ace-assign 0.69.0 → 0.70.0

data/lib/ace/assign/authority/socket_server.rb

@@ -0,0 +1,255 @@
+# frozen_string_literal: true
+
+require "socket"
+require "fileutils"
+require_relative "transfer_codec"
+require_relative "../molecules/evidence_journal"
+
+module Ace
+  module Assign
+    module Authority
+      # Shared endpoint lifetime and bounded wire protocol. Concrete source
+      # compositions authenticate their own installed principals before dispatch.
+      # Protected deployment/kernel requirements remain in Server.
+      class SocketServer
+        CONNECTIONS = 16
+
+        def initialize(service:, lifecycle:, services: [])
+          unless services.is_a?(Array) && services.uniq.size == services.size &&
+              services.all? { |owned| owned.respond_to?(:run) && owned.respond_to?(:stop) }
+            raise ArgumentError, "authority services require distinct source-owned run/stop lifetimes"
+          end
+          @service, @lifecycle, @services = service, lifecycle, services.dup.freeze
+          @service_threads = []
+          @activation_gates = []
+          @mutex = Mutex.new
+          @connections = []
+          @handlers = []
+          @transfers = 0
+          @stopped = false
+        end
+
+        def serve
+          verify_listener!
+          directory = File.dirname(@service.fetch("socket_path"))
+          wire.root_path!(directory, directory: true, owner: @service.fetch("uid"))
+          lock = File.open(File.join(directory, "listener.lock"), File::RDWR | File::CREAT | File::NOFOLLOW, 0o600)
+          unless lock.flock(File::LOCK_EX | File::LOCK_NB)
+            raise AttemptErrors::Conflict, "assignment authority already owns its listener"
+          end
+          path = @service.fetch("socket_path")
+          if File.exist?(path) || File.symlink?(path)
+            raise AttemptErrors::Conflict, "existing authority endpoint requires verified installer recovery"
+          end
+          @listener = UNIXServer.new(path)
+          @endpoint = wire.socket_identity(path)
+          File.chmod(0o660, path)
+          start_services!
+          verify_services!
+          @activation_gates.each { |gate| gate << :activate }
+          until @stopped
+            verify_services!
+            ready = IO.select([@listener], nil, nil, 0.25)
+            next unless ready
+            socket = @listener.accept_nonblock(exception: false)
+            next if socket == :wait_readable
+            admitted = @mutex.synchronize do
+              if @connections.size < CONNECTIONS
+                @connections << socket
+                true
+              end
+            end
+            unless admitted
+              refusal(socket, "busy")
+              socket.close
+              next
+            end
+            @mutex.synchronize do
+              @handlers.reject! { |handler| !handler.alive? }
+              @handlers << Thread.new(socket) { |connection| receive(connection) }
+            end
+          end
+        rescue IOError, Errno::EBADF
+          raise unless @stopped
+        ensure
+          begin
+            stop
+            stop_services!
+          ensure
+            # Closing a stream does not cancel an admitted transaction. Hold
+            # the owner lock and endpoint until every handler has ended.
+            begin
+              @mutex.synchronize { @handlers.dup }.each(&:join)
+              @lifecycle.close if @endpoint && @lifecycle.respond_to?(:close)
+            ensure
+              begin
+                File.unlink(path) if @endpoint && same_endpoint?(path)
+              ensure
+                lock&.close
+              end
+            end
+          end
+        end
+
+        def request_stop
+          @stopped = true
+        end
+
+        def stop
+          @stopped = true
+          @listener&.close unless @listener&.closed?
+          @mutex.synchronize { @connections.each { |socket| socket.close unless socket.closed? } }
+        end
+
+        private
+
+        # Installed HITL and merge listeners share the assignment owner lock.
+        # Every selected boundary must be ready before assignment ingress opens;
+        # a stopped boundary closes admission until the complete owner restarts.
+        def start_services!
+          @services.each do |owned|
+            ready = Queue.new
+            activation = Queue.new
+            @activation_gates << activation
+            thread = Thread.new do
+              owned.run(on_ready: lambda do
+                ready << :ready
+                unless activation.pop == :activate
+                  raise Ace::Runtime::RuntimeUnavailableError, "authority startup was cancelled"
+                end
+              end)
+            rescue Exception => error
+              ready << error
+            ensure
+              ready << :stopped
+            end
+            thread.report_on_exception = false
+            @service_threads << [owned, thread]
+            result = ready.pop(timeout: 5)
+            raise Ace::Runtime::RuntimeUnavailableError, "authority service startup did not become ready" unless result == :ready || result.is_a?(Exception)
+            raise result if result.is_a?(Exception)
+          end
+        end
+
+        def verify_services!
+          unless @service_threads.all? { |_, thread| thread.alive? }
