            refuse!("unsupported_command")
-          end
-          run!(%w[cat-file --batch-check], stdin_data: oids.join("\n") + "\n", limit: oids.size * 128).stdout.to_s.b
-        end
-
-        def blob(path, commit:, max_bytes:)
-          refuse!("read_outside_snapshot") unless @view && @commit
-          unless commit.is_a?(String) && commit.match?(OID) && max_bytes.is_a?(Integer) && max_bytes.positive?
-            refuse!("unsupported_command")
-          end
-          result = run!(["cat-file", "blob", "#{commit}:#{path}"], limit: [max_bytes, BYTE_LIMIT].min)
-          result.stdout.to_s.b
-        end
-
         private
 
         def refuse!(reason)
@@ -352,15 +300,6 @@ module Ace
           File.binwrite(ref, "#{@commit}\n")
         end
 
-        def read_command?(argv, stdin)
-          return false unless argv.is_a?(Array) && argv.all? { |item| item.is_a?(String) && !item.include?("\0") } && stdin.empty?
-          allowed = {"rev-parse" => %w[--verify --quiet --git-dir], "cat-file" => %w[-t -s blob],
-            "rev-list" => %w[--first-parent --parents], "ls-tree" => %w[-r -l -d --name-only --],
-            "show" => [], "log" => %w[--diff-filter=A -1 --format=%H --]}
-          flags = allowed[argv.first]
-          flags && argv.drop(1).all? { |item| !item.start_with?("-") || flags.include?(item) || item == "--max-count=100001" }
-        end
-
         def run!(argv, stdin_data: "", limit:)
           result = Herdr::Molecules::BoundedProcess.call([@git, "--git-dir=#{@view}", "--no-pager", *argv],
             environment: ENVIRONMENT, chdir: @view, stdin_data: stdin_data,

data/lib/ace/assign/molecules/evidence_journal.rb

@@ -62,6 +62,7 @@ module Ace
         def initialize(repo_root:, ref: nil, checkout_root: nil, mode: :local,
           evidence_reader: nil, service_authorizer: nil, read_boundary: nil)
           unless %i[local protected].include?(mode) &&
+              (evidence_reader.nil? || evidence_reader.respond_to?(:call)) &&
               (mode != :protected || [evidence_reader, service_authorizer].all? { |owner| owner.respond_to?(:call) })
             raise ArgumentError, "protected journal requires source-owned evidence and service boundaries"
           end
@@ -128,7 +129,7 @@ module Ace
             paths.each do |path|
               parts = path.split("/", -1)
               event = parts.size == 4 && parts[0] == "execution" && parts[2] == "events" && JournalMutation::ID.match?(parts[1]) && parts[3].end_with?(".json")
-              request = parts.size == 3 && parts[0, 2] == %w[execution requests] && parts[2].end_with?(".json") && JournalMutation::ID.match?(parts[2].delete_suffix(".json"))
+              request = parts.size == 3 && [%w[execution requests], %w[execution merge-requests]].include?(parts[0, 2]) && parts[2].end_with?(".json") && JournalMutation::ID.match?(parts[2].delete_suffix(".json"))
               # Definitions, prepared packets, candidate bundles and imports
               # retain the SAME mutation owner's closed immutable blob dialect.
               validate_blob_path!(path) unless event || request
@@ -138,6 +139,12 @@ module Ace
             unless records.map { |record| record.fetch("request_id") }.sort == expected_requests
               raise AttemptErrors::EvidenceUnavailable, "canonical initialization service inventory differs"
             end
+            fixed_records = fixed_merge_request_records(commit: value)
+            expected_fixed = paths.select { |path| path.start_with?("execution/merge-requests/") }.map { |path| File.basename(path, ".json") }.sort
+            unless fixed_records.map { |record| record.fetch("request_id") }.sort == expected_fixed
+              raise AttemptErrors::EvidenceUnavailable, "canonical initialization fixed merge inventory differs"
+            end
+            fixed_records.each { |record| verify_fixed_record!(record, commit: value) }
             current = File.stat(@repo_root)
             unless !File.symlink?(@repo_root) && [current.dev, current.ino, current.uid, current.gid, current.mode] == identity && ref_value == value
               raise AttemptErrors::EvidenceUnavailable, "canonical initialization selection changed"
@@ -201,6 +208,21 @@ module Ace
           event_commits_for_assignments!(selectors: {assignment_id => event_digests}, commit: commit).fetch(assignment_id)
         end
 
