ace-assign 0.69.0 → 0.71.0

data/lib/ace/assign/authority/candidate_transfer.rb

@@ -6,7 +6,11 @@ require "fileutils"
 require "tmpdir"
 require "tempfile"
 require "ace/herdr/molecules/bounded_process"
+require "ace/review/atoms/campaign_contract"
 require_relative "private_directory"
+require_relative "../atoms/candidate_limits"
+require_relative "candidate_head_comparison"
+require_relative "candidate_blob_batch"
 
 module Ace
   module Assign
@@ -14,8 +18,17 @@ module Ace
       # Untrusted bundles enter a clean bare quarantine. Only complete verified
       # objects are retained; no uploader configuration or worktree is read.
       class CandidateTransfer
-        MAX_BYTES = 64 * 1024 * 1024
-        DEADLINE = 30
+        include CandidateHeadComparison
+        include CandidateBlobBatch
+        MAX_BYTES = Atoms::CandidateLimits::BYTES
+        MAX_REVIEW_BYTES = Ace::Review::Atoms::CampaignContract::MAX_HEAD_CONTEXT_BYTES
+        # Measured on the real 82,809,675-byte candidate (9,203 entries,
+        # 71,583,200 expanded bytes): two full admits alone need ~14s of
+        # bounded Git work and the complete comparison ~23s on a loaded host
+        # (evidence in .ace-tasks/8xf.t.ei9-wave-3 evidence). 30s failed
+        # closed under legitimate load; 60s keeps a finite secondary guard
+        # with measured headroom. Inputs stay byte/count-bounded separately.
+        DEADLINE = 60
         SHA = /\A[0-9a-f]{40}\z/
 
         class CampaignReadView
@@ -115,14 +128,14 @@ module Ace
           reject!("Prepared export filesystem is unavailable")
         end
 
-        def admit(bytes:, sha256:, size:, head:, &consumer)
+        def admit(bytes:, sha256:, size:, head:, deadline: nil, &consumer)
           unless bytes.is_a?(String) && size.is_a?(Integer) && size.positive? && size <= MAX_BYTES &&
               size == bytes.bytesize && sha256.is_a?(String) &&
               Digest::SHA256.hexdigest(bytes.b) == sha256 && head.is_a?(String) && head.match?(SHA)
             reject!("Candidate bundle binding or size is invalid")
           end
           verify_root!
-          deadline = monotonic + DEADLINE
+          deadline = deadline ? [deadline, monotonic + DEADLINE].min : monotonic + DEADLINE
           Dir.mktmpdir("quarantine-", @root) do |directory|
             File.chmod(0700, directory)
             bundle = File.join(directory, "candidate.bundle")
@@ -165,20 +178,29 @@ module Ace
             File.chmod(0700, destination)
             begin
               entries = git(repository, deadline, "ls-tree", "-r", "-z", head, limit: MAX_BYTES).b.split("\0")
-              total = 0
-              links = []
-              entries.each do |entry|
+              reject!("Candidate file inventory is oversized") if entries.size > MAX_OBJECTS
+              parsed = entries.map do |entry|
                 metadata, path = entry.split("\t", 2)
                 mode, kind, oid = metadata.to_s.split(" ")
-                parts = path.to_s.split("/", -1)
-                unless path && !path.start_with?("/") &&
-                    parts.none? { |part| part.empty? || %w[. .. .git].include?(part.downcase) } &&
-                    kind == "blob" && %w[100644 100755 120000].include?(mode) && oid.match?(SHA)
+                # Total path bytes are bounded before any component or
+                # filesystem prefix work consumes them.
+                reject!("Candidate path exceeds bounded length") unless path && !path.start_with?("/") &&
+                  path.bytesize <= Atoms::CandidateLimits::PATH_BYTES
+                parts = path.split("/", -1)
+                unless parts.none? { |part| part.empty? || part.bytesize > Atoms::CandidateLimits::PATH_COMPONENT_BYTES ||
+                    %w[. .. .git].include?(part.downcase) } &&
+                    kind == "blob" && %w[100644 100755 120000].include?(mode) && oid&.match?(SHA)
                   reject!("Candidate contains unsafe filesystem entry")
                 end
-                content = git(repository, deadline, "cat-file", "blob", oid, limit: MAX_BYTES).b
-                total += content.bytesize
-                reject!("Candidate expanded content is oversized") if total > MAX_BYTES
+                [path, mode, oid]
+              end
+              by_oid = parsed.group_by(&:last)
+              sizes = by_oid.keys.zip(candidate_blob_sizes(repository, deadline, by_oid.keys)).to_h
+              reject!("Candidate expanded content is oversized") if parsed.sum { |_path, _mode, oid| sizes.fetch(oid) } > MAX_BYTES
+              links = []
+              ordered = parsed.each
+              each_candidate_blob(repository, deadline, parsed.map { |_path, _mode, oid| [oid, sizes.fetch(oid)] }) do |oid, content|
+                path, mode, _oid = ordered.next
                 target = File.join(destination, path)
                 FileUtils.mkdir_p(File.dirname(target), mode: 0700)
                 if mode == "120000"
@@ -242,7 +264,7 @@ module Ace
           result = materialize(bytes: bytes, sha256: sha256, size: size, head: head, tree: tree, root: root) do |path, mode, oid, content|
             entry = JSON.generate("path" => review_bytes(path), "mode" => mode, "oid" => oid, "content" => review_bytes(content))
             separator = first ? "" : ","
-            reject!("Complete candidate review snapshot is oversized") if subject.bytesize + separator.bytesize + entry.bytesize + 2 > MAX_BYTES
+            reject!("Complete candidate review snapshot is oversized") if subject.bytesize + separator.bytesize + entry.bytesize + 2 > Atoms::CandidateLimits::REVIEW_SNAPSHOT_BYTES
             subject << separator << entry
             first = false
           end
@@ -256,19 +278,26 @@ module Ace
         def prepared_files(repository:, deadline:, head:)
           entries = git(repository, deadline, "ls-tree", "-r", "-z", head, limit: MAX_BYTES).b.split("\0")
           reject!("Prepared file inventory is oversized") unless entries.size.between?(4, 4096)
-          total = 0
-          files = entries.to_h do |entry|
+          parsed = entries.map do |entry|
             metadata, path = entry.split("\t", 2)
             mode, kind, oid = metadata.to_s.split(" ")
-            unless path && mode == "100644" && kind == "blob" && oid.match?(SHA) &&
-                !path.start_with?("/") && path.split("/", -1).none? { |part| part.empty? || %w[. .. .git].include?(part.downcase) }
+            reject!("Prepared tree path exceeds bounded length") unless path && !path.start_with?("/") &&
+              path.bytesize <= Atoms::CandidateLimits::PATH_BYTES
+            unless mode == "100644" && kind == "blob" && oid&.match?(SHA) &&
+                path.split("/", -1).none? { |part| part.empty? || part.bytesize > Atoms::CandidateLimits::PATH_COMPONENT_BYTES ||
+                  %w[. .. .git].include?(part.downcase) }
               reject!("Prepared tree contains unsafe entry")
             end
-            size = git(repository, deadline, "cat-file", "-s", oid).strip
-            reject!("Prepared text is oversized") unless size.match?(/\A[0-9]+\z/) && size.to_i.between?(1, 1024 * 1024)
-            total += size.to_i
-            reject!("Prepared expanded content is oversized") if total > MAX_BYTES
-            [path, git(repository, deadline, "cat-file", "blob", oid, limit: 1024 * 1024).b]
+            [path, oid]
+          end
+          by_oid = parsed.group_by(&:last)
+          sizes = by_oid.keys.zip(candidate_blob_sizes(repository, deadline, by_oid.keys)).to_h
+          reject!("Prepared text is oversized") unless sizes.values.all? { |size| size.between?(1, 1024 * 1024) }
+          reject!("Prepared expanded content is oversized") if parsed.sum { |_path, oid| sizes.fetch(oid) } > Atoms::CandidateLimits::PREPARED_BYTES
+          files = {}
+          ordered = parsed.each
+          each_candidate_blob(repository, deadline, parsed.map { |_path, oid| [oid, sizes.fetch(oid)] }) do |_oid, content|
+            files[ordered.next.first] = content
           end
           reject!("Prepared inventory has duplicate paths") unless files.size == entries.size
           files
@@ -289,18 +318,19 @@ module Ace
           PrivateDirectory.verify!(@root)
         end
 
