ace-assign 0.69.0 → 0.71.0

data/lib/ace/assign/authority/fixed_publication_lifecycle.rb

@@ -0,0 +1,176 @@
+# frozen_string_literal: true
+
+module Ace
+  module Assign
+    module Authority
+      module FixedPublicationLifecycle
+        def publication_executor_identity?(project:, uid:)
+          service_project!(project).fetch("service_executor_uids").include?(uid)
+        end
+
+        def with_publication_hitl!(binding:, project:, peer:)
+          params = binding.slice("mapping_id", "assignment_id", "attempt_id", "request_id", "claim_binding", "input_digest", "candidate_generation", "head")
+          map = service_mapping!(params.fetch("mapping_id"))
+          raise AttemptErrors::UnauthorizedIdentity, "publication project differs" unless map.fetch("project_id") == project
+          with_service_scope(params: params, map: map) do |journal, _registration|
+            service_journal!(journal)
+            record = publication_record!(journal, params, map, peer, :executor)
+            unless record["dispatch_phase"] == "otp_pending" && record["publication_challenge_digest"] == binding.fetch("challenge_digest")
+              raise AttemptErrors::Conflict, "publication HITL challenge is no longer pending"
+            end
+            ServiceEvidence.new(journal: journal).publication_challenge!(record)
+            selection = settlement_immutable({"executor_process_binding" => record.fetch("executor_process_binding"),
+              "challenge_ref" => record.fetch("publication_challenge_ref").fetch("ref")})
+            yield selection
+          end
+        end
+
+        def authorize_publication_update!(journal:, existing:, replacement:, pending:)
+          operation = pending.fetch(:operation)
+          allowed = ServicePublicationEvidence::PUBLICATION_FIELDS + ["dispatch_phase"]
+          unless existing.except(*allowed) == replacement.except(*allowed) && existing["state"] == "uncertain"
+            raise AttemptErrors::InvalidState, "publication transition changed original binding"
+          end
+          owner = ServiceEvidence.new(journal: journal)
+          if operation == "publication_challenge"
+            unless %w[dispatch_started issuing].include?(existing["dispatch_phase"]) && replacement["dispatch_phase"] == "otp_pending" &&
+                replacement["publication_issuing_event_digest"] == existing["publication_issuing_event_digest"]
+              raise AttemptErrors::InvalidState, "publication need has no source-owned rejected push"
+            end
+            need = owner.publication_challenge!(replacement, pending: pending)
+            unless need["previous_challenge_digest"] == existing["publication_challenge_digest"]
+              raise AttemptErrors::InvalidState, "publication need predecessor differs"
+            end
+          elsif operation == "publication_continue"
+            unless existing["dispatch_phase"] == "otp_pending" && replacement["dispatch_phase"] == "issuing" &&
+                (allowed - %w[dispatch_phase publication_issuing_event_digest]).all? { |key| existing[key] == replacement[key] }
+              raise AttemptErrors::InvalidState, "publication continuation is not a unique pending challenge"
+            end
+            owner.publication_challenge!(replacement, pending: pending)
+            events = pending.fetch(:current_events) + pending.fetch(:pending_events)
+            event = events.find { |row| row["digest"] == replacement["publication_issuing_event_digest"] }
+            unless event && event["type"] == "service_publication_issuing" &&
+                %w[request_id input_digest claim_binding publication_challenge_digest].all? { |key| event.dig("payload", key) == replacement[key] }
+              raise AttemptErrors::EvidenceUnavailable, "publication issuing event is unavailable"
+            end
+          else
+            raise AttemptErrors::InvalidState, "publication transition has no fixed source owner"
+          end
+          true
+        end
+
+        def publication_record!(journal, params, map, peer, role, events: nil)
+          record = journal.service_request(params.fetch("request_id"))
+          unless record && record["operation"] == "publish" && record["state"] == "uncertain" &&
+              %w[dispatch_started otp_pending issuing].include?(record["dispatch_phase"]) &&
+              %w[claim_binding input_digest candidate_generation].all? { |key| record[key] == params[key] } &&
+              record["candidate_head"] == params["head"] && record["mapping_id"] == params["mapping_id"]
+            raise AttemptErrors::Conflict, "publication original tuple or phase differs"
+          end
+          service_executor!(peer, role, record)
+          service_ticket!(record, params, map, peer)
+          events ||= attempt_events(journal, params)
+          current = exact_candidate!(candidate(events), params)
+          origin = service_origin!(events, params)
+          service_worker!(record.fetch("worker_process_binding"), :worker, map, origin)
+          service_review!(journal, events, params, map, current)
+          service_scope_open!(events: events, params: params, map: map)
+          service_policy!.authorize!(record)
+          ServiceEvidence.new(journal: journal).context(record)
+          record
+        end
+
+        def authorize_publication_transfer!(request, params, map, peer, role)
+          with_service_scope(params: params, map: map) do |journal, _registration|