+            raise Ace::Runtime::RuntimeUnavailableError, "an owned service stopped before its authority"
+          end
+        end
+
+        def stop_services!
+          errors = []
+          @activation_gates.each { |gate| gate << :cancel }
+          @service_threads.reverse_each do |owned, _|
+            owned.stop
+          rescue Exception => error
+            errors << error
+          end
+          @service_threads.each do |_, thread|
+            thread.join
+          rescue Exception => error
+            errors << error
+          end
+          raise errors.first unless errors.empty?
+        end
+
+        def same_endpoint?(path)
+          wire.socket_identity(path) == @endpoint
+        rescue StandardError
+          false
+        end
+
+        def verify_listener!
+          raise NotImplementedError, "source composition must verify its installed listener"
+        end
+
+        def dispatch_request(socket, request, peer, role, deadline, frame_bytes:)
+          params = request.fetch("params")
+          admitted_transfer = false
+          Molecules::EvidenceJournal.with_event_read_operation do
+            binding = @lifecycle.transfer_binding(request) if @lifecycle.respond_to?(:transfer_binding)
+            if binding
+              raise AttemptErrors::UnauthorizedIdentity, "transfer role differs" unless binding.fetch(:roles).include?(role)
+              raise ArgumentError, "transfer control header is oversized" if frame_bytes > 16_384
+              authorize_transfer!(request: request, peer: peer, role: role, deadline: deadline)
+              admitted_transfer = @mutex.synchronize do
+                if @transfers < 2
+                  @transfers += 1
+                  true
+                end
+              end
+              raise AttemptErrors::Conflict, "transfer capacity is busy" unless admitted_transfer
+              codec = transfer_codec
+              if binding.fetch(:direction) == :upload
+                result = codec.receive(socket, descriptor: params.fetch("transfer"), purpose: binding.fetch(:purpose), deadline: deadline) do |input|
+                  dispatch_lifecycle(request: request, peer: peer, role: role, transfer: input, deadline: deadline)
+                end
+              else
+                result = dispatch_lifecycle(request: request, peer: peer, role: role, deadline: deadline)
+                parts = result.fetch(:transfer_parts)
+                descriptor = codec.descriptor(parts, purpose: binding.fetch(:purpose))
+                result = result.merge(data: result.fetch(:data).merge("transfer" => descriptor))
+              end
+            else
+              raise ArgumentError, "unexpected transfer descriptor" if params.key?("transfer")
+              result = dispatch_lifecycle(request: request, peer: peer, role: role, deadline: deadline)
+            end
+            wire.write(socket, {"status" => "ok", "data" => result.fetch(:data),
+              "transport" => {"replayed" => result.fetch(:replayed, false)}}, deadline: deadline, limit: 16_384)
+            if binding && binding.fetch(:direction) == :download
+              codec.send(socket, parts: parts, descriptor: descriptor, purpose: binding.fetch(:purpose), deadline: deadline)
+            end
+          end
+        ensure
+          @mutex.synchronize { @transfers -= 1 } if admitted_transfer
+        end
+
+        def authorize_transfer!(request:, peer:, role:, deadline:)
+          @lifecycle.authorize_transfer!(request: request, peer: peer, role: role)
+        end
+
+        def dispatch_lifecycle(request:, peer:, role:, deadline:, transfer: nil)
+          options = {request: request, peer: peer, role: role}
+          options[:transfer] = transfer if transfer
+          @lifecycle.dispatch(**options)
+        end
+
+        # These closed read operations have no request body. Half-close proves
+        # framing completion before status or artifact data can be exposed.
+        def bodyless_read!(socket, deadline)
+          loop do
+            remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+            raise ArgumentError, "read request framing is incomplete" unless remaining.positive? && IO.select([socket], nil, nil, remaining)
+            bytes = socket.read_nonblock(1, exception: false)
+            next if bytes == :wait_readable
+            raise ArgumentError, "unexpected read request body" unless bytes.nil?
+            return
+          end
+        end
+
+        def transfer_codec
+          @mutex.synchronize do
+            @transfer_codec ||= begin
+              root = @service.fetch("state_root")
+              PrivateDirectory.verify!(root)
+              spool = File.join(root, "transfers")
+              Dir.mkdir(spool, 0o700) unless File.exist?(spool) || File.symlink?(spool)
+              TransferCodec.new(root: spool)
+            end
+          end
+        end
+
+        def refusal(socket, code)
+          wire.write(socket, {"status" => "error", "error" => {"code" => code, "message" => "Protected authority refused #{code}"}},
+            deadline: wire.deadline(0.1))
+        rescue StandardError
+          nil
+        end
+
+        def wire
+          Ace::Runtime::Molecules::ProtectedSocket
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/transfer_codec.rb

@@ -16,7 +16,7 @@ module Ace
         LIMITS = {prompt_text: [16_384, 1, 16_384], scope_boundary_observation: [65_536, 1, 65_536], candidate: [64 * 1024 * 1024, 1, 64 * 1024 * 1024],
                   artifacts: [256 * 1024, 16, 64 * 1024],
                   receipt_artifacts: [272 * 1024, 17, 64 * 1024],
-                  service_input: [64 * 1024, 1, 64 * 1024]}.freeze
+                  service_input: [64 * 1024, 1, 64 * 1024], assignment_snapshot: [64 * 1024 * 1024, 1, 64 * 1024 * 1024]}.freeze
         SHA256 = /\A[0-9a-f]{64}\z/
 
         class Input
@@ -149,7 +149,7 @@ module Ace
                 part["bytes"].is_a?(Integer) && part["bytes"].between?(0, each) &&
                 part["sha256"].is_a?(String) && part["sha256"].match?(SHA256) } &&
               descriptor["bytes"] == descriptor["parts"].sum { |part| part["bytes"] } &&
-              (!%i[candidate service_input prompt_text].include?(purpose) || descriptor["bytes"].positive?)
+              (!%i[candidate service_input prompt_text assignment_snapshot].include?(purpose) || descriptor["bytes"].positive?)
             reject!("Invalid or oversized transfer descriptor")
           end
           if purpose == :receipt_artifacts

data/lib/ace/assign/cli/commands/attempt/evidence.rb

@@ -7,12 +7,12 @@ module Ace
         module Attempt
           class Evidence < Ace::Support::Cli::Command
             include Attempt::Base
-            desc "Read coordinator-accepted live execution or historical review authority"
+            desc "Read coordinator-accepted live execution or historical execution authority"
             option :attempt, required: true, desc: "Accepted execution attempt ID"
             option :receipt_digest, required: true, desc: "Accepted receipt digest"
             option :kind, default: "check", desc: "Evidence purpose: check, review-collection or review-approval"
             option :check_name, default: "tests", desc: "Required check name (tests binds operation test)"
-            option :historical_head, desc: "Recorded collection/approval head for historical authority only"
+            option :historical_head, desc: "Exact recorded head for historical authority only (never current-head evidence)"
             option :format, default: "json", desc: "JSON evidence projection"
 
             def call(**options)

