ace-assign 0.69.0 → 0.70.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 407eb167c22a0bac683f3ac5db391b535f6200f420a38d458cc13bf36590d930
-  data.tar.gz: ef23045c1b5c2915768a21110675121dd390a896347dba0f6be90f134eb5fe12
+  metadata.gz: 9de34921fd3a299eabfd530c8df3c76fed9405606cb0e717a0458fed9ecf614e
+  data.tar.gz: a9a2d22448d0c100b5404ce9ca9666b72ed0e6fb3d9bf158a5051ce001b703b1
 SHA512:
-  metadata.gz: 217a25d646c1499d23196d0d43e1eed171914b01fa91532cf2d996f728eb1ef2b60a7126e3cc46aa8b58d0e7015c844637ee67e18c8fb3cfb36b900c81ee4342
-  data.tar.gz: 4de219ae9bdf137b84d813c599643a459961fd0337b7de987b69ac6edd8cbc4c483bd63def33a30f7bbbb075df66030843dbe71cab847f863edeb2f483ad2c26
+  metadata.gz: f68696b349c145768cf15634945c0fe40a659a80394f6053b37fd4270c244d8884345dbc9ba438a257de66593a0e44d88feca77c3c2580ea0e5208221d896746
+  data.tar.gz: 07c573b0f8160c1929fbba896362180ad2bd08097ab306139ca0e5a28c00762650845840f8709e16f825660add6057b6569ce49a1f7595370c2f83a6740c4e07

data/.ace-defaults/assign/presets/deliver-release.yml

@@ -2,7 +2,7 @@
 # Usage: ace-assign create --task TASK[,TASK...] --preset deliver-release
 
 name: deliver-release
-description: Prepare and bind a stable release cut without exercising publication authority
+description: Deliver a bound release cut through the project-authorized publisher and installation owners
 
 parameters:
   taskrefs:
@@ -37,15 +37,18 @@ steps:
       final artifact digest, and update the manifest before it is accepted. Preparation
       is not publication, installation, deployment, or proof of any of those effects.
 
-  - name: publication-authority-placeholder
+  - name: request-authorized-publication
     number: "040"
     instructions: |
-      Publication placeholder only. Do not run a publish command in this preset. Route
-      the exact manifest to the separate publication authority named by project policy.
-      Missing credentials, publisher identity, or admission is
-      BLOCKED(provision, owner). If that authority accepts a request and returns a
-      durable operation reference plus reconciliation path, record
-      WAIT(reference, next-check); otherwise preserve uncertainty and do not retry.
+      Resolve the concrete publication workflow and executor from project policy and
+      invoke that existing workflow with the exact accepted manifest through the separate
+      publication authority. This step grants no credentials or permission by itself.
+      Missing publisher identity, executable binding, or admission is BLOCKED(provision, owner).
+      Use the project's existing publisher, dependency order and scoped HITL OTP route.
+      Record the accepted operation reference and reconciliation path before WAIT.
+      Track published, pending and uncertain artifacts separately. Verify registry version
+      and digest before retry; never republish an already matching artifact or repeat an
+      uncertain effect blindly. Keep delivery open after partial or unknown publication.
 
   - name: record-release-outcome
     number: "050"

data/.ace-defaults/assign/presets/integrate-batch.yml

@@ -32,11 +32,16 @@ steps:
   - name: delegate-renewed-evidence
     number: "030"
     instructions: |
-      After any candidate movement, delegate renewed evidence for the new exact head:
-      prove replay content identity with range-diff or a stronger project-approved
-      comparison, run fresh relevant tests, and obtain an independent reviewer verdict.
-      The reviewer must be independent of the executor. Content beyond the declared
-      replay delta requires the full project review gate, not a verdict-stands shortcut.
+      Require an initial independent reviewer verdict, then record an accepted-head
+      assessment after every candidate movement. Retain old/new head and base SHAs,
+      the executed range-diff/content comparison, full repository context, risks and
+      fresh relevant tests. Proven identical rebases may carry the initial review;
+      patch-id alone is insufficient. An integrator may accept a minor safe correction
+      with recorded reasoning and tests. Material or uncertain changes, including small
+      authority/security changes, require independent delta review. Keep the initial
+      review and formal forge approval actor/state/SHA separate from this assessment.
+      Post and read back the evidence before merge; use the exact accepted head in the
+      server-side merge guard. Failed publication of evidence blocks integration.
 
