ace-assign 0.69.0 → 0.71.0

data/lib/ace/assign/molecules/installed_journal_read.rb

@@ -0,0 +1,143 @@
+# frozen_string_literal: true
+
+require "ace/herdr/molecules/bounded_process"
+require_relative "evidence_journal"
+require_relative "canonical_read_commands"
+
+module Ace
+  module Assign
+    module Molecules
+      # Read the installed owner's immutable Git objects without opening its
+      # private writer lock/cache, copying the repository, or contacting it.
+      # Source selection is supplied only by verified installation policy.
+      class InstalledJournalRead
+        include CanonicalReadCommands
+        ENVIRONMENT = {"PATH" => "/usr/bin:/bin", "LC_ALL" => "C",
+          "GIT_CONFIG_NOSYSTEM" => "1", "GIT_CONFIG_SYSTEM" => "/dev/null",
+          "GIT_CONFIG_GLOBAL" => "/dev/null", "GIT_TERMINAL_PROMPT" => "0",
+          "GIT_ALLOW_PROTOCOL" => "", "GIT_NO_REPLACE_OBJECTS" => "1",
+          "GIT_NO_LAZY_FETCH" => "1", "GIT_OPTIONAL_LOCKS" => "0"}.freeze
+        ENTRY_LIMIT = 100_000
+
+        def initialize(repo_root:, ref:, owner_uid:)
+          unless repo_root.is_a?(String) && repo_root.start_with?("/") &&
+              !repo_root.include?("\0") && File.expand_path(repo_root) == repo_root &&
+              ref.is_a?(String) && ref.match?(%r{\Arefs/[a-zA-Z0-9_-]+(?:/[a-zA-Z0-9_-]+)+\z}) &&
+              owner_uid.is_a?(Integer) && owner_uid.positive?
+            raise ArgumentError, "installed journal selection is malformed"
+          end
+          @repo_root, @ref, @owner_uid = repo_root.dup.freeze, ref.dup.freeze, owner_uid
+          @mutex = Mutex.new
+        end
+
+        def with(deadline:)
+          refuse!("read_busy") unless @mutex.try_lock
+          begin
+            @deadline = deadline
+            remaining
+            verify_source!
+            @view = File.join(@repo_root, ".git")
+            @commit = run!(["rev-parse", "--verify", @ref], limit: 128).stdout.strip
+            refuse!("ref_unavailable") unless @commit.match?(OID)
+            result = yield self
+            verify_source!
+            result
+          ensure
+            @view = @commit = @deadline = nil
+            @mutex.unlock
+          end
+        rescue SystemCallError, IOError, Timeout::Error, Herdr::Molecules::BoundedProcess::PostLaunchError
+          refuse!("source_unavailable")
+        end
+
+        private
+
+        def refuse!(reason)
+          raise AttemptErrors::EvidenceUnavailable, "installed journal read unavailable: #{reason}"
+        end
+
+        def remaining
+          refuse!("deadline") unless @deadline.is_a?(Numeric) && @deadline.finite?
+          value = @deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+          refuse!("deadline") unless value.positive?
+          value
+        end
+
+        def verify_source!
+          # Caller-writable ancestors can replace even a correctly owned leaf.
+          current = File.join(@repo_root, ".git")
+          loop do
+            stat = File.lstat(current)
+            unless stat.directory? && !stat.symlink? && [0, @owner_uid].include?(stat.uid) &&
+                (stat.mode & 0o022).zero?
+              refuse!("storage_owner")
+            end
+            if [@repo_root, File.join(@repo_root, ".git")].include?(current) && stat.uid != @owner_uid
