ace-assign 0.69.0 → 0.70.0

data/lib/ace/assign/authority/ordinary_effect_settlement.rb

@@ -0,0 +1,118 @@
+# frozen_string_literal: true
+
+require_relative "service_evidence"
+require_relative "../molecules/ordinary_merge_contract"
+
+module Ace
+  module Assign
+    module Authority
+      # Completion reads the existing effect owners at the held CAS prefix.
+      # A prompt, acknowledgment or failed dispatch never settles an effect.
+      class OrdinaryEffectSettlement
+        def initialize(journal:)
+          @journal = journal
+        end
+
+        def verify!(project:, assignment:, attempt:, events:, commit:)
+          retained = @journal.read_events(assignment, commit: commit).select { |event| event["attempt_id"] == attempt }
+          unless retained == events && Models::EvidenceEvent.chain_valid?(events)
+            unavailable!("ordinary settlement needs its exact canonical attempt")
+          end
+          selection = {"project_id" => project, "assignment_id" => assignment, "attempt_id" => attempt}
+          services = records!(@journal.service_request_records(commit: commit), events, selection, %w[service_claim service_transition])
+          merges = records!(@journal.fixed_merge_request_records(commit: commit), events, selection, %w[merge_admission merge_transition])
+          services.each { |record| service!(record, commit) }
+          merges.each { |record| merge!(record, commit) }
+          assignment_events = @journal.read_events(assignment, commit: commit)
+          assignment_events.group_by { |event| event.fetch("attempt_id") }.each_value do |chain|
+            unavailable!("ordinary delivery history is corrupt") unless Models::EvidenceEvent.chain_valid?(chain)
+          end
+          delivery!(events, merges, assignment_events)
+          {"journal_commit" => commit, "service_requests" => services.map { |record| record.fetch("request_id") }.sort,
+            "merge_requests" => merges.map { |record| record.fetch("request_id") }.sort}
+        end
+
+        private
+
+        def records!(inventory, events, selection, types)
+          records = inventory.select { |record| record.values_at("assignment_id", "attempt_id") == selection.values_at("assignment_id", "attempt_id") }
+          references = events.select { |event| types.include?(event["type"]) }
+          ids = references.map { |event| event.fetch("payload").fetch("request_id") }.uniq.sort
+          unless records.map { |record| record.fetch("request_id") }.sort == ids
+            unavailable!("ordinary effect inventory and event set differ")
+          end
+          records.each do |record|
+            latest = references.reverse.find { |event| event.dig("payload", "request_id") == record.fetch("request_id") }
+            unless record.slice(*selection.keys) == selection && latest.dig("payload", "state") == record["state"] &&
+                latest.dig("payload", "record_digest") == Atoms::EvidenceDigest.digest(record) &&
+                latest.dig("payload", "receipt_digest") == (record["receipt"] && Atoms::EvidenceDigest.digest(record["receipt"]))
+              unavailable!("ordinary effect record differs from its accepted owner event")
+            end
+          end
+          records
+        end
+
+        def service!(record, commit)
+          return if record["state"] == "rejected" && record["consumed"] == false
+          pending!("ordinary service effect is unresolved") unless %w[succeeded failed-settled].include?(record["state"])
+          receipt = record.fetch("receipt")
+          @journal.validate_terminal_receipt_structure!(record, record.fetch("state"), receipt)
+          # The installed owner consumes the existing canonical import, never
+          # the old local receipt file. This is independent of journal mode.
