ace-assign 0.69.0 → 0.71.0

data/lib/ace/assign/authority/ordinary_client.rb

@@ -0,0 +1,70 @@
+# frozen_string_literal: true
+
+require_relative "ordinary_peer"
+require_relative "transfer_codec"
+
+module Ace
+  module Assign
+    module Authority
+      # Installed selection is supplied by the caller's trusted composition.
+      # This client never selects a journal, local fallback or execution identity.
+      class OrdinaryClient
+        Reply = Struct.new(:data, :replayed, :parts, keyword_init: true)
+
+        def initialize(project_id:, service:, verify_selection:, peer: OrdinaryPeer.new, scratch_root: nil)
+          @project_id, @service, @verify_selection, @peer, @scratch_root = project_id, service, verify_selection, peer, scratch_root
+        end
+
+        def call(operation, params, mutation_id: nil, upload_parts: nil, download: false, purpose: nil, timeout: 30)
+          unless operation.is_a?(String) && params.is_a?(Hash) && !params.key?("transfer") &&
+              timeout.is_a?(Numeric) && timeout.finite? && timeout.positive?
+            raise ArgumentError, "invalid ordinary authority request"
+          end
+          raise ArgumentError, "ordinary download needs private scratch and forbids upload" if download && (upload_parts || !@scratch_root)
+          @verify_selection.call
+          wire = Ace::Runtime::Molecules::ProtectedSocket
+          path = @service.fetch("socket_path")
+          wire.root_path!(File.dirname(path), directory: true, owner: @service.fetch("uid"))
+          before = wire.socket_identity(path, mode: 0o660)
+          raise AttemptErrors::UnauthorizedIdentity, "ordinary endpoint owner differs" unless before.last == @service.fetch("uid")
+          codec = TransferCodec.new(root: download ? @scratch_root : nil)
+          descriptor = codec.descriptor(upload_parts, purpose: purpose) if upload_parts
+          parameters = descriptor ? params.merge("transfer" => descriptor) : params
+          deadline = wire.deadline([timeout, 30].min)
+          wire.connect(path, deadline: deadline) do |socket|
+            observed = @peer.capture(socket, deadline: deadline)
+            unless observed.values_at("uid", "gid") == @service.values_at("uid", "gid") && wire.socket_identity(path, mode: 0o660) == before
+              raise AttemptErrors::UnauthorizedIdentity, "ordinary endpoint peer changed"
+            end
+            @verify_selection.call
+            wire.write(socket, {"version" => 1, "operation" => operation, "mutation_id" => mutation_id,
+              "project_id" => @project_id, "params" => parameters}, deadline: deadline, limit: 16_384)
+            codec.send(socket, parts: upload_parts, descriptor: descriptor, purpose: purpose, deadline: deadline) if upload_parts
+            socket.shutdown(Socket::SHUT_WR)
+            ingress = wire::Ingress.new(socket)
+            result = wire.read(ingress, deadline: deadline, limit: 16_384)
+            unless result.is_a?(Hash) && result.keys.sort == %w[data status transport] && result["status"] == "ok" &&
+                result["data"].is_a?(Hash) && result["transport"].is_a?(Hash) &&
+                result["transport"].keys == ["replayed"] && [true, false].include?(result["transport"]["replayed"])
+              code = result.is_a?(Hash) && result["error"].is_a?(Hash) ? result["error"]["code"] : nil
+              raise AttemptErrors::EvidenceUnavailable, "ordinary authority refused (#{code || 'invalid_response'}); retain original mutation"
+            end
+            parts = if download
+              codec.receive(ingress, descriptor: result.fetch("data").fetch("transfer"), purpose: purpose, deadline: deadline) do |input|
+                Array.new(input.count) { |index| input.bytes(index: index) }
+              end
+            end
+            @verify_selection.call
+            @peer.live!(observed, deadline: deadline)
+            unless wire.socket_identity(path, mode: 0o660) == before
+              raise AttemptErrors::UnauthorizedIdentity, "ordinary endpoint changed before response acceptance"
+            end
+            Reply.new(data: result.fetch("data"), replayed: result.fetch("transport").fetch("replayed"), parts: parts)
+          end
+        rescue SystemCallError, IOError, Ace::Runtime::RuntimeUnavailableError
+          raise AttemptErrors::EvidenceUnavailable, "ordinary authority outcome unavailable; retain original mutation; no local fallback"
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/ordinary_completion.rb

@@ -0,0 +1,104 @@
+# frozen_string_literal: true
+
+require_relative "ordinary_effect_settlement"
+require_relative "../organisms/attempt_coordinator"
+
+module Ace
+  module Assign
+    module Authority
+      # Terminal acceptance consumes the submitted canonical receipt. The
+      # supervisor cannot replace its bytes, worker, scope or candidate.
+      module OrdinaryCompletion
+        FINISH_KEYS = %w[assignment_id attempt_id expected_generation pane head result_id receipt_digest].freeze
+
+        private
+
+        def finish_result(request, peer, role, deadline)
+          params = request.fetch("params")
+          strict!(params, FINISH_KEYS)
+          %w[assignment_id attempt_id result_id].each { |key| token!(params.fetch(key)) }
+          token!(request.fetch("mutation_id"))
+          unless role == :supervisor
+            raise AttemptErrors::UnauthorizedIdentity, "ordinary completion requires the installed supervisor"
+          end
+          unless params.fetch("expected_generation").is_a?(Integer) && params.fetch("expected_generation").positive? &&
+              params.fetch("head").is_a?(String) && params.fetch("head").match?(/\A[0-9a-f]{40}\z/) &&
+              params.fetch("receipt_digest").is_a?(String) && params.fetch("receipt_digest").match?(/\A[0-9a-f]{64}\z/)
+            raise ArgumentError, "ordinary completion selection is invalid"
+          end
+          registered = registration(params.fetch("assignment_id"), commit: @journal.ref_value)
+          raise AttemptErrors::NotFound, "ordinary work is not registered" unless registered
+          verify_result_owner!(request, peer, role, deadline, registered)
+          digest = Atoms::EvidenceDigest.digest({"params" => params, "project_id" => @project, "peer_uid" => peer.fetch("uid")})
+          @exclusion.with_shared_multi([@exclusion.task_key(registered.fetch("task_id"))], deadline: deadline) do
+            @exclusion.with_exclusive(@exclusion.assignment_key(params.fetch("assignment_id")), deadline: deadline) do
+              authorize!(request, peer, role, deadline)
+              with_result_transport(request, deadline) do |transport|
+                @journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
+                  mutation_id: request.fetch("mutation_id"), operation: "finish", parameters_digest: digest,
+                  expected_generation: params.fetch("expected_generation"), with_replay: true, deadline: deadline,
+                  replay_authorizer: -> { verify_result_owner!(request, peer, role, deadline, registered) }) do |events, prefix, _generation|
+                  verify_result_owner!(request, peer, role, deadline, registered)
+                  unless Molecules::CanonicalAttemptState.derive(events) == "running"
+                    raise AttemptErrors::Conflict, "ordinary completion requires a running attempt"
+                  end
+                  result = retained_ordinary_result(params, events, prefix)
+                  unless result && result.fetch("result_id") == params.fetch("result_id") &&
+                      result.dig("receipt", "digest") == params.fetch("receipt_digest") && result.dig("binding", "head") == params.fetch("head")
+                    raise AttemptErrors::ReceiptRejected, "ordinary completion requires its exact submitted result"
+                  end
+                  binding = result.fetch("binding")
+                  observed = @admission.recorded_execution!(binding: binding.fetch("runtime_binding"), head: binding.fetch("head"), deadline: deadline)
+                  unless observed.fetch(:runtime_binding) == binding.fetch("runtime_binding") && observed.fetch(:checkout) == binding.fetch("checkout")
+                    raise AttemptErrors::UnauthorizedIdentity, "ordinary result worker checkout changed"
+                  end
+                  references = events.select { |event| event["type"] == "inbox_binding" }.map { |event| event.fetch("payload") }
+                  delivery = transport.call(references: references, attempt_id: params.fetch("attempt_id"), owner: binding.fetch("runtime_binding"))
+                  scope = events.find { |event| event["type"] == "intent" }.fetch("payload").fetch("scope")
+                  work = registered_work(registered, prefix, deadline)
+                  queue = OrdinaryQueue.new(work: work, root: @input_root, bytes: queue_bytes(current_queue_record(registered, prefix), prefix))
+                  verdict = result.dig("receipt", "verdict")
+                  complete = verdict == "succeeded" ? queue.status.subtree_complete?(scope) : queue.status.subtree_failed?(scope)
+                  raise AttemptErrors::Conflict, "ordinary result scope has unfinished progress" unless complete
+                  settlement = OrdinaryEffectSettlement.new(journal: @journal).verify!(project: @project,
+                    assignment: params.fetch("assignment_id"), attempt: params.fetch("attempt_id"), events: events, commit: prefix)
+                  verify_result_owner!(request, peer, role, deadline, registered)
+                  plan = Organisms::AttemptCoordinator.finished_transition_plan(events: events, receipt: result.fetch("receipt"), authority: :ordinary)
+                  plan.merge(data: params.slice("assignment_id", "attempt_id", "result_id", "head", "receipt_digest").merge(
+                    "authority" => "ordinary", "scope" => scope, "state" => verdict, "settlement" => settlement, "inbox_deliveries" => delivery))
+                end
+              end
+            end
+          end