+              refuse!("repository_owner")
+            end
+            break if current == "/"
+            current = File.dirname(current)
+          end
+          %w[commondir shallow reftable info/grafts objects/info/alternates objects/info/http-alternates].each do |name|
+            path = File.join(@repo_root, ".git", name)
+            refuse!("redirected_storage") if File.exist?(path) || File.symlink?(path)
+          end
+          @entries = 0
+          %w[objects refs config HEAD packed-refs].each do |name|
+            path = File.join(@repo_root, ".git", name)
+            next if %w[HEAD packed-refs].include?(name) && !File.exist?(path) && !File.symlink?(path)
+            verify_tree!(path)
+          end
+          verify_config!
+        end
+
+        def verify_tree!(path)
+          remaining
+          @entries += 1
+          refuse!("storage_inventory_limit") if @entries > ENTRY_LIMIT
+          stat = File.lstat(path)
+          unless !stat.symlink? && (stat.file? || stat.directory?) &&
+              [0, @owner_uid].include?(stat.uid) && (stat.mode & 0o022).zero?
+            refuse!("storage_owner")
+          end
+          Dir.each_child(path) { |name| verify_tree!(File.join(path, name)) } if stat.directory?
+        end
+
+        def verify_config!
+          bytes = File.open(File.join(@repo_root, ".git/config"), File::RDONLY | File::NOFOLLOW) { |io| io.read(65_537) }
+          refuse!("config_limit") if bytes.bytesize > 65_536
+          result = Herdr::Molecules::BoundedProcess.call(
+            ["/usr/bin/git", "config", "--no-includes", "--null", "--list", "--file", "/dev/stdin"],
+            environment: ENVIRONMENT, chdir: "/", stdin_data: bytes,
+            timeout_s: remaining, output_limit: 65_536)
+          refuse!("config_unavailable") unless result.status.success? && !result.oversized
+          result.stdout.split("\0").each do |entry|
+            key, value = entry.split("\n", 2)
+            if key.start_with?("include.", "includeif.", "extensions.") || key == "core.worktree" ||
+                key == "core.repositoryformatversion" && value != "0"
+              refuse!("redirected_configuration")
+            end
+          end
+        end
+
+        def read_result(argv, **options)
+          run!(argv, **options, allow_failure: true)
+        end
+
+        def run!(argv, stdin_data: "", limit:, allow_failure: false)
+          # All ref-based reads in one observation use the same immutable tip.
+          selected = argv.map { |arg| arg == @ref && @commit ? @commit : arg }
+          result = Herdr::Molecules::BoundedProcess.call([
+            "/usr/bin/git", "--git-dir=#{@view}", "--no-pager",
+            "-c", "safe.directory=#{@repo_root}", "-c", "core.hooksPath=/dev/null",
+            "-c", "core.fsmonitor=false", "-c", "protocol.allow=never", *selected],
+            environment: ENVIRONMENT, chdir: @repo_root, stdin_data: stdin_data,
+            timeout_s: remaining, output_limit: [limit, BYTE_LIMIT].min, stderr_limit: 65_536)
+          refuse!("resource_limit") if result.oversized
+          refuse!("git_unavailable") unless allow_failure || result.status.success?
+          result
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/molecules/journal_mutation.rb