   - name: reevaluate-integration-readiness
     number: "040"

data/.ace-defaults/assign/presets/supervise-delivery.yml

@@ -20,8 +20,8 @@ steps:
 
       These are references to producer tasks; never reparent, duplicate, reopen, or
       change producer task status. A PR-ready worker remains terminal even while this
-      delivery assignment stays open. No second queue, journal, daemon, or cache may
-      be created. Treat an empty observation as current input only: Transiently empty
+      delivery assignment stays open. A local objective queue may store goals, next actions, blockers and references;
+      no second execution queue, journal, daemon, or cache may be created. Treat an empty observation as current input only: Transiently empty
       is not accepted completion.
 
   - name: supervise-delivery-queue
@@ -42,8 +42,10 @@ steps:
       - policy/plan revision and evidence references used for the decision.
 
       For every entry, evaluate dependency state, exact candidate head SHA, fresh
-      test and independent-review evidence bound to that head, required authority and
-      transport, and grouping constraints. Re-record the decision after dependency,
+      tests, initial independent review and a documented accepted-head assessment.
+      An identical rebase needs executed content-identity proof; a minor safe correction
+      needs integrator reasoning and tests; material or uncertain delta needs independent
+      delta review. Evaluate required authority, transport and grouping constraints. Re-record the decision after dependency,
       candidate head, evidence, authority, transport, or target-branch movement.
 
   - name: reconcile-integration-operation

data/CHANGELOG.md

@@ -7,6 +7,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.70.0] - 2026-10-16
+
+### Added
+
+- Admit ordinary assignments, native starts, progress, submitted results and terminal settlement through the installed canonical owner. Retain original mutations and immutable snapshots across restart, isolate sibling scopes, and join current HITL, service and Inbox evidence.
+- Preserve historical review checks at their recorded head and align delivery presets with accepted-head assessment and serial integration.
+
 ## [0.69.0] - 2026-10-16
 
 ### Changed

data/lib/ace/assign/atoms/assignment_scope.rb

@@ -47,6 +47,11 @@ module Ace
         rescue Ace::Assign::AttemptErrors::InvalidScope
           false
         end
+
+        # An owner of a subtree also owns every descendant scope.
+        def self.overlap?(left, right)
+          equal?(left, right) || left.start_with?("#{right}.") || right.start_with?("#{left}.")
+        end
       end
     end
   end

data/lib/ace/assign/authority/assignment_definition.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+require "digest"
+require "json"
+require_relative "campaign_execution"
+
+module Ace
+  module Assign
+    module Authority
+      # Shared byte/schema validation; each lifecycle separately authenticates
+      # the registration's owner, campaign provenance and original selection.
+      module AssignmentDefinition
+        def self.parse(bytes:, digest:, assignment_id:, project_id:)
+          unless bytes.is_a?(String) && bytes.bytesize <= 32_768 && digest.is_a?(String) &&
+              Digest::SHA256.hexdigest(bytes) == digest
+            raise ArgumentError, "invalid assignment definition digest or size"
+          end
+          value = JSON.parse(bytes)
+          allowed = %w[session_id name description created_at updated_at source_config parent task_id project_id prepared_work review_campaign campaign_execution]
+          unless value.is_a?(Hash) && (value.keys - allowed).empty? &&
+              %w[session_id name created_at source_config task_id project_id].all? { |key| value[key].is_a?(String) && !value[key].empty? } &&
+              value["session_id"] == assignment_id && value["project_id"] == project_id
+            raise ArgumentError, "invalid managed assignment definition"
+          end
+          CampaignExecution.validate_parent!(value.fetch("review_campaign")) if value.key?("review_campaign")
+          assignment = Models::Assignment.from_h(value)
+          unless assignment.managed? && assignment.task_id.match?(/\A[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}\z/)
+            raise ArgumentError, "definition is not managed or task identity is invalid"
+          end
+          assignment
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/candidate_transfer.rb

@@ -115,14 +115,14 @@ module Ace
           reject!("Prepared export filesystem is unavailable")
         end
 