data/lib/ace/assign/molecules/canonical_read_commands.rb

@@ -0,0 +1,84 @@
+# frozen_string_literal: true
+
+module Ace
+  module Assign
+    module Molecules
+      # Closed bounded read dialect shared by isolated protected snapshots and
+      # trusted installed journals. Neither boundary can dispatch a Git write.
+      module CanonicalReadCommands
+        BYTE_LIMIT = 256 * 1_048_576
+        OID = /\A[0-9a-f]{40}\z/
+
+        attr_reader :commit
+
+        # EvidenceJournal uses this only as its existing read command boundary.
+        def call(argv, stdin_data: "", output_limit: BYTE_LIMIT)
+          refuse!("read_outside_snapshot") unless @view && @commit
+          unless read_command?(argv, stdin_data)
+            refuse!("write_or_unsupported_command")
+          end
+          result = read_result(argv, stdin_data: stdin_data, limit: [output_limit, BYTE_LIMIT].min)
+          [result.stdout.to_s.strip, result.stderr.to_s.strip, result.status]
+        end
+
+        def blob_batch(entries, output_limit:)
+          refuse!("read_outside_snapshot") unless @view && @commit
+          unless entries.is_a?(Array) && entries.all? { |oid| oid.is_a?(String) && oid.match?(OID) }
+            refuse!("unsupported_command")
+          end
+          result = run!(["cat-file", "--batch"], stdin_data: entries.join("\n") + "\n",
+            limit: [output_limit, BYTE_LIMIT].min)
+          result.stdout.to_s.b
+        end
+
+        def history_diff(commits, paths, output_limit:)
+          refuse!("read_outside_snapshot") unless @view && @commit
+          unless commits.is_a?(Array) && commits.size.between?(1, 64) && commits.uniq.size == commits.size &&
+              commits.all? { |commit| commit.is_a?(String) && commit.match?(OID) } &&
+              paths.is_a?(Array) && !paths.empty? && paths.uniq.size == paths.size &&
+              (paths == ["execution/"] || paths.all? { |path| path.is_a?(String) && path.match?(%r{\Aexecution/[a-zA-Z0-9_.:-]+/events/\z}) }) &&
+              output_limit.is_a?(Integer) && output_limit.positive?
+            refuse!("unsupported_command")
+          end
+          result = run!(%w[diff-tree --stdin --always --root -r --raw -z --no-renames --no-ext-diff
+            --no-textconv --no-abbrev --] + paths, stdin_data: commits.join("\n") + "\n",
+            limit: [output_limit, BYTE_LIMIT].min)
+          result.stdout.to_s.b
+        end
+
+        def blob_sizes(oids)
+          refuse!("read_outside_snapshot") unless @view && @commit
+          unless oids.is_a?(Array) && oids.size.between?(1, 64) && oids.all? { |oid| oid.is_a?(String) && oid.match?(OID) }
+            refuse!("unsupported_command")
+          end
+          run!(%w[cat-file --batch-check], stdin_data: oids.join("\n") + "\n", limit: oids.size * 128).stdout.to_s.b
+        end
+
+        def blob(path, commit:, max_bytes:)
+          refuse!("read_outside_snapshot") unless @view && @commit
+          unless commit.is_a?(String) && commit.match?(OID) && max_bytes.is_a?(Integer) && max_bytes.positive?
+            refuse!("unsupported_command")
+          end
+          result = run!(["cat-file", "blob", "#{commit}:#{path}"], limit: [max_bytes, BYTE_LIMIT].min)
+          result.stdout.to_s.b
+        end
+
+        private
+
+        def read_result(argv, **options)
+          run!(argv, **options)
+        end
+
+        def read_command?(argv, stdin)
+          return false unless argv.is_a?(Array) && argv.all? { |item| item.is_a?(String) && !item.include?("\0") } && stdin.empty?
+          allowed = {"rev-parse" => %w[--verify --quiet --git-dir], "cat-file" => %w[-t -s blob],
+            "rev-list" => %w[--first-parent --parents], "ls-tree" => %w[-r -l -d --name-only --],
+            "show" => [], "log" => %w[--diff-filter=A -1 --format=%H --]}
+          flags = allowed[argv.first]
+          flags && argv.drop(1).all? { |item| !item.start_with?("-") || flags.include?(item) || item == "--max-count=100001" }
+        end
+
+      end
+    end
+  end
+end

data/lib/ace/assign/molecules/canonical_read_snapshot.rb

@@ -5,6 +5,7 @@ require "fileutils"
 require "tmpdir"
 require "ace/herdr/molecules/bounded_process"
 require_relative "evidence_journal"
+require_relative "canonical_read_commands"
 require_relative "../authority/private_directory"
 
 module Ace
@@ -13,6 +14,7 @@ module Ace
       # Isolates read-only Git from an installed authority's live configuration.
       # The copied view never publishes evidence or mutates the source journal.
       class CanonicalReadSnapshot
+        include CanonicalReadCommands
         class Unavailable < AttemptErrors::EvidenceUnavailable; end
         BYTE_LIMIT = 256 * 1_048_576
         ENTRY_LIMIT = 4096
@@ -94,60 +96,6 @@ module Ace
         end
         private :with_snapshot
 
