ace-assign 0.69.0 → 0.71.0

data/lib/ace/assign/authority/ordinary_results.rb

@@ -0,0 +1,206 @@
+# frozen_string_literal: true
+
+require_relative "receipt_transfer"
+require_relative "../molecules/canonical_evidence"
+
+module Ace
+  module Assign
+    module Authority
+      # A worker submits an attributable result. This never accepts a terminal
+      # outcome, an independent review, or an external delivery effect.
+      module OrdinaryResults
+        RESULT_OPERATIONS = %w[submit_result result_status result_snapshot].freeze
+        RESULT_TRANSFERS = {
+          "submit_result" => {direction: :upload, purpose: :receipt_artifacts, roles: %i[worker supervisor]},
+          "result_snapshot" => {direction: :download, purpose: :receipt_artifacts, roles: %i[worker supervisor]}
+        }.freeze
+        RESULT_KEYS = %w[assignment_id attempt_id expected_generation pane head receipt_sha256 transfer].freeze
+
+        private
+
+        def validate_result!(request)
+          params = request.fetch("params")
+          if request.fetch("operation") != "submit_result"
+            snapshot = request.fetch("operation") == "result_snapshot"
+            strict!(params, %w[assignment_id attempt_id] + (snapshot ? ["result_id"] : []))
+            token!(params.fetch("result_id")) if snapshot
+            raise ArgumentError, "ordinary result status mutation must be null" unless request.fetch("mutation_id").nil?
+          else
+            strict!(params, RESULT_KEYS)
+            token!(request.fetch("mutation_id"))
+            unless params.fetch("expected_generation").is_a?(Integer) && params.fetch("expected_generation").positive? &&
+                params.fetch("head").is_a?(String) && params.fetch("head").match?(/\A[0-9a-f]{40}\z/) &&
+                params.fetch("receipt_sha256").is_a?(String) && params.fetch("receipt_sha256").match?(/\A[0-9a-f]{64}\z/)
+              raise ArgumentError, "ordinary result selection is invalid"
+            end
+          end
+          %w[assignment_id attempt_id].each { |key| token!(params.fetch(key)) }
+        end
+
+        def ordinary_result(request, peer, role, deadline, transfer)
+          validate_result!(request)
+          params = request.fetch("params")
+          commit = @journal.ref_value
+          registered = registration(params.fetch("assignment_id"), commit: commit)
+          raise AttemptErrors::NotFound, "ordinary work is not registered" unless registered
+          if request.fetch("operation") != "submit_result"
+            if request.fetch("operation") == "result_status" && @journal.read_events(params.fetch("assignment_id"), commit: commit)
+                .none? { |event| event.fetch("attempt_id") == params.fetch("attempt_id") }
+              authorize!(request, peer, role, deadline)
+              return {data: params.slice("assignment_id", "attempt_id").merge("project_id" => @project,
+                "state" => "not_started", "generation" => 0, "submitted_result" => nil), replayed: false}
+            end
+            events = result_events(params, commit)
+            result = retained_ordinary_result(params, events, commit)
+            if request.fetch("operation") == "result_snapshot"
+              unless result && result.fetch("result_id") == params.fetch("result_id")
+                raise AttemptErrors::NotFound, "ordinary exact result is unavailable"
+              end
+              receipt = result.fetch("receipt")
+              canonical = Molecules::CanonicalEvidence.new(journal: @journal)
+              parts = [JSON.generate(receipt)] + receipt.fetch("artifacts").map { |artifact|
+                canonical.read({"ref" => artifact.fetch("path"), "sha256" => artifact.fetch("sha256")},
+                  **ordinary_result_context(result.fetch("binding")), commit: commit)
+              }
+              authorize!(request, peer, role, deadline)
+              return {data: ordinary_result_projection(result).merge("journal_commit" => commit), transfer_parts: parts, replayed: false}
+            end
+            authorize!(request, peer, role, deadline)
+            started = events.find { |event| event["type"] == "process_start" }.fetch("payload")
+            scope = events.find { |event| event["type"] == "intent" }.fetch("payload").fetch("scope")
+            return {data: {"project_id" => @project, "assignment_id" => params.fetch("assignment_id"), "attempt_id" => params.fetch("attempt_id"),
+              "scope" => scope, "producer" => started.slice("actor", "role", "runtime"),
+              "runtime_binding" => started.fetch("runtime_binding"),
+              "journal_commit" => commit, "generation" => @journal.authority_generation(events),
+              "state" => Molecules::CanonicalAttemptState.derive(events), "submitted_result" => result && ordinary_result_projection(result)}, replayed: false}
+          end
+          unless %i[worker supervisor].include?(role)
+            raise AttemptErrors::UnauthorizedIdentity, "ordinary result requires its original worker"
+          end
+          authorize_start_replay!(request, peer, role, deadline)
+          admitted = ReceiptTransfer.decode(input: transfer, receipt_sha256: params.fetch("receipt_sha256"),
+            artifact_field: "artifacts", reference_key: "path")
+          digest = Atoms::EvidenceDigest.digest({"params" => params, "project_id" => @project, "peer_uid" => peer.fetch("uid")})
+          keys = [@exclusion.task_key(registered.fetch("task_id")), @exclusion.assignment_key(params.fetch("assignment_id"))]
+          @exclusion.with_shared_multi(keys, deadline: deadline) do
+            @journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
+              mutation_id: request.fetch("mutation_id"), operation: "submit_result", parameters_digest: digest,
+              expected_generation: params.fetch("expected_generation"), with_replay: true, deadline: deadline,
+              replay_authorizer: -> { authorize_start_replay!(request, peer, role, deadline) }) do |events, prefix, generation|
+              authorize_start_replay!(request, peer, role, deadline)
+              unless Molecules::CanonicalAttemptState.derive(events) == "running"
+                raise AttemptErrors::Conflict, "ordinary result requires the original running attempt"
+              end
+              raise AttemptErrors::Conflict, "ordinary attempt already submitted its result" if retained_ordinary_result(params, events, prefix)
+              observed = @admission.execution!(peer: peer, pane: params.fetch("pane"), head: params.fetch("head"), deadline: deadline)
+              start_replay_owner!(params, observed.fetch(:identity))
+              ordinary_result_plan(params, peer, admitted, observed, events, prefix, generation + 1)
+            end
+          end
+        end
+
+        def result_events(params, commit)
+          events = @journal.read_events(params.fetch("assignment_id"), commit: commit)
+            .select { |event| event.fetch("attempt_id") == params.fetch("attempt_id") }
+          unless Models::EvidenceEvent.chain_valid?(events) && events.one? { |event| event["type"] == "process_start" }
+            raise AttemptErrors::EvidenceUnavailable, "ordinary result attempt evidence is unavailable"
+          end
+          events
+        end
+
+        def ordinary_result_plan(params, peer, admitted, observed, events, commit, generation)
+          original = admitted.fetch(:receipt)
+          original_receipt = Models::ExecutionReceipt.from_h(original)
+          unless original_receipt.digest == Atoms::EvidenceDigest.digest(original_receipt.digest_payload)
+            raise AttemptErrors::ReceiptRejected, "ordinary original result digest differs"
+          end
+          identity = observed.fetch(:identity)
+          expected_producer = {"actor" => identity.actor, "role" => identity.role, "runtime" => identity.runtime}
+          validate_ordinary_result_receipt!(original, expected_producer)
+          id = SecureRandom.hex(16)
+          binding = params.slice("assignment_id", "attempt_id", "head").merge("authority" => "ordinary", "project_id" => @project,
+            "result_id" => id, "worker_uid" => peer.fetch("uid"), "producer" => expected_producer,
+            "runtime_binding" => identity.runtime_binding, "checkout" => observed.fetch(:checkout),
+            "generation" => generation, "uploaded_receipt_sha256" => admitted.fetch(:receipt_sha256),
+            "original_receipt_digest" => original_receipt.digest)
+          canonical = Molecules::CanonicalEvidence.new(journal: @journal)
+          plan = admitted.fetch(:artifacts).empty? ? {events: [], blobs: {}, references: []} :
+            canonical.import_plan(**ordinary_result_context(binding), artifacts: admitted.fetch(:artifacts),
+              admitted_after_event_digest: events.last.fetch("digest"))
+          receipt = original.except("digest", "recorded_at").merge("artifacts" => plan.fetch(:references).map { |reference|
+            {"path" => reference.fetch("ref"), "sha256" => reference.fetch("sha256")}
+          })
+          pending = @journal.send(:chain_mutation_events, params.fetch("attempt_id"), events.last.fetch("digest"), plan.fetch(:events))
+          reader = ->(_data, artifact) { canonical.read_pending({"ref" => artifact.fetch("path"), "sha256" => artifact.fetch("sha256")},
+            **ordinary_result_context(binding), current_events: events, pending_events: pending, blobs: plan.fetch(:blobs), commit: commit) }
+          verified = verify_ordinary_result_receipt(params, receipt, binding, commit, reader)
+          if JSON.generate(verified.to_h).bytesize > 16_384
+            raise AttemptErrors::ReceiptRejected, "canonical ordinary receipt exceeds its transfer limit"
+          end
+          payload = {"authority" => "ordinary", "result_id" => id, "binding" => binding, "receipt" => verified.to_h}
+          plan.merge(events: plan.fetch(:events) + [{type: "result_submitted", payload: payload}],
+            data: ordinary_result_projection(payload))
+        end
+
+        def ordinary_result_projection(payload)
+          payload.slice("result_id").merge(payload.fetch("binding").slice("head", "generation"),
+            "receipt_digest" => payload.fetch("receipt").fetch("digest"), "verdict" => payload.fetch("receipt").fetch("verdict"),
+            "state" => "running", "authority" => "ordinary")
+        end
+
+        def ordinary_result_context(binding)
+          {kind: "result", project_id: @project, assignment_id: binding.fetch("assignment_id"), attempt_id: binding.fetch("attempt_id"),
+            peer_uid: binding.fetch("worker_uid"), binding: binding, request_id_or_event_id: binding.fetch("result_id"), generation: binding.fetch("generation")}
+        end
+
+        def validate_ordinary_result_receipt!(receipt, producer)
+          unless receipt["producer"] == producer && (receipt.keys - Models::ExecutionReceipt.from_h(receipt).to_h.keys).empty? &&
+              !receipt["campaign"] && !receipt["review"] && receipt["operation"] != "review" &&
+              !Molecules::ReceiptVerifier::EXTERNAL_EFFECT_OPERATIONS.include?(receipt["operation"])
+            raise AttemptErrors::ReceiptRejected, "ordinary result producer or operation requires another evidence owner"
+          end
+        end
+
+        def verify_ordinary_result_receipt(params, receipt, binding, commit, reader)
+          validate_ordinary_result_receipt!(receipt, binding.fetch("producer"))
+          attempt = @journal.derived_attempts(params.fetch("assignment_id"), commit: commit).find { |item| item.attempt_id == params.fetch("attempt_id") }
+          raise AttemptErrors::EvidenceUnavailable, "ordinary result attempt is unavailable" unless attempt
+          Array(receipt["artifacts"]).each { |artifact| reader.call(receipt, artifact) }
+          Molecules::ReceiptVerifier.new(artifact_reader: reader).verify_result!(receipt,
+            attempt: attempt, live_head: binding.fetch("head"), repo_root: @journal.repo_root)
+        end
+
+        def retained_ordinary_result(params, events, commit)
+          raise AttemptErrors::EvidenceUnavailable, "ordinary result chain is corrupt" unless Models::EvidenceEvent.chain_valid?(events)
+          records = events.select { |event| event["type"] == "result_submitted" }
+          replies = events.select { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "submit_result" }
+          return nil if records.empty? && replies.empty?
+          unless records.one? && replies.one?
+            raise AttemptErrors::EvidenceUnavailable, "ordinary result provenance is missing or duplicated"
+          end
+          payload = records.first.fetch("payload")
+          binding = payload.fetch("binding")
+          start = events.find { |event| event["type"] == "process_start" }.fetch("payload")
+          unless payload.keys.sort == %w[authority binding receipt result_id] && payload["authority"] == "ordinary" &&
+              payload["result_id"].is_a?(String) && payload["result_id"].match?(/\A[0-9a-f]{32}\z/) &&
+              binding.keys.sort == %w[assignment_id attempt_id authority checkout generation head original_receipt_digest producer project_id result_id runtime_binding uploaded_receipt_sha256 worker_uid] &&
+              binding["authority"] == "ordinary" && binding["result_id"] == payload["result_id"] &&
+              binding["head"] == binding.dig("checkout", "head") &&
+              binding.values_at("project_id", "assignment_id", "attempt_id", "runtime_binding") ==
+              [@project, params.fetch("assignment_id"), params.fetch("attempt_id"), start.fetch("runtime_binding")] &&
+              binding.fetch("producer") == start.slice("actor", "role", "runtime") &&
+              binding.fetch("worker_uid") == start.dig("runtime_binding", "process_identity", "uid") &&
+              payload.fetch("receipt").fetch("producer") == binding.fetch("producer") &&
+              replies.first.dig("payload", "data").slice(*ordinary_result_projection(payload).keys) == ordinary_result_projection(payload)
+            raise AttemptErrors::EvidenceUnavailable, "ordinary result owner differs"
+          end
+          canonical = Molecules::CanonicalEvidence.new(journal: @journal)
+          reader = ->(_data, artifact) { canonical.read({"ref" => artifact.fetch("path"), "sha256" => artifact.fetch("sha256")},
+            **ordinary_result_context(binding), commit: commit) }
+          verify_ordinary_result_receipt(params, payload.fetch("receipt"), binding, commit, reader)
+          payload
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/ordinary_review_evidence.rb

@@ -0,0 +1,180 @@
+# frozen_string_literal: true
+
+require_relative "candidate_transfer"
+require_relative "receipt_transfer"
+require_relative "../molecules/canonical_evidence"
+
+module Ace
+  module Assign
+    module Authority
+      # Source-owned views of the same ordinary journal used by lifecycle CAS.
+      # Caller labels, filesystem reports and protected launch tickets are not
+      # alternate evidence sources. Service and merge consumers share this owner.
+      module OrdinaryReviewEvidence
+        def with_scope(assignment:, attempt:, deadline:)
+          token!(assignment)
+          token!(attempt)
+          selected = registration(assignment, commit: @journal.ref_value)
+          raise AttemptErrors::NotFound, "ordinary assignment is not registered" unless selected
+          @exclusion.with_shared_multi([@exclusion.task_key(selected.fetch("task_id")),
+            @exclusion.assignment_key(assignment)], deadline: deadline) do
+            yield @journal, selected
+          end
+        end
+
+        def origin_at!(events:, commit:)
+          ordinary_origin_at!(events, commit, running: true)
+        end
+
+        def candidate_at!(events:, commit:, head:, generation:)
+          origin_at!(events: events, commit: commit)
+          selected = ordinary_candidate_event(events)&.dig("payload", "data")
+          unless selected && selected.values_at("head", "candidate_generation") == [head, generation]
+            raise AttemptErrors::Conflict, "ordinary candidate changed"
+          end
+          bytes = @journal.bounded_blob(selected.fetch("bundle_ref"), commit: commit, max_bytes: CandidateTransfer::MAX_BYTES)
+          unless bytes.bytesize == selected.fetch("bytes") && Digest::SHA256.hexdigest(bytes) == selected.fetch("sha256")
+            raise AttemptErrors::EvidenceUnavailable, "ordinary canonical candidate is corrupt"
+          end
+          selected.slice("head", "tree", "candidate_generation", "bundle_ref", "sha256", "bytes")
+        end
+
+        def candidate_reference_at!(events:, commit:, head:, generation:)
+          candidate_at!(events: events, commit: commit, head: head, generation: generation)
+          origin = origin_at!(events: events, commit: commit)
+          origin.slice("assignment_id", "attempt_id").merge("candidate_generation" => generation,
+            "acceptance_event_digest" => ordinary_candidate_event(events).fetch("digest"))
+        end
+
+        def review_at!(events:, commit:, head:, generation:)
+          current = candidate_at!(events: events, commit: commit, head: head, generation: generation)
+          assigned = ordinary_review_assignment!(events, current)
+          ordinary_review_origins!(events, commit, assigned)
+          accepted = events.reverse.find { |event| event["type"] == "authority_mutation" &&
+            event.dig("payload", "operation") == "accept_review" && event.dig("payload", "data", "review_id") == assigned.fetch("review_id") }
+          data = accepted && accepted.dig("payload", "data")
+          unless data && data.fetch("review_binding") == assigned.except("generation", "journal_commit")
+            raise AttemptErrors::ReceiