ace-assign 0.69.0 → 0.70.0

data/lib/ace/assign/authority/ordinary_results.rb

@@ -0,0 +1,196 @@
+# frozen_string_literal: true
+
+require_relative "receipt_transfer"
+require_relative "../molecules/canonical_evidence"
+
+module Ace
+  module Assign
+    module Authority
+      # A worker submits an attributable result. This never accepts a terminal
+      # outcome, an independent review, or an external delivery effect.
+      module OrdinaryResults
+        RESULT_OPERATIONS = %w[submit_result result_status result_snapshot].freeze
+        RESULT_TRANSFERS = {
+          "submit_result" => {direction: :upload, purpose: :receipt_artifacts, roles: %i[worker supervisor]},
+          "result_snapshot" => {direction: :download, purpose: :receipt_artifacts, roles: %i[worker supervisor]}
+        }.freeze
+        RESULT_KEYS = %w[assignment_id attempt_id expected_generation pane head receipt_sha256 transfer].freeze
+
+        private
+
+        def validate_result!(request)
+          params = request.fetch("params")
+          if request.fetch("operation") != "submit_result"
+            snapshot = request.fetch("operation") == "result_snapshot"
+            strict!(params, %w[assignment_id attempt_id] + (snapshot ? ["result_id"] : []))
+            token!(params.fetch("result_id")) if snapshot
+            raise ArgumentError, "ordinary result status mutation must be null" unless request.fetch("mutation_id").nil?
+          else
+            strict!(params, RESULT_KEYS)
+            token!(request.fetch("mutation_id"))
+            unless params.fetch("expected_generation").is_a?(Integer) && params.fetch("expected_generation").positive? &&
+                params.fetch("head").is_a?(String) && params.fetch("head").match?(/\A[0-9a-f]{40}\z/) &&
+                params.fetch("receipt_sha256").is_a?(String) && params.fetch("receipt_sha256").match?(/\A[0-9a-f]{64}\z/)
+              raise ArgumentError, "ordinary result selection is invalid"
+            end
+          end
+          %w[assignment_id attempt_id].each { |key| token!(params.fetch(key)) }
+        end
+
+        def ordinary_result(request, peer, role, deadline, transfer)
+          validate_result!(request)
+          params = request.fetch("params")
+          commit = @journal.ref_value
+          registered = registration(params.fetch("assignment_id"), commit: commit)
+          raise AttemptErrors::NotFound, "ordinary work is not registered" unless registered
+          if request.fetch("operation") != "submit_result"
+            events = result_events(params, commit)
+            result = retained_ordinary_result(params, events, commit)
+            if request.fetch("operation") == "result_snapshot"
+              unless result && result.fetch("result_id") == params.fetch("result_id")
+                raise AttemptErrors::NotFound, "ordinary exact result is unavailable"
+              end
+              receipt = result.fetch("receipt")
+              canonical = Molecules::CanonicalEvidence.new(journal: @journal)
+              parts = [JSON.generate(receipt)] + receipt.fetch("artifacts").map { |artifact|
+                canonical.read({"ref" => artifact.fetch("path"), "sha256" => artifact.fetch("sha256")},
+                  **ordinary_result_context(result.fetch("binding")), commit: commit)
+              }
+              authorize!(request, peer, role, deadline)
+              return {data: ordinary_result_projection(result).merge("journal_commit" => commit), transfer_parts: parts, replayed: false}
+            end
+            authorize!(request, peer, role, deadline)
+            return {data: {"assignment_id" => params.fetch("assignment_id"), "attempt_id" => params.fetch("attempt_id"),
+              "journal_commit" => commit, "generation" => @journal.authority_generation(events),
+              "state" => Molecules::CanonicalAttemptState.derive(events), "submitted_result" => result && ordinary_result_projection(result)}, replayed: false}
+          end
+          unless %i[worker supervisor].include?(role)
+            raise AttemptErrors::UnauthorizedIdentity, "ordinary result requires its original worker"
+          end
+          authorize_start_replay!(request, peer, role, deadline)
+          admitted = ReceiptTransfer.decode(input: transfer, receipt_sha256: params.fetch("receipt_sha256"),