+          owner = ServiceEvidence.new(journal: @journal)
+          references = receipt.fetch("evidence")
+          if %w[publish prune-preserved-workspace].include?(record["operation"])
+            contents = owner.call(references, record, record.fetch("state"), {commit: commit})
+            unless contents.is_a?(Array) && contents.size == references.size
+              unavailable!("ordinary service evidence collection differs")
+            end
+          else
+            contents = references.map { |reference| owner.call(reference, record, record.fetch("state"), {commit: commit}) }
+          end
+          references.zip(contents).each do |reference, bytes|
+            unavailable!("ordinary service evidence digest differs") unless bytes.is_a?(String) && Digest::SHA256.hexdigest(bytes.b) == reference.fetch("sha256")
+            @journal.verify_service_attestation!(bytes, record, record.fetch("state")) unless %w[publish prune-preserved-workspace].include?(record["operation"])
+          end
+        end
+
+        def merge!(record, commit)
+          unless @journal.fixed_merge_settlement!(record.fetch("request_id"), commit: commit) == record
+            unavailable!("ordinary merge settlement differs from its selected record")
+          end
+        end
+
+        def delivery!(events, merges, assignment_events)
+          deliveries = assignment_events.select { |event| event["type"] == "delivery" }
+          events.select { |event| event["type"] == "delivery" }.each do |intent|
+            payload = intent.fetch("payload")
+            case payload["stage"]
+            when "intent"
+              settled = deliveries.any? { |event| event.dig("payload", "stage") == "result" &&
+                event.dig("payload", "intent_digest") == intent.fetch("digest") &&
+                event.dig("payload", "intent_attempt_id") == intent.fetch("attempt_id") &&
+                event.dig("payload", "operation") == payload.fetch("operation") &&
+                event.dig("payload", "head") == payload.fetch("head") && event.dig("payload", "outcome") == "succeeded" }
+              pending!("ordinary delivery intent is unresolved") unless settled
+            when "ordinary-merge-intent"
+              result = deliveries.reverse.find { |event| event.dig("payload", "stage") == "ordinary-merge-result" &&
+                event.dig("payload", "request_id") == payload.fetch("request_id") && event.dig("payload", "input_digest") == payload.fetch("input_digest") }
+              pending!("ordinary merge delivery is unresolved") unless result
+              accepted = result.fetch("payload")
+              record = merges.find { |item| item["request_id"] == payload.fetch("request_id") }
+              if accepted["outcome"] == "refused_no_effect" && record.nil?
+                refusal = accepted.slice("code", "message", "request_id", "input_digest").merge("schema" => "ace.lab.service.ordinary-merge-refusal/v1")
+                Molecules::OrdinaryMergeContract.validate_refusal!(refusal)
+                pending!("ordinary merge receiver availability is unresolved") if refusal["code"] == Molecules::OrdinaryMergeContract::UNAVAILABLE_CODE
+              elsif !record || record["input_digest"] != payload.fetch("input_digest") || record["receipt"] != accepted["receipt"]
+                unavailable!("ordinary delivery result differs from the merge owner")
+              end
+            end
+          end
+        end
+
+        def unavailable!(message) = raise AttemptErrors::EvidenceUnavailable, message
+        def pending!(message) = raise AttemptErrors::ServiceSettlementPending, message
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/ordinary_lifecycle.rb

@@ -0,0 +1,191 @@
+# frozen_string_literal: true
+
+require "ace/herdr"
+require_relative "prepared_work"
+require_relative "assignment_definition"
+require_relative "ordinary_queue"
+require_relative "ordinary_attempt_start"
+require_relative "ordinary_progress"
+require_relative "ordinary_results"
+require_relative "ordinary_completion"
+require_relative "../molecules/lifecycle_exclusion"
+
+module Ace
+  module Assign
+    module Authority
+      # Ordinary lifecycle uses the existing canonical execution ref and CAS.
+      # The installed Lab composition supplies one journal and exclusion owner
+      # shared with HITL and merge. No requester cache supplies accepted state.
+      class OrdinaryLifecycle
+        include OrdinaryAttemptStart
+        include OrdinaryProgress
+        include OrdinaryResults
+        include OrdinaryCompletion
+        OPERATIONS = (%w[register_assignment registration_status start_attempt finish] + OrdinaryProgress::PROGRESS_OPERATIONS + OrdinaryResults::RESULT_OPERATIONS).freeze
+        TRANSFER_OPERATIONS = {"register_assignment" => {direction: :upload, purpose: :candidate, roles: [:supervisor]}}
+          .merge(OrdinaryProgress::PROGRESS_TRANSFERS).merge(OrdinaryResults::RESULT_TRANSFERS).freeze
+        REGISTER_KEYS = %w[assignment_id definition_digest prepared_head prepared_tree manifest_sha256 expected_generation pane transfer].freeze
+
+        def initialize(project:, admission:, journal:, exclusion:, input_root:, inbox: nil)
+          @project, @admission, @journal, @exclusion = project, admission, journal, exclusion
+          @input_root = PrivateDirectory.verify!(input_root)
+          unless inbox.nil? || inbox.is_a?(Ace::Herdr::Organisms::Inbox)
+            raise ArgumentError, "ordinary completion requires the installed Inbox owner"
+          end
+          @inbox = inbox
+        end
+
+        def authorize_transfer!(request:, peer:, role:, deadline:)
+          authorize!(request, peer, role, deadline)
+          if OrdinaryResults::RESULT_TRANSFERS.key?(request.fetch("operation"))
+            validate_result!(request)
+            authorize_start_replay!(request, peer, role, deadline) if request.fetch("operation") == "submit_result"
+            return
+          end
+          if OrdinaryProgress::PROGRESS_TRANSFERS.key?(request.fetch("operation"))
+            validate_progress!(request)
+            return
+          end
+          unless request.fetch("operation") == "register_assignment" && role == :supervisor
+            raise AttemptErrors::UnauthorizedIdentity, "ordinary registration requires the installed supervisor"
+          end
+          validate_registration!(request)
+        end
+
+        def dispatch(request:, peer:, role:, deadline:, transfer: nil)
+          authorize!(request, peer, role, deadline)
+          case request.fetch("operation")
+          when "registration_status"
+            strict!(request.fetch("params"), %w[assignment_id])
+            raise ArgumentError, "status mutation must be null" unless request.fetch("mutation_id").nil?
