ace-assign 0.69.0 → 0.71.0

data/lib/ace/assign/authority/ordinary_peer.rb

@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+require "socket"
+require "ace/runtime/molecules/process_identity"
+require "ace/herdr/molecules/bounded_observation"
+
+module Ace
+  module Assign
+    module Authority
+      # Ordinary UNIX peer attribution. This is not a protected launch observer:
+      # it confers no Yama, capability, cgroup or descendant-closure guarantee.
+      class OrdinaryPeer
+        def initialize(identity: nil)
+          @identity = identity
+        end
+
+        def capture(socket, deadline: default_deadline)
+          identity = identity_observer(deadline)
+          uid, gid = socket.getpeereid
+          pid = if RUBY_PLATFORM.include?("darwin")
+            socket.getsockopt(0, 2).int # SOL_LOCAL / LOCAL_PEERPID
+          elsif Socket.const_defined?(:SO_PEERCRED)
+            observed_pid, observed_uid, observed_gid = socket.getsockopt(Socket::SOL_SOCKET, Socket::SO_PEERCRED).data.unpack("i!3")
+            unavailable! unless [observed_uid, observed_gid] == [uid, gid]
+            observed_pid
+          end
+          value = identity.capture(pid)
+          unavailable! unless value && value["uid"] == uid && socket.getpeereid == [uid, gid] && identity.capture(pid) == value
+          value.merge("gid" => gid).freeze
+        rescue SystemCallError, IOError, SocketError, NotImplementedError
+          unavailable!
+        end
+
+        def live!(peer, deadline: default_deadline)
+          unavailable! unless peer.is_a?(Hash) && identity_observer(deadline).capture(peer["pid"]) == peer.slice("pid", "uid", "started_at", "host")
+          peer
+        end
+
+        private
+
+        def default_deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + 5
+
+        def identity_observer(deadline)
+          @identity || Ace::Runtime::Molecules::ProcessIdentity.new(
+            executor: Ace::Herdr::Molecules::BoundedObservation.new(deadline: deadline))
+        end
+
+        def unavailable!
+          raise AttemptErrors::UnauthorizedIdentity, "ordinary kernel peer is unavailable or changed"
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/ordinary_progress.rb

@@ -0,0 +1,162 @@
+# frozen_string_literal: true
+
+module Ace
+  module Assign
+    module Authority
+      # Source-owned progress for the already accepted work. Queue completion
+      # remains a worker report, never a successful execution result or merge.
+      module OrdinaryProgress
+        PROGRESS_OPERATIONS = %w[queue_start queue_finish queue_fail assignment_snapshot].freeze
+        PROGRESS_TRANSFERS = {
+          "queue_finish" => {direction: :upload, purpose: :artifacts, roles: %i[worker supervisor]},
+          "assignment_snapshot" => {direction: :download, purpose: :assignment_snapshot, roles: %i[worker supervisor reviewer]}
+        }.freeze
+        PROGRESS_COMMON = %w[assignment_id attempt_id expected_generation pane].freeze
+
+        private
+
+        def validate_progress!(request)
+          params = request.fetch("params")
+          operation = request.fetch("operation")
+          if operation == "assignment_snapshot"
+            strict!(params, %w[assignment_id attempt_id kind])
+            token!(params.fetch("attempt_id")) unless params.fetch("attempt_id").nil?
+            unless request.fetch("mutation_id").nil? && %w[prepared_work queue].include?(params.fetch("kind"))
+              raise ArgumentError, "ordinary snapshot must be a read of accepted work or queue"
+            end
+          else
+            fields = case operation
+            when "queue_start" then %w[step]
+            when "queue_finish" then %w[step transfer]
+            when "queue_fail" then %w[message]
+            else raise ArgumentError, "unknown ordinary progress operation"
+            end
+            strict!(params, PROGRESS_COMMON + fields)
+            token!(params.fetch("attempt_id")); token!(request.fetch("mutation_id"))
+            unless params.fetch("expected_generation").is_a?(Integer) && params.fetch("expected_generation").positive?