-        def admit(bytes:, sha256:, size:, head:, &consumer)
+        def admit(bytes:, sha256:, size:, head:, deadline: nil, &consumer)
           unless bytes.is_a?(String) && size.is_a?(Integer) && size.positive? && size <= MAX_BYTES &&
               size == bytes.bytesize && sha256.is_a?(String) &&
               Digest::SHA256.hexdigest(bytes.b) == sha256 && head.is_a?(String) && head.match?(SHA)
             reject!("Candidate bundle binding or size is invalid")
           end
           verify_root!
-          deadline = monotonic + DEADLINE
+          deadline = deadline ? [deadline, monotonic + DEADLINE].min : monotonic + DEADLINE
           Dir.mktmpdir("quarantine-", @root) do |directory|
             File.chmod(0700, directory)
             bundle = File.join(directory, "candidate.bundle")

data/lib/ace/assign/authority/endcap_attempts.rb

@@ -179,7 +179,7 @@ module Ace
                 @launch.campaign_children_settled!(journal: selected, commit: prefix, params: params, map: map)
                 @launch.completion_scope!(journal: selected, events: fresh, params: params, map: map, commit: prefix)
                 service_settlement_evidence!(journal: selected, events: fresh, params: params, map: map, commit: prefix)
-                plan = Organisms::AttemptCoordinator.finished_transition_plan(events: fresh, receipt: result.fetch("receipt"))
+                plan = Organisms::AttemptCoordinator.finished_transition_plan(events: fresh, receipt: result.fetch("receipt"), authority: :protected)
                 plan.merge(data: params.slice("attempt_id", "result_id", "head", "candidate_generation").merge(
                   "receipt_digest" => result.fetch("receipt_digest"), "state" => result.dig("receipt", "verdict")))
                 end

data/lib/ace/assign/authority/launch_control_exclusions.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 require_relative "../molecules/protected_control_exclusion"
 require_relative "campaign_execution"
+require_relative "assignment_definition"
 
 module Ace
   module Assign
@@ -117,23 +118,8 @@ module Ace
         end
 
         def validated_registration_definition!(params, map)
-          bytes = params.fetch("definition_bytes")
-          unless bytes.is_a?(String) && bytes.bytesize <= 32_768 && params["definition_digest"].is_a?(String) &&
-              Digest::SHA256.hexdigest(bytes) == params["definition_digest"]
-            raise ArgumentError, "invalid assignment definition digest or size"
-          end
-          value = JSON.parse(bytes)
-          allowed = %w[session_id name description created_at updated_at source_config parent task_id project_id prepared_work review_campaign campaign_execution]
-          unless value.is_a?(Hash) && (value.keys - allowed).empty? &&
-              %w[session_id name created_at source_config task_id project_id].all? { |key| value[key].is_a?(String) && !value[key].empty? } &&
-              value["session_id"] == params["assignment_id"] && value["project_id"] == map["project_id"]
-            raise ArgumentError, "invalid managed assignment definition"
-          end
-          CampaignExecution.validate_parent!(value.fetch("review_campaign")) if value.key?("review_campaign")
-          assignment = Models::Assignment.from_h(value)
-          raise ArgumentError, "definition is not managed" unless assignment.managed?
-          token!(assignment.task_id)
-          assignment
+          AssignmentDefinition.parse(bytes: params.fetch("definition_bytes"), digest: params["definition_digest"],
+            assignment_id: params["assignment_id"], project_id: map["project_id"])
         end
       end
     end