+            assignment = request.fetch("params").fetch("assignment_id")
+            token!(assignment)
+            commit = @journal.ref_value
+            data = registration(assignment, commit: commit) || {"assignment_id" => assignment, "generation" => 0}
+            {data: data.merge("journal_commit" => commit), replayed: false}
+          when "register_assignment"
+            authorize_transfer!(request: request, peer: peer, role: role, deadline: deadline)
+            register(request, peer, deadline, transfer)
+          when "start_attempt"
+            raise ArgumentError, "ordinary start forbids transfer" if transfer
+            start_attempt(request, peer, role, deadline)
+          when "assignment_snapshot"
+            raise ArgumentError, "ordinary snapshot forbids upload" if transfer
+            assignment_snapshot(request, peer, role, deadline)
+          when "queue_start", "queue_finish", "queue_fail"
+            progress(request, peer, role, deadline, transfer)
+          when "submit_result", "result_status", "result_snapshot"
+            ordinary_result(request, peer, role, deadline, transfer)
+          when "finish"
+            raise ArgumentError, "ordinary completion forbids transfer" if transfer
+            finish_result(request, peer, role, deadline)
+          else
+            raise ArgumentError, "unknown ordinary lifecycle operation"
+          end
+        end
+
+        private
+
+        def register(request, peer, deadline, transfer)
+          params = request.fetch("params")
+          # Native observation and candidate subprocesses happen before CAS.
+          identity = @admission.identity!(peer: peer, pane: params.fetch("pane"), deadline: deadline)
+          unless identity.role == "coordinator"
+            raise AttemptErrors::UnauthorizedIdentity, "ordinary registration native owner differs"
+          end
+          raise AttemptErrors::MalformedTransfer, "prepared input requires one bundle" unless transfer && transfer.count == 1
+          bytes = transfer.bytes.freeze
+          descriptor = params.fetch("transfer")
+          work = PreparedWork.admit(bytes: bytes, head: params.fetch("prepared_head"), tree: params.fetch("prepared_tree"),
+            sha256: descriptor.fetch("sha256"), size: descriptor.fetch("bytes"), root: @input_root, deadline: deadline)
+          unless work.manifest.values_at("assignment_id", "project_id") == [params.fetch("assignment_id"), @project] &&
+              work.manifest_sha256 == params.fetch("manifest_sha256")
+            raise ArgumentError, "ordinary prepared assignment association differs"
+          end
+          definition = work.definition_bytes(head: params.fetch("prepared_head"), tree: params.fetch("prepared_tree"))
+          assignment = AssignmentDefinition.parse(bytes: definition, digest: params.fetch("definition_digest"),
+            assignment_id: params.fetch("assignment_id"), project_id: @project)
+          # Campaign registration needs its existing canonical campaign owner;
+          # it cannot be manufactured by attaching unchecked parent metadata.