+              raise ArgumentError, "ordinary progress generation is invalid"
+            end
+            if params.key?("step") && !params["step"].nil? &&
+                !(params["step"].is_a?(String) && params["step"].bytesize.between?(1, 128) && PreparedWork::SCOPE.match?(params["step"]))
+              raise ArgumentError, "ordinary progress step is invalid"
+            end
+            if params.key?("message") && !(params["message"].is_a?(String) && params["message"].bytesize.between?(1, 1024) && !params["message"].include?("\0"))
+              raise ArgumentError, "ordinary failure message is invalid"
+            end
+          end
+          token!(params.fetch("assignment_id"))
+        end
+
+        def assignment_snapshot(request, peer, role, deadline)
+          validate_progress!(request)
+          params = request.fetch("params")
+          commit = @journal.ref_value
+          registered = registration(params.fetch("assignment_id"), commit: commit)
+          raise AttemptErrors::NotFound, "ordinary assignment is not registered" unless registered
+          queue_record = current_queue_record(registered, commit)
+          selected_events = if params.fetch("attempt_id")
+            result_events(params, commit)
+          else
+            []
+          end
+          kind = params.fetch("kind")
+          source = kind == "prepared_work" ? registered : queue_record
+          path_key, digest_key, size = if kind == "prepared_work"
+            ["prepared_bundle_ref", "prepared_bundle_sha256", registered.fetch("prepared_bundle_bytes")]
+          else
+            ["queue_ref", "queue_sha256", PreparedWork::MAX_TOTAL]
+          end
+          bytes = @journal.bounded_blob(source.fetch(path_key), commit: commit, max_bytes: size)
+          unless Digest::SHA256.hexdigest(bytes) == source.fetch(digest_key)
+            raise AttemptErrors::EvidenceUnavailable, "ordinary snapshot bytes differ from accepted selection"
+          end
+          authorize!(request, peer, role, deadline)
+          {data: {"project_id" => @project, "assignment_id" => params.fetch("assignment_id"), "kind" => kind,
+            "attempt_id" => params.fetch("attempt_id"), "generation" => @journal.authority_generation(selected_events),
+            "scope" => selected_events.find { |event| event["type"] == "intent" }&.dig("payload", "scope"),
+            "journal_commit" => commit, "sha256" => source.fetch(digest_key), "bytes" => bytes.bytesize,
+            "prepared_work" => registered.fetch("prepared_work"), "definition_digest" => registered.fetch("definition_digest")},
+            transfer_parts: [bytes], replayed: false}
+        end
+
+        def progress(request, peer, role, deadline, transfer)
+          validate_progress!(request)
+          unless %i[supervisor worker].include?(role)
+            raise AttemptErrors::UnauthorizedIdentity, "ordinary progress requires its original worker"
+          end
+          params, operation = request.fetch("params"), request.fetch("operation")
+          report = if operation == "queue_finish"
+            raise ArgumentError, "ordinary progress report needs one bounded part" unless transfer && transfer.count == 1
+            bytes = transfer.bytes.dup.force_encoding(Encoding::UTF_8)
+            unless bytes.bytesize.between?(1, 65_536) && bytes.valid_encoding? && !bytes.include?("\0")
+              raise ArgumentError, "ordinary progress report must be bounded UTF-8"
+            end
+            bytes
+          elsif transfer
+            raise ArgumentError, "ordinary progress operation forbids transfer"
+          end
+          commit = @journal.ref_value
+          registered = registration(params.fetch("assignment_id"), commit: commit)
+          raise AttemptErrors::NotFound, "ordinary work is not registered" unless registered
+          work = registered_work(registered, commit, deadline)
+          digest = Atoms::EvidenceDigest.digest({"params" => params, "project_id" => @project, "peer_uid" => peer.fetch("uid")})
+          keys = [@exclusion.task_key(registered.fetch("task_id")), @exclusion.assignment_key(params.fetch("assignment_id"))]
+          @exclusion.with_shared_multi(keys, deadline: deadline) do
+            authorize!(request, peer, role, deadline)
+            @journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
+              mutation_id: request.fetch("mutation_id"), operation: operation, parameters_digest: digest,
+              expected_generation: params.fetch("expected_generation"), with_replay: true, deadline: deadline,
+              replay_authorizer: -> { authorize_start_replay!(request, peer, role, deadline) }) do |events, prefix, _generation|