+        rescue Ace::Herdr::Error => error
+          raise AttemptErrors::EvidenceUnavailable, "ordinary transport settlement is unavailable: #{error.message}"
+        end
+
+        def verify_result_owner!(request, peer, role, deadline, registered)
+          authorize!(request, peer, role, deadline)
+          supervisor = @admission.identity!(peer: peer, pane: request.fetch("params").fetch("pane"), deadline: deadline)
+          unless supervisor.role == "coordinator" &&
+              supervisor.runtime_binding == supervisor_selection(registered, @journal.ref_value).fetch("binding")
+            raise AttemptErrors::UnauthorizedIdentity, "ordinary completion belongs to its original supervisor"
+          end
+        end
+
+        def with_result_transport(request, deadline)
+          if @journal.mutation_result(request.fetch("mutation_id"), commit: @journal.ref_value)
+            # A terminal reply is immutable. Current peer authority is still
+            # checked by mutate, but retired transport files are not replay input.
+            return yield nil
+          end
+          if @inbox
+            @inbox.with_delivery_settlement(deadline: deadline) { |verify| yield verify }
+          else
+            yield lambda { |references:, **_|
+              raise AttemptErrors::EvidenceUnavailable, "ordinary Inbox owner is not installed" unless references.empty?
+              []
+            }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/ordinary_effect_settlement.rb

@@ -0,0 +1,118 @@
+# frozen_string_literal: true
+
+require_relative "service_evidence"
+require_relative "../molecules/ordinary_merge_contract"
+
+module Ace
+  module Assign
+    module Authority
+      # Completion reads the existing effect owners at the held CAS prefix.
+      # A prompt, acknowledgment or failed dispatch never settles an effect.
+      class OrdinaryEffectSettlement
+        def initialize(journal:)
+          @journal = journal
+        end
+
+        def verify!(project:, assignment:, attempt:, events:, commit:)
+          retained = @journal.read_events(assignment, commit: commit).select { |event| event["attempt_id"] == attempt }
+          unless retained == events && Models::EvidenceEvent.chain_valid?(events)
+            unavailable!("ordinary settlement needs its exact canonical attempt")
+          end
+          selection = {"project_id" => project, "assignment_id" => assignment, "attempt_id" => attempt}
+          services = records!(@journal.service_request_records(commit: commit), events, selection, %w[service_claim service_transition])
+          merges = records!(@journal.fixed_merge_request_records(commit: commit), events, selection, %w[merge_admission merge_transition])
+          services.each { |record| service!(record, commit) }
+          merges.each { |record| merge!(record, commit) }
+          assignment_events = @journal.read_events(assignment, commit: commit)
+          assignment_events.group_by { |event| event.fetch("attempt_id") }.each_value do |chain|
+            unavailable!("ordinary delivery history is corrupt") unless Models::EvidenceEvent.chain_valid?(chain)
+          end
+          delivery!(events, merges, assignment_events)
+          {"journal_commit" => commit, "service_requests" => services.map { |record| record.fetch("request_id") }.sort,
+            "merge_requests" => merges.map { |record| record.fetch("request_id") }.sort}
+        end
+
+        private
+
+        def records!(inventory, events, selection, types)
+          records = inventory.select { |record| record.values_at("assignment_id", "attempt_id") == selection.values_at("assignment_id", "attempt_id") }
+          references = events.select { |event| types.include?(event["type"]) }
+          ids = references.map { |event| event.fetch("payload").fetch("request_id") }.uniq.sort
+          unless records.map { |record| record.fetch("request_id") }.sort == ids
+            unavailable!("ordinary effect inventory and event set differ")
+          end
+          records.each do |record|
+            latest = references.reverse.find { |event| event.dig("payload", "request_id") == record.fetch("request_id") }
+            unless record.slice(*selection.keys) == selection && latest.dig("payload", "state") == record["state"] &&
+                latest.dig("payload", "record_digest") == Atoms::EvidenceDigest.digest(record) &&
+                latest.dig("payload", "receipt_digest") == (record["receipt"] && Atoms::EvidenceDigest.digest(record["receipt"]))
+              unavailable!("ordinary effect record differs from its accepted owner event")
+            end
+          end
+          records
+        end
+
+        def service!(record, commit)
+          return if record["state"] == "rejected" && record["consumed"] == false
+          pending!("ordinary service effect is unresolved") unless %w[succeeded failed-settled].include?(record["state"])
+          receipt = record.fetch("receipt")
+          @journal.validate_terminal_receipt_structure!(record, record.fetch("state"), receipt)
+          # The installed owner consumes the existing canonical import, never
+          # the old local receipt file. This is independent of journal mode.