-        def git(repository, deadline, *arguments, limit: 65_536)
+        def git(repository, deadline, *arguments, limit: 65_536, stdin_data: "")
           remaining = deadline - monotonic
           raise Timeout::Error if remaining <= 0
           # Git variables may redirect object/config storage even in a clean
           # repository. Strip every inherited Git setting and global config.
           environment = ENV.keys.to_h { |key| [key, nil] }
           environment.merge!("GIT_CONFIG_NOSYSTEM" => "1", "GIT_CONFIG_GLOBAL" => "/dev/null",
+            "GIT_ATTR_NOSYSTEM" => "1",
             "GIT_TERMINAL_PROMPT" => "0", "GIT_ALLOW_PROTOCOL" => "file",
             "GIT_NO_REPLACE_OBJECTS" => "1", "PATH" => "/usr/bin:/bin", "LC_ALL" => "C")
           result = Herdr::Molecules::BoundedProcess.call([environment, "/usr/bin/git", "-C", repository,
-            "-c", "core.hooksPath=/dev/null", "-c", "protocol.file.allow=always", *arguments],
-            stdin_data: "", timeout_s: remaining, output_limit: limit)
+            "-c", "core.hooksPath=/dev/null", "-c", "core.attributesFile=/dev/null", "-c", "protocol.file.allow=always", *arguments],
+            stdin_data: stdin_data, timeout_s: remaining, output_limit: limit)
           reject!("Candidate Git verification failed") unless result.status.success? && !result.oversized
           result.stdout
         end