+            service_journal!(journal)
+            publication_record!(journal, params, map, peer, role)
+          end
+          true
+        end
+
+        def dispatch_publication(request, params, map, peer, role, transfer)
+          authorize_publication_transfer!(request, params, map, peer, role)
+          challenge = request.fetch("operation") == "publication_challenge"
+          bytes = nil
+          if challenge
+            unless transfer && transfer.count == 1
+              raise ArgumentError, "publication need requires one bounded artifact"
+            end
+            bytes = transfer.bytes.dup.freeze
+            unless Digest::SHA256.hexdigest(bytes) == params.fetch("receipt_sha256")
+              raise AttemptErrors::ReceiptRejected, "publication need transfer digest differs"
+            end
+          elsif transfer
+            raise ArgumentError, "publication continuation forbids upload"
+          end
+          with_service_scope(params: params, map: map) do |journal, _registration|
+            publication_record!(journal, params, map, peer, role)
+            result = journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
+              mutation_id: request.fetch("mutation_id"), operation: request.fetch("operation"),
+              parameters_digest: Atoms::EvidenceDigest.digest(params), expected_generation: params.fetch("expected_generation"),
+              with_replay: true) do |events, _commit, generation|
+              record = publication_record!(journal, params, map, peer, role, events: events)
+              if challenge
+                publication_challenge_plan(journal, events, record, params, bytes, generation)
+              else
+                publication_continue_plan(journal, events, record, params, generation)
+              end
+            end
+            if !challenge && result.fetch(:replayed)
+              result = result.merge(data: result.fetch(:data).merge("invocation" => "already_issued"))
+            end
+            result
+          end
+        end
+
+        def publication_challenge_plan(journal, events, record, params, bytes, generation)
+          owner = ServiceEvidence.new(journal: journal)
+          digest = Digest::SHA256.hexdigest(bytes)
+          if record["dispatch_phase"] == "otp_pending"
+            owner.publication_challenge!(record)
+            raise AttemptErrors::Conflict, "publication pending challenge differs" unless record["publication_challenge_digest"] == digest
+            return {data: service_projection(record).merge("challenge" => "retained")}
+          end
+          unless %w[dispatch_started issuing].include?(record["dispatch_phase"])
+            raise AttemptErrors::InvalidState, "publication has no rejected push"
+          end
+          previous = record["publication_challenge_digest"]
+          owner.publication_challenge!(record) if previous
+          owner.publication_need!(bytes, record, previous: previous)
+          payload = record.slice("request_id", "input_digest", "claim_binding").merge(
+            "challenge_digest" => digest, "previous_challenge_digest" => previous, "generation" => generation + 1)
+          time = Time.now.utc
+          event = Models::EvidenceEvent.build(type: "service_publication_challenge", attempt_id: record.fetch("attempt_id"),
+            payload: payload, previous_digest: events.last&.fetch("digest"), recorded_at: time)
+          plan = Molecules::CanonicalEvidence.new(journal: journal).import_plan(**owner.context(record),
+            artifacts: [bytes], admitted_after_event_digest: event.fetch("digest"))
+          replacement = record.merge("dispatch_phase" => "otp_pending", "publication_challenge_digest" => digest,
+            "publication_challenge_ref" => plan.fetch(:references).fetch(0),
+            "publication_challenge_event_digest" => event.fetch("digest"), "publication_challenge_generation" => generation + 1)
+          plan.merge(events: [{type: "service_publication_challenge", payload: payload, recorded_at: time}] + plan.fetch(:events),
+            data: service_projection(replacement).merge("challenge" => "created"), service_updates: [{request_id: record.fetch("request_id"),
+              expected: record, replacement: replacement, event_type: "service_transition"}])
+        end
+
+        def publication_continue_plan(journal, events, record, params, generation)
+          ServiceEvidence.new(journal: journal).publication_challenge!(record)
+          unless record["publication_challenge_digest"] == params.fetch("challenge_digest")
+            raise AttemptErrors::Conflict, "publication continuation challenge differs"
+          end
+          if record["dispatch_phase"] == "issuing"
+            return {data: service_projection(record).merge("invocation" => "already_issued")}
+          end
+          raise AttemptErrors::InvalidState, "publication is not pending" unless record["dispatch_phase"] == "otp_pending"
+          payload = record.slice("request_id", "input_digest", "claim_binding", "publication_challenge_digest").merge("generation" => generation + 1)
+          time = Time.now.utc
+          event = Models::EvidenceEvent.build(type: "service_publication_issuing", attempt_id: record.fetch("attempt_id"),
+            payload: payload, previous_digest: events.last&.fetch("digest"), recorded_at: time)
+          replacement = record.merge("dispatch_phase" => "issuing", "publication_issuing_event_digest" => event.fetch("digest"))