+              authorize_start_replay!(request, peer, role, deadline)
+              unless Molecules::CanonicalAttemptState.derive(events) == "running"
+                raise AttemptErrors::Conflict, "ordinary progress requires the original running attempt"
+              end
+              record = current_queue_record(registered, prefix)
+              scope = events.find { |event| event["type"] == "intent" }.fetch("payload").fetch("scope")
+              queue = OrdinaryQueue.new(work: work, root: @input_root, bytes: queue_bytes(record, prefix))
+              next_queue = case operation
+              when "queue_start" then queue.transition(operation: :start, scope: scope, step: params.fetch("step"))
+              when "queue_finish" then queue.transition(operation: :finish, scope: scope, step: params.fetch("step"), report: report)
+              when "queue_fail" then queue.transition(operation: :fail, scope: scope, message: params.fetch("message"))
+              end
+              sha = Digest::SHA256.hexdigest(next_queue.bytes)
+              path = "execution/definitions/#{params.fetch('assignment_id')}-queue-#{sha}.json"
+              {events: [], blobs: {path => next_queue.bytes}, data: {
+                "authority" => "ordinary", "assignment_id" => params.fetch("assignment_id"), "attempt_id" => params.fetch("attempt_id"),
+                "project_id" => @project, "scope" => scope, "queue_ref" => path, "queue_sha256" => sha, "state" => "running",
+                "queue_complete" => next_queue.status.subtree_complete?(scope)}}
+            end
+          end
+        end
+
+        def current_queue_record(registered, commit)
+          assignment = registered.fetch("assignment_id")
+          events = @journal.read_events(assignment, commit: commit)
+          events.group_by { |event| event.fetch("attempt_id") }.each_value do |chain|
+            raise AttemptErrors::EvidenceUnavailable, "ordinary queue history is corrupt" unless Models::EvidenceEvent.chain_valid?(chain)
+          end
+          updates = events.select do |entry|
+            entry["type"] == "authority_mutation" &&
+              %w[start_attempt queue_start queue_finish queue_fail].include?(entry.dig("payload", "operation"))
+          end
+          return registered if updates.empty?
+          event = @journal.latest_event!(assignment_id: assignment, event_digests: updates.map { |entry| entry.fetch("digest") }, commit: commit)
+          record = event.dig("payload", "data")
+          unless record && record.values_at("authority", "assignment_id", "attempt_id", "project_id") ==
+              ["ordinary", assignment, event.fetch("attempt_id"), @project]
+            raise AttemptErrors::EvidenceUnavailable, "ordinary canonical queue is unavailable"
+          end
+          record
+        end
+
+        def queue_bytes(record, commit)
+          bytes = @journal.bounded_blob(record.fetch("queue_ref"), commit: commit, max_bytes: PreparedWork::MAX_TOTAL)
+          unless Digest::SHA256.hexdigest(bytes) == record.fetch("queue_sha256")
+            raise AttemptErrors::EvidenceUnavailable, "ordinary canonical queue bytes differ"
+          end
+          bytes
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/ordinary_queue.rb

@@ -0,0 +1,115 @@
+# frozen_string_literal: true
+
+require "tmpdir"
+require "fileutils"
+require_relative "prepared_work"
+require_relative "private_directory"
+require_relative "../organisms/assignment_executor"
+
+module Ace
+  module Assign
+    module Authority
+      # A disposable projection for the existing queue engine. Only bytes read
+      # from (or about to be committed to) the canonical execution ref enter it.
+      # No files left by an earlier coordinator are recovery input.
+      class OrdinaryQueue
+        attr_reader :bytes
+
+        def initialize(work:, root:, bytes: nil)
+          raise ArgumentError, "ordinary queue requires prepared work" unless work.is_a?(PreparedWork)
+          @work, @root = work, PrivateDirectory.verify!(root)
+          value = if bytes
+            invalid! unless bytes.is_a?(String) && bytes.bytesize.between?(1, PreparedWork::MAX_TOTAL)
+            JSON.parse(bytes)
+          else
+            {"version" => 1, "steps" => work.manifest.fetch("steps").to_h { |step|
+              name = step.fetch("filename"); [name, work.files.fetch("steps/#{name}")]
+            }, "reports" => {}}
+          end
+          validate!(value, initial: bytes.nil?)
+          @bytes = Atoms::EvidenceDigest.canonical_json(value).freeze
+        rescue JSON::ParserError
+          invalid!