+        # Cross-attempt projections use canonical publication order, never the
+        # wall-clock timestamps of independently chained attempts. Exactly one
+        # selected event must have been introduced by the latest relevant CAS.
+        def latest_event!(assignment_id:, event_digests:, commit:)
+          introductions = event_commits!(assignment_id: assignment_id, event_digests: event_digests, commit: commit)
+          introduced_commits = introductions.values.to_h { |value| [value, true] }
+          node = canonical_history_nodes!(commit).find { |entry| introduced_commits.key?(entry.first) }
+          selected = node && introductions.select { |_digest, introduced| introduced == node.first }.keys
+          unless selected&.one?
+            raise AttemptErrors::EvidenceUnavailable, "latest canonical event is missing or ambiguous"
+          end
+          read_events(assignment_id, commit: commit).find { |event| event.fetch("digest") == selected.first } ||
+            raise(AttemptErrors::EvidenceUnavailable, "latest canonical event is unavailable")
+        end
+
         # One immutable walk for an operation selecting several assignments.
         # Every selected assignment retains its complete chain and exact raw
         # blob proof; the result is returned, never cached on this owner.
@@ -760,7 +782,9 @@ module Ace
           %w[succeeded failed failed-settled].include?(state)
         end
 
-        def validate_terminal_receipt!(current, state, receipt, pending: nil)
+        # Shared schema/binding checks; storage interpretation belongs to the
+        # caller's source-selected evidence owner, not this pure validator.
+        def validate_terminal_receipt_structure!(current, state, receipt)
           unless receipt.is_a?(Hash) && receipt.keys.sort == TERMINAL_RECEIPT_FIELDS.sort
             raise AttemptErrors::ReceiptRejected,
               "Service terminal receipt has invalid fields"
@@ -787,7 +811,14 @@ module Ace
             raise AttemptErrors::ReceiptRejected,
               "Service settlement requires a no-effect attestation artifact"
           end
-          if @mode == :protected
+          evidence_items
+        end
+
+        def validate_terminal_receipt!(current, state, receipt, pending: nil)
+          evidence_items = validate_terminal_receipt_structure!(current, state, receipt)
+          # Canonical byte ownership is also usable by the ordinary installed
+          # service. It does not opt that service into protected authority.
+          if @evidence_reader
             if (current["operation"] == "prune-preserved-workspace" && %w[succeeded failed-settled].include?(state)) ||
                 (current["operation"] == "publish" && %w[succeeded failed].include?(state))
               # The same installed evidence reader owns the entire imported
@@ -922,6 +953,9 @@ module Ace
         def authorization_conflict(binding)
           authorization = binding["authorization"]
           return nil unless authorization.is_a?(String) && !authorization.empty?
+          if authorization.start_with?("proposal-")
+            return proposal_claim_conflict(authorization, request_id: binding.fetch("request_id"), fixed: false)
+          end
           service_request_records.find do |other|
             next false if other["request_id"] == binding.fetch("request_id")
             next false if other["state"] == "rejected" && other["consumed"] == false
@@ -994,8 +1028,8 @@ module Ace
         #
         # @param assignment_id [String] Assignment ID
         # @return [Array<Models::Attempt>] Derived attempts
-        def derived_attempts(assignment_id)
-          events = read_events(assignment_id)
+        def derived_attempts(assignment_id, commit: ref_value)
+          events = read_events(assignment_id, commit: commit)
           by_attempt = events.group_by { |event| event["attempt_id"] }
           by_attempt.delete(nil)
 
@@ -1006,7 +1040,7 @@ module Ace
             state = derive_state(attempt_events)
             next if state.nil?
 