@@ -4,6 +4,7 @@ require "json"
 require "digest"
 require "ace/herdr/molecules/bounded_process"
 require_relative "journal_prompt_mutation"
+require_relative "../atoms/candidate_limits"
 require_relative "journal_input_inhibition"
 
 module Ace
@@ -34,7 +35,7 @@ module Ace
         # returns events [{type:, payload:}], immutable blobs, and public data.
         # Only the authority calls this internal journal API; wire requests
         # cannot select blob paths, event types, or accepted response data.
-        def mutate(assignment_id:, attempt_id:, mutation_id:, operation:, parameters_digest:, expected_generation:, with_replay: false, generation_mode: :expected, prompt_binding: nil, prompt_completion: nil, prompt_observation: nil, input_inhibition: nil)
+        def mutate(assignment_id:, attempt_id:, mutation_id:, operation:, parameters_digest:, expected_generation:, with_replay: false, generation_mode: :expected, prompt_binding: nil, prompt_completion: nil, prompt_observation: nil, input_inhibition: nil, deadline: nil, replay_authorizer: nil)
           unless (generation_mode == :expected && expected_generation.is_a?(Integer) && expected_generation >= 0) ||
               (generation_mode == :recorded_completion && %w[complete_service complete_no_effect].include?(operation) && expected_generation.nil?) ||
               (generation_mode == :prompt_completion && operation == "prompt_attempt" && expected_generation.nil? && prompt_completion.is_a?(Hash)) ||
@@ -71,7 +72,8 @@ module Ace
           unless parameters_digest.is_a?(String) && parameters_digest.match?(/\A[0-9a-f]{64}\z/)
             raise ArgumentError, "invalid mutation parameter digest"
           end
-          with_lock do
+          raise ArgumentError, "replay authorizer must be source owned" if replay_authorizer && !replay_authorizer.respond_to?(:call)
+          with_lock(deadline: deadline) do
             self.class::CAS_ATTEMPTS.times do
               old = ref_value
               ensure_checkout!
@@ -96,6 +98,7 @@ module Ace
                   raise AttemptErrors::Conflict, "Mutation ID is already bound to different input"
                 end
                 result = replay.fetch("data").merge("journal_commit" => replay.fetch("journal_commit"))
+                replay_authorizer&.call
                 return with_replay ? {data: result, replayed: true} : result
               end
               current = read_events(assignment_id, commit: old).select { |event| event["attempt_id"] == attempt_id }
@@ -190,7 +193,7 @@ module Ace
         def bounded_blob(path, commit:, max_bytes:)
           validate_blob_path!(path)
           unless commit.is_a?(String) && commit.match?(/\A[0-9a-f]{40}(?:[0-9a-f]{24})?\z/) &&
-              max_bytes.is_a?(Integer) && max_bytes.between?(1, 64 * 1024 * 1024)
+              max_bytes.is_a?(Integer) && max_bytes.between?(1, Atoms::CandidateLimits::BYTES)
             raise AttemptErrors::EvidenceUnavailable, "Canonical prepared blob selector differs"
           end
           return @read_boundary.blob(path, commit: commit, max_bytes: max_bytes) if @read_boundary
@@ -215,7 +218,7 @@ module Ace
         end
 
         def validate_blob_path!(path)
-          unless path.is_a?(String) && path.match?(%r{\A(?:evidence/imports|execution/definitions|execution/prepared|candidates/bundles)/[a-zA-Z0-9_.-]+\z}) &&
+          unless path.is_a?(String) && path.match?(%r{\A(?:evidence/imports|execution/definitions|execution/prepared|execution/merge-evidence|candidates/bundles)/[a-zA-Z0-9_.-]+\z}) &&
               !%w[. ..].include?(File.basename(path))
             raise ArgumentError, "invalid canonical blob reference"
           end

data/lib/ace/assign/molecules/lifecycle_exclusion.rb

@@ -214,14 +214,25 @@ module Ace
         # given order, released in reverse — callers must use one consistent
         # global order, task before assignment, to avoid deadlock). Fails
         # closed when any identity was pruned.
-        def with_shared_multi(keys, reset_removed: false)
+        def with_shared_multi(keys, reset_removed: false, deadline: nil)
           ordered = Array(keys).compact.reject { |key| key.to_s.empty? }.uniq
           raise ArgumentError, "exclusion keys are required" if ordered.empty?
 
           locks = []
           begin
+            maintenance_deadline!(deadline) if deadline
             ordered.each { |key| locks << open_lock(key) }
-            locks.each { |lock| lock.flock(File::LOCK_SH) }
+            locks.each do |lock|
+              if deadline
+                until lock.flock(File::LOCK_SH | File::LOCK_NB)
+                  maintenance_deadline!(deadline)
+                  sleep 0.01
+                end
+                maintenance_deadline!(deadline)
+              else
+                lock.flock(File::LOCK_SH)
+              end
+            end
             ordered.each do |key|
               if removed?(key)
                 unless reset_removed

data/lib/ace/assign/molecules/proposal_journal.rb

@@ -11,7 +11,7 @@ module Ace
         PROPOSAL_REFERENCE = /\Aproposal-[0-9a-f]{24}-r[1-9][0-9]*\z/
         PROPOSAL_BINDING = %w[operation project_id assignment_id attempt_id input_digest target candidate_head caller_uid].freeze
 