+        end
+
+        def status
+          value = JSON.parse(@bytes)
+          assignment = Models::Assignment.from_h(@work.definition, cache_dir: File.join(@root, @work.manifest.fetch("assignment_id")))
+          Molecules::QueueScanner.new.scan_captured(steps: value.fetch("steps"), reports: value.fetch("reports"), assignment: assignment)
+        end
+
+        # This returns proposed bytes only. The lifecycle owns authorization,
+        # generation, replay and publication together with its attempt events.
+        def transition(operation:, scope: @work.manifest.fetch("scope"), step: nil, report: nil, message: nil)
+          invalid! unless @work.manifest.fetch("steps").any? { |entry| entry.fetch("number") == scope }
+          value = JSON.parse(@bytes)
+          Dir.mktmpdir("ordinary-queue-", @root) do |scratch|
+            File.chmod(0o700, scratch)
+            directory = File.join(scratch, @work.manifest.fetch("assignment_id"))
+            %w[steps reports].each { |name| FileUtils.mkdir_p(File.join(directory, name), mode: 0700) }
+            assignment = Models::Assignment.from_h(@work.definition, cache_dir: directory)
+            write(File.join(directory, "assignment.yaml"), assignment.to_h.to_yaml)
+            write(File.join(directory, "job.yaml"), @work.files.fetch("job.yaml"))
+            %w[steps reports].each do |group|
+              value.fetch(group).each { |filename, content| write(File.join(directory, group, filename), content) }
+            end
+            executor = Organisms::AssignmentExecutor.new(cache_base: scratch, selected_assignment: assignment)
+            case operation
+            when :activate
+              state = executor.status.fetch(:state)
+              invalid! unless state.find_by_number(scope)&.status == :pending
+              executor.step_writer.mark_active(state.find_by_number(scope).file_path)
+            when :start
+              executor.start_step(step_number: step, fork_root: scope)
+            when :finish
+              executor.finish_step(report_content: report, step_number: step, fork_root: scope)
+            when :fail
+              executor.fail(message, fork_root: scope)
+            else
+              raise ArgumentError, "unknown ordinary queue transition"
+            end
+            result = {"version" => 1}
+            %w[steps reports].each do |group|
+              result[group] = Dir.children(File.join(directory, group)).to_h do |filename|
+                [filename, File.binread(File.join(directory, group, filename)).force_encoding(Encoding::UTF_8)]
+              end
+            end
+            self.class.new(work: @work, root: @root, bytes: Atoms::EvidenceDigest.canonical_json(result))
+          end
+        end
+
+        private
+
+        def validate!(value, initial:)
+          invalid! unless value.is_a?(Hash) && value.keys.sort == %w[reports steps version] && value["version"].is_a?(Integer) && value["version"] == 1 &&
+            value["steps"].is_a?(Hash) && value["reports"].is_a?(Hash)
+          expected = @work.manifest.fetch("steps").map { |step| step.fetch("filename") }
+          invalid! unless value.fetch("steps").keys.sort == expected.sort
+          reports = []
+          value.fetch("steps").each do |filename, content|
+            parsed = @work.parse_queue_step!(content)
+            progress = parsed.fetch(:frontmatter).keys & PreparedWork::PROGRESS
+            allowed = initial ? %w[status] : %w[status started_at completed_at error stall_reason]
+            invalid! unless (progress - allowed).empty?
+            original = @work.files.fetch("steps/#{filename}")
+            invalid! unless PreparedWork.work_projection(content) == PreparedWork.work_projection(original) &&
+              %w[pending active done failed].include?(parsed.fetch(:frontmatter).fetch("status", "pending"))
+            info = Atoms::StepFileParser.parse_filename(filename)
+            reports << Atoms::StepFileParser.generate_report_filename(info.fetch(:number), info.fetch(:name))
+          end
+          invalid! unless (value.fetch("reports").keys - reports).empty?
+          value.fetch("reports").each_value { |content| @work.parse_queue_step!(content) }
+          invalid! if Atoms::EvidenceDigest.canonical_json(value).bytesize > PreparedWork::MAX_TOTAL
+        end
+
+        def write(path, content)
+          File.open(path, File::WRONLY | File::CREAT | File::EXCL | File::NOFOLLOW, 0600) { |file| file.write(content) }
+        end
+
+        def invalid!