-            build_attempt(assignment_id, attempt_id, intent["payload"], attempt_events, state)
+            build_attempt(assignment_id, attempt_id, intent["payload"], attempt_events, state, commit: commit)
           end
         end
 
@@ -1271,7 +1305,7 @@ module Ace
         # opaque reference is receiver-issued, never caller-supplied, and
         # replays return the originally issued one.
         FIXED_MERGE_BINDING_FIELDS = %w[request_id project_id assignment_id attempt_id
-          queue_entry operation authorization input_digest request principal receiver_id
+          queue_entry operation authorization input_digest request principal caller_uid receiver_id
           configuration_sha256 execution_identity].freeze
         FIXED_MERGE_MUTABLE_FIELDS = %w[state receipt reference recorded_at claimed_at finished_at].freeze
 
@@ -1324,25 +1358,27 @@ module Ace
 
         # Claim the start of the fixed effect: pending -> uncertain in one
         # CAS transition, so a receiver restart can never dispatch a second
-        # merge for the same admitted record — begin replays as already
-        # started, and only the owning effect may later settle it.
+        # merge for the same admitted record. An already-started claim refuses;
+        # only the winning effect may later settle it.
         def begin_fixed_merge_request(request_id)
           current = fixed_merge_request(request_id)
           raise AttemptErrors::NotFound, "Fixed merge request #{request_id} not found" unless current
-          return current if current["state"] == "uncertain"
+          if current["state"] == "uncertain"
+            raise AttemptErrors::InvalidState, "Fixed merge request #{request_id} was already started"
+          end
           unless current["state"] == "pending"
             raise AttemptErrors::InvalidState, "Fixed merge request #{request_id} is terminal"
           end
           update_fixed_merge_request(request_id, expected: current,
             replacement: current.merge("state" => "uncertain", "claimed_at" => Time.now.utc.iso8601(9)),
-            event_type: "merge_transition")
+            event_type: "merge_transition", guard: -> { verify_fixed_proposal!(current) })
         end
 
         # Terminal settlement: succeeded/failed with the exact receipt
         # validated HERE at the journal boundary — structure, the closed
         # terminal invariants, and the binding against the current record.
         # Failure is terminal only with immutable no-effect evidence.
-        def settle_fixed_merge_request(request_id, terminal_status:, receipt:)
+        def settle_fixed_merge_request(request_id, terminal_status:, receipt:, attestation: nil)
           unless FIXED_MERGE_STATES.include?(terminal_status) && %w[succeeded failed].include?(terminal_status)
             raise ArgumentError, "invalid fixed merge terminal status"
           end
@@ -1351,17 +1387,40 @@ module Ace
           unless %w[pending uncertain].include?(current["state"])
             raise AttemptErrors::InvalidState, "Fixed merge request #{request_id} is terminal"
           end
+          evidence_files = {}
+          if terminal_status == "failed"
+            unless attestation.is_a?(Hash) &&
+                attestation.values_at("request_id", "input_digest", "reference", "outcome") ==
+                  current.values_at("request_id", "input_digest", "reference") + ["no_effect"] &&
+                attestation["candidate_head"] == current.dig("request", "candidate_head") &&
+                attestation["expected_base_head"] == current.dig("request", "expected_base_head")
+              raise AttemptErrors::ReceiptRejected, "Fixed merge no_effect_evidence requires a bound canonical attestation"
+            end
+            content = JSON.generate(attestation)
+            raise AttemptErrors::ReceiptRejected, "Fixed merge attestation exceeds bound" if content.bytesize > 16_384
+            path = fixed_no_effect_path(request_id)
+            evidence_files[path] = content
+            receipt = receipt.merge("effect" => receipt.fetch("effect").merge(
+              "no_effect_evidence" => {"reference" => path, "sha256" => Digest::SHA256.hexdigest(content)}))
+          elsif attestation
+            raise AttemptErrors::ReceiptRejected, "Successful merge cannot carry no-effect attestation"
+          end
           validate_fixed_receipt!(current, terminal_status, receipt)
           update_fixed_merge_request(request_id, expected: current,
             replacement: current.merge("state" => terminal_status, "receipt" => receipt,
               "finished_at" => Time.now.utc.iso8601(9)),
-            event_type: "merge_transition")
+            event_type: "merge_transition", evidence_files: evidence_files)
         end
 
         def fixed_merge_request_path(request_id)
           "execution/merge-requests/#{request_id}.json"
         end
 