-        PROPOSAL_IMMUTABLE = (PROPOSAL_BINDING + %w[schema proposal_id revision revision_id request_id requester content_digest created_at authorization context options recommendation rationale prerequisites lifecycle_request revision_operation_id expected_source_revision]).freeze
+        PROPOSAL_IMMUTABLE = (PROPOSAL_BINDING + %w[schema proposal_id revision revision_id request_id requester content_digest created_at authorization context options recommendation rationale prerequisites lifecycle_request revision_operation_id expected_source_revision silence_delegated]).freeze
 
         def proposal_history(id)
           assignment_ids.flat_map do |assignment|
@@ -110,8 +110,7 @@ module Ace
             valid &&= updated["revision_operation_id"].nil? && updated["expected_source_revision"].nil?
           end
           unresolved = previous && proposal_claims(previous["revision_id"]).any? do |claim|
-            claim["state"] != "succeeded" &&
-              !(claim["state"] == "failed-settled" && settlement_evidence_intact?(claim))
+            claim["state"] != "succeeded" && !proposal_no_effect?(claim)
           end
           raise AttemptErrors::ReceiptRejected, "Claimed proposal cannot be revised; reconcile the existing effect" if unresolved
           raise AttemptErrors::ReceiptRejected, "Proposal revision must begin with exact immutable delivery scope" unless valid
@@ -119,10 +118,39 @@ module Ace
         private :validate_proposal_revision!
 
         def proposal_claims(reference)
-          service_request_records.select do |request|
+          claims = (service_request_records + fixed_merge_request_records).select do |request|
             request["authorization"] == reference &&
               !(request["state"] == "rejected" && request["consumed"] == false)
           end
+          return claims if claims.empty?
+          events = read_events(claims.first.fetch("assignment_id"))
+          claims.sort_by do |claim|
+            kind = claim.key?("queue_entry") ? "merge_admission" : "service_claim"
+            events.index do |event|
+              event["type"] == kind && event["attempt_id"] == claim.fetch("attempt_id") &&
+                event.dig("payload", "request_id") == claim.fetch("request_id")
+            end || raise(AttemptErrors::EvidenceUnavailable, "Proposal claim has no canonical admission event")
+          end
+        end
+
+        # Request IDs are scoped by record family. A same-text ID in the other
+        # family is another effect, never an idempotent replay.
+        def proposal_claim_conflict(reference, request_id:, fixed:)
+          [[service_request_records, false], [fixed_merge_request_records, true]].each do |records, family|
+            conflict = records.find do |claim|
+              claim["authorization"] == reference &&
+                !(family == fixed && claim["request_id"] == request_id) &&
+                !(claim["state"] == "rejected" && claim["consumed"] == false) &&
+                !proposal_no_effect?(claim)
+            end
+            return conflict if conflict
+          end
+          nil
+        end
+
+        def proposal_no_effect?(claim)
+          (claim["state"] == "failed-settled" && settlement_evidence_intact?(claim)) ||
+            (claim["state"] == "failed" && claim.key?("queue_entry") && fixed_no_effect_intact?(claim))
         end
 
         def proposal_authorize!(reference, binding)