data/lib/ace/assign/authority/ordinary_attempt_start.rb

@@ -0,0 +1,137 @@
+# frozen_string_literal: true
+
+module Ace
+  module Assign
+    module Authority
+      module OrdinaryAttemptStart
+        START_KEYS = %w[assignment_id attempt_id expected_generation head pane scope].freeze
+
+        private
+
+        def start_attempt(request, peer, role, deadline)
+          params = request.fetch("params")
+          strict!(params, START_KEYS)
+          %w[assignment_id attempt_id].each { |key| token!(params.fetch(key)) }
+          if params.fetch("attempt_id").start_with?("definition-")
+            raise ArgumentError, "ordinary attempt ID uses the registration namespace"
+          end
+          token!(request.fetch("mutation_id"))
+          unless params.fetch("head").is_a?(String) && params.fetch("head").match?(/\A[0-9a-f]{40}\z/)
+            raise ArgumentError, "ordinary start HEAD is invalid"
+          end
+          unless %i[supervisor worker].include?(role) && params.fetch("expected_generation").is_a?(Integer) && params.fetch("expected_generation") == 0
+            raise AttemptErrors::UnauthorizedIdentity, "ordinary start requires an installed worker and a new attempt"
+          end
+          commit = @journal.ref_value
+          registered = registration(params.fetch("assignment_id"), commit: commit)
+          raise AttemptErrors::NotFound, "ordinary work is not registered" unless registered
+          work = registered_work(registered, commit, deadline)
+          scope = params.fetch("scope")
+          unless work.manifest.fetch("steps").any? { |step| step.fetch("number") == scope }
+            raise AttemptErrors::InvalidScope, "ordinary scope is not in the accepted work"
+          end
+          keys = [@exclusion.task_key(registered.fetch("task_id")), @exclusion.assignment_key(params.fetch("assignment_id"))]
+          @exclusion.with_shared_multi(keys, deadline: deadline) do
+            if @journal.mutation_result(request.fetch("mutation_id"))
+              # Work may legitimately have advanced since an acknowledged or
+              # lost start reply. Recover its original head, never recapture it.
+              identity = @admission.identity!(peer: peer, pane: params.fetch("pane"), deadline: deadline)
+              return @journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
+                mutation_id: request.fetch("mutation_id"), operation: "start_attempt", parameters_digest: start_digest(params, peer, identity),
+                expected_generation: 0, with_replay: true, deadline: deadline,
+                replay_authorizer: -> { authorize_start_replay!(request, peer, role, deadline) }) do
+                  raise AttemptErrors::EvidenceUnavailable, "accepted ordinary start disappeared"
+                end
+            end
+            # Only the installed admission can observe the actual native owner
+            # and worker checkout. It performs no launch or delivery effect.
+            observed = @admission.execution!(peer: peer, pane: params.fetch("pane"), head: params.fetch("head"), deadline: deadline)
+            identity = observed.fetch(:identity)
+            principal = {"uid" => peer.fetch("uid"), "actor" => identity.actor}
+            digest = start_digest(params, peer, identity)
+            authorize!(request, peer, role, deadline)
+            @journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
+              mutation_id: request.fetch("mutation_id"), operation: "start_attempt", parameters_digest: digest,
+              expected_generation: 0, with_replay: true, deadline: deadline,
+              replay_authorizer: -> { authorize_start_replay!(request, peer, role, deadline) }) do |events, prefix, _generation|
+              authorize!(request, peer, role, deadline)
+              unless @admission.identity!(peer: peer, pane: params.fetch("pane"), deadline: deadline) == identity
+                raise AttemptErrors::UnauthorizedIdentity, "ordinary native worker changed before start acceptance"
+              end
+              unless events.empty? && registration(params.fetch("assignment_id"), commit: prefix) == registered
+                raise AttemptErrors::Conflict, "ordinary start registration or attempt changed"
+              end
+              if @journal.assignment_ids(commit: prefix).any? { |assignment|
+                  assignment != params.fetch("assignment_id") && @journal.read_events(assignment, commit: prefix).any? { |event|
+                    event.fetch("attempt_id") == params.fetch("attempt_id") } }
+                raise AttemptErrors::Conflict, "ordinary attempt ID belongs to another assignment"
+              end