+        def fixed_no_effect_path(request_id)
+          validate_request_id!(request_id)
+          "execution/merge-evidence/#{request_id}.json"
+        end
+
         def validate_fixed_receipt!(current, terminal_status, receipt)
           Atoms::FixedMergeSchemas.validate_receipt!(receipt)
           Atoms::FixedMergeSchemas.validate_receipt_against!(receipt, current)
@@ -1388,25 +1447,39 @@ module Ace
           end
         end
 
-        def fixed_no_effect_intact?(record)
+        def fixed_no_effect_intact?(record, commit: ref_value)
           receipt = record["receipt"]
           return false unless receipt.is_a?(Hash)
           evidence = receipt.dig("effect", "no_effect_evidence")
           return false unless evidence.is_a?(Hash)
-          repo_root = File.realpath(@repo_root)
-          path = File.expand_path(evidence["reference"].to_s, repo_root)
-          real = begin
-            File.realpath(path)
-          rescue Errno::ENOENT, Errno::EACCES, Errno::ELOOP
-            return false
-          end
-          real.start_with?(repo_root + File::SEPARATOR) &&
-            Digest::SHA256.file(real).hexdigest == evidence.fetch("sha256")
-        rescue Errno::ENOENT, AttemptErrors::EvidenceUnavailable
+          path = fixed_no_effect_path(record.fetch("request_id"))
+          return false unless evidence["reference"] == path
+          content = bounded_blob(path, commit: commit, max_bytes: 16_384)
+          proof = JSON.parse(content)
+          Digest::SHA256.hexdigest(content) == evidence["sha256"] &&
+            proof.values_at("request_id", "input_digest", "reference", "outcome") == record.values_at("request_id", "input_digest", "reference") + ["no_effect"] &&
+            proof["candidate_head"] == record.dig("request", "candidate_head") && proof["expected_base_head"] == record.dig("request", "expected_base_head")
+        rescue AttemptErrors::EvidenceUnavailable, JSON::ParserError, NoMethodError
           false
         end
 