+          if assignment.review_campaign || assignment.campaign_execution
+            raise AttemptErrors::EvidenceUnavailable, "ordinary campaign registration requires its campaign owner"
+          end
+          principal = {"uid" => peer.fetch("uid"), "actor" => identity.actor}
+          queue = OrdinaryQueue.new(work: work, root: @input_root)
+          queue_sha = Digest::SHA256.hexdigest(queue.bytes)
+          digest = Atoms::EvidenceDigest.digest({"params" => params, "project_id" => @project, "principal" => principal})
+          keys = [@exclusion.task_key(assignment.task_id), @exclusion.assignment_key(assignment.id)]
+          @exclusion.with_shared_multi(keys, deadline: deadline) do
+            # Replay bypasses the CAS callback; current authority is mandatory
+            # before that lookup as well as on every fresh CAS attempt.
+            authorize!(request, peer, :supervisor, deadline)
+            @journal.mutate(assignment_id: assignment.id, attempt_id: "definition-#{assignment.id}",
+              mutation_id: request.fetch("mutation_id"), operation: "register_assignment", parameters_digest: digest,
+              expected_generation: params.fetch("expected_generation"), with_replay: true, deadline: deadline,
+              replay_authorizer: -> { authorize!(request, peer, :supervisor, deadline) }) do |events, commit, _generation|
+              authorize!(request, peer, :supervisor, deadline)
+              unless events.empty? && registration(assignment.id, commit: commit).nil?
+                raise AttemptErrors::Conflict, "ordinary assignment is already registered; retain its original definition"
+              end
+              bundle_sha = Digest::SHA256.hexdigest(bytes)
+              definition_path = "execution/definitions/#{assignment.id}-#{params.fetch('definition_digest')}.json"
+              bundle_path = "execution/prepared/#{assignment.id}-#{bundle_sha}.bundle"
+              queue_path = "execution/definitions/#{assignment.id}-queue-#{queue_sha}.json"
+              {events: [], blobs: {definition_path => definition, bundle_path => bytes, queue_path => queue.bytes}, data: {
+                "authority" => "ordinary", "assignment_id" => assignment.id, "project_id" => @project,
+                "task_id" => assignment.task_id, "registered_by" => principal, "phase" => "registered",
+                "definition_ref" => definition_path, "definition_digest" => params.fetch("definition_digest"),
+                "queue_ref" => queue_path, "queue_sha256" => queue_sha,
+                "prepared_work" => work.reference(head: params.fetch("prepared_head"), tree: params.fetch("prepared_tree")),
+                "prepared_bundle_ref" => bundle_path, "prepared_bundle_sha256" => bundle_sha,
+                "prepared_bundle_bytes" => bytes.bytesize}}
+            end
+          end
+        end
+
+        def registration(assignment, commit:)
+          return nil unless commit
+          events = @journal.read_events(assignment, commit: commit)
+          events.group_by { |event| event.fetch("attempt_id") }.each_value do |chain|
+            raise AttemptErrors::EvidenceUnavailable, "ordinary assignment evidence is corrupt" unless Models::EvidenceEvent.chain_valid?(chain)
+          end
+          registrations = events.select { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "register_assignment" }
+          return nil if registrations.empty?
+          data = registrations.one? && registrations.first.dig("payload", "data")
+          unless data && data.values_at("authority", "assignment_id", "project_id") == ["ordinary", assignment, @project]
+            raise AttemptErrors::EvidenceUnavailable, "ordinary assignment registration owner differs"
+          end
+          data
+        end
+
+        def authorize!(request, peer, role, deadline)
+          unless deadline.is_a?(Numeric) && deadline.finite? && deadline > Process.clock_gettime(Process::CLOCK_MONOTONIC)
+            raise AttemptErrors::EvidenceUnavailable, "ordinary lifecycle deadline elapsed"
+          end
+          unless request.fetch("project_id") == @project && @admission.authorize!(request: request, peer: peer, deadline: deadline) == role
+            raise AttemptErrors::UnauthorizedIdentity, "ordinary lifecycle principal differs"
+          end
+        end
+
+        def validate_registration!(request)
+          params = request.fetch("params")
+          strict!(params, REGISTER_KEYS)
+          token!(request.fetch("mutation_id"))
+          token!(params.fetch("assignment_id"))
+          token!("definition-#{params.fetch('assignment_id')}")
+          unless params.fetch("expected_generation").is_a?(Integer) && params.fetch("expected_generation") >= 0
+            raise ArgumentError, "ordinary generation is invalid"
+          end
+        end
+
+        def strict!(value, keys)
+          raise ArgumentError, "ordinary authority fields differ" unless value.is_a?(Hash) && value.keys.sort == keys.sort
+        end
+
+        def token!(value)
+          raise ArgumentError, "ordinary identity is invalid" unless value.is_a?(String) && Molecules::JournalMutation::ID.match?(value)
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/ordinary_peer.rb

@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+require "socket"
+require "ace/runtime/molecules/process_identity"
+require "ace/herdr/molecules/bounded_observation"
+
+module Ace
+  module Assign
+    module Authority
+      # Ordinary UNIX peer attribution. This is not a protected launch observer:
+      # it confers no Yama, capability, cgroup or descendant-closure guarantee.