+              # Sibling scopes may run independently. A different request ID
+              # never repeats an already consumed scope or any part of it.
+              if @journal.derived_attempts(params.fetch("assignment_id"), commit: prefix).any? { |attempt|
+                  Atoms::AssignmentScope.overlap?(attempt.binding.scope, scope) }
+                raise AttemptErrors::Conflict, "ordinary scope already has an attempt; reconcile its original execution"
+              end
+              record = current_queue_record(registered, prefix)
+              queue = OrdinaryQueue.new(work: work, root: @input_root, bytes: queue_bytes(record, prefix))
+                .transition(operation: :activate, scope: scope)
+              queue_sha = Digest::SHA256.hexdigest(queue.bytes)
+              queue_path = "execution/definitions/#{params.fetch('assignment_id')}-queue-#{queue_sha}.json"
+              {events: [
+                {type: "intent", payload: {"assignment_id" => params.fetch("assignment_id"), "scope" => scope,
+                  "project_id" => @project, "task_id" => registered.fetch("task_id"), "base_head" => observed.fetch(:checkout).fetch("head")}},
+                {type: "process_start", payload: {"actor" => identity.actor, "role" => identity.role, "runtime" => identity.runtime,
+                  "pid" => identity.process_pid, "process_identity" => identity.runtime_binding.fetch("process_identity"),
+                  "runtime_binding" => identity.runtime_binding, "checkout" => observed.fetch(:checkout)}}
+              ], blobs: {queue_path => queue.bytes}, data: {
+                "authority" => "ordinary", "assignment_id" => params.fetch("assignment_id"), "attempt_id" => params.fetch("attempt_id"),
+                "project_id" => @project, "scope" => scope, "state" => "running", "started_by" => principal,
+                "base_head" => observed.fetch(:checkout).fetch("head"), "runtime_binding" => identity.runtime_binding,
+                "queue_ref" => queue_path, "queue_sha256" => queue_sha}}
+            end
+          end
+        end
+
+        def start_digest(params, peer, identity)
+          Atoms::EvidenceDigest.digest({"params" => params, "project_id" => @project,
+            "principal" => {"uid" => peer.fetch("uid"), "actor" => identity.actor}})
+        end
+
+        def authorize_start_replay!(request, peer, role, deadline)
+          authorize!(request, peer, role, deadline)
+          params = request.fetch("params")
+          identity = @admission.identity!(peer: peer, pane: params.fetch("pane"), deadline: deadline)
+          start_replay_owner!(params, identity)
+        end
+
+        def registered_work(registered, commit, deadline)
+          reference = registered.fetch("prepared_work")
+          bytes = @journal.bounded_blob(registered.fetch("prepared_bundle_ref"), commit: commit,
+            max_bytes: registered.fetch("prepared_bundle_bytes"))
+          work = PreparedWork.admit(bytes: bytes, head: reference.fetch("prepared_head"), tree: reference.fetch("prepared_tree"),
+            sha256: registered.fetch("prepared_bundle_sha256"), size: registered.fetch("prepared_bundle_bytes"),
+            root: @input_root, deadline: deadline)
+          unless work.reference(head: reference.fetch("prepared_head"), tree: reference.fetch("prepared_tree")) == reference &&
+              work.manifest.values_at("assignment_id", "project_id", "task_id") == registered.values_at("assignment_id", "project_id", "task_id") &&
+              Digest::SHA256.hexdigest(work.definition_bytes(head: reference.fetch("prepared_head"), tree: reference.fetch("prepared_tree"))) == registered.fetch("definition_digest")
+            raise AttemptErrors::EvidenceUnavailable, "ordinary prepared registration bytes differ"
+          end
+          work
+        end
+
+        def start_replay_owner!(params, identity)
+          events = @journal.read_events(params.fetch("assignment_id"))
+            .select { |event| event.fetch("attempt_id") == params.fetch("attempt_id") }
+          unless Models::EvidenceEvent.chain_valid?(events) && events.count { |event| event["type"] == "process_start" } == 1
+            raise AttemptErrors::EvidenceUnavailable, "ordinary start evidence is unavailable"
+          end
+          owner = events.find { |event| event["type"] == "process_start" }.fetch("payload")
+          unless owner.values_at("actor", "role", "runtime", "runtime_binding") ==
+              [identity.actor, identity.role, identity.runtime, identity.runtime_binding]
+            raise AttemptErrors::UnauthorizedIdentity, "ordinary replay belongs to its original native worker"
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/ordinary_client.rb