data/lib/ace/assign/authority/command_execution.rb

@@ -0,0 +1,180 @@
+# frozen_string_literal: true
+
+require "json"
+require "digest"
+require_relative "../molecules/evidence_journal"
+
+module Ace
+  module Assign
+    module Authority
+      # Project commands share the installed journal, without manufacturing a
+      # managed task or projecting command exit as completed product delivery.
+      class CommandExecution
+        OPERATIONS = %w[command_admit command_status command_claim command_bind command_complete].freeze
+        ID = /\A[a-zA-Z0-9][a-zA-Z0-9_.-]{0,63}\z/
+        SHA = /\A[0-9a-f]{64}\z/
+
+        def initialize(project:, journal:, admission:)
+          @project, @journal, @admission = project, journal, admission
+        end
+
+        attr_reader :journal
+
+        def dispatch(request:, peer:, role:, deadline:)
+          operation = request.fetch("operation")
+          params = request.fetch("params")
+          raise ArgumentError, "invalid command project" unless request.fetch("project_id") == @project
+          id = params.fetch("execution_id")
+          raise ArgumentError, "invalid command reference" unless id.is_a?(String) && ID.match?(id)
+          if operation == "command_status"
+            strict!(params, %w[execution_id])
+            raise ArgumentError, "status mutation must be null" unless request.fetch("mutation_id").nil?
+            commit = @journal.ref_value
+            data = projection(id, commit)
+            @admission.command_reader!(peer: peer, definition: data.fetch("definition"), deadline: deadline)
+            return {data: data.merge("journal_commit" => commit), replayed: false}
+          end
+          strict!(params, case operation
+          when "command_admit" then %w[execution_id selection]
+          when "command_claim" then %w[execution_id caller]
+          when "command_bind" then %w[execution_id child]
+          when "command_complete" then %w[execution_id result]
+          else raise ArgumentError, "unknown command operation"
+          end)
+          authenticated_peer = peer
+          launcher = nil
+          plan = if operation == "command_admit"
+            @admission.command_request!(selection: params.fetch("selection"), peer: peer, deadline: deadline)
+          else
+            launcher = @admission.command_launcher!(peer: authenticated_peer, deadline: deadline)
+            nil
+          end
+          authenticate = lambda do
+            if operation == "command_admit"
+              unless @admission.command_request!(selection: params.fetch("selection"), peer: peer, deadline: deadline) == plan
+                raise AttemptErrors::UnauthorizedIdentity, "command admission changed"
+              end
+            else
+              unless @admission.command_launcher!(peer: authenticated_peer, deadline: deadline) == launcher
+                raise AttemptErrors::UnauthorizedIdentity, "installed command launcher changed"
+              end
+            end
+          end
+          peer = launcher if launcher
+          expected = {"command_admit" => 0, "command_claim" => 1, "command_bind" => 2, "command_complete" => 3}.fetch(operation)
+          digest = Atoms::EvidenceDigest.digest({"project" => @project, "params" => params, "peer" => peer, "plan" => plan})
+          @journal.mutate(assignment_id: namespace(id), attempt_id: namespace(id),
+            mutation_id: request.fetch("mutation_id"), operation: operation, parameters_digest: digest,
+            expected_generation: expected, with_replay: true, deadline: deadline,
+            replay_authorizer: authenticate) do |_events, commit, _generation|
+            authenticate.call
+            prior = projection(id, commit, missing: true)
+            data = transition(operation, id, params, plan, prior, peer, deadline)
+            {events: [], data: data}
+          end
+        end
+
+        # Read only the accepted launcher-owned four-stage execution at the
+        # caller's held CAS prefix. Arbitrary allowed commands are not tests.
+        def test_evidence_at!(execution_id:, commit:, head:, tree:, deadline:)
+          unless execution_id.is_a?(String) && ID.match?(execution_id) && commit && @journal.ref_value == commit
+            raise AttemptErrors::EvidenceUnavailable, "test execution prefix or selector differs"
+          end
+          data = projection(execution_id, commit)
+          definition = data.fetch("definition")
+          events = @journal.read_events(namespace(execution_id), commit: commit)
+          accepted = events.select { |event| event["type"] == "authority_mutation" }
+          stages = accepted.map { |event| event.fetch("payload").fetch("data") }
+          unless accepted.size == 4 && data["phase"] == "exited" && data["result"] == {"exit_status" => 0, "signal" => nil} &&
+              definition["purpose"] == "test" && definition["source"] == {"head" => head, "tree" => tree} &&
+              [head, tree].all? { |value| value.is_a?(String) && value.match?(/\A[0-9a-f]{40}\z/) } &&
+              stages.all? { |stage| stage.fetch("definition") == definition } &&
+              stages.map { |stage| stage.fetch("phase") } == %w[admitted claimed running exited] &&
+              stages.drop(1).all? { |stage| stage.fetch("launcher") == data.fetch("launcher") } &&
+              stages[2].fetch("child") == data.fetch("child") && data.dig("launcher", "uid") == 0 &&
+              data.dig("child", "witnessed_by") == data.fetch("launcher") &&
+              data.dig("child", "kernel_identity") == data.dig("child", "root_witness")&.slice("pid", "uid", "started_at", "host") &&
+              data.dig("child", "root_witness", "cwd") == definition.dig("executor", "cwd") &&
+              data.dig("child", "kernel_identity", "uid") == definition.dig("executor", "uid")
+            raise AttemptErrors::ReceiptRejected, "candidate requires an exact successful executed test command"
+          end
+          @admission.command_test_evidence!(definition: definition, deadline: deadline)
+          command = JSON.generate(definition.fetch("argv"))
+          raise AttemptErrors::ReceiptRejected, "executed test command reference is oversized" if command.bytesize > 2048
+          {"schema" => "ace.test.execution-reference/v1", "reference" => execution_id,
+            "candidate_head" => head, "command" => command, "result" => "passed",
+            "recorded_at" => accepted.last.fetch("recorded_at"), "receipt_sha256" => Atoms::EvidenceDigest.digest(data)}
+        rescue KeyError, TypeError
+          raise AttemptErrors::EvidenceUnavailable, "canonical test execution is incomplete"
+        end
+
+        private
+
+        def transition(operation, id, params, plan, prior, peer, deadline)
+          base = {"schema" => "project-command/v1", "execution_id" => id, "project_id" => @project}
+          case operation
+          when "command_admit"
+            raise AttemptErrors::Conflict, "command already admitted" if prior
+            # Plan contains references and nonsecret context; its closed schema
+            # is owned by the installed Lab admission, never requester input.
+            base.merge("phase" => "admitted", "definition" => plan)
+          when "command_claim"
+            phase!(prior, "admitted")
+            @admission.command_claim!(definition: prior.fetch("definition"), caller: params.fetch("caller"),
+              launcher: peer, deadline: deadline)
+            prior.merge("phase" => "claimed", "launcher" => peer)
+          when "command_bind"
+            phase!(prior, "claimed")
+            launcher!(prior, peer)
+            child = @admission.command_child!(definition: prior.fetch("definition"), child: params.fetch("child"),
+              launcher: peer, deadline: deadline)
+            prior.merge("phase" => "running", "child" => child)
+          when "command_complete"
+            phase!(prior, "running")
+            launcher!(prior, peer)
+            result = params.fetch("result")
+            strict!(result, %w[exit_status signal])
+            exit_status, signal = result.values_at("exit_status", "signal")
+            unless (exit_status.is_a?(Integer) && exit_status.between?(0, 255) && signal.nil?) ||
+                (exit_status.nil? && signal.is_a?(Integer) && signal.between?(1, 127))
+              raise ArgumentError, "invalid command termination"
+            end
+            prior.merge("phase" => "exited", "result" => result)
+          end
+        end
+
+        def projection(id, commit, missing: false)
+          events = @journal.read_events(namespace(id), commit: commit)
+          unless Models::EvidenceEvent.chain_valid?(events)
+            raise AttemptErrors::EvidenceUnavailable, "command history is corrupt"
+          end
+          accepted = events.select { |event| event["type"] == "authority_mutation" }
+          if accepted.empty?
+            return nil if missing
+            raise AttemptErrors::NotFound, "command reference is unknown"
+          end
+          operations = accepted.map { |event| event.dig("payload", "operation") }
+          unless operations == OPERATIONS.reject { |name| name == "command_status" }.take(operations.size) && operations.size <= 4
+            raise AttemptErrors::EvidenceUnavailable, "command lifecycle is corrupt"
+          end
+          data = accepted.last.fetch("payload").fetch("data")
+          unless data.values_at("schema", "project_id", "execution_id") == ["project-command/v1", @project, id]
+            raise AttemptErrors::EvidenceUnavailable, "command association differs"
+          end
+          data
+        end
+
+        def namespace(id) = "command-#{id}"
+        def strict!(value, keys)
+          raise ArgumentError, "invalid command fields" unless value.is_a?(Hash) && value.keys.sort == keys.sort
+        end
+        def phase!(prior, phase)
+          raise AttemptErrors::Conflict, "command phase differs; inspect original execution" unless prior && prior["phase"] == phase
+        end
+        def launcher!(prior, peer)
+          raise AttemptErrors::UnauthorizedIdentity, "command launcher changed" unless prior.fetch("launcher") == peer
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/endcap.rb