-        def update_fixed_merge_request(request_id, expected:, replacement:, event_type:, guard: nil)
+        # Immutable terminal consumption for ordinary completion. It uses the
+        # same receipt and no-effect owners as admission/authorization release.
+        def fixed_merge_settlement!(request_id, commit: ref_value)
+          record = fixed_merge_request(request_id, commit: commit)
+          raise AttemptErrors::EvidenceUnavailable, "canonical fixed merge is missing" unless record
+          verify_fixed_record!(record, commit: commit)
+          unless %w[succeeded failed].include?(record["state"])
+            raise AttemptErrors::ServiceSettlementPending, "canonical fixed merge is unresolved"
+          end
+          validate_fixed_receipt!(record, record.fetch("state"), record.fetch("receipt"))
+          if record["state"] == "failed" && !fixed_no_effect_intact?(record, commit: commit)
+            raise AttemptErrors::EvidenceUnavailable, "canonical fixed merge no-effect proof differs"
+          end
+          record
+        end
+
+        def update_fixed_merge_request(request_id, expected:, replacement:, event_type:, guard: nil, evidence_files: {})
           unless %w[merge_admission merge_transition].include?(event_type)
             raise ArgumentError, "invalid fixed merge event type"
           end
@@ -1419,10 +1492,8 @@ module Ace
               prepared = prepare_fixed_update(request_id: request_id, expected: expected,
                 replacement: replacement, event_type: event_type, guard: guard)
               return prepared.fetch(:record) if prepared[:replayed]
+              write_mutation_blobs(evidence_files, commit: old)
               path = fixed_merge_request_path(request_id)
-              full = File.join(checkout_dir, path)
-              FileUtils.mkdir_p(File.dirname(full))
-              File.write(full, JSON.pretty_generate(prepared.fetch(:record)))
               assignment_id = replacement.fetch("assignment_id")
               attempt_id = replacement.fetch("attempt_id")
               prior = read_events(assignment_id).reverse
@@ -1430,7 +1501,8 @@ module Ace
               event = Models::EvidenceEvent.build(type: event_type, attempt_id: attempt_id,
                 payload: prepared.fetch(:event).fetch(:payload), previous_digest: prior)
               write_event_files(assignment_id, [event])
-              git!("-C", checkout_dir, "add", "--", path, "execution/#{assignment_id}/events")
+              git!("-C", checkout_dir, "add", "--", "execution/#{assignment_id}/events")
+              stage_mutation_blobs(evidence_files.merge(path => JSON.pretty_generate(prepared.fetch(:record))))
               state = replacement.fetch("state")
               git!("-C", checkout_dir, "-c", "user.name=ace-assign", "-c", "user.email=ace-assign@localhost",
                 "commit", "-m", "evidence: fixed merge request #{request_id} #{state}")
@@ -1477,6 +1549,13 @@ module Ace
           end
           conflict = guard&.call
           raise_authorization_conflict!(conflict) if conflict
+          if expected.nil? || replacement["state"] == "uncertain"
+            attempt = derived_attempts(replacement.fetch("assignment_id")).find { |item| item.attempt_id == replacement.fetch("attempt_id") }
+            unless attempt&.managed? && attempt.active? && attempt.binding.project_id == replacement.fetch("project_id")
+              raise AttemptErrors::ReceiptRejected, "Fixed merge admission requires its current active canonical attempt"
+            end
+          end
+          verify_fixed_proposal!(replacement) if event_type == "merge_admission"
           payload = {"request_id" => request_id, "state" => replacement.fetch("state"),
                      "input_digest" => replacement.fetch("input_digest"),
                      "record_digest" => Atoms::EvidenceDigest.digest(replacement),
@@ -1485,6 +1564,21 @@ module Ace
         end
         private :prepare_fixed_update
 
+        def verify_fixed_proposal!(record)
+          return unless record.fetch("authorization").start_with?("proposal-")
+          proposal_authorize!(record.fetch("authorization"), fixed_proposal_binding(record))
+          conflict = proposal_claim_conflict(record.fetch("authorization"),
+            request_id: record.fetch("request_id"), fixed: true)
+          raise AttemptErrors::AuthorizationConflict, "Proposal already holds an effect claim" if conflict
+          nil
+        end
+
+        def fixed_proposal_binding(record)
+          record.slice("operation", "project_id", "assignment_id", "attempt_id", "input_digest", "caller_uid").merge(
+            "target" => {"resource" => record.fetch("request").fetch("pr_url"), "artifact_digest" => nil},
+            "candidate_head" => record.fetch("request").fetch("candidate_head"))
+        end
+
         def fixed_replay?(existing, replacement)
           FIXED_MERGE_BINDING_FIELDS.all? do |field|
             existing[field] == replacement.fetch(field)
@@ -1514,7 +1608,8 @@ module Ace
         # The module marks a private region above; the fixed merge primitive
         # is a public coordinator-facing surface, so it is re-published here.
         public :fixed_merge_request, :fixed_merge_request_records, :admit_fixed_merge_request,
-          :begin_fixed_merge_request, :settle_fixed_merge_request, :fixed_authorization_conflict
+          :begin_fixed_merge_request, :settle_fixed_merge_request, :fixed_authorization_conflict, :fixed_merge_settlement!,
+          :verify_service_attestation!
 