data/lib/ace/assign/molecules/receipt_verifier.rb

@@ -24,7 +24,7 @@ module Ace
         # @param identity_resolver [ExecutionIdentityResolver] Trust boundary
         # @param artifact_reader [#call, nil] Source-owned canonical byte
         #   reader for protected composition; nil selects explicit local files
-        def initialize(identity_resolver: nil, artifact_reader: nil, campaign_verifier: nil)
+        def initialize(identity_resolver: nil, artifact_reader: nil, campaign_verifier: nil, review_independence_verifier: nil)
           @identity_resolver = identity_resolver || ExecutionIdentityResolver.new
           unless artifact_reader.nil? || artifact_reader.respond_to?(:call)
             raise ArgumentError, "artifact reader must be a source-owned callable"
@@ -34,6 +34,10 @@ module Ace
             raise ArgumentError, "campaign verifier must be a source-owned callable"
           end
           @campaign_verifier = campaign_verifier
+          unless review_independence_verifier.nil? || review_independence_verifier.respond_to?(:call)
+            raise ArgumentError, "review independence verifier must be a source-owned callable"
+          end
+          @review_independence_verifier = review_independence_verifier
         end
 
         # Validate a submitted receipt against an attempt.
@@ -222,7 +226,9 @@ module Ace
           reject_unless(reviewer.is_a?(Hash) && !reviewer["actor"].to_s.strip.empty?, "review must name an executed reviewer")
 
           producer_actor = data.dig("producer", "actor").to_s.strip
-          if reviewer["actor"].to_s.strip == producer_actor
+          if @review_independence_verifier
+            reject("canonical reviewer independence is unverifiable") unless @review_independence_verifier.call(data) == true
+          elsif reviewer["actor"].to_s.strip == producer_actor
             reject("reviewer and producer must differ (self-approval rejected)")
           end
 

data/lib/ace/assign/molecules/runtime_control_surface_runner.rb

@@ -12,9 +12,10 @@ module Ace
       # operation delegates to the resolved Ace::Runtime adapter; assign
       # never calls a runtime-native API directly (k86.3 interface rule).
       class RuntimeControlSurfaceRunner
-        def initialize(runtime: nil, env: ENV)
+        def initialize(runtime: nil, env: ENV, adapter: nil)
           @runtime_name = runtime
           @env = env
+          @runtime = adapter
         end
 
         attr_reader :runtime_name, :env

data/lib/ace/assign/organisms/attempt_coordinator.rb

@@ -37,7 +37,10 @@ module Ace
         # @param identity_resolver [Molecules::ExecutionIdentityResolver, nil] Trust boundary
         # @param verifier [Molecules::ReceiptVerifier, nil] Receipt verifier
         def initialize(cache_base: nil, repo_root: nil, journal: nil, identity_resolver: nil, verifier: nil,
-          lifecycle_exclusion: nil)
+          lifecycle_exclusion: nil, recorded_binding_observer: nil, ordinary_merge_evidence: nil)
+          unless recorded_binding_observer.nil? || recorded_binding_observer.respond_to?(:call)
+            raise ArgumentError, "recorded native binding observer must be callable"
+          end
           @manager = Molecules::AssignmentManager.new(cache_base: cache_base)
           @store = @manager.attempt_store
           @repo_root = repo_root || Ace::Support::Fs::Molecules::ProjectRootFinder.find_or_current
@@ -45,6 +48,8 @@ module Ace
           @identity_resolver = identity_resolver || Molecules::ExecutionIdentityResolver.new
           @verifier = verifier || Molecules::ReceiptVerifier.new(identity_resolver: @identity_resolver)
           @lifecycle_exclusion = lifecycle_exclusion
+          @recorded_binding_observer = recorded_binding_observer
+          @ordinary_merge_evidence = ordinary_merge_evidence
         end
 
         attr_reader :store
@@ -59,16 +64,17 @@ module Ace
           {events: [{type: "attempt_stopped", payload: payload}], blobs: {}}
         end
 