@@ -294,7 +294,7 @@ module Ace
               data.fetch("head") == params.fetch("head")
             raise AttemptErrors::EvidenceUnavailable, "candidate replay provenance differs"
           end
-          bytes = journal.bounded_blob(data.fetch("bundle_ref"), commit: replay.fetch("journal_commit"), max_bytes: 64 * 1024 * 1024)
+          bytes = journal.bounded_blob(data.fetch("bundle_ref"), commit: replay.fetch("journal_commit"), max_bytes: CandidateTransfer::MAX_BYTES)
           unless bytes.bytesize == data.fetch("bytes") && Digest::SHA256.hexdigest(bytes) == data.fetch("sha256")
             raise AttemptErrors::EvidenceUnavailable, "candidate replay bundle differs"
           end
@@ -434,7 +434,9 @@ module Ace
   end
 end
 
-require_relative "endcap_services"
+require_relative "fixed_service_lifecycle"
+require_relative "fixed_publication_lifecycle"
+require_relative "endcap_service_context"
 require_relative "endcap_service_settlement"
 
 require_relative "endcap_campaign_results"

data/lib/ace/assign/authority/endcap_attempts.rb

@@ -179,7 +179,7 @@ module Ace
                 @launch.campaign_children_settled!(journal: selected, commit: prefix, params: params, map: map)
                 @launch.completion_scope!(journal: selected, events: fresh, params: params, map: map, commit: prefix)
                 service_settlement_evidence!(journal: selected, events: fresh, params: params, map: map, commit: prefix)
-                plan = Organisms::AttemptCoordinator.finished_transition_plan(events: fresh, receipt: result.fetch("receipt"))
+                plan = Organisms::AttemptCoordinator.finished_transition_plan(events: fresh, receipt: result.fetch("receipt"), authority: :protected)
                 plan.merge(data: params.slice("attempt_id", "result_id", "head", "candidate_generation").merge(
                   "receipt_digest" => result.fetch("receipt_digest"), "state" => result.dig("receipt", "verdict")))
                 end

data/lib/ace/assign/authority/endcap_campaign_rounds.rb

@@ -37,7 +37,7 @@ module Ace
         end
 
         def with_campaign_receipt!(journal:, commit:, events:, params:, map:, receipt:, result:, historical:)
-          unless result.is_a?(Hash) && result["schema"] == "ace.review.accepted-result/v1" &&
+          unless result.is_a?(Hash) && result["schema"] == "ace.review.accepted-result/v2" &&
               receipt["campaign"].is_a?(Hash) && receipt["campaign"].keys.sort == %w[id result] &&
               receipt["operation"] == "review" && receipt["verdict"] == "succeeded"
             raise AttemptErrors::ReceiptRejected, "parent campaign receipt differs"