+      class OrdinaryPeer
+        def initialize(identity: nil)
+          @identity = identity
+        end
+
+        def capture(socket, deadline: default_deadline)
+          identity = identity_observer(deadline)
+          uid, gid = socket.getpeereid
+          pid = if RUBY_PLATFORM.include?("darwin")
+            socket.getsockopt(0, 2).int # SOL_LOCAL / LOCAL_PEERPID
+          elsif Socket.const_defined?(:SO_PEERCRED)
+            observed_pid, observed_uid, observed_gid = socket.getsockopt(Socket::SOL_SOCKET, Socket::SO_PEERCRED).data.unpack("i!3")
+            unavailable! unless [observed_uid, observed_gid] == [uid, gid]
+            observed_pid
+          end
+          value = identity.capture(pid)
+          unavailable! unless value && value["uid"] == uid && socket.getpeereid == [uid, gid] && identity.capture(pid) == value
+          value.merge("gid" => gid).freeze
+        rescue SystemCallError, IOError, SocketError, NotImplementedError
+          unavailable!
+        end
+
+        def live!(peer, deadline: default_deadline)
+          unavailable! unless peer.is_a?(Hash) && identity_observer(deadline).capture(peer["pid"]) == peer.slice("pid", "uid", "started_at", "host")
+          peer
+        end
+
+        private
+
+        def default_deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + 5
+
+        def identity_observer(deadline)
+          @identity || Ace::Runtime::Molecules::ProcessIdentity.new(
+            executor: Ace::Herdr::Molecules::BoundedObservation.new(deadline: deadline))
+        end
+
+        def unavailable!
+          raise AttemptErrors::UnauthorizedIdentity, "ordinary kernel peer is unavailable or changed"
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/ordinary_progress.rb

@@ -0,0 +1,162 @@
+# frozen_string_literal: true
+
+module Ace
+  module Assign
+    module Authority
+      # Source-owned progress for the already accepted work. Queue completion
+      # remains a worker report, never a successful execution result or merge.
+      module OrdinaryProgress
+        PROGRESS_OPERATIONS = %w[queue_start queue_finish queue_fail assignment_snapshot].freeze
+        PROGRESS_TRANSFERS = {
+          "queue_finish" => {direction: :upload, purpose: :artifacts, roles: %i[worker supervisor]},
+          "assignment_snapshot" => {direction: :download, purpose: :assignment_snapshot, roles: %i[worker supervisor reviewer]}
+        }.freeze
+        PROGRESS_COMMON = %w[assignment_id attempt_id expected_generation pane].freeze
+
+        private
+
+        def validate_progress!(request)
+          params = request.fetch("params")
+          operation = request.fetch("operation")
+          if operation == "assignment_snapshot"
+            strict!(params, %w[assignment_id attempt_id kind])
+            token!(params.fetch("attempt_id")) unless params.fetch("attempt_id").nil?
+            unless request.fetch("mutation_id").nil? && %w[prepared_work queue].include?(params.fetch("kind"))
+              raise ArgumentError, "ordinary snapshot must be a read of accepted work or queue"
+            end
+          else
+            fields = case operation
+            when "queue_start" then %w[step]
+            when "queue_finish" then %w[step transfer]
+            when "queue_fail" then %w[message]
+            else raise ArgumentError, "unknown ordinary progress operation"
+            end
+            strict!(params, PROGRESS_COMMON + fields)
+            token!(params.fetch("attempt_id")); token!(request.fetch("mutation_id"))
+            unless params.fetch("expected_generation").is_a?(Integer) && params.fetch("expected_generation").positive?