+          {events: [{type: "service_publication_issuing", payload: payload, recorded_at: time}],
+            data: service_projection(replacement).merge("invocation" => "permitted"), service_updates: [{request_id: record.fetch("request_id"),
+              expected: record, replacement: replacement, event_type: "service_transition"}]}
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/{endcap_services.rb → fixed_service_lifecycle.rb}

@@ -3,7 +3,7 @@
 module Ace
   module Assign
     module Authority
-      class Endcap
+      module FixedServiceLifecycle
         SERVICE_IDENTITY = %w[request_id assignment_id attempt_id project_id operation input_digest target
           authorization service_id caller_uid candidate_head candidate_generation executor_uid transport policy_digest
           worker_process_binding launch_ticket reservation_generation mapping_id].freeze
@@ -17,7 +17,7 @@ module Ace
         end
 
         def service_settlement_evidence!(journal:, events:, params:, map:, commit:)
-          protected_journal!(journal)
+          service_journal!(journal)
           journal.verify_commit!(commit)
           retained = journal.read_events(params.fetch("assignment_id"), commit: commit)
             .select { |event| event["attempt_id"] == params.fetch("attempt_id") }
@@ -80,7 +80,7 @@ module Ace
         # Called only by the installed journal composition, including lower
         # service writers. It never reacquires lifecycle/authority locks.
         def authorize_service_update!(journal:, existing:, replacement:, pending:)
-          protected_journal!(journal)
+          service_journal!(journal)
           if existing && existing.key?("executor_process_binding") &&
               Atoms::EvidenceDigest.digest(existing.fetch("executor_process_binding")) != Atoms::EvidenceDigest.digest(replacement["executor_process_binding"])
             raise AttemptErrors::InvalidState, "original cleanup executor cannot change"
@@ -114,28 +114,27 @@ module Ace
           end
           bytes = pending && pending.fetch(:service_inputs, {})[replacement.fetch("request_id")]
           raise AttemptErrors::UnauthorizedIdentity, "fresh service effect requires its exact original input" unless bytes.is_a?(String)
-          map = @deployment.mapping(replacement.fetch("mapping_id"))
+          map = service_mapping!(replacement.fetch("mapping_id"))
           unless replacement["project_id"] == map["project_id"] && replacement["caller_uid"] == map["worker_uid"]
             raise AttemptErrors::UnauthorizedIdentity, "protected service mapping differs"
           end
           params = replacement.slice("mapping_id", "assignment_id", "attempt_id", "candidate_generation").merge("head" => replacement.fetch("candidate_head"))
           events = pending.fetch(:current_events)
-          @launch.scope_open_for_effect!(events: events, params: params, map: map)
-          origin = active_origin(events, params)
-          unless replacement["worker_process_binding"] == origin.fetch("process_binding").fetch("process_identity") &&
-              replacement["launch_ticket"] == origin.fetch("launch_ticket") && replacement["reservation_generation"] == origin.fetch("reservation_generation")
+          service_scope_open!(events: events, params: params, map: map)
+          origin = service_origin!(events, params)
+          unless service_origin_matches!(replacement, origin)
             raise AttemptErrors::UnauthorizedIdentity, "protected service origin differs"
           end
-          receiver = @deployment.project(map.fetch("project_id")).fetch("service_receivers").fetch(replacement.fetch("service_id"))
+          receiver = service_project!(map.fetch("project_id")).fetch("service_receivers").fetch(replacement.fetch("service_id"))
           raise AttemptErrors::UnauthorizedIdentity, "protected service executor differs" unless receiver.fetch("executor_uid") == replacement.fetch("executor_uid")
           current = exact_candidate!(candidate(events), params)
-          approved_review!(journal, events, params, map, current, service_operation: replacement.fetch("operation")) unless %w[create update].include?(replacement.fetch("operation"))
+          service_review!(journal, events, params, map, current, service_operation: replacement.fetch("operation")) unless %w[create update].include?(replacement.fetch("operation"))
           service_policy!.prepare!(replacement, input_bytes: bytes)
           if begin_dispatch && %w[prune-preserved-workspace publish].include?(replacement.fetch("operation"))
             executor = replacement.fetch("executor_process_binding")
             boot = replacement.fetch("worker_process_binding").fetch("started_at").split(":").fetch(1)
             Molecules::ExecutionScopeLineage.validate_process_identity!(executor, boot_id: boot)
-            credentials = @deployment.project(map.fetch("project_id")).fetch("peer_credentials").fetch(receiver.fetch("executor_uid").to_s)
+            credentials = service_project!(map.fetch("project_id")).fetch("peer_credentials").fetch(receiver.fetch("executor_uid").to_s)
             unless executor.slice("uid", "gid", "groups") == credentials.slice("gid", "groups").merge("uid" => receiver.fetch("executor_uid"))
               raise AttemptErrors::UnauthorizedIdentity, "original cleanup executor credentials differ"
             end
@@ -164,8 +163,8 @@ module Ace
         def authorize_service_transfer!(request, params, map, peer, role)
           service_policy!