         # Latest lifecycle state implied by the events, or nil when the
         # events do not describe a full attempt (intent missing).
@@ -1522,7 +1617,7 @@ module Ace
           CanonicalAttemptState.derive(events)
         end
 
-        def build_attempt(assignment_id, attempt_id, intent_payload, events, state)
+        def build_attempt(assignment_id, attempt_id, intent_payload, events, state, commit: ref_value)
           process_start = events.reverse.find do |event|
             event["type"] == "process_start" && event["attempt_id"] == attempt_id
           end
@@ -1552,7 +1647,7 @@ module Ace
             binding: binding,
             state: state,
             candidate_head: candidate_head,
-            journal_commit: ref_value
+            journal_commit: commit
           )
         end
 
@@ -1658,7 +1753,7 @@ module Ace
           File.join(@checkout_root, ".evidence.lock")
         end
 
-        def with_lock(cleanup_on_failure: true, owner_uid: nil, owner_gid: nil)
+        def with_lock(cleanup_on_failure: true, owner_uid: nil, owner_gid: nil, deadline: nil)
           raise AttemptErrors::EvidenceUnavailable, "read-only journal cannot mutate canonical evidence" if @read_boundary
           FileUtils.mkdir_p(@checkout_root)
           lock = if owner_uid
@@ -1667,7 +1762,19 @@ module Ace
             File.open(lock_path, File::RDWR | File::CREAT, 0o600)
           end
           begin
-            lock.flock(File::LOCK_EX)
+            if deadline
+              unless deadline.is_a?(Numeric) && deadline.finite?
+                raise ArgumentError, "canonical lock deadline must be finite"
+              end
+              loop do
+                remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+                raise AttemptErrors::Conflict, "canonical journal lock deadline elapsed" unless remaining.positive?
+                break if lock.flock(File::LOCK_EX | File::LOCK_NB)
+                sleep [remaining, 0.01].min
+              end
+            else
+              lock.flock(File::LOCK_EX)
+            end
             begin
               yield
             rescue