+              raise ArgumentError, "ordinary progress generation is invalid"
+            end
+            if params.key?("step") && !params["step"].nil? &&
+                !(params["step"].is_a?(String) && params["step"].bytesize.between?(1, 128) && PreparedWork::SCOPE.match?(params["step"]))
+              raise ArgumentError, "ordinary progress step is invalid"
+            end
+            if params.key?("message") && !(params["message"].is_a?(String) && params["message"].bytesize.between?(1, 1024) && !params["message"].include?("\0"))
+              raise ArgumentError, "ordinary failure message is invalid"
+            end
+          end
+          token!(params.fetch("assignment_id"))
+        end
+
+        def assignment_snapshot(request, peer, role, deadline)
+          validate_progress!(request)
+          params = request.fetch("params")
+          commit = @journal.ref_value
+          registered = registration(params.fetch("assignment_id"), commit: commit)
+          raise AttemptErrors::NotFound, "ordinary assignment is not registered" unless registered
+          queue_record = current_queue_record(registered, commit)
+          selected_events = if params.fetch("attempt_id")
+            result_events(params, commit)
+          else
+            []
+          end
+          kind = params.fetch("kind")
+          source = kind == "prepared_work" ? registered : queue_record
+          path_key, digest_key, size = if kind == "prepared_work"
+            ["prepared_bundle_ref", "prepared_bundle_sha256", registered.fetch("prepared_bundle_bytes")]
+          else
+            ["queue_ref", "queue_sha256", PreparedWork::MAX_TOTAL]
+          end
+          bytes = @journal.bounded_blob(source.fetch(path_key), commit: commit, max_bytes: size)
+          unless Digest::SHA256.hexdigest(bytes) == source.fetch(digest_key)
+            raise AttemptErrors::EvidenceUnavailable, "ordinary snapshot bytes differ from accepted selection"
+          end
+          authorize!(request, peer, role, deadline)
+          {data: {"project_id" => @project, "assignment_id" => params.fetch("assignment_id"), "kind" => kind,
+            "attempt_id" => params.fetch("attempt_id"), "generation" => @journal.authority_generation(selected_events),
+            "scope" => selected_events.find { |event| event["type"] == "intent" }&.dig("payload", "scope"),
+            "journal_commit" => commit, "sha256" => source.fetch(digest_key), "bytes" => bytes.bytesize,
+            "prepared_work" => registered.fetch("prepared_work"), "definition_digest" => registered.fetch("definition_digest")},
+            transfer_parts: [bytes], replayed: false}
+        end
+
+        def progress(request, peer, role, deadline, transfer)
+          validate_progress!(request)
+          unless %i[supervisor worker].include?(role)
+            raise AttemptErrors::UnauthorizedIdentity, "ordinary progress requires its original worker"
+          end
+          params, operation = request.fetch("params"), request.fetch("operation")
+          report = if operation == "queue_finish"
+            raise ArgumentError, "ordinary progress report needs one bounded part" unless transfer && transfer.count == 1
+            bytes = transfer.bytes.dup.force_encoding(Encoding::UTF_8)
+            unless bytes.bytesize.between?(1, 65_536) && bytes.valid_encoding? && !bytes.include?("\0")
+              raise ArgumentError, "ordinary progress report must be bounded UTF-8"
+            end
+            bytes
+          elsif transfer
+            raise ArgumentError, "ordinary progress operation forbids transfer"
+          end
+          commit = @journal.ref_value
+          registered = registration(params.fetch("assignment_id"), commit: commit)
+          raise AttemptErrors::NotFound, "ordinary work is not registered" unless registered
+          work = registered_work(registered, commit, deadline)
+          digest = Atoms::EvidenceDigest.digest({"params" => params, "project_id" => @project, "peer_uid" => peer.fetch("uid")})
+          keys = [@exclusion.task_key(registered.fetch("task_id")), @exclusion.assignment_key(params.fetch("assignment_id"))]
+          @exclusion.with_shared_multi(keys, deadline: deadline) do
+            authorize!(request, peer, role, deadline)
+            @journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
+              mutation_id: request.fetch("mutation_id"), operation: operation, parameters_digest: digest,
+              expected_generation: params.fetch("expected_generation"), with_replay: true, deadline: deadline,
+              replay_authorizer: -> { authorize_start_replay!(request, peer, role, deadline) }) do |events, prefix, _generation|