@@ -0,0 +1,70 @@
+# frozen_string_literal: true
+
+require_relative "ordinary_peer"
+require_relative "transfer_codec"
+
+module Ace
+  module Assign
+    module Authority
+      # Installed selection is supplied by the caller's trusted composition.
+      # This client never selects a journal, local fallback or execution identity.
+      class OrdinaryClient
+        Reply = Struct.new(:data, :replayed, :parts, keyword_init: true)
+
+        def initialize(project_id:, service:, verify_selection:, peer: OrdinaryPeer.new, scratch_root: nil)
+          @project_id, @service, @verify_selection, @peer, @scratch_root = project_id, service, verify_selection, peer, scratch_root
+        end
+
+        def call(operation, params, mutation_id: nil, upload_parts: nil, download: false, purpose: nil, timeout: 30)
+          unless operation.is_a?(String) && params.is_a?(Hash) && !params.key?("transfer") &&
+              timeout.is_a?(Numeric) && timeout.finite? && timeout.positive?
+            raise ArgumentError, "invalid ordinary authority request"
+          end
+          raise ArgumentError, "ordinary download needs private scratch and forbids upload" if download && (upload_parts || !@scratch_root)
+          @verify_selection.call
+          wire = Ace::Runtime::Molecules::ProtectedSocket
+          path = @service.fetch("socket_path")
+          wire.root_path!(File.dirname(path), directory: true, owner: @service.fetch("uid"))
+          before = wire.socket_identity(path, mode: 0o660)
+          raise AttemptErrors::UnauthorizedIdentity, "ordinary endpoint owner differs" unless before.last == @service.fetch("uid")
+          codec = TransferCodec.new(root: download ? @scratch_root : nil)
+          descriptor = codec.descriptor(upload_parts, purpose: purpose) if upload_parts
+          parameters = descriptor ? params.merge("transfer" => descriptor) : params
+          deadline = wire.deadline([timeout, 30].min)
+          wire.connect(path, deadline: deadline) do |socket|
+            observed = @peer.capture(socket, deadline: deadline)
+            unless observed.values_at("uid", "gid") == @service.values_at("uid", "gid") && wire.socket_identity(path, mode: 0o660) == before
+              raise AttemptErrors::UnauthorizedIdentity, "ordinary endpoint peer changed"
+            end
+            @verify_selection.call
+            wire.write(socket, {"version" => 1, "operation" => operation, "mutation_id" => mutation_id,
+              "project_id" => @project_id, "params" => parameters}, deadline: deadline, limit: 16_384)
+            codec.send(socket, parts: upload_parts, descriptor: descriptor, purpose: purpose, deadline: deadline) if upload_parts
+            socket.shutdown(Socket::SHUT_WR)
+            ingress = wire::Ingress.new(socket)
+            result = wire.read(ingress, deadline: deadline, limit: 16_384)
+            unless result.is_a?(Hash) && result.keys.sort == %w[data status transport] && result["status"] == "ok" &&
+                result["data"].is_a?(Hash) && result["transport"].is_a?(Hash) &&
+                result["transport"].keys == ["replayed"] && [true, false].include?(result["transport"]["replayed"])
+              code = result.is_a?(Hash) && result["error"].is_a?(Hash) ? result["error"]["code"] : nil
+              raise AttemptErrors::EvidenceUnavailable, "ordinary authority refused (#{code || 'invalid_response'}); retain original mutation"
+            end
+            parts = if download
+              codec.receive(ingress, descriptor: result.fetch("data").fetch("transfer"), purpose: purpose, deadline: deadline) do |input|
+                Array.new(input.count) { |index| input.bytes(index: index) }
+              end
+            end
+            @verify_selection.call
+            @peer.live!(observed, deadline: deadline)
+            unless wire.socket_identity(path, mode: 0o660) == before
+              raise AttemptErrors::UnauthorizedIdentity, "ordinary endpoint changed before response acceptance"
+            end
+            Reply.new(data: result.fetch("data"), replayed: result.fetch("transport").fetch("replayed"), parts: parts)
+          end
+        rescue SystemCallError, IOError, Ace::Runtime::RuntimeUnavailableError
+          raise AttemptErrors::EvidenceUnavailable, "ordinary authority outcome unavailable; retain original mutation; no local fallback"
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/ordinary_completion.rb