+            artifact_field: "artifacts", reference_key: "path")
+          digest = Atoms::EvidenceDigest.digest({"params" => params, "project_id" => @project, "peer_uid" => peer.fetch("uid")})
+          keys = [@exclusion.task_key(registered.fetch("task_id")), @exclusion.assignment_key(params.fetch("assignment_id"))]
+          @exclusion.with_shared_multi(keys, deadline: deadline) do
+            @journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
+              mutation_id: request.fetch("mutation_id"), operation: "submit_result", parameters_digest: digest,
+              expected_generation: params.fetch("expected_generation"), with_replay: true, deadline: deadline,
+              replay_authorizer: -> { authorize_start_replay!(request, peer, role, deadline) }) do |events, prefix, generation|
+              authorize_start_replay!(request, peer, role, deadline)
+              unless Molecules::CanonicalAttemptState.derive(events) == "running"
+                raise AttemptErrors::Conflict, "ordinary result requires the original running attempt"
+              end
+              raise AttemptErrors::Conflict, "ordinary attempt already submitted its result" if retained_ordinary_result(params, events, prefix)
+              observed = @admission.execution!(peer: peer, pane: params.fetch("pane"), head: params.fetch("head"), deadline: deadline)
+              start_replay_owner!(params, observed.fetch(:identity))
+              ordinary_result_plan(params, peer, admitted, observed, events, prefix, generation + 1)
+            end
+          end
+        end
+
+        def result_events(params, commit)
+          events = @journal.read_events(params.fetch("assignment_id"), commit: commit)
+            .select { |event| event.fetch("attempt_id") == params.fetch("attempt_id") }
+          unless Models::EvidenceEvent.chain_valid?(events) && events.one? { |event| event["type"] == "process_start" }
+            raise AttemptErrors::EvidenceUnavailable, "ordinary result attempt evidence is unavailable"
+          end
+          events
+        end
+
+        def ordinary_result_plan(params, peer, admitted, observed, events, commit, generation)
+          original = admitted.fetch(:receipt)
+          original_receipt = Models::ExecutionReceipt.from_h(original)
+          unless original_receipt.digest == Atoms::EvidenceDigest.digest(original_receipt.digest_payload)
+            raise AttemptErrors::ReceiptRejected, "ordinary original result digest differs"
+          end
+          identity = observed.fetch(:identity)
+          expected_producer = {"actor" => identity.actor, "role" => identity.role, "runtime" => identity.runtime}
+          validate_ordinary_result_receipt!(original, expected_producer)
+          id = SecureRandom.hex(16)
+          binding = params.slice("assignment_id", "attempt_id", "head").merge("authority" => "ordinary", "project_id" => @project,
+            "result_id" => id, "worker_uid" => peer.fetch("uid"), "producer" => expected_producer,
+            "runtime_binding" => identity.runtime_binding, "checkout" => observed.fetch(:checkout),
+            "generation" => generation, "uploaded_receipt_sha256" => admitted.fetch(:receipt_sha256),
+            "original_receipt_digest" => original_receipt.digest)
+          canonical = Molecules::CanonicalEvidence.new(journal: @journal)
+          plan = admitted.fetch(:artifacts).empty? ? {events: [], blobs: {}, references: []} :
+            canonical.import_plan(**ordinary_result_context(binding), artifacts: admitted.fetch(:artifacts),
+              admitted_after_event_digest: events.last.fetch("digest"))
+          receipt = original.except("digest", "recorded_at").merge("artifacts" => plan.fetch(:references).map { |reference|
+            {"path" => reference.fetch("ref"), "sha256" => reference.fetch("sha256")}
+          })
+          pending = @journal.send(:chain_mutation_events, params.fetch("attempt_id"), events.last.fetch("digest"), plan.fetch(:events))
+          reader = ->(_data, artifact) { canonical.read_pending({"ref" => artifact.fetch("path"), "sha256" => artifact.fetch("sha256")},
+            **ordinary_result_context(binding), current_events: events, pending_events: pending, blobs: plan.fetch(:blobs), commit: commit) }