+              authorize_start_replay!(request, peer, role, deadline)
+              unless Molecules::CanonicalAttemptState.derive(events) == "running"
+                raise AttemptErrors::Conflict, "ordinary progress requires the original running attempt"
+              end
+              record = current_queue_record(registered, prefix)
+              scope = events.find { |event| event["type"] == "intent" }.fetch("payload").fetch("scope")
+              queue = OrdinaryQueue.new(work: work, root: @input_root, bytes: queue_bytes(record, prefix))
+              next_queue = case operation
+              when "queue_start" then queue.transition(operation: :start, scope: scope, step: params.fetch("step"))
+              when "queue_finish" then queue.transition(operation: :finish, scope: scope, step: params.fetch("step"), report: report)
+              when "queue_fail" then queue.transition(operation: :fail, scope: scope, message: params.fetch("message"))
+              end
+              sha = Digest::SHA256.hexdigest(next_queue.bytes)
+              path = "execution/definitions/#{params.fetch('assignment_id')}-queue-#{sha}.json"
+              {events: [], blobs: {path => next_queue.bytes}, data: {
+                "authority" => "ordinary", "assignment_id" => params.fetch("assignment_id"), "attempt_id" => params.fetch("attempt_id"),
+                "project_id" => @project, "scope" => scope, "queue_ref" => path, "queue_sha256" => sha, "state" => "running",
+                "queue_complete" => next_queue.status.subtree_complete?(scope)}}
+            end
+          end
+        end
+
+        def current_queue_record(registered, commit)
+          assignment = registered.fetch("assignment_id")
+          events = @journal.read_events(assignment, commit: commit)
+          events.group_by { |event| event.fetch("attempt_id") }.each_value do |chain|
+            raise AttemptErrors::EvidenceUnavailable, "ordinary queue history is corrupt" unless Models::EvidenceEvent.chain_valid?(chain)
+          end
+          updates = events.select do |entry|
+            entry["type"] == "authority_mutation" &&
+              %w[start_attempt queue_start queue_finish queue_fail].include?(entry.dig("payload", "operation"))
+          end
+          return registered if updates.empty?
+          event = @journal.latest_event!(assignment_id: assignment, event_digests: updates.map { |entry| entry.fetch("digest") }, commit: commit)
+          record = event.dig("payload", "data")
+          unless record && record.values_at("authority", "assignment_id", "attempt_id", "project_id") ==
+              ["ordinary", assignment, event.fetch("attempt_id"), @project]
+            raise AttemptErrors::EvidenceUnavailable, "ordinary canonical queue is unavailable"
+          end
+          record
+        end
+
+        def queue_bytes(record, commit)
+          bytes = @journal.bounded_blob(record.fetch("queue_ref"), commit: commit, max_bytes: PreparedWork::MAX_TOTAL)
+          unless Digest::SHA256.hexdigest(bytes) == record.fetch("queue_sha256")
+            raise AttemptErrors::EvidenceUnavailable, "ordinary canonical queue bytes differ"
+          end
+          bytes
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/ordinary_queue.rb

@@ -0,0 +1,115 @@
+# frozen_string_literal: true
+
+require "tmpdir"
+require "fileutils"
+require_relative "prepared_work"
+require_relative "private_directory"
+require_relative "../organisms/assignment_executor"
+
+module Ace
+  module Assign
+    module Authority
+      # A disposable projection for the existing queue engine. Only bytes read
+      # from (or about to be committed to) the canonical execution ref enter it.
+      # No files left by an earlier coordinator are recovery input.
+      class OrdinaryQueue
+        attr_reader :bytes
+
+        def initialize(work:, root:, bytes: nil)
+          raise ArgumentError, "ordinary queue requires prepared work" unless work.is_a?(PreparedWork)
+          @work, @root = work, PrivateDirectory.verify!(root)
+          value = if bytes
+            invalid! unless bytes.is_a?(String) && bytes.bytesize.between?(1, PreparedWork::MAX_TOTAL)
+            JSON.parse(bytes)
+          else
+            {"version" => 1, "steps" => work.manifest.fetch("steps").to_h { |step|
+              name = step.fetch("filename"); [name, work.files.fetch("steps/#{name}")]
+            }, "reports" => {}}
+          end
+          validate!(value, initial: bytes.nil?)
+          @bytes = Atoms::EvidenceDigest.canonical_json(value).freeze
+        rescue JSON::ParserError
+          invalid!