-        # The protected result owner authenticates imported bytes, candidate,
+        # The source-selected result owner authenticates imported bytes, candidate,
         # closure and independent settlements at the same CAS prefix.
-        def self.finished_transition_plan(events:, receipt:)
+        def self.finished_transition_plan(events:, receipt:, authority:)
+          raise ArgumentError, "unknown result authority" unless %i[ordinary protected].include?(authority)
           state = Molecules::CanonicalAttemptState.derive(events)
           unless state == "running" && %w[succeeded failed].include?(receipt.fetch("verdict"))
             raise AttemptErrors::Conflict, "Result finish requires a running attempt"
           end
           Atoms::AttemptStateMachine.transition!(state, receipt.fetch("verdict"))
           {events: [{type: "receipt_accepted", payload: {"receipt" => receipt}},
-            {type: "transition", payload: {"from" => state, "to" => receipt.fetch("verdict"), "reason" => "protected_result_accepted"}}], blobs: {}}
+            {type: "transition", payload: {"from" => state, "to" => receipt.fetch("verdict"), "reason" => "#{authority}_result_accepted"}}], blobs: {}}
         end
 
         def self.protected_recovery_decision(state:, effects_pending:, bound:, live:, checkpoint:)
@@ -113,21 +119,13 @@ module Ace
             raise AttemptErrors::ReceiptRejected, "Native reverse requires an active managed attempt"
           end
           binding = reconciler.recorded_binding(attempt)
-          observation = reconciler.observation(attempt)
-          unless binding && observation["liveness"] == "live" &&
-              binding["process_identity"] == observation["identity"] &&
-              %w[runtime session pane].all? { |key| binding[key].is_a?(String) && !binding[key].empty? }
+          unless binding && %w[runtime session pane].all? { |key| binding[key].is_a?(String) && !binding[key].empty? }
             raise AttemptErrors::ReceiptRejected, "Exact native owner binding is unavailable or changed"
           end
-          unless caller_pid.nil?
-            unless caller_pid.is_a?(Integer) && caller_pid.positive?
-              raise AttemptErrors::UnauthorizedIdentity, "Kernel caller process is unavailable"
-            end
-            caller = Ace::Runtime.resolve(binding["runtime"]).process_binding(pane: binding["pane"], caller_pid: caller_pid)
-            unless caller == binding
-              raise AttemptErrors::UnauthorizedIdentity, "Caller does not descend from the recorded native owner"
-            end
+          unless caller_pid.nil? || (caller_pid.is_a?(Integer) && caller_pid.positive?)
+            raise AttemptErrors::UnauthorizedIdentity, "Kernel caller process is unavailable"
           end
+          observe_runtime_binding!(attempt, binding, caller_pid)
           latest = recover_managed_attempt(attempt.binding.assignment_id, attempt_id)
           unless latest&.active? && latest.binding.to_h == attempt.binding.to_h && reconciler.recorded_binding(latest) == binding
             raise AttemptErrors::ReceiptRejected, "Native owner changed during observation"
@@ -137,6 +135,28 @@ module Ace
           raise AttemptErrors::ReceiptRejected, "Native owner observation unavailable (#{e.class})"
         end
 
+        # An installed consumer selects its own bounded native reader. It must
+        # never fall back to the service process's ambient runtime on failure.
+        def observe_runtime_binding!(attempt, binding, caller_pid)
+          if @recorded_binding_observer
+            actual = @recorded_binding_observer.call(binding: binding, caller_pid: caller_pid)
+            unless actual == binding
+              raise AttemptErrors::UnauthorizedIdentity, "Installed native owner observation differs"
+            end
+            return
+          end
+          observation = reconciler.observation(attempt)
+          unless observation["liveness"] == "live" && binding["process_identity"] == observation["identity"]
+            raise AttemptErrors::ReceiptRejected, "Exact native owner binding is unavailable or changed"
+          end
+          return if caller_pid.nil?
+          caller = Ace::Runtime.resolve(binding["runtime"]).process_binding(pane: binding["pane"], caller_pid: caller_pid)
+          unless caller == binding
+            raise AttemptErrors::UnauthorizedIdentity, "Caller does not descend from the recorded native owner"
+          end
+        end
+        private :observe_runtime_binding!
+
         # Claim an external service effect before dispatch. Only a managed,
         # active attempt for the exact project and candidate may own it. The
         # guard re-runs inside the journal lock per CAS attempt, so a
@@ -174,7 +194,10 @@ module Ace
         end
 