+          verified = verify_ordinary_result_receipt(params, receipt, binding, commit, reader)
+          if JSON.generate(verified.to_h).bytesize > 16_384
+            raise AttemptErrors::ReceiptRejected, "canonical ordinary receipt exceeds its transfer limit"
+          end
+          payload = {"authority" => "ordinary", "result_id" => id, "binding" => binding, "receipt" => verified.to_h}
+          plan.merge(events: plan.fetch(:events) + [{type: "result_submitted", payload: payload}],
+            data: ordinary_result_projection(payload))
+        end
+
+        def ordinary_result_projection(payload)
+          payload.slice("result_id").merge(payload.fetch("binding").slice("head", "generation"),
+            "receipt_digest" => payload.fetch("receipt").fetch("digest"), "verdict" => payload.fetch("receipt").fetch("verdict"),
+            "state" => "running", "authority" => "ordinary")
+        end
+
+        def ordinary_result_context(binding)
+          {kind: "result", project_id: @project, assignment_id: binding.fetch("assignment_id"), attempt_id: binding.fetch("attempt_id"),
+            peer_uid: binding.fetch("worker_uid"), binding: binding, request_id_or_event_id: binding.fetch("result_id"), generation: binding.fetch("generation")}
+        end
+
+        def validate_ordinary_result_receipt!(receipt, producer)
+          unless receipt["producer"] == producer && (receipt.keys - Models::ExecutionReceipt.from_h(receipt).to_h.keys).empty? &&
+              !receipt["campaign"] && !receipt["review"] && receipt["operation"] != "review" &&
+              !Molecules::ReceiptVerifier::EXTERNAL_EFFECT_OPERATIONS.include?(receipt["operation"])
+            raise AttemptErrors::ReceiptRejected, "ordinary result producer or operation requires another evidence owner"
+          end
+        end
+
+        def verify_ordinary_result_receipt(params, receipt, binding, commit, reader)
+          validate_ordinary_result_receipt!(receipt, binding.fetch("producer"))
+          attempt = @journal.derived_attempts(params.fetch("assignment_id"), commit: commit).find { |item| item.attempt_id == params.fetch("attempt_id") }
+          raise AttemptErrors::EvidenceUnavailable, "ordinary result attempt is unavailable" unless attempt
+          Array(receipt["artifacts"]).each { |artifact| reader.call(receipt, artifact) }
+          Molecules::ReceiptVerifier.new(artifact_reader: reader).verify_result!(receipt,
+            attempt: attempt, live_head: binding.fetch("head"), repo_root: @journal.repo_root)
+        end
+
+        def retained_ordinary_result(params, events, commit)
+          raise AttemptErrors::EvidenceUnavailable, "ordinary result chain is corrupt" unless Models::EvidenceEvent.chain_valid?(events)
+          records = events.select { |event| event["type"] == "result_submitted" }
+          replies = events.select { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "submit_result" }
+          return nil if records.empty? && replies.empty?
+          unless records.one? && replies.one?
+            raise AttemptErrors::EvidenceUnavailable, "ordinary result provenance is missing or duplicated"
+          end
+          payload = records.first.fetch("payload")
+          binding = payload.fetch("binding")
+          start = events.find { |event| event["type"] == "process_start" }.fetch("payload")
+          unless payload.keys.sort == %w[authority binding receipt result_id] && payload["authority"] == "ordinary" &&
+              payload["result_id"].is_a?(String) && payload["result_id"].match?(/\A[0-9a-f]{32}\z/) &&
+              binding.keys.sort == %w[assignment_id attempt_id authority checkout generation head original_receipt_digest producer project_id result_id runtime_binding uploaded_receipt_sha256 worker_uid] &&
+              binding["authority"] == "ordinary" && binding["result_id"] == payload["result_id"] &&
+              binding["head"] == binding.dig("checkout", "head") &&
+              binding.values_at("project_id", "assignment_id", "attempt_id", "runtime_binding") ==
+              [@project, params.fetch("assignment_id"), params.fetch("attempt_id"), start.fetch("runtime_binding")] &&
+              binding.fetch("producer") == start.slice("actor", "role", "runtime") &&
+              binding.fetch("worker_uid") == start.dig("runtime_binding", "process_identity", "uid") &&