data/lib/ace/assign/molecules/installed_journal_read.rb

@@ -0,0 +1,143 @@
+# frozen_string_literal: true
+
+require "ace/herdr/molecules/bounded_process"
+require_relative "evidence_journal"
+require_relative "canonical_read_commands"
+
+module Ace
+  module Assign
+    module Molecules
+      # Read the installed owner's immutable Git objects without opening its
+      # private writer lock/cache, copying the repository, or contacting it.
+      # Source selection is supplied only by verified installation policy.
+      class InstalledJournalRead
+        include CanonicalReadCommands
+        ENVIRONMENT = {"PATH" => "/usr/bin:/bin", "LC_ALL" => "C",
+          "GIT_CONFIG_NOSYSTEM" => "1", "GIT_CONFIG_SYSTEM" => "/dev/null",
+          "GIT_CONFIG_GLOBAL" => "/dev/null", "GIT_TERMINAL_PROMPT" => "0",
+          "GIT_ALLOW_PROTOCOL" => "", "GIT_NO_REPLACE_OBJECTS" => "1",
+          "GIT_NO_LAZY_FETCH" => "1", "GIT_OPTIONAL_LOCKS" => "0"}.freeze
+        ENTRY_LIMIT = 100_000
+
+        def initialize(repo_root:, ref:, owner_uid:)
+          unless repo_root.is_a?(String) && repo_root.start_with?("/") &&
+              !repo_root.include?("\0") && File.expand_path(repo_root) == repo_root &&
+              ref.is_a?(String) && ref.match?(%r{\Arefs/[a-zA-Z0-9_-]+(?:/[a-zA-Z0-9_-]+)+\z}) &&
+              owner_uid.is_a?(Integer) && owner_uid.positive?
+            raise ArgumentError, "installed journal selection is malformed"
+          end
+          @repo_root, @ref, @owner_uid = repo_root.dup.freeze, ref.dup.freeze, owner_uid
+          @mutex = Mutex.new
+        end
+
+        def with(deadline:)
+          refuse!("read_busy") unless @mutex.try_lock
+          begin
+            @deadline = deadline
+            remaining
+            verify_source!
+            @view = File.join(@repo_root, ".git")
+            @commit = run!(["rev-parse", "--verify", @ref], limit: 128).stdout.strip
+            refuse!("ref_unavailable") unless @commit.match?(OID)
+            result = yield self
+            verify_source!
+            result
+          ensure
+            @view = @commit = @deadline = nil
+            @mutex.unlock
+          end
+        rescue SystemCallError, IOError, Timeout::Error, Herdr::Molecules::BoundedProcess::PostLaunchError
+          refuse!("source_unavailable")
+        end
+
+        private
+
+        def refuse!(reason)
+          raise AttemptErrors::EvidenceUnavailable, "installed journal read unavailable: #{reason}"
+        end
+
+        def remaining
+          refuse!("deadline") unless @deadline.is_a?(Numeric) && @deadline.finite?
+          value = @deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+          refuse!("deadline") unless value.positive?
+          value
+        end
+
+        def verify_source!
+          # Caller-writable ancestors can replace even a correctly owned leaf.
+          current = File.join(@repo_root, ".git")
+          loop do
+            stat = File.lstat(current)
+            unless stat.directory? && !stat.symlink? && [0, @owner_uid].include?(stat.uid) &&
+                (stat.mode & 0o022).zero?
+              refuse!("storage_owner")
+            end
+            if [@repo_root, File.join(@repo_root, ".git")].include?(current) && stat.uid != @owner_uid
+              refuse!("repository_owner")
+            end
+            break if current == "/"
+            current = File.dirname(current)
+          end
+          %w[commondir shallow reftable info/grafts objects/info/alternates objects/info/http-alternates].each do |name|
+            path = File.join(@repo_root, ".git", name)
+            refuse!("redirected_storage") if File.exist?(path) || File.symlink?(path)
+          end
+          @entries = 0
+          %w[objects refs config HEAD packed-refs].each do |name|
+            path = File.join(@repo_root, ".git", name)
+            next if %w[HEAD packed-refs].include?(name) && !File.exist?(path) && !File.symlink?(path)
+            verify_tree!(path)
+          end
+          verify_config!
+        end
+
+        def verify_tree!(path)
+          remaining
+          @entries += 1
+          refuse!("storage_inventory_limit") if @entries > ENTRY_LIMIT
+          stat = File.lstat(path)
+          unless !stat.symlink? && (stat.file? || stat.directory?) &&
+              [0, @owner_uid].include?(stat.uid) && (stat.mode & 0o022).zero?
+            refuse!("storage_owner")
+          end
+          Dir.each_child(path) { |name| verify_tree!(File.join(path, name)) } if stat.directory?
+        end
+
+        def verify_config!
+          bytes = File.open(File.join(@repo_root, ".git/config"), File::RDONLY | File::NOFOLLOW) { |io| io.read(65_537) }
+          refuse!("config_limit") if bytes.bytesize > 65_536
+          result = Herdr::Molecules::BoundedProcess.call(
+            ["/usr/bin/git", "config", "--no-includes", "--null", "--list", "--file", "/dev/stdin"],
+            environment: ENVIRONMENT, chdir: "/", stdin_data: bytes,
+            timeout_s: remaining, output_limit: 65_536)
+          refuse!("config_unavailable") unless result.status.success? && !result.oversized
+          result.stdout.split("\0").each do |entry|
+            key, value = entry.split("\n", 2)
+            if key.start_with?("include.", "includeif.", "extensions.") || key == "core.worktree" ||
+                key == "core.repositoryformatversion" && value != "0"
+              refuse!("redirected_configuration")
+            end
+          end
+        end
+
+        def read_result(argv, **options)
+          run!(argv, **options, allow_failure: true)
+        end
+
+        def run!(argv, stdin_data: "", limit:, allow_failure: false)
+          # All ref-based reads in one observation use the same immutable tip.
+          selected = argv.map { |arg| arg == @ref && @commit ? @commit : arg }
+          result = Herdr::Molecules::BoundedProcess.call([
+            "/usr/bin/git", "--git-dir=#{@view}", "--no-pager",
+            "-c", "safe.directory=#{@repo_root}", "-c", "core.hooksPath=/dev/null",
+            "-c", "core.fsmonitor=false", "-c", "protocol.allow=never", *selected],
+            environment: ENVIRONMENT, chdir: @repo_root, stdin_data: stdin_data,
+            timeout_s: remaining, output_limit: [limit, BYTE_LIMIT].min, stderr_limit: 65_536)
+          refuse!("resource_limit") if result.oversized
+          refuse!("git_unavailable") unless allow_failure || result.status.success?
+          result
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/molecules/journal_mutation.rb