           service_policy!.visible!(project: map.fetch("project_id"), uid: map.fetch("worker_uid")) unless request.fetch("operation") == "complete_service"
-          @launch.with_assignment(params: params, map: map) do |journal, _registration|
-            protected_journal!(journal)
+          with_service_scope(params: params, map: map) do |journal, _registration|
+            service_journal!(journal)
             if request.fetch("operation") == "request_service"
               existing = journal.service_request(params.fetch("request_id"))
               if existing
@@ -173,8 +172,8 @@ module Ace
                 service_replay_binding!(existing, params, map)
               else
                 events = attempt_events(journal, params)
-                origin = active_origin(events, params)
-                worker_or_launcher!(params.fetch("worker_process_binding"), :worker, map, origin)
+                origin = service_origin!(events, params)
+                service_worker!(params.fetch("worker_process_binding"), :worker, map, origin)
                 service_receiver!(peer, role, map, params.fetch("service_id"))
               end
             else
@@ -191,7 +190,7 @@ module Ace
         # This immutable observation grants no service claim or dispatch permit.
         def workspace_prune_preview_context(_request, params, map, peer, role, transfer)
           raise ArgumentError, "preview context forbids upload" unless transfer.nil?
-          @launch.with_assignment(params: params, map: map) do |journal, _registration|
+          with_service_scope(params: params, map: map) do |journal, _registration|
             {data: workspace_prune_preview_context_at!(journal: journal, params: params, map: map, peer: peer, role: role), replayed: false}
           end
         end
@@ -203,11 +202,11 @@ module Ace
 
         def workspace_prune_preview_context_at!(journal:, params:, map:, peer:, role:)
           service_policy!.visible!(project: map.fetch("project_id"), uid: map.fetch("worker_uid"))
-          protected_journal!(journal)
+          service_journal!(journal)
           commit = journal.ref_value
-          events = @launch.preview_attempt_events!(journal: journal, commit: commit, params: params, map: map)
-          origin = active_origin(events, params)
-          worker_or_launcher!(params.fetch("worker_process_binding"), :worker, map, origin)
+          events = service_preview_events!(journal: journal, commit: commit, params: params, map: map)
+          origin = service_origin!(events, params)
+          service_worker!(params.fetch("worker_process_binding"), :worker, map, origin)
           receiver = service_receiver!(peer, role, map, params.fetch("service_id"))
           service_policy!.workspace_prune_receiver!(project: map.fetch("project_id"), uid: map.fetch("worker_uid"),
             service_id: params.fetch("service_id"), executor_uid: receiver.fetch("executor_uid"))
@@ -220,7 +219,7 @@ module Ace
             "journal_commit" => commit,
             "maintenance" => params.slice("mapping_id", "assignment_id", "attempt_id").merge("project_id" => map.fetch("project_id")),
             "head" => selected.fetch("head"), "candidate_generation" => selected.fetch("candidate_generation"),
-            "worker_process_binding" => origin.fetch("process_binding").fetch("process_identity"),
+            "worker_process_binding" => service_origin_fields!(origin).fetch("worker_process_binding"),
             "caller_process_binding" => params.fetch("worker_process_binding")
           }
           raise AttemptErrors::Conflict, "preview canonical selection changed" unless journal.ref_value == commit
@@ -232,8 +231,8 @@ module Ace
         private
 
         def service_status(_request, params, map, peer, role)
-          @launch.with_assignment(params: params, map: map) do |journal, _registration|
-            protected_journal!(journal)
+          with_service_scope(params: params, map: map) do |journal, _registration|
+            service_journal!(journal)