@@ -0,0 +1,94 @@
+# frozen_string_literal: true
+
+require_relative "ordinary_effect_settlement"
+require_relative "../organisms/attempt_coordinator"
+
+module Ace
+  module Assign
+    module Authority
+      # Terminal acceptance consumes the submitted canonical receipt. The
+      # supervisor cannot replace its bytes, worker, scope or candidate.
+      module OrdinaryCompletion
+        FINISH_KEYS = %w[assignment_id attempt_id expected_generation pane head result_id receipt_digest].freeze
+
+        private
+
+        def finish_result(request, peer, role, deadline)
+          params = request.fetch("params")
+          strict!(params, FINISH_KEYS)
+          %w[assignment_id attempt_id result_id].each { |key| token!(params.fetch(key)) }
+          token!(request.fetch("mutation_id"))
+          unless role == :supervisor
+            raise AttemptErrors::UnauthorizedIdentity, "ordinary completion requires the installed supervisor"
+          end
+          unless params.fetch("expected_generation").is_a?(Integer) && params.fetch("expected_generation").positive? &&
+              params.fetch("head").is_a?(String) && params.fetch("head").match?(/\A[0-9a-f]{40}\z/) &&
+              params.fetch("receipt_digest").is_a?(String) && params.fetch("receipt_digest").match?(/\A[0-9a-f]{64}\z/)
+            raise ArgumentError, "ordinary completion selection is invalid"
+          end
+          registered = registration(params.fetch("assignment_id"), commit: @journal.ref_value)
+          raise AttemptErrors::NotFound, "ordinary work is not registered" unless registered
+          digest = Atoms::EvidenceDigest.digest({"params" => params, "project_id" => @project, "peer_uid" => peer.fetch("uid")})
+          @exclusion.with_shared_multi([@exclusion.task_key(registered.fetch("task_id"))], deadline: deadline) do
+            @exclusion.with_exclusive(@exclusion.assignment_key(params.fetch("assignment_id")), deadline: deadline) do
+              authorize!(request, peer, role, deadline)
+              with_result_transport(request, deadline) do |transport|
+                @journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
+                  mutation_id: request.fetch("mutation_id"), operation: "finish", parameters_digest: digest,
+                  expected_generation: params.fetch("expected_generation"), with_replay: true, deadline: deadline,
+                  replay_authorizer: -> { authorize!(request, peer, role, deadline) }) do |events, prefix, _generation|
+                  authorize!(request, peer, role, deadline)
+                  unless Molecules::CanonicalAttemptState.derive(events) == "running"
+                    raise AttemptErrors::Conflict, "ordinary completion requires a running attempt"
+                  end
+                  result = retained_ordinary_result(params, events, prefix)
+                  unless result && result.fetch("result_id") == params.fetch("result_id") &&
+                      result.dig("receipt", "digest") == params.fetch("receipt_digest") && result.dig("binding", "head") == params.fetch("head")
+                    raise AttemptErrors::ReceiptRejected, "ordinary completion requires its exact submitted result"
+                  end
+                  binding = result.fetch("binding")
+                  observed = @admission.recorded_execution!(binding: binding.fetch("runtime_binding"), head: binding.fetch("head"), deadline: deadline)
+                  unless observed.fetch(:runtime_binding) == binding.fetch("runtime_binding") && observed.fetch(:checkout) == binding.fetch("checkout")
+                    raise AttemptErrors::UnauthorizedIdentity, "ordinary result worker checkout changed"
+                  end
+                  references = events.select { |event| event["type"] == "inbox_binding" }.map { |event| event.fetch("payload") }
+                  delivery = transport.call(references: references, attempt_id: params.fetch("attempt_id"), owner: binding.fetch("runtime_binding"))
+                  scope = events.find { |event| event["type"] == "intent" }.fetch("payload").fetch("scope")
+                  work = registered_work(registered, prefix, deadline)
+                  queue = OrdinaryQueue.new(work: work, root: @input_root, bytes: queue_bytes(current_queue_record(registered, prefix), prefix))
+                  verdict = result.dig("receipt", "verdict")
+                  complete = verdict == "succeeded" ? queue.status.subtree_complete?(scope) : queue.status.subtree_failed?(scope)
+                  raise AttemptErrors::Conflict, "ordinary result scope has unfinished progress" unless complete
+                  settlement = OrdinaryEffectSettlement.new(journal: @journal).verify!(project: @project,
+                    assignment: params.fetch("assignment_id"), attempt: params.fetch("attempt_id"), events: events, commit: prefix)
+                  authorize!(request, peer, role, deadline)
+                  plan = Organisms::AttemptCoordinator.finished_transition_plan(events: events, receipt: result.fetch("receipt"), authority: :ordinary)
+                  plan.merge(data: params.slice("assignment_id", "attempt_id", "result_id", "head", "receipt_digest").merge(
+                    "authority" => "ordinary", "scope" => scope, "state" => verdict, "settlement" => settlement, "inbox_deliveries" => delivery))
+                end
+              end
+            end
+          end
+        rescue Ace::Herdr::Error => error
+          raise AttemptErrors::EvidenceUnavailable, "ordinary transport settlement is unavailable: #{error.message}"
+        end
+
+        def with_result_transport(request, deadline)
+          if @journal.mutation_result(request.fetch("mutation_id"), commit: @journal.ref_value)
+            # A terminal reply is immutable. Current peer authority is still
+            # checked by mutate, but retired transport files are not replay input.
+            return yield nil
+          end
+          if @inbox
+            @inbox.with_delivery_settlement(deadline: deadline) { |verify| yield verify }
+          else
+            yield lambda { |references:, **_|
+              raise AttemptErrors::EvidenceUnavailable, "ordinary Inbox owner is not installed" unless references.empty?
+              []
+            }
+          end
+        end
+      end
+    end
+  end
+end