         def service_attempt(binding)
-          attempt = authoritative_attempt(binding)
+          # An effect can never acquire authority from a requester cache, even
+          # when the assignment definition is missing from this consumer.
+          attempt = journal_for.derived_attempts(binding.fetch("assignment_id"))
+            .find { |candidate| candidate.attempt_id == binding.fetch("attempt_id") }
           raise AttemptErrors::NotFound, "Attempt not found" unless attempt
           unless attempt.managed? && attempt.active? &&
               attempt.binding.assignment_id == binding["assignment_id"] &&
@@ -306,28 +329,65 @@ module Ace
           # never need message-string discrimination: replay/binding conflicts
           # stay Conflict, a consumed authorization is AuthorizationConflict.
           guard = lambda do
-            conflict = @journal.fixed_authorization_conflict(record)
+            verify_fixed_merge_evidence!(record)
+            conflict = journal_for.fixed_authorization_conflict(record)
             if conflict
               raise AttemptErrors::AuthorizationConflict,
                 "Authorization reference is not currently valid"
             end
             nil
           end
-          @journal.admit_fixed_merge_request(record, guard: guard)
+          with_fixed_merge_scope(record) do
+            journal_for.admit_fixed_merge_request(record, guard: guard)
+          end
         end
 
         # Begin the fixed effect (pending -> uncertain). The single CAS
         # transition is the at-most-one-merge proof: a restarted receiver
-        # replays "already started" and must not dispatch again.
+        # refuses an already-started claim and must not dispatch again.
         def begin_fixed_merge_effect(request_id)
-          @journal.begin_fixed_merge_request(request_id)
+          record = journal_for.fixed_merge_request(request_id)
+          raise AttemptErrors::NotFound, "fixed merge record is unavailable" unless record
+          with_fixed_merge_scope(record) do
+            journal_for.begin_fixed_merge_request(request_id, guard: -> { verify_fixed_merge_evidence!(record) })
+          end
+        end
+
+        # Hold the existing assignment exclusion through the external effect.
+        # Review cancellation/head changes/finish cannot race this interval.
+        def with_fixed_merge_evidence(record)
+          with_fixed_merge_scope(record, exclusive: true) do
+            verify_fixed_merge_evidence!(record)
+            yield
+          end
+        end
+
+        def verify_fixed_merge_evidence!(record)
+          unless @ordinary_merge_evidence
+            raise AttemptErrors::ReceiptRejected, "canonical ordinary merge evidence owner is not installed"
+          end
+          @ordinary_merge_evidence.verify_merge_evidence_at!(record: record, commit: journal_for.ref_value,
+            deadline: Process.clock_gettime(Process::CLOCK_MONOTONIC) + 30)
+          nil
+        rescue AttemptErrors::EvidenceUnavailable, AttemptErrors::UnauthorizedIdentity, AttemptErrors::Conflict, AttemptErrors::NotFound
+          raise AttemptErrors::ReceiptRejected, "canonical ordinary review or executed test evidence is unavailable"
+        end
+
+        def with_fixed_merge_scope(record, exclusive: false, &block)
+          unless @ordinary_merge_evidence
+            raise AttemptErrors::ReceiptRejected, "canonical ordinary merge evidence owner is not installed"
+          end
+          @ordinary_merge_evidence.with_merge_scope(record: record, exclusive: exclusive,
+            deadline: Process.clock_gettime(Process::CLOCK_MONOTONIC) + 30, &block)
         end
+        private :with_fixed_merge_scope
 