data/lib/ace/assign/authority/endcap_publication.rb

@@ -35,172 +35,6 @@ module Ace
           end
         end
 
-        def publication_executor_identity?(project:, uid:)
-          @deployment.project(project).fetch("service_executor_uids").include?(uid)
-        end
-
-        def with_publication_hitl!(binding:, project:, peer:)
-          params = binding.slice("mapping_id", "assignment_id", "attempt_id", "request_id", "claim_binding", "input_digest", "candidate_generation", "head")
-          map = @deployment.mapping(params.fetch("mapping_id"))
-          raise AttemptErrors::UnauthorizedIdentity, "publication project differs" unless map.fetch("project_id") == project
-          @launch.with_assignment(params: params, map: map) do |journal, _registration|
-            protected_journal!(journal)
-            record = publication_record!(journal, params, map, peer, :executor)
-            unless record["dispatch_phase"] == "otp_pending" && record["publication_challenge_digest"] == binding.fetch("challenge_digest")
-              raise AttemptErrors::Conflict, "publication HITL challenge is no longer pending"
-            end
-            ServiceEvidence.new(journal: journal).publication_challenge!(record)
-            selection = settlement_immutable({"executor_process_binding" => record.fetch("executor_process_binding"),
-              "challenge_ref" => record.fetch("publication_challenge_ref").fetch("ref")})
-            yield selection
-          end
-        end
-
-        def authorize_publication_update!(journal:, existing:, replacement:, pending:)
-          operation = pending.fetch(:operation)
-          allowed = ServicePublicationEvidence::PUBLICATION_FIELDS + ["dispatch_phase"]
-          unless existing.except(*allowed) == replacement.except(*allowed) && existing["state"] == "uncertain"
-            raise AttemptErrors::InvalidState, "publication transition changed original binding"
-          end
-          owner = ServiceEvidence.new(journal: journal)
-          if operation == "publication_challenge"
-            unless %w[dispatch_started issuing].include?(existing["dispatch_phase"]) && replacement["dispatch_phase"] == "otp_pending" &&
-                replacement["publication_issuing_event_digest"] == existing["publication_issuing_event_digest"]
-              raise AttemptErrors::InvalidState, "publication need has no source-owned rejected push"
-            end
-            need = owner.publication_challenge!(replacement, pending: pending)
-            unless need["previous_challenge_digest"] == existing["publication_challenge_digest"]
-              raise AttemptErrors::InvalidState, "publication need predecessor differs"
-            end
-          elsif operation == "publication_continue"
-            unless existing["dispatch_phase"] == "otp_pending" && replacement["dispatch_phase"] == "issuing" &&
-                (allowed - %w[dispatch_phase publication_issuing_event_digest]).all? { |key| existing[key] == replacement[key] }
-              raise AttemptErrors::InvalidState, "publication continuation is not a unique pending challenge"
-            end
-            owner.publication_challenge!(replacement, pending: pending)
-            events = pending.fetch(:current_events) + pending.fetch(:pending_events)
-            event = events.find { |row| row["digest"] == replacement["publication_issuing_event_digest"] }
-            unless event && event["type"] == "service_publication_issuing" &&
-                %w[request_id input_digest claim_binding publication_challenge_digest].all? { |key| event.dig("payload", key) == replacement[key] }
-              raise AttemptErrors::EvidenceUnavailable, "publication issuing event is unavailable"
-            end
-          else
-            raise AttemptErrors::InvalidState, "publication transition has no fixed source owner"
-          end
-          true
-        end
-
-        def publication_record!(journal, params, map, peer, role, events: nil)
-          record = journal.service_request(params.fetch("request_id"))
-          unless record && record["operation"] == "publish" && record["state"] == "uncertain" &&
-              %w[dispatch_started otp_pending issuing].include?(record["dispatch_phase"]) &&
-              %w[claim_binding input_digest candidate_generation].all? { |key| record[key] == params[key] } &&
-              record["candidate_head"] == params["head"] && record["mapping_id"] == params["mapping_id"]
-            raise AttemptErrors::Conflict, "publication original tuple or phase differs"
-          end
-          service_executor!(peer, role, record)
-          service_ticket!(record, params, map, peer)
-          events ||= attempt_events(journal, params)
-          current = exact_candidate!(candidate(events), params)
-          origin = active_origin(events, params)
-          worker_or_launcher!(record.fetch("worker_process_binding"), :worker, map, origin)
-          approved_review!(journal, events, params, map, current)
-          @launch.scope_open_for_effect!(events: events, params: params, map: map)
-          service_policy!.authorize!(record)
-          ServiceEvidence.new(journal: journal).context(record)
-          record
-        end
-
-        def authorize_publication_transfer!(request, params, map, peer, role)
-          @launch.with_assignment(params: params, map: map) do |journal, _registration|
-            protected_journal!(journal)
-            publication_record!(journal, params, map, peer, role)
-          end
-          true
-        end
-
-        def dispatch_publication(request, params, map, peer, role, transfer)