@@ -34,7 +34,7 @@ module Ace
         # returns events [{type:, payload:}], immutable blobs, and public data.
         # Only the authority calls this internal journal API; wire requests
         # cannot select blob paths, event types, or accepted response data.
-        def mutate(assignment_id:, attempt_id:, mutation_id:, operation:, parameters_digest:, expected_generation:, with_replay: false, generation_mode: :expected, prompt_binding: nil, prompt_completion: nil, prompt_observation: nil, input_inhibition: nil)
+        def mutate(assignment_id:, attempt_id:, mutation_id:, operation:, parameters_digest:, expected_generation:, with_replay: false, generation_mode: :expected, prompt_binding: nil, prompt_completion: nil, prompt_observation: nil, input_inhibition: nil, deadline: nil, replay_authorizer: nil)
           unless (generation_mode == :expected && expected_generation.is_a?(Integer) && expected_generation >= 0) ||
               (generation_mode == :recorded_completion && %w[complete_service complete_no_effect].include?(operation) && expected_generation.nil?) ||
               (generation_mode == :prompt_completion && operation == "prompt_attempt" && expected_generation.nil? && prompt_completion.is_a?(Hash)) ||
@@ -71,7 +71,8 @@ module Ace
           unless parameters_digest.is_a?(String) && parameters_digest.match?(/\A[0-9a-f]{64}\z/)
             raise ArgumentError, "invalid mutation parameter digest"
           end
-          with_lock do
+          raise ArgumentError, "replay authorizer must be source owned" if replay_authorizer && !replay_authorizer.respond_to?(:call)
+          with_lock(deadline: deadline) do
             self.class::CAS_ATTEMPTS.times do
               old = ref_value
               ensure_checkout!
@@ -96,6 +97,7 @@ module Ace
                   raise AttemptErrors::Conflict, "Mutation ID is already bound to different input"
                 end
                 result = replay.fetch("data").merge("journal_commit" => replay.fetch("journal_commit"))
+                replay_authorizer&.call
                 return with_replay ? {data: result, replayed: true} : result
               end
               current = read_events(assignment_id, commit: old).select { |event| event["attempt_id"] == attempt_id }
@@ -215,7 +217,7 @@ module Ace
         end
 
         def validate_blob_path!(path)
-          unless path.is_a?(String) && path.match?(%r{\A(?:evidence/imports|execution/definitions|execution/prepared|candidates/bundles)/[a-zA-Z0-9_.-]+\z}) &&
+          unless path.is_a?(String) && path.match?(%r{\A(?:evidence/imports|execution/definitions|execution/prepared|execution/merge-evidence|candidates/bundles)/[a-zA-Z0-9_.-]+\z}) &&
               !%w[. ..].include?(File.basename(path))
             raise ArgumentError, "invalid canonical blob reference"
           end

data/lib/ace/assign/molecules/lifecycle_exclusion.rb

@@ -214,14 +214,25 @@ module Ace
         # given order, released in reverse — callers must use one consistent
         # global order, task before assignment, to avoid deadlock). Fails
         # closed when any identity was pruned.
-        def with_shared_multi(keys, reset_removed: false)
+        def with_shared_multi(keys, reset_removed: false, deadline: nil)
           ordered = Array(keys).compact.reject { |key| key.to_s.empty? }.uniq
           raise ArgumentError, "exclusion keys are required" if ordered.empty?
 
           locks = []
           begin
+            maintenance_deadline!(deadline) if deadline
             ordered.each { |key| locks << open_lock(key) }
-            locks.each { |lock| lock.flock(File::LOCK_SH) }
+            locks.each do |lock|
+              if deadline
+                until lock.flock(File::LOCK_SH | File::LOCK_NB)
+                  maintenance_deadline!(deadline)
+                  sleep 0.01
+                end
+                maintenance_deadline!(deadline)
+              else
+                lock.flock(File::LOCK_SH)
+              end
+            end
             ordered.each do |key|
               if removed?(key)
                 unless reset_removed