+              payload.fetch("receipt").fetch("producer") == binding.fetch("producer") &&
+              replies.first.dig("payload", "data").slice(*ordinary_result_projection(payload).keys) == ordinary_result_projection(payload)
+            raise AttemptErrors::EvidenceUnavailable, "ordinary result owner differs"
+          end
+          canonical = Molecules::CanonicalEvidence.new(journal: @journal)
+          reader = ->(_data, artifact) { canonical.read({"ref" => artifact.fetch("path"), "sha256" => artifact.fetch("sha256")},
+            **ordinary_result_context(binding), commit: commit) }
+          verify_ordinary_result_receipt(params, payload.fetch("receipt"), binding, commit, reader)
+          payload
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/ordinary_server.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+require_relative "socket_server"
+
+module Ace
+  module Assign
+    module Authority
+      # Explicit ordinary admission over Assign's existing wire/transfer owner.
+      # The Lab composition supplies a trusted installed admission object and
+      # closed handlers. No protected Deployment or kernel adapter is replaced.
+      class OrdinaryServer < SocketServer
+        def initialize(admission:, lifecycle:, services: [])
+          @admission = admission
+          super(service: admission.service, lifecycle: lifecycle, services: services)
+        end
+
+        private
+
+        def verify_listener!
+          @admission.verify_listener!
+        end
+
+        def authorize_transfer!(request:, peer:, role:, deadline:)
+          @lifecycle.authorize_transfer!(request: request, peer: peer, role: role, deadline: deadline)
+        end
+
+        def dispatch_lifecycle(request:, peer:, role:, deadline:, transfer: nil)
+          @lifecycle.dispatch(request: request, peer: peer, role: role, deadline: deadline, transfer: transfer)
+        end
+
+        def receive(socket)
+          deadline = wire.deadline(30)
+          peer = @admission.peer(socket, deadline: deadline)
+          ingress = Ace::Runtime::Molecules::ProtectedSocket::Ingress.new(socket)
+          frame = wire.read(ingress, deadline: [deadline, wire.deadline(5)].min, limit: 16_384, with_size: true)
+          request = frame.fetch(:data)
+          unless request.is_a?(Hash) && request.keys.sort == %w[mutation_id operation params project_id version] &&
+              request["version"].is_a?(Integer) && request["version"] == 1 &&
+              request["operation"].is_a?(String) && request["params"].is_a?(Hash)
+            raise ArgumentError, "invalid ordinary authority envelope"
+          end
+          role = @admission.authorize!(request: request, peer: peer, deadline: deadline)
+          binding = @lifecycle.transfer_binding(request)
+          bodyless_read!(ingress, deadline) unless binding && binding.fetch(:direction) == :upload
+          # Both binary bodies and EOF use ancillary-rejecting reads. Replies
+          # use the original duplex socket through the wrapper below.
+          dispatch_request(Duplex.new(socket, ingress), request, peer, role, deadline, frame_bytes: frame.fetch(:bytesize))
+        rescue ArgumentError, KeyError, AttemptErrors::MalformedTransfer
+          refusal(socket, "invalid_input")
+        rescue AttemptErrors::UnauthorizedIdentity, SecurityError
+          refusal(socket, "unauthorized")
+        rescue AttemptErrors::Conflict
+          refusal(socket, "conflict")
+        rescue AttemptErrors::NotFound
+          refusal(socket, "missing")
+        rescue AttemptErrors::BoundedResultUnavailable
+          refusal(socket, "bounded_result")
+        rescue StandardError
+          refusal(socket, "evidence_unavailable")
+        ensure
+          socket.close unless socket.closed?
+          @mutex.synchronize { @connections.delete(socket) }
+        end
+
+        class Duplex
+          def initialize(socket, ingress) = (@socket, @ingress = socket, ingress)
+          def to_io = @socket
+          def read_nonblock(*args, **options) = @ingress.read_nonblock(*args, **options)
+          def write_nonblock(*args, **options) = @socket.write_nonblock(*args, **options)
+        end
+        private_constant :Duplex
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/prepared_work.rb