-          authorize_publication_transfer!(request, params, map, peer, role)
-          challenge = request.fetch("operation") == "publication_challenge"
-          bytes = nil
-          if challenge
-            unless transfer && transfer.count == 1
-              raise ArgumentError, "publication need requires one bounded artifact"
-            end
-            bytes = transfer.bytes.dup.freeze
-            unless Digest::SHA256.hexdigest(bytes) == params.fetch("receipt_sha256")
-              raise AttemptErrors::ReceiptRejected, "publication need transfer digest differs"
-            end
-          elsif transfer
-            raise ArgumentError, "publication continuation forbids upload"
-          end
-          @launch.with_assignment(params: params, map: map) do |journal, _registration|
-            publication_record!(journal, params, map, peer, role)
-            result = journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
-              mutation_id: request.fetch("mutation_id"), operation: request.fetch("operation"),
-              parameters_digest: Atoms::EvidenceDigest.digest(params), expected_generation: params.fetch("expected_generation"),
-              with_replay: true) do |events, _commit, generation|
-              record = publication_record!(journal, params, map, peer, role, events: events)
-              if challenge
-                publication_challenge_plan(journal, events, record, params, bytes, generation)
-              else
-                publication_continue_plan(journal, events, record, params, generation)
-              end
-            end
-            if !challenge && result.fetch(:replayed)
-              result = result.merge(data: result.fetch(:data).merge("invocation" => "already_issued"))
-            end
-            result
-          end
-        end
-
-        def publication_challenge_plan(journal, events, record, params, bytes, generation)
-          owner = ServiceEvidence.new(journal: journal)
-          digest = Digest::SHA256.hexdigest(bytes)
-          if record["dispatch_phase"] == "otp_pending"
-            owner.publication_challenge!(record)
-            raise AttemptErrors::Conflict, "publication pending challenge differs" unless record["publication_challenge_digest"] == digest
-            return {data: service_projection(record).merge("challenge" => "retained")}
-          end
-          unless %w[dispatch_started issuing].include?(record["dispatch_phase"])
-            raise AttemptErrors::InvalidState, "publication has no rejected push"
-          end
-          previous = record["publication_challenge_digest"]
-          owner.publication_challenge!(record) if previous
-          owner.publication_need!(bytes, record, previous: previous)
-          payload = record.slice("request_id", "input_digest", "claim_binding").merge(
-            "challenge_digest" => digest, "previous_challenge_digest" => previous, "generation" => generation + 1)
-          time = Time.now.utc
-          event = Models::EvidenceEvent.build(type: "service_publication_challenge", attempt_id: record.fetch("attempt_id"),
-            payload: payload, previous_digest: events.last&.fetch("digest"), recorded_at: time)
-          plan = Molecules::CanonicalEvidence.new(journal: journal).import_plan(**owner.context(record),
-            artifacts: [bytes], admitted_after_event_digest: event.fetch("digest"))
-          replacement = record.merge("dispatch_phase" => "otp_pending", "publication_challenge_digest" => digest,
-            "publication_challenge_ref" => plan.fetch(:references).fetch(0),
-            "publication_challenge_event_digest" => event.fetch("digest"), "publication_challenge_generation" => generation + 1)
-          plan.merge(events: [{type: "service_publication_challenge", payload: payload, recorded_at: time}] + plan.fetch(:events),
-            data: service_projection(replacement).merge("challenge" => "created"), service_updates: [{request_id: record.fetch("request_id"),
-              expected: record, replacement: replacement, event_type: "service_transition"}])
-        end
-
-        def publication_continue_plan(journal, events, record, params, generation)
-          ServiceEvidence.new(journal: journal).publication_challenge!(record)
-          unless record["publication_challenge_digest"] == params.fetch("challenge_digest")
-            raise AttemptErrors::Conflict, "publication continuation challenge differs"
-          end
-          if record["dispatch_phase"] == "issuing"
-            return {data: service_projection(record).merge("invocation" => "already_issued")}
-          end
-          raise AttemptErrors::InvalidState, "publication is not pending" unless record["dispatch_phase"] == "otp_pending"
-          payload = record.slice("request_id", "input_digest", "claim_binding", "publication_challenge_digest").merge("generation" => generation + 1)
-          time = Time.now.utc
-          event = Models::EvidenceEvent.build(type: "service_publication_issuing", attempt_id: record.fetch("attempt_id"),
-            payload: payload, previous_digest: events.last&.fetch("digest"), recorded_at: time)
-          replacement = record.merge("dispatch_phase" => "issuing", "publication_issuing_event_digest" => event.fetch("digest"))
-          {events: [{type: "service_publication_issuing", payload: payload, recorded_at: time}],
-            data: service_projection(replacement).merge("invocation" => "permitted"), service_updates: [{request_id: record.fetch("request_id"),
-              expected: record, replacement: replacement, event_type: "service_transition"}]}
-        end
       end
     end
   end