         # Settle the fixed effect with the exact terminal receipt. The
         # journal validates the closed receipt schema and its binding to the
         # admitted record before the transition lands.
-        def settle_fixed_merge_effect(request_id, terminal_status:, receipt:)
-          @journal.settle_fixed_merge_request(request_id, terminal_status: terminal_status, receipt: receipt)
+        def settle_fixed_merge_effect(request_id, terminal_status:, receipt:, attestation: nil)
+          journal_for.settle_fixed_merge_request(request_id, terminal_status: terminal_status,
+            receipt: receipt, attestation: attestation)
         end
 
         # Read-only canonical record lookup by request ID: lets the producer
@@ -352,7 +412,7 @@ module Ace
         # without revealing whether another project holds the reference.
         def fixed_merge_status(reference:, request_id:, project_id:, assignment_id:, attempt_id:,
           queue_entry:, input_digest:)
-          record = @journal.fixed_merge_request(request_id)
+          record = journal_for.fixed_merge_request(request_id)
           return nil unless record
           matches = reference == record["reference"] && input_digest == record["input_digest"] &&
             [project_id, assignment_id, attempt_id, queue_entry].zip(
@@ -603,7 +663,7 @@ input:#{Regexp.escape(request.fetch("input_digest"))} outcome:(\S+)( no-effect:(
 
               active_scopes = @store.list(assignment_id).select(&:active?).map(&:binding)
               active_scopes.concat(journal_actives.map(&:binding))
-              blocker = active_scopes.find { |binding| scopes_overlap?(binding.scope, scope) }
+              blocker = active_scopes.find { |binding| Atoms::AssignmentScope.overlap?(binding.scope, scope) }
               if blocker
                 raise AttemptErrors::Conflict,
                   "Active attempt scope #{blocker.scope} overlaps requested scope #{scope} on #{assignment_id}; " \
@@ -842,9 +902,9 @@ input:#{Regexp.escape(request.fetch("input_digest"))} outcome:(\S+)( no-effect:(
           unless %w[check review-collection review-approval].include?(kind) && check_name.is_a?(String) && !check_name.strip.empty?
             raise AttemptErrors::ReceiptRejected, "Invalid evidence kind or check name"
           end
-          if !historical_head.nil? && (!%w[review-collection review-approval].include?(kind) || !historical_head.is_a?(String) ||
+          if !historical_head.nil? && (!historical_head.is_a?(String) ||
               !historical_head.match?(/\A[0-9a-f]{40,64}\z/))
-            raise AttemptErrors::ReceiptRejected, "Historical evidence requires review collection/approval and an exact recorded head"
+            raise AttemptErrors::ReceiptRejected, "Historical evidence requires an exact recorded head"
           end
           unless attempt_id.to_s.match?(/\A[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}\z/) &&
               receipt_digest.to_s.match?(/\A[0-9a-f]{64}\z/)
@@ -994,14 +1054,6 @@ input:#{Regexp.escape(request.fetch("input_digest"))} outcome:(\S+)( no-effect:(
           raise Error, "Failed to generate a unique attempt ID for #{assignment_id} after 100 attempts"
         end
 
-        # Ancestors and descendants overlap: an active attempt for 010 owns
-        # its 010.01 subtree, and vice versa.
-        def scopes_overlap?(left, right)
-          return true if Atoms::AssignmentScope.equal?(left, right)
-
-          left.start_with?("#{right}.") || right.start_with?("#{left}.")
-        end
-
         # Active attempts derived from the authoritative journal, used when
         # the local record may be missing (lost or wiped cache). Derivation
         # lives in the journal (owner of attempt-state interpretation).
@@ -1059,7 +1111,7 @@ input:#{Regexp.escape(request.fetch("input_digest"))} outcome:(\S+)( no-effect:(
         # merges both). The loser records a stopped transition and refuses.
         def yield_lost_ownership_race(attempt, assignment_id, scope)
           rival = journal_for.active_attempts(assignment_id).find do |other|
-            other.attempt_id != attempt.attempt_id && scopes_overlap?(other.binding.scope, scope)
+            other.attempt_id != attempt.attempt_id && Atoms::AssignmentScope.overlap?(other.binding.scope, scope)
           end
           return attempt if rival.nil?