+          raise AttemptErrors::EvidenceUnavailable, "ordinary canonical queue differs from its accepted work"
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/ordinary_release_artifacts.rb

@@ -0,0 +1,143 @@
+# frozen_string_literal: true
+
+require_relative "release_artifact_manifest"
+require_relative "candidate_transfer"
+
+module Ace
+  module Assign
+    module Authority
+      # Retention is a canonical input, never a publication permit or result.
+      # Native/candidate/review and release policy are rechecked at every CAS.
+      module OrdinaryReleaseArtifacts
+        RELEASE_OPERATIONS = %w[retain_release_artifact].freeze
+        RELEASE_TRANSFERS = {"retain_release_artifact" =>
+          {direction: :upload, purpose: :release_artifact, roles: %i[worker supervisor]}}.freeze
+        RELEASE_PARAMETERS = %w[assignment_id attempt_id head candidate_generation pane expected_generation
+          authorization manifest transfer].freeze
+
+        # Read an accepted import at the current immutable canonical prefix only.
+        # Historical commit selection is not supported by the native origin reader.
+        # The later effect consumer must independently admit its fresh scope,
+        # candidate, review, authorization and fixed executor before dispatch.
+        def release_artifact_at!(events:, commit:, artifact_id:)
+          token!(artifact_id)
+          unless commit && Models::EvidenceEvent.chain_valid?(events)
+            raise AttemptErrors::EvidenceUnavailable, "release artifact history is unavailable"
+          end
+          accepted = events.select { |event| event["type"] == "authority_mutation" &&
+            event.dig("payload", "operation") == "retain_release_artifact" && event.dig("payload", "mutation_id") == artifact_id }
+          data = accepted.one? && accepted.first.dig("payload", "data")
+          unless data && data["artifact_id"] == artifact_id && data["input_digest"] == Atoms::EvidenceDigest.digest(data.fetch("input"))
+            raise AttemptErrors::EvidenceUnavailable, "release artifact acceptance is unavailable"
+          end
+          origin = data.fetch("producer_origin")
+          retained = @journal.read_events(origin.fetch("assignment_id"), commit: commit)
+            .select { |event| event["attempt_id"] == origin.fetch("attempt_id") }
+          unless retained == events && ordinary_origin_at!(events, commit, running: false) == origin
+            raise AttemptErrors::EvidenceUnavailable, "release artifact original scope differs"
+          end
+          context = release_evidence_context(data.fetch("input"), origin, data.fetch("authorization"), artifact_id)
+          bytes = Molecules::CanonicalEvidence.new(journal: @journal).read(data.fetch("artifact"), **context, commit: commit)
+          unless bytes.bytesize == data.dig("input", "publication", "artifact_bytes") &&
+              Digest::SHA256.hexdigest(bytes) == data.dig("input", "target", "artifact_digest")
+            raise AttemptErrors::EvidenceUnavailable, "release artifact retained bytes differ"
+          end
+          data.merge("bytes" => bytes)
+        rescue KeyError, TypeError
+          raise AttemptErrors::EvidenceUnavailable, "release artifact acceptance is incomplete"
+        end
+
+        private
+
+        def validate_ordinary_release!(request)
+          params = request.fetch("params")
+          strict!(params, RELEASE_PARAMETERS)
+          %w[assignment_id attempt_id authorization].each { |key| token!(params.fetch(key)) }
+          token!(request.fetch("mutation_id"))
+          unless params["head"].is_a?(String) && CandidateTransfer::SHA.match?(params["head"]) &&
+              %w[candidate_generation expected_generation].all? { |key| params[key].is_a?(Integer) && params[key].positive? }
+            raise ArgumentError, "invalid release artifact candidate selection"
+          end
+          ReleaseArtifactManifest.validate!(params.fetch("manifest"))
+        end
+
+        def authorize_ordinary_release!(request, peer, role, deadline)
+          validate_ordinary_release!(request)
+          params = request.fetch("params")
+          with_scope(assignment: params.fetch("assignment_id"), attempt: params.fetch("attempt_id"), deadline: deadline) do
+            prefix = @journal.ref_value
+            release_context_at!(request, peer, role, deadline, result_events(params, prefix), prefix)
+          end
+        end
+
+        # Caller holds lifecycle exclusion before entering the journal writer.
+        # This method never acquires another lifecycle lock or trusts a path.