data/lib/ace/assign/authority/endcap_service_context.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+module Ace
+  module Assign
+    module Authority
+      # Protected admission remains here. The shared fixed service transitions
+      # never manufacture a Deployment mapping or a protected launch origin.
+      class Endcap
+        include FixedServiceLifecycle
+        include FixedPublicationLifecycle
+
+        private
+
+        def with_service_scope(**options, &block) = @launch.with_assignment(**options, &block)
+        def service_journal!(journal) = protected_journal!(journal)
+        def service_mapping!(id) = @deployment.mapping(id)
+        def service_project!(id) = @deployment.project(id)
+        def service_scope_open!(**options) = @launch.scope_open_for_effect!(**options)
+        def service_preview_events!(**options) = @launch.preview_attempt_events!(**options)
+        def service_origin!(events, params) = active_origin(events, params)
+
+        def service_origin_fields!(origin)
+          {"worker_process_binding" => origin.fetch("process_binding").fetch("process_identity"),
+            "launch_ticket" => origin.fetch("launch_ticket"),
+            "reservation_generation" => origin.fetch("reservation_generation")}
+        end
+
+        def service_origin_matches!(record, origin)
+          expected = service_origin_fields!(origin)
+          record.slice(*expected.keys) == expected
+        end
+
+        def service_worker!(*args, **options) = worker_or_launcher!(*args, **options)
+        def service_review!(*args, **options) = approved_review!(*args, **options)
+      end
+    end
+  end
+end