+          owner = ServiceEvidence.new(journal: @journal)
+          references = receipt.fetch("evidence")
+          if %w[publish prune-preserved-workspace].include?(record["operation"])
+            contents = owner.call(references, record, record.fetch("state"), {commit: commit})
+            unless contents.is_a?(Array) && contents.size == references.size
+              unavailable!("ordinary service evidence collection differs")
+            end
+          else
+            contents = references.map { |reference| owner.call(reference, record, record.fetch("state"), {commit: commit}) }
+          end
+          references.zip(contents).each do |reference, bytes|
+            unavailable!("ordinary service evidence digest differs") unless bytes.is_a?(String) && Digest::SHA256.hexdigest(bytes.b) == reference.fetch("sha256")
+            @journal.verify_service_attestation!(bytes, record, record.fetch("state")) unless %w[publish prune-preserved-workspace].include?(record["operation"])
+          end
+        end
+
+        def merge!(record, commit)
+          unless @journal.fixed_merge_settlement!(record.fetch("request_id"), commit: commit) == record
+            unavailable!("ordinary merge settlement differs from its selected record")
+          end
+        end
+
+        def delivery!(events, merges, assignment_events)
+          deliveries = assignment_events.select { |event| event["type"] == "delivery" }
+          events.select { |event| event["type"] == "delivery" }.each do |intent|
+            payload = intent.fetch("payload")
+            case payload["stage"]
+            when "intent"
+              settled = deliveries.any? { |event| event.dig("payload", "stage") == "result" &&
+                event.dig("payload", "intent_digest") == intent.fetch("digest") &&
+                event.dig("payload", "intent_attempt_id") == intent.fetch("attempt_id") &&
+                event.dig("payload", "operation") == payload.fetch("operation") &&
+                event.dig("payload", "head") == payload.fetch("head") && event.dig("payload", "outcome") == "succeeded" }
+              pending!("ordinary delivery intent is unresolved") unless settled
+            when "ordinary-merge-intent"
+              result = deliveries.reverse.find { |event| event.dig("payload", "stage") == "ordinary-merge-result" &&
+                event.dig("payload", "request_id") == payload.fetch("request_id") && event.dig("payload", "input_digest") == payload.fetch("input_digest") }
+              pending!("ordinary merge delivery is unresolved") unless result
+              accepted = result.fetch("payload")
+              record = merges.find { |item| item["request_id"] == payload.fetch("request_id") }
+              if accepted["outcome"] == "refused_no_effect" && record.nil?
+                refusal = accepted.slice("code", "message", "request_id", "input_digest").merge("schema" => "ace.lab.service.ordinary-merge-refusal/v1")
+                Molecules::OrdinaryMergeContract.validate_refusal!(refusal)
+                pending!("ordinary merge receiver availability is unresolved") if refusal["code"] == Molecules::OrdinaryMergeContract::UNAVAILABLE_CODE
+              elsif !record || record["input_digest"] != payload.fetch("input_digest") || record["receipt"] != accepted["receipt"]
+                unavailable!("ordinary delivery result differs from the merge owner")
+              end
+            end
+          end
+        end
+
+        def unavailable!(message) = raise AttemptErrors::EvidenceUnavailable, message
+        def pending!(message) = raise AttemptErrors::ServiceSettlementPending, message
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/ordinary_lifecycle.rb

@@ -0,0 +1,227 @@
+# frozen_string_literal: true
+
+require "ace/herdr"
+require_relative "prepared_work"
+require_relative "assignment_definition"
+require_relative "ordinary_queue"
+require_relative "ordinary_attempt_start"
+require_relative "ordinary_progress"
+require_relative "ordinary_results"
+require_relative "ordinary_completion"
+require_relative "ordinary_supervisor"
+require_relative "ordinary_reviews"
+require_relative "ordinary_merge_evidence"
+require_relative "ordinary_release_artifacts"
+require_relative "../molecules/lifecycle_exclusion"
+
+module Ace
+  module Assign
+    module Authority
+      # Ordinary lifecycle uses the existing canonical execution ref and CAS.