-        attr_reader :commit
-
-        # EvidenceJournal uses this only as its existing read command boundary.
-        def call(argv, stdin_data: "", output_limit: BYTE_LIMIT)
-          refuse!("read_outside_snapshot") unless @view && @commit
-          unless read_command?(argv, stdin_data)
-            refuse!("write_or_unsupported_command")
-          end
-          result = run!(argv, stdin_data: stdin_data, limit: [output_limit, BYTE_LIMIT].min)
-          [result.stdout.to_s.strip, result.stderr.to_s.strip, result.status]
-        end
-
-        def blob_batch(entries, output_limit:)
-          refuse!("read_outside_snapshot") unless @view && @commit
-          unless entries.is_a?(Array) && entries.all? { |oid| oid.is_a?(String) && oid.match?(OID) }
-            refuse!("unsupported_command")
-          end
-          result = run!(["cat-file", "--batch"], stdin_data: entries.join("\n") + "\n",
-            limit: [output_limit, BYTE_LIMIT].min)
-          result.stdout.to_s.b
-        end
-
-        def history_diff(commits, paths, output_limit:)
-          refuse!("read_outside_snapshot") unless @view && @commit
-          unless commits.is_a?(Array) && commits.size.between?(1, 64) && commits.uniq.size == commits.size &&
-              commits.all? { |commit| commit.is_a?(String) && commit.match?(OID) } &&
-              paths.is_a?(Array) && !paths.empty? && paths.uniq.size == paths.size &&
-              (paths == ["execution/"] || paths.all? { |path| path.is_a?(String) && path.match?(%r{\Aexecution/[a-zA-Z0-9_.:-]+/events/\z}) }) &&
-              output_limit.is_a?(Integer) && output_limit.positive?
-            refuse!("unsupported_command")
-          end
-          result = run!(%w[diff-tree --stdin --always --root -r --raw -z --no-renames --no-ext-diff
-            --no-textconv --no-abbrev --] + paths, stdin_data: commits.join("\n") + "\n",
-            limit: [output_limit, BYTE_LIMIT].min)
-          result.stdout.to_s.b
-        end
-
-        def blob_sizes(oids)
-          refuse!("read_outside_snapshot") unless @view && @commit
-          unless oids.is_a?(Array) && oids.size.between?(1, 64) && oids.all? { |oid| oid.is_a?(String) && oid.match?(OID) }
-            refuse!("unsupported_command")
-          end
-          run!(%w[cat-file --batch-check], stdin_data: oids.join("\n") + "\n", limit: oids.size * 128).stdout.to_s.b
-        end
-
-        def blob(path, commit:, max_bytes:)
-          refuse!("read_outside_snapshot") unless @view && @commit
-          unless commit.is_a?(String) && commit.match?(OID) && max_bytes.is_a?(Integer) && max_bytes.positive?
-            refuse!("unsupported_command")
-          end
-          result = run!(["cat-file", "blob", "#{commit}:#{path}"], limit: [max_bytes, BYTE_LIMIT].min)
-          result.stdout.to_s.b
-        end
-
         private
 
         def refuse!(reason)
@@ -352,15 +300,6 @@ module Ace
           File.binwrite(ref, "#{@commit}\n")
         end
 
-        def read_command?(argv, stdin)
-          return false unless argv.is_a?(Array) && argv.all? { |item| item.is_a?(String) && !item.include?("\0") } && stdin.empty?
-          allowed = {"rev-parse" => %w[--verify --quiet --git-dir], "cat-file" => %w[-t -s blob],
-            "rev-list" => %w[--first-parent --parents], "ls-tree" => %w[-r -l -d --name-only --],
-            "show" => [], "log" => %w[--diff-filter=A -1 --format=%H --]}
-          flags = allowed[argv.first]
-          flags && argv.drop(1).all? { |item| !item.start_with?("-") || flags.include?(item) || item == "--max-count=100001" }
-        end
-
         def run!(argv, stdin_data: "", limit:)
           result = Herdr::Molecules::BoundedProcess.call([@git, "--git-dir=#{@view}", "--no-pager", *argv],
             environment: ENVIRONMENT, chdir: @view, stdin_data: stdin_data,