             commit = journal.ref_value
             read = role == :executor && journal.service_settlement_read(params.fetch("request_id"), commit: commit)
             record = read ? read.fetch(:record) : journal.service_request(params.fetch("request_id"), commit: commit)
@@ -261,7 +260,7 @@ module Ace
                 review && review["reviewer_uid"] == peer["uid"] && review["head"] == params["head"] &&
                   review["candidate_generation"] == params["candidate_generation"] && @kernel.descendant?(peer, review.fetch("reviewer_process_binding"))
               when :supervisor
-                @deployment.project(map.fetch("project_id")).fetch("supervisor_uids").include?(peer["uid"])
+                service_project!(map.fetch("project_id")).fetch("supervisor_uids").include?(peer["uid"])
               else
                 false
               end
@@ -287,8 +286,8 @@ module Ace
           authorize_service_transfer!(request, params, map, peer, role)
           raise ArgumentError, "structured service input transfer is missing" unless transfer && transfer.count == 1
           bytes = transfer.bytes.dup.freeze
-          @launch.with_assignment(params: params, map: map) do |journal, _registration|
-            protected_journal!(journal)
+          with_service_scope(params: params, map: map) do |journal, _registration|
+            service_journal!(journal)
             record = journal.service_request(params.fetch("request_id"))
             service_executor!(peer, role, record)
             service_ticket!(record, params, map, peer)
@@ -296,10 +295,9 @@ module Ace
               raise AttemptErrors::Conflict, "authorization input binding differs"
             end
             events = attempt_events(journal, params)
-            @launch.scope_open_for_effect!(events: events, params: params, map: map)
-            origin = active_origin(events, params)
-            unless record["worker_process_binding"] == origin.fetch("process_binding").fetch("process_identity") &&
-                record["launch_ticket"] == origin.fetch("launch_ticket") && record["reservation_generation"] == origin.fetch("reservation_generation")
+            service_scope_open!(events: events, params: params, map: map)
+            origin = service_origin!(events, params)
+            unless service_origin_matches!(record, origin)
               raise AttemptErrors::UnauthorizedIdentity, "authorization launch origin differs"
             end
             current = exact_candidate!(candidate(events), params)
@@ -307,7 +305,7 @@ module Ace
               raise AttemptErrors::Conflict, "authorization candidate changed"
             end
             service_receiver!(peer, role, map, record.fetch("service_id"))
-            approved_review!(journal, events, params, map, current, service_operation: record.fetch("operation")) unless %w[create update].include?(record.fetch("operation"))
+            service_review!(journal, events, params, map, current, service_operation: record.fetch("operation")) unless %w[create update].include?(record.fetch("operation"))
             prepared = service_policy!.prepare!(record, input_bytes: bytes)
             data = params.slice("request_id", "claim_binding", "head", "candidate_generation").merge(
               "policy_digest" => prepared.fetch(:policy_digest), "operation_digest" => prepared.fetch(:operation_digest))
@@ -324,8 +322,8 @@ module Ace
             raise ArgumentError, "structured service input transfer is missing" unless transfer && transfer.count == 1
             transfer.bytes.dup.freeze
           end
-          @launch.with_assignment(params: params, map: map) do |journal, _registration|
-            protected_journal!(journal)
+          with_service_scope(params: params, map: map) do |journal, _registration|
+            service_journal!(journal)
             unless request.fetch("operation") == "complete_service"
               input_record = request.fetch("operation") == "request_service" ? params : journal.service_request(params.fetch("request_id"))