+      # The installed Lab composition supplies one journal and exclusion owner
+      # shared with HITL and merge. No requester cache supplies accepted state.
+      class OrdinaryLifecycle
+        include OrdinaryAttemptStart
+        include OrdinaryProgress
+        include OrdinaryResults
+        include OrdinaryCompletion
+        include OrdinarySupervisor
+        include OrdinaryReviews
+        include OrdinaryMergeEvidence
+        include OrdinaryReleaseArtifacts
+        OPERATIONS = (%w[register_assignment registration_status start_attempt finish merge_evidence] + OrdinaryProgress::PROGRESS_OPERATIONS + OrdinaryResults::RESULT_OPERATIONS + OrdinarySupervisor::SUPERVISOR_OPERATIONS + OrdinaryReviews::REVIEW_OPERATIONS + OrdinaryReleaseArtifacts::RELEASE_OPERATIONS).freeze
+        TRANSFER_OPERATIONS = {"register_assignment" => {direction: :upload, purpose: :candidate, roles: [:supervisor]}}
+          .merge(OrdinaryProgress::PROGRESS_TRANSFERS).merge(OrdinaryResults::RESULT_TRANSFERS).merge(OrdinaryReviews::REVIEW_TRANSFERS).merge(OrdinaryReleaseArtifacts::RELEASE_TRANSFERS).freeze
+        REGISTER_KEYS = %w[assignment_id definition_digest prepared_head prepared_tree manifest_sha256 expected_generation pane transfer].freeze
+
+        def initialize(project:, admission:, journal:, exclusion:, input_root:, inbox: nil, command_evidence: nil, release_authorizer: nil)
+          @project, @admission, @journal, @exclusion = project, admission, journal, exclusion
+          @input_root = PrivateDirectory.verify!(input_root)
+          unless inbox.nil? || inbox.is_a?(Ace::Herdr::Organisms::Inbox)
+            raise ArgumentError, "ordinary completion requires the installed Inbox owner"
+          end
+          unless release_authorizer.nil? || release_authorizer.respond_to?(:call)
+            raise ArgumentError, "release artifact authorization requires its installed policy owner"
+          end
+          @inbox, @command_evidence, @release_authorizer = inbox, command_evidence, release_authorizer
+        end
+
+        def authorize_transfer!(request:, peer:, role:, deadline:)
+          authorize!(request, peer, role, deadline)
+          if OrdinaryReleaseArtifacts::RELEASE_TRANSFERS.key?(request.fetch("operation"))
+            authorize_ordinary_release!(request, peer, role, deadline)
+            return
+          end
+          if OrdinaryReviews::REVIEW_TRANSFERS.key?(request.fetch("operation"))
+            authorize_ordinary_review!(request, peer, role, deadline)
+            return
+          end
+          if OrdinaryResults::RESULT_TRANSFERS.key?(request.fetch("operation"))
+            validate_result!(request)
+            authorize_start_replay!(request, peer, role, deadline) if request.fetch("operation") == "submit_result"
+            return
+          end
+          if OrdinaryProgress::PROGRESS_TRANSFERS.key?(request.fetch("operation"))
+            validate_progress!(request)
+            return
+          end
+          unless request.fetch("operation") == "register_assignment" && role == :supervisor
+            raise AttemptErrors::UnauthorizedIdentity, "ordinary registration requires the installed supervisor"
+          end
+          validate_registration!(request)
+        end
+
+        def dispatch(request:, peer:, role:, deadline:, transfer: nil)
+          authorize!(request, peer, role, deadline)
+          return ordinary_review_operation(request, peer, role, deadline, transfer) if OrdinaryReviews::REVIEW_OPERATIONS.include?(request.fetch("operation"))
+          case request.fetch("operation")
+          when "retain_release_artifact"
+            retain_release_artifact(request, peer, role, deadline, transfer)
+          when "merge_evidence"
+            raise ArgumentError, "merge evidence read forbids transfer" if transfer
+            ordinary_merge_evidence(request, peer, role, deadline)
+          when "supervisor_status", "adopt_supervisor"
+            raise ArgumentError, "ordinary supervisor operation forbids transfer" if transfer
+            supervisor_operation(request, peer, role, deadline)
+          when "registration_status"
+            strict!(request.fetch("params"), %w[assignment_id])
+            raise ArgumentError, "status mutation must be null" unless request.fetch("mutation_id").nil?