@@ -69,9 +69,9 @@ module Ace
         # The existing transport verifies complete Git objects before this
         # shared byte contract parses anything. Preserve the original input for
         # the eventual registration journal; CandidateTransfer may reexport it.
-        def self.admit(bytes:, head:, tree:, sha256:, size:, root:)
+        def self.admit(bytes:, head:, tree:, sha256:, size:, root:, deadline: nil)
           transfer = CandidateTransfer.new(root: root)
-          transfer.admit(bytes: bytes, head: head, sha256: sha256, size: size) do |repository, deadline, result|
+          transfer.admit(bytes: bytes, head: head, sha256: sha256, size: size, deadline: deadline) do |repository, deadline, result|
             raise ArgumentError, "prepared_input_invalid: Git tree differs" unless result.fetch("tree") == tree
             new(files: transfer.prepared_files(repository: repository, deadline: deadline, head: head))
           end

data/lib/ace/assign/authority/protected_assignment_context.rb

@@ -12,7 +12,7 @@ module Ace
       class ProtectedAssignmentContext
         attr_reader :uid
 
-        def self.load
+        def self.load(uid: Process.uid)
           paths = [Deployment::PATH, DeploymentHistory::PATH]
           installed = paths.any? do |path|
             begin
@@ -22,13 +22,13 @@ module Ace
               false
             end
           end
-          return new(deployment: nil, history: nil) unless installed
+          return new(deployment: nil, history: nil, uid: uid) unless installed
           deployment = Deployment.load
           history = DeploymentHistory.load
           unless history.selects?(deployment)
             raise AttemptErrors::EvidenceUnavailable, "installed protected descriptor is not retained"
           end
-          new(deployment: deployment, history: history)
+          new(deployment: deployment, history: history, uid: uid)
         end
 
         def initialize(deployment:, history:, uid: Process.uid, kernel: nil, env: ENV,

data/lib/ace/assign/authority/router.rb

@@ -4,10 +4,10 @@ module Ace
     module Authority
       # Source-owned handlers share one listener. Requests never name a method.
       class Router
-        def initialize(launch:, handlers: [])
+        def initialize(launch: nil, handlers: [])
           @launch = launch
           @routes = {}
-          ([launch] + handlers).each do |handler|
+          ([launch].compact + handlers).each do |handler|
             handler.class::OPERATIONS.each do |operation|
               raise ArgumentError, "duplicate authority operation" if @routes.key?(operation)
               @routes[operation] = handler
@@ -16,11 +16,12 @@ module Ace
           @routes.freeze
         end
 
-        def dispatch(request:, peer:, role:, transfer: nil)
+        def dispatch(request:, peer:, role:, transfer: nil, deadline: nil)
           validate_review_namespace!(request)
           handler = @routes.fetch(request.fetch("operation")) { raise ArgumentError, "unknown authority operation" }
           options = {request: request, peer: peer, role: role}
           options[:transfer] = transfer if transfer
+          options[:deadline] = deadline if deadline
           handler.dispatch(**options)
         end
 
@@ -42,10 +43,12 @@ module Ace
           binding
         end
 
-        def authorize_transfer!(request:, peer:, role:)
+        def authorize_transfer!(request:, peer:, role:, deadline: nil)
           validate_review_namespace!(request)
           handler = @routes.fetch(request.fetch("operation"))
-          handler.authorize_transfer!(request: request, peer: peer, role: role)
+          options = {request: request, peer: peer, role: role}
+          options[:deadline] = deadline if deadline
+          handler.authorize_transfer!(**options)
         end
 
         def validate_review_namespace!(request)
@@ -60,14 +63,16 @@ module Ace
         private :validate_review_namespace!
 
         def close
-          @launch.close
+          @routes.values.uniq.each { |handler| handler.close if handler.respond_to?(:close) }
         end
 
         def serve_launch_control!(**options)
+          raise AttemptErrors::EvidenceUnavailable, "launch control is unavailable in this composition" unless @launch
           @launch.serve_launch_control!(**options)
         end
 
         def gate_ready(**options)
+          raise AttemptErrors::EvidenceUnavailable, "launch gate is unavailable in this composition" unless @launch
           @launch.gate_ready(**options)
         end
       end

data/lib/ace/assign/authority/server.rb

@@ -1,129 +1,29 @@
 # frozen_string_literal: true
-require "socket"
-require "fileutils"
+
 require_relative "deployment"
-require_relative "transfer_codec"
-require_relative "../molecules/evidence_journal"
+require_relative "socket_server"
 