               # Replay bypasses the mutation callback, never input validation.
@@ -348,8 +346,8 @@ module Ace
               service_ticket!(record, params, map, peer)
               completion_binding!(record, params, admitted) if request.fetch("operation") == "complete_service"
             elsif !retained
-              origin = active_origin(attempt_events(journal, params), params)
-              worker_or_launcher!(params.fetch("worker_process_binding"), :worker, map, origin)
+              origin = service_origin!(attempt_events(journal, params), params)
+              service_worker!(params.fetch("worker_process_binding"), :worker, map, origin)
               service_receiver!(peer, role, map, params.fetch("service_id"))
             end
             result = journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
@@ -433,7 +431,7 @@ module Ace
         end
 
         def service_receiver!(peer, role, map, service_id)
-          project = @deployment.project(map.fetch("project_id"))
+          project = service_project!(map.fetch("project_id"))
           receiver = project.fetch("service_receivers").fetch(service_id)
           unless role == :executor && peer["uid"] == receiver.fetch("executor_uid") &&
               project.fetch("service_executor_uids").include?(peer["uid"]) &&
@@ -447,18 +445,17 @@ module Ace
         end
 
         def service_claim_plan(journal, events, params, map, peer, role, input_bytes)
-          origin = active_origin(events, params)
+          origin = service_origin!(events, params)
           worker = params.fetch("worker_process_binding")
-          worker_or_launcher!(worker, :worker, map, origin)
+          service_worker!(worker, :worker, map, origin)
           current = exact_candidate!(candidate(events), params)
-          approved_review!(journal, events, params, map, current, service_operation: params.fetch("operation")) unless %w[create update].include?(params.fetch("operation"))
+          service_review!(journal, events, params, map, current, service_operation: params.fetch("operation")) unless %w[create update].include?(params.fetch("operation"))
           receiver = service_receiver!(peer, role, map, params.fetch("service_id"))
           binding = params.slice("request_id", "assignment_id", "attempt_id", "operation", "input_digest", "target",
             "authorization", "service_id").merge("project_id" => map.fetch("project_id"),
               "caller_uid" => map.fetch("worker_uid"), "mapping_id" => params.fetch("mapping_id"), "candidate_head" => current.fetch("head"),
-              "candidate_generation" => current.fetch("candidate_generation"),
-              "worker_process_binding" => origin.fetch("process_binding").fetch("process_identity"),
-              "launch_ticket" => origin.fetch("launch_ticket"), "reservation_generation" => origin.fetch("reservation_generation"))
+              "candidate_generation" => current.fetch("candidate_generation"))
+            .merge(service_origin_fields!(origin))
           prepared = service_policy!.prepare!(binding, input_bytes: input_bytes)
           binding = prepared.fetch(:binding).merge("policy_digest" => prepared.fetch(:policy_digest))
           unless binding["executor_uid"] == receiver.fetch("executor_uid")
@@ -488,16 +485,15 @@ module Ace
           # A repeated begin never grants a second invocation, including after
           # lease expiry or terminality. It reports only retained ticket truth.
           return {data: service_projection(record).merge("invocation" => "already_started")} unless record["dispatch_phase"] == "issued"
-          origin = active_origin(events, params)
-          unless record["worker_process_binding"] == origin.fetch("process_binding").fetch("process_identity") &&
-              record["launch_ticket"] == origin.fetch("launch_ticket") && record["reservation_generation"] == origin.fetch("reservation_generation")
+          origin = service_origin!(events, params)
+          unless service_origin_matches!(record, origin)
             raise AttemptErrors::UnauthorizedIdentity, "dispatch launch origin differs"
           end
           current = exact_candidate!(candidate(events), params)
           unless record["candidate_head"] == current["head"] && record["candidate_generation"] == current["candidate_generation"]
             raise AttemptErrors::Conflict, "dispatch candidate changed"
           end
-          approved_review!(journal, events, params, map, current, service_operation: record.fetch("operation")) unless %w[create update].include?(record.fetch("operation"))
+          service_review!(journal, events, params, map, current, service_operation: record.fetch("operation")) unless %w[create update].include?(record.fetch("operation"))
           service_policy!.prepare!(record, input_bytes: input_bytes)
           replacement = record.merge("dispatch_phase" => "dispatch_started")
           if record.fetch("operation") == "prune-preserved-workspace"

data/lib/ace/assign/authority/launch_control_exclusions.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 require_relative "../molecules/protected_control_exclusion"
 require_relative "campaign_execution"
+require_relative "assignment_definition"
 
 module Ace
   module Assign
@@ -117,23 +118,8 @@ module Ace
         end
 
         def validated_registration_definition!(params, map)
-          bytes = params.fetch("definition_bytes")
-          unless bytes.is_a?(String) && bytes.bytesize <= 32_768 && params["definition_digest"].is_a?(String) &&
-              Digest::SHA256.hexdigest(bytes) == params["definition_digest"]
-            raise ArgumentError, "invalid assignment definition digest or size"
-          end
-          value = JSON.parse(bytes)
-          allowed = %w[session_id name description created_at updated_at source_config parent task_id project_id prepared_work review_campaign campaign_execution]
-          unless value.is_a?(Hash) && (value.keys - allowed).empty? &&
-              %w[session_id name created_at source_config task_id project_id].all? { |key| value[key].is_a?(String) && !value[key].empty? } &&
-              value["session_id"] == params["assignment_id"] && value["project_id"] == map["project_id"]
-            raise ArgumentError, "invalid managed assignment definition"
-          end
-          CampaignExecution.validate_parent!(value.fetch("review_campaign")) if value.key?("review_campaign")
-          assignment = Models::Assignment.from_h(value)
-          raise ArgumentError, "definition is not managed" unless assignment.managed?
-          token!(assignment.task_id)
-          assignment
+          AssignmentDefinition.parse(bytes: params.fetch("definition_bytes"), digest: params["definition_digest"],
+            assignment_id: params["assignment_id"], project_id: map["project_id"])
         end
       end
     end

data/lib/ace/assign/authority/ordinary_attempt_start.rb

@@ -0,0 +1,137 @@
+# frozen_string_literal: true
+
+module Ace
+  module Assign
+    module Authority
+      module OrdinaryAttemptStart
+        START_KEYS = %w[assignment_id attempt_id expected_generation head pane scope].freeze
+
+        private
+
+        def start_attempt(request, peer, role, deadline)
+          params = request.fetch("params")
+          strict!(params, START_KEYS)
+          %w[assignment_id attempt_id].each { |key| token!(params.fetch(key)) }
+          if params.fetch("attempt_id").start_with?("definition-")
+            raise ArgumentError, "ordinary attempt ID uses the registration namespace"
+          end
+          token!(request.fetch("mutation_id"))
+          unless params.fetch("head").is_a?(String) && params.fetch("head").match?(/\A[0-9a-f]{40}\z/)
+            raise ArgumentError, "ordinary start HEAD is invalid"
+          end
+          unless %i[supervisor worker].include?(role) && params.fetch("expected_generation").is_a?(Integer) && params.fetch("expected_generation") == 0
+            raise AttemptErrors::UnauthorizedIdentity, "ordinary start requires an installed worker and a new attempt"
+          end
+          commit = @journal.ref_value
+          registered = registration(params.fetch("assignment_id"), commit: commit)
+          raise AttemptErrors::NotFound, "ordinary work is not registered" unless registered
+          work = registered_work(registered, commit, deadline)
+          scope = params.fetch("scope")
+          unless work.manifest.fetch("steps").any? { |step| step.fetch("number") == scope }
+            raise AttemptErrors::InvalidScope, "ordinary scope is not in the accepted work"
+          end
+          keys = [@exclusion.task_key(registered.fetch("task_id")), @exclusion.assignment_key(params.fetch("assignment_id"))]
+          @exclusion.with_shared_multi(keys, deadline: deadline) do
+            if @journal.mutation_result(request.fetch("mutation_id"))
+              # Work may legitimately have advanced since an acknowledged or
+              # lost start reply. Recover its original head, never recapture it.
+              identity = @admission.identity!(peer: peer, pane: params.fetch("pane"), deadline: deadline)
+              return @journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
+                mutation_id: request.fetch("mutation_id"), operation: "start_attempt", parameters_digest: start_digest(params, peer, identity),
+                expected_generation: 0, with_replay: true, deadline: deadline,
+                replay_authorizer: -> { authorize_start_replay!(request, peer, role, deadline) }) do
+                  raise AttemptErrors::EvidenceUnavailable, "accepted ordinary start disappeared"
+                end
+            end
+            # Only the installed admission can observe the actual native owner
+            # and worker checkout. It performs no launch or delivery effect.
+            observed = @admission.execution!(peer: peer, pane: params.fetch("pane"), head: params.fetch("head"), deadline: deadline)
+            identity = observed.fetch(:identity)
+            principal = {"uid" => peer.fetch("uid"), "actor" => identity.actor}
+            digest = start_digest(params, peer, identity)
+            authorize!(request, peer, role, deadline)
+            @journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
+              mutation_id: request.fetch("mutation_id"), operation: "start_attempt", parameters_digest: digest,
+              expected_generation: 0, with_replay: true, deadline: deadline,
+              replay_authorizer: -> { authorize_start_replay!(request, peer, role, deadline) }) do |events, prefix, _generation|
+              authorize!(request, peer, role, deadline)
+              unless @admission.identity!(peer: peer, pane: params.fetch("pane"), deadline: deadline) == identity
+                raise AttemptErrors::UnauthorizedIdentity, "ordinary native worker changed before start acceptance"
+              end
+              unless events.empty? && registration(params.fetch("assignment_id"), commit: prefix) == registered
+                raise AttemptErrors::Conflict, "ordinary start registration or attempt changed"
+              end
+              if @journal.assignment_ids(commit: prefix).any? { |assignment|
+                  assignment != params.fetch("assignment_id") && @journal.read_events(assignment, commit: prefix).any? { |event|
+                    event.fetch("attempt_id") == params.fetch("attempt_id") } }
+                raise AttemptErrors::Conflict, "ordinary attempt ID belongs to another assignment"
+              end
+              # Sibling scopes may run independently. A different request ID
+              # never repeats an already consumed scope or any part of it.
+              if @journal.derived_attempts(params.fetch("assignment_id"), commit: prefix).any? { |attempt|
+                  Atoms::AssignmentScope.overlap?(attempt.binding.scope, scope) }
+                raise AttemptErrors::Conflict, "ordinary scope already has an attempt; reconcile its original execution"
+              end
+              record = current_queue_record(registered, prefix)
+              queue = OrdinaryQueue.new(work: work, root: @input_root, bytes: queue_bytes(record, prefix))
+                .transition(operation: :activate, scope: scope)
+              queue_sha = Digest::SHA256.hexdigest(queue.bytes)
+              queue_path = "execution/definitions/#{params.fetch('assignment_id')}-queue-#{queue_sha}.json"
+              {events: [
+                {type: "intent", payload: {"assignment_id" => params.fetch("assignment_id"), "scope" => scope,
+                  "project_id" => @project, "task_id" => registered.fetch("task_id"), "base_head" => observed.fetch(:checkout).fetch("head")}},
+                {type: "process_start", payload: {"actor" => identity.actor, "role" => identity.role, "runtime" => identity.runtime,
+                  "pid" => identity.process_pid, "process_identity" => identity.runtime_binding.fetch("process_identity"),
+                  "runtime_binding" => identity.runtime_binding, "checkout" => observed.fetch(:checkout)}}
+              ], blobs: {queue_path => queue.bytes}, data: {
+                "authority" => "ordinary", "assignment_id" => params.fetch("assignment_id"), "attempt_id" => params.fetch("attempt_id"),
+                "project_id" => @project, "scope" => scope, "state" => "running", "started_by" => principal,
+                "base_head" => observed.fetch(:checkout).fetch("head"), "runtime_binding" => identity.runtime_binding,
+                "queue_ref" => queue_path, "queue_sha256" => queue_sha}}
+            end
+          end
+        end
+
+        def start_digest(params, peer, identity)
+          Atoms::EvidenceDigest.digest({"params" => params, "project_id" => @project,
+            "principal" => {"uid" => peer.fetch("uid"), "actor" => identity.actor}})
+        end
+
+        def authorize_start_replay!(request, peer, role, deadline)
+          authorize!(request, peer, role, deadline)
+          params = request.fetch("params")
+          identity = @admission.identity!(peer: peer, pane: params.fetch("pane"), deadline: deadline)
+          start_replay_owner!(params, identity)
+        end
+
+        def registered_work(registered, commit, deadline)
+          reference = registered.fetch("prepared_work")
+          bytes = @journal.bounded_blob(registered.fetch("prepared_bundle_ref"), commit: commit,
+            max_bytes: registered.fetch("prepared_bundle_bytes"))
+          work = PreparedWork.admit(bytes: bytes, head: reference.fetch("prepared_head"), tree: reference.fetch("prepared_tree"),
+            sha256: registered.fetch("prepared_bundle_sha256"), size: registered.fetch("prepared_bundle_bytes"),
+            root: @input_root, deadline: deadline)
+          unless work.reference(head: reference.fetch("prepared_head"), tree: reference.fetch("prepared_tree")) == reference &&
+              work.manifest.values_at("assignment_id", "project_id", "task_id") == registered.values_at("assignment_id", "project_id", "task_id") &&
+              Digest::SHA256.hexdigest(work.definition_bytes(head: reference.fetch("prepared_head"), tree: reference.fetch("prepared_tree"))) == registered.fetch("definition_digest")
+            raise AttemptErrors::EvidenceUnavailable, "ordinary prepared registration bytes differ"
+          end
+          work
+        end
+
+        def start_replay_owner!(params, identity)
+          events = @journal.read_events(params.fetch("assignment_id"))
+            .select { |event| event.fetch("attempt_id") == params.fetch("attempt_id") }
+          unless Models::EvidenceEvent.chain_valid?(events) && events.count { |event| event["type"] == "process_start" } == 1
+            raise AttemptErrors::EvidenceUnavailable, "ordinary start evidence is unavailable"
+          end
+          owner = events.find { |event| event["type"] == "process_start" }.fetch("payload")
+          unless owner.values_at("actor", "role", "runtime", "runtime_binding") ==
+              [identity.actor, identity.role, identity.runtime, identity.runtime_binding]
+            raise AttemptErrors::UnauthorizedIdentity, "ordinary replay belongs to its original native worker"
+          end
+        end
+      end
+    end
+  end
+end