+            assignment = request.fetch("params").fetch("assignment_id")
+            token!(assignment)
+            commit = @journal.ref_value
+            data = registration(assignment, commit: commit) || {"assignment_id" => assignment, "generation" => 0}
+            {data: data.merge("journal_commit" => commit), replayed: false}
+          when "register_assignment"
+            authorize_transfer!(request: request, peer: peer, role: role, deadline: deadline)
+            register(request, peer, deadline, transfer)
+          when "start_attempt"
+            raise ArgumentError, "ordinary start forbids transfer" if transfer
+            start_attempt(request, peer, role, deadline)
+          when "assignment_snapshot"
+            raise ArgumentError, "ordinary snapshot forbids upload" if transfer
+            assignment_snapshot(request, peer, role, deadline)
+          when "queue_start", "queue_finish", "queue_fail"
+            progress(request, peer, role, deadline, transfer)
+          when "submit_result", "result_status", "result_snapshot"
+            ordinary_result(request, peer, role, deadline, transfer)
+          when "finish"
+            raise ArgumentError, "ordinary completion forbids transfer" if transfer
+            finish_result(request, peer, role, deadline)
+          else
+            raise ArgumentError, "unknown ordinary lifecycle operation"
+          end
+        end
+
+        private
+
+        def register(request, peer, deadline, transfer)
+          params = request.fetch("params")
+          # Native observation and candidate subprocesses happen before CAS.
+          identity = @admission.identity!(peer: peer, pane: params.fetch("pane"), deadline: deadline)
+          unless identity.role == "coordinator"
+            raise AttemptErrors::UnauthorizedIdentity, "ordinary registration native owner differs"
+          end
+          raise AttemptErrors::MalformedTransfer, "prepared input requires one bundle" unless transfer && transfer.count == 1
+          bytes = transfer.bytes.freeze
+          descriptor = params.fetch("transfer")
+          work = PreparedWork.admit(bytes: bytes, head: params.fetch("prepared_head"), tree: params.fetch("prepared_tree"),
+            sha256: descriptor.fetch("sha256"), size: descriptor.fetch("bytes"), root: @input_root, deadline: deadline)
+          unless work.manifest.values_at("assignment_id", "project_id") == [params.fetch("assignment_id"), @project] &&
+              work.manifest_sha256 == params.fetch("manifest_sha256")
+            raise ArgumentError, "ordinary prepared assignment association differs"
+          end
+          definition = work.definition_bytes(head: params.fetch("prepared_head"), tree: params.fetch("prepared_tree"))
+          assignment = AssignmentDefinition.parse(bytes: definition, digest: params.fetch("definition_digest"),
+            assignment_id: params.fetch("assignment_id"), project_id: @project)
+          # Campaign registration needs its existing canonical campaign owner;
+          # it cannot be manufactured by attaching unchecked parent metadata.
+          if assignment.review_campaign || assignment.campaign_execution
+            raise AttemptErrors::EvidenceUnavailable, "ordinary campaign registration requires its campaign owner"
+          end
+          principal = {"uid" => peer.fetch("uid"), "actor" => identity.actor}
+          queue = OrdinaryQueue.new(work: work, root: @input_root)
+          queue_sha = Digest::SHA256.hexdigest(queue.bytes)
+          digest = Atoms::EvidenceDigest.digest({"params" => params, "project_id" => @project, "principal" => principal})
+          keys = [@exclusion.task_key(assignment.task_id), @exclusion.assignment_key(assignment.id)]
+          @exclusion.with_shared_multi(keys, deadline: deadline) do
+            # Replay bypasses the CAS callback; current authority is mandatory
+            # before that lookup as well as on every fresh CAS attempt.