+        end
+
+        def status
+          value = JSON.parse(@bytes)
+          assignment = Models::Assignment.from_h(@work.definition, cache_dir: File.join(@root, @work.manifest.fetch("assignment_id")))
+          Molecules::QueueScanner.new.scan_captured(steps: value.fetch("steps"), reports: value.fetch("reports"), assignment: assignment)
+        end
+
+        # This returns proposed bytes only. The lifecycle owns authorization,
+        # generation, replay and publication together with its attempt events.
+        def transition(operation:, scope: @work.manifest.fetch("scope"), step: nil, report: nil, message: nil)
+          invalid! unless @work.manifest.fetch("steps").any? { |entry| entry.fetch("number") == scope }
+          value = JSON.parse(@bytes)
+          Dir.mktmpdir("ordinary-queue-", @root) do |scratch|
+            File.chmod(0o700, scratch)
+            directory = File.join(scratch, @work.manifest.fetch("assignment_id"))
+            %w[steps reports].each { |name| FileUtils.mkdir_p(File.join(directory, name), mode: 0700) }
+            assignment = Models::Assignment.from_h(@work.definition, cache_dir: directory)
+            write(File.join(directory, "assignment.yaml"), assignment.to_h.to_yaml)
+            write(File.join(directory, "job.yaml"), @work.files.fetch("job.yaml"))
+            %w[steps reports].each do |group|
+              value.fetch(group).each { |filename, content| write(File.join(directory, group, filename), content) }
+            end
+            executor = Organisms::AssignmentExecutor.new(cache_base: scratch, selected_assignment: assignment)
+            case operation
+            when :activate
+              state = executor.status.fetch(:state)
+              invalid! unless state.find_by_number(scope)&.status == :pending
+              executor.step_writer.mark_active(state.find_by_number(scope).file_path)
+            when :start
+              executor.start_step(step_number: step, fork_root: scope)
+            when :finish
+              executor.finish_step(report_content: report, step_number: step, fork_root: scope)
+            when :fail
+              executor.fail(message, fork_root: scope)
+            else
+              raise ArgumentError, "unknown ordinary queue transition"
+            end
+            result = {"version" => 1}
+            %w[steps reports].each do |group|
+              result[group] = Dir.children(File.join(directory, group)).to_h do |filename|
+                [filename, File.binread(File.join(directory, group, filename)).force_encoding(Encoding::UTF_8)]
+              end
+            end
+            self.class.new(work: @work, root: @root, bytes: Atoms::EvidenceDigest.canonical_json(result))
+          end
+        end
+
+        private
+
+        def validate!(value, initial:)
+          invalid! unless value.is_a?(Hash) && value.keys.sort == %w[reports steps version] && value["version"].is_a?(Integer) && value["version"] == 1 &&
+            value["steps"].is_a?(Hash) && value["reports"].is_a?(Hash)
+          expected = @work.manifest.fetch("steps").map { |step| step.fetch("filename") }
+          invalid! unless value.fetch("steps").keys.sort == expected.sort
+          reports = []
+          value.fetch("steps").each do |filename, content|
+            parsed = @work.parse_queue_step!(content)
+            progress = parsed.fetch(:frontmatter).keys & PreparedWork::PROGRESS
+            allowed = initial ? %w[status] : %w[status started_at completed_at error stall_reason]
+            invalid! unless (progress - allowed).empty?
+            original = @work.files.fetch("steps/#{filename}")
+            invalid! unless PreparedWork.work_projection(content) == PreparedWork.work_projection(original) &&
+              %w[pending active done failed].include?(parsed.fetch(:frontmatter).fetch("status", "pending"))
+            info = Atoms::StepFileParser.parse_filename(filename)
+            reports << Atoms::StepFileParser.generate_report_filename(info.fetch(:number), info.fetch(:name))
+          end
+          invalid! unless (value.fetch("reports").keys - reports).empty?
+          value.fetch("reports").each_value { |content| @work.parse_queue_step!(content) }
+          invalid! if Atoms::EvidenceDigest.canonical_json(value).bytesize > PreparedWork::MAX_TOTAL
+        end
+
+        def write(path, content)
+          File.open(path, File::WRONLY | File::CREAT | File::EXCL | File::NOFOLLOW, 0600) { |file| file.write(content) }
+        end
+
+        def invalid!
+          raise AttemptErrors::EvidenceUnavailable, "ordinary canonical queue differs from its accepted work"
+        end
+      end
+    end
+  end
+end