+        def release_context_at!(request, peer, role, deadline, events, commit)
+          authorize!(request, peer, role, deadline)
+          unless %i[worker supervisor].include?(role) && @release_authorizer
+            raise AttemptErrors::UnauthorizedIdentity, "installed release artifact authorization is unavailable"
+          end
+          params = request.fetch("params")
+          origin = origin_at!(events: events, commit: commit)
+          current = candidate_at!(events: events, commit: commit, head: params.fetch("head"), generation: params.fetch("candidate_generation"))
+          reference = candidate_reference_at!(events: events, commit: commit, head: params.fetch("head"), generation: params.fetch("candidate_generation"))
+          observed = @admission.execution!(peer: peer, pane: params.fetch("pane"), head: current.fetch("head"), deadline: deadline)
+          unless observed.fetch(:identity).runtime_binding == origin.fetch("runtime_binding")
+            raise AttemptErrors::UnauthorizedIdentity, "release artifact producer native identity changed"
+          end
+          review_at!(events: events, commit: commit, head: current.fetch("head"), generation: current.fetch("candidate_generation"))
+          input = ReleaseArtifactManifest.publication_input(manifest: params.fetch("manifest"), candidate: current, reference: reference)
+          binding = params.slice("assignment_id", "attempt_id", "authorization").merge(
+            "operation" => "publish", "project_id" => @project, "candidate_head" => current.fetch("head"),
+            "caller_uid" => origin.dig("runtime_binding", "process_identity", "uid"),
+            "input_digest" => Atoms::EvidenceDigest.digest(input), "target" => input.fetch("target"))
+          unless @release_authorizer.call(binding)
+            raise AttemptErrors::UnauthorizedIdentity, "release artifact manifest is not authorized"
+          end
+          {input: input, binding: binding, origin: origin}
+        rescue SecurityError
+          raise AttemptErrors::UnauthorizedIdentity, "release artifact manifest authorization is unavailable"
+        end
+
+        def retain_release_artifact(request, peer, role, deadline, transfer)
+          validate_ordinary_release!(request)
+          unless transfer && transfer.count == 1
+            raise AttemptErrors::MalformedTransfer, "release artifact requires its one bounded binary transfer"
+          end
+          params = request.fetch("params")
+          with_scope(assignment: params.fetch("assignment_id"), attempt: params.fetch("attempt_id"), deadline: deadline) do
+            prefix = @journal.ref_value
+            release_context_at!(request, peer, role, deadline, result_events(params, prefix), prefix)
+            bytes = transfer.bytes.dup.freeze
+            ReleaseArtifactManifest.verify!(bytes, params.fetch("manifest"))
+            digest = Atoms::EvidenceDigest.digest("project_id" => @project, "params" => params)
+            recheck = lambda do
+              current = @journal.ref_value
+              release_context_at!(request, peer, role, deadline, result_events(params, current), current)
+            end
+            @journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
+              mutation_id: request.fetch("mutation_id"), operation: "retain_release_artifact", parameters_digest: digest,
+              expected_generation: params.fetch("expected_generation"), with_replay: true, deadline: deadline,
+              replay_authorizer: recheck) do |events, commit, _generation|
+              selected = release_context_at!(request, peer, role, deadline, events, commit)
+              artifact_id = request.fetch("mutation_id")
+              context = release_evidence_context(selected.fetch(:input), selected.fetch(:origin), params.fetch("authorization"), artifact_id)
+              plan = Molecules::CanonicalEvidence.new(journal: @journal).import_plan(**context,
+                artifacts: [bytes], admitted_after_event_digest: events.last.fetch("digest"))
+              plan.merge(data: {"artifact_id" => artifact_id, "input" => selected.fetch(:input),
+                "input_digest" => selected.fetch(:binding).fetch("input_digest"), "artifact" => plan.fetch(:references).first,
+                "authorization" => params.fetch("authorization"), "producer_origin" => selected.fetch(:origin)})
+            end
+          end
+        end
+
+        def release_evidence_context(input, origin, authorization, artifact_id)
+          {kind: "release-artifact", project_id: @project, assignment_id: origin.fetch("assignment_id"),
+            attempt_id: origin.fetch("attempt_id"), peer_uid: origin.dig("runtime_binding", "process_identity", "uid"),
+            binding: {"input" => input, "producer_origin" => origin, "authorization" => authorization},
+            request_id_or_event_id: artifact_id, generation: input.fetch("publication").fetch("candidate_reference").fetch("candidate_generation")}
+        end
+      end
+    end
+  end
+end