+            authorize!(request, peer, :supervisor, deadline)
+            @journal.mutate(assignment_id: assignment.id, attempt_id: "definition-#{assignment.id}",
+              mutation_id: request.fetch("mutation_id"), operation: "register_assignment", parameters_digest: digest,
+              expected_generation: params.fetch("expected_generation"), with_replay: true, deadline: deadline,
+              replay_authorizer: -> { authorize!(request, peer, :supervisor, deadline) }) do |events, commit, _generation|
+              authorize!(request, peer, :supervisor, deadline)
+              unless events.empty? && registration(assignment.id, commit: commit).nil?
+                raise AttemptErrors::Conflict, "ordinary assignment is already registered; retain its original definition"
+              end
+              bundle_sha = Digest::SHA256.hexdigest(bytes)
+              definition_path = "execution/definitions/#{assignment.id}-#{params.fetch('definition_digest')}.json"
+              bundle_path = "execution/prepared/#{assignment.id}-#{bundle_sha}.bundle"
+              queue_path = "execution/definitions/#{assignment.id}-queue-#{queue_sha}.json"
+              {events: [], blobs: {definition_path => definition, bundle_path => bytes, queue_path => queue.bytes}, data: {
+                "authority" => "ordinary", "assignment_id" => assignment.id, "project_id" => @project,
+                "task_id" => assignment.task_id, "registered_by" => principal, "phase" => "registered",
+                "supervisor_binding" => identity.runtime_binding,
+                "definition_ref" => definition_path, "definition_digest" => params.fetch("definition_digest"),
+                "queue_ref" => queue_path, "queue_sha256" => queue_sha,
+                "prepared_work" => work.reference(head: params.fetch("prepared_head"), tree: params.fetch("prepared_tree")),
+                "prepared_bundle_ref" => bundle_path, "prepared_bundle_sha256" => bundle_sha,
+                "prepared_bundle_bytes" => bytes.bytesize}}
+            end
+          end
+        end
+
+        def registration(assignment, commit:)
+          return nil unless commit
+          events = @journal.read_events(assignment, commit: commit)
+          events.group_by { |event| event.fetch("attempt_id") }.each_value do |chain|
+            raise AttemptErrors::EvidenceUnavailable, "ordinary assignment evidence is corrupt" unless Models::EvidenceEvent.chain_valid?(chain)
+          end
+          registrations = events.select { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "register_assignment" }
+          return nil if registrations.empty?
+          data = registrations.one? && registrations.first.dig("payload", "data")
+          unless data && data.values_at("authority", "assignment_id", "project_id") == ["ordinary", assignment, @project]
+            raise AttemptErrors::EvidenceUnavailable, "ordinary assignment registration owner differs"
+          end
+          data
+        end
+
+        def authorize!(request, peer, role, deadline)
+          unless deadline.is_a?(Numeric) && deadline.finite? && deadline > Process.clock_gettime(Process::CLOCK_MONOTONIC)
+            raise AttemptErrors::EvidenceUnavailable, "ordinary lifecycle deadline elapsed"
+          end
+          unless request.fetch("project_id") == @project && @admission.authorize!(request: request, peer: peer, deadline: deadline) == role
+            raise AttemptErrors::UnauthorizedIdentity, "ordinary lifecycle principal differs"
+          end
+          # Project commands share the canonical journal but never the managed
+          # assignment namespace. Reserve their prefix on every ordinary route,
+          # including transfer admission, status and registration replay.
+          assignment = request.fetch("params")["assignment_id"]
+          if assignment.is_a?(String) && assignment.start_with?("command-")
+            raise ArgumentError, "ordinary assignment uses the reserved project-command namespace"
+          end
+        end
+
+        def validate_registration!(request)
+          params = request.fetch("params")
+          strict!(params, REGISTER_KEYS)
+          token!(request.fetch("mutation_id"))
+          token!(params.fetch("assignment_id"))
+          token!("definition-#{params.fetch('assignment_id')}")
+          unless params.fetch("expected_generation").is_a?(Integer) && params.fetch("expected_generation") >= 0
+            raise ArgumentError, "ordinary generation is invalid"
+          end
+        end
+
+        def strict!(value, keys)
+          raise ArgumentError, "ordinary authority fields differ" unless value.is_a?(Hash) && value.keys.sort == keys.sort
+        end
+
+        def token!(value)
+          raise ArgumentError, "ordinary identity is invalid" unless value.is_a?(String) && Molecules::JournalMutation::ID.match?(value)
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/ordinary_merge_evidence.rb

@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+
+module Ace
+  module Assign
+    module Authority
+      # The installed fixed merge consumes this same lifecycle, never a local
+      # receipt file. Locks precede journal CAS; no callback acquires an inverted
+      # lifecycle lock while holding the journal writer lock.