 module Ace
   module Assign
     module Authority
-      # Existing assignment owner transport; kernel peers select roles, never argv.
-      class Server
-        CONNECTIONS = 16
+      # Protected admission is mandatory for this source-selected composition.
+      class Server < SocketServer
         def initialize(authority_id:, lifecycle:, deployment: Deployment.load,
-          kernel: Ace::Runtime::Molecules::ProtectedLinux.new, composition: "launch", hitl_service: nil)
-          @authority_id, @lifecycle, @deployment, @kernel = authority_id, lifecycle, deployment, kernel
-          @composition = composition
-          @hitl_service = hitl_service
+          kernel: Ace::Runtime::Molecules::ProtectedLinux.new, composition: "launch", services: [])
+          @authority_id, @deployment, @kernel, @composition = authority_id, deployment, kernel, composition
           deployment.verify_composition!(authority_id, composition: composition)
-          @service = deployment.authority(authority_id)
-          @mutex = Mutex.new
-          @connections = []
-          @handlers = []
-          @transfers = 0
-          @stopped = false
+          super(service: deployment.authority(authority_id), lifecycle: lifecycle, services: services)
         end
 
-        def serve
+        private
+
+        def verify_listener!
           @kernel.supported!
           me = @kernel.capture(Process.pid)
           unless principal?(me, @service, "uid", "gid", "groups")
             raise AttemptErrors::UnauthorizedIdentity, "listener principal differs from installed authority"
           end
           @deployment.verify_receiver_paths!(@authority_id)
-          directory = File.dirname(@service.fetch("socket_path"))
-          wire.root_path!(directory, directory: true, owner: @service.fetch("uid"))
-          lock = File.open(File.join(directory, "listener.lock"), File::RDWR | File::CREAT | File::NOFOLLOW, 0o600)
-          unless lock.flock(File::LOCK_EX | File::LOCK_NB)
-            raise AttemptErrors::Conflict, "assignment authority already owns its listener"
-          end
-          start_hitl_service!
-          path = @service.fetch("socket_path")
-          if File.exist?(path) || File.symlink?(path)
-            raise AttemptErrors::Conflict, "existing authority endpoint requires verified installer recovery"
-          end
-          @listener = UNIXServer.new(path)
-          File.chmod(0o660, path)
-          @endpoint = wire.socket_identity(path)
-          until @stopped
-            if @hitl_thread && !@hitl_thread.alive?
-              raise Ace::Runtime::RuntimeUnavailableError, "protected HITL boundary stopped before its authority"
-            end
-            ready = IO.select([@listener], nil, nil, 0.25)
-            next unless ready
-            socket = @listener.accept_nonblock(exception: false)
-            next if socket == :wait_readable
-            admitted = @mutex.synchronize do
-              if @connections.size < CONNECTIONS
-                @connections << socket
-                true
-              end
-            end
-            unless admitted
-              refusal(socket, "busy")
-              socket.close
-              next
-            end
-            @mutex.synchronize do
-              @handlers.reject! { |handler| !handler.alive? }
-              @handlers << Thread.new(socket) { |connection| receive(connection) }
-            end
-          end
-        rescue IOError, Errno::EBADF
-          raise unless @stopped
-        ensure
-          stop
-          stop_hitl_service!
-          # Closing a stream does not cancel a handler already inside dispatch.
-          # The owner lock and endpoint remain held until every handler ends.
-          @mutex.synchronize { @handlers.dup }.each(&:join)
-          @lifecycle.close if @endpoint && @lifecycle.respond_to?(:close)
-          if @endpoint && same_endpoint?(path)
-            File.unlink(path)
-          end
-          lock&.close
-        end
-
-        def request_stop
-          @stopped = true
-        end
-
-        def stop
-          @stopped = true
-          @listener&.close unless @listener&.closed?
-          @mutex.synchronize { @connections.each { |socket| socket.close unless socket.closed? } }
-        end
-
-        private
-
-        # The existing HITL boundary is a sibling owned by this listener's
-        # lifetime. It must be ready before assignment ingress is opened.
-        def start_hitl_service!
-          return unless @hitl_service
-          ready = Queue.new
-          @hitl_thread = Thread.new do
-            @hitl_service.run(on_ready: -> { ready << :ready })
-          rescue Exception => error
-            @hitl_failure = error
-            ready << error
-          end
-          @hitl_thread.report_on_exception = false
-          result = ready.pop(timeout: 5)
-          raise Ace::Runtime::RuntimeUnavailableError, "protected HITL boundary startup timed out" if result.nil?
-          raise result if result.is_a?(Exception)
-        end
-
-        def stop_hitl_service!
-          return unless @hitl_thread
-          @hitl_service.stop
-          @hitl_thread.join
-        end
-
-        def same_endpoint?(path)
-          wire.socket_identity(path) == @endpoint
-        rescue StandardError
-          false
         end
 
         def receive(socket)
@@ -200,40 +100,7 @@ module Ace
             raise AttemptErrors::UnauthorizedIdentity, "gate readiness requires worker peer" unless role == :worker
             @lifecycle.gate_ready(request: request, peer: peer, socket: socket, deadline: deadline)
           else
-            Molecules::EvidenceJournal.with_event_read_operation do
-              binding = @lifecycle.transfer_binding(request) if @lifecycle.respond_to?(:transfer_binding)
-              if binding
-                raise AttemptErrors::UnauthorizedIdentity, "transfer role differs" unless binding.fetch(:roles).include?(role)
-                raise ArgumentError, "transfer control header is oversized" if frame.fetch(:bytesize) > 16_384
-                @lifecycle.authorize_transfer!(request: request, peer: peer, role: role)
-                admitted_transfer = @mutex.synchronize do
-                  if @transfers < 2
-                    @transfers += 1
-                    true
-                  end
-                end
-                raise AttemptErrors::Conflict, "transfer capacity is busy" unless admitted_transfer
-                codec = transfer_codec
-                if binding.fetch(:direction) == :upload
-                  result = codec.receive(socket, descriptor: params.fetch("transfer"), purpose: binding.fetch(:purpose), deadline: deadline) do |input|
-                    @lifecycle.dispatch(request: request, peer: peer, role: role, transfer: input)
-                  end
-                else
-                  result = @lifecycle.dispatch(request: request, peer: peer, role: role)
-                  parts = result.fetch(:transfer_parts)
-                  descriptor = codec.descriptor(parts, purpose: binding.fetch(:purpose))
-                  result = result.merge(data: result.fetch(:data).merge("transfer" => descriptor))
-                end
-              else
-                raise ArgumentError, "unexpected transfer descriptor" if params.key?("transfer")
-                result = @lifecycle.dispatch(request: request, peer: peer, role: role)
-              end
-              wire.write(socket, {"status" => "ok", "data" => result.fetch(:data),
-                "transport" => {"replayed" => result.fetch(:replayed, false)}}, deadline: deadline, limit: 16_384)
-              if binding && binding.fetch(:direction) == :download
-                codec.send(socket, parts: parts, descriptor: descriptor, purpose: binding.fetch(:purpose), deadline: deadline)
-              end
-            end
+            dispatch_request(socket, request, peer, role, deadline, frame_bytes: frame.fetch(:bytesize))
           end
         rescue ArgumentError, KeyError, AttemptErrors::MalformedTransfer
           refusal(socket, "invalid_input")
@@ -255,45 +122,9 @@ module Ace
           end
         end
 
-        # These closed read operations have no request body. Half-close proves
-        # framing completion before status or artifact data can be exposed.
-        def bodyless_read!(socket, deadline)
-          loop do
-            remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
-            raise ArgumentError, "read request framing is incomplete" unless remaining.positive? && IO.select([socket], nil, nil, remaining)
-            bytes = socket.read_nonblock(1, exception: false)
-            next if bytes == :wait_readable
-            raise ArgumentError, "unexpected read request body" unless bytes.nil?
-            return
-          end
-        end
-
-        def transfer_codec
-          @mutex.synchronize do
-            @transfer_codec ||= begin
-              root = @service.fetch("state_root")
-              PrivateDirectory.verify!(root)
-              spool = File.join(root, "transfers")
-              Dir.mkdir(spool, 0o700) unless File.exist?(spool) || File.symlink?(spool)
-              TransferCodec.new(root: spool)
-            end
-          end
-        end
-
         def principal?(identity, mapping, uid, gid, groups)
           identity["uid"] == mapping[uid] && identity["gid"] == mapping[gid] && identity["groups"] == mapping[groups]
         end
-
-        def refusal(socket, code)
-          wire.write(socket, {"status" => "error", "error" => {"code" => code, "message" => "Protected authority refused #{code}"}},
-            deadline: wire.deadline(0.1))
-        rescue StandardError
-          nil
-        end
-
-        def wire
-          Ace::Runtime::Molecules::ProtectedSocket
-        end
       end
     end
   end