+      module OrdinaryMergeEvidence
+        def with_merge_scope(record:, deadline:, exclusive: false)
+          assignment, attempt = record.values_at("assignment_id", "attempt_id")
+          token!(assignment)
+          token!(attempt)
+          registered = registration(assignment, commit: @journal.ref_value)
+          raise AttemptErrors::EvidenceUnavailable, "merge assignment is unregistered" unless registered
+          @exclusion.with_shared_multi([@exclusion.task_key(registered.fetch("task_id"))], deadline: deadline) do
+            key = @exclusion.assignment_key(assignment)
+            if exclusive
+              @exclusion.with_exclusive(key, deadline: deadline) { yield }
+            else
+              @exclusion.with_shared_multi([key], deadline: deadline) { yield }
+            end
+          end
+        end
+
+        def verify_merge_evidence_at!(record:, commit:, deadline:)
+          unless record.fetch("project_id") == @project
+            raise AttemptErrors::ReceiptRejected, "merge evidence project differs"
+          end
+          request = record.fetch("request")
+          events = result_events(record, commit)
+          current = ordinary_candidate_event(events)&.dig("payload", "data")
+          raise AttemptErrors::ReceiptRejected, "merge candidate is unavailable" unless current
+          projection = merge_evidence_at!(events: events, commit: commit, head: request.fetch("candidate_head"),
+            generation: current.fetch("candidate_generation"), execution_ids: request.fetch("test_evidence").map { |reference| reference.fetch("reference") }, deadline: deadline)
+          unless request.fetch("review_evidence") == projection.fetch("review_evidence") && request.fetch("test_evidence") == projection.fetch("test_evidence")
+            raise AttemptErrors::ReceiptRejected, "merge requires exact canonical review and executed test references"
+          end
+          origin = origin_at!(events: events, commit: commit)
+          observed = @admission.recorded_execution!(binding: origin.fetch("runtime_binding"), head: request.fetch("candidate_head"), deadline: deadline)
+          unless observed.fetch(:runtime_binding) == origin.fetch("runtime_binding")
+            raise AttemptErrors::UnauthorizedIdentity, "merge producer native identity changed"
+          end
+          true
+        rescue KeyError, TypeError
+          raise AttemptErrors::ReceiptRejected, "canonical merge evidence is incomplete"
+        end
+
+        def merge_evidence_at!(events:, commit:, head:, generation:, execution_ids:, deadline:)
+          unless @command_evidence && @command_evidence.journal.equal?(@journal) && execution_ids.is_a?(Array) &&
+              execution_ids.size.between?(1, 16) && execution_ids.uniq == execution_ids
+            raise AttemptErrors::EvidenceUnavailable, "merge requires the installed canonical executed-test owner"
+          end
+          candidate = candidate_at!(events: events, commit: commit, head: head, generation: generation)
+          review = review_at!(events: events, commit: commit, head: head, generation: generation)
+          tests = execution_ids.map { |id| @command_evidence.test_evidence_at!(execution_id: id, commit: commit,
+            head: head, tree: candidate.fetch("tree"), deadline: deadline) }
+          {"review_evidence" => {"schema" => "ace.review.acceptance-reference/v1", "reference" => review.fetch("review_id"),
+            "reviewer" => review.fetch("reviewer_actor"), "verdict" => "approved", "reviewed_head" => head,
+            "recorded_at" => review.fetch("recorded_at"), "record_sha256" => review.fetch("acceptance_event_digest")},
+            "test_evidence" => tests}
+        end
+
+        private
+
+        def ordinary_merge_evidence(request, peer, role, deadline)
+          params = request.fetch("params")
+          strict!(params, %w[assignment_id attempt_id head candidate_generation test_execution_ids])
+          raise ArgumentError, "merge evidence read mutation must be null" unless request.fetch("mutation_id").nil?
+          with_scope(assignment: params.fetch("assignment_id"), attempt: params.fetch("attempt_id"), deadline: deadline) do
+            prefix = @journal.ref_value
+            projection = merge_evidence_at!(events: result_events(params, prefix), commit: prefix, head: params.fetch("head"),
+              generation: params.fetch("candidate_generation"), execution_ids: params.fetch("test_execution_ids"), deadline: deadline)
+            authorize!(request, peer, role, deadline)
+            {data: projection.merge("journal_commit" => prefix), replayed: false}
+          end
+        end
+      end
+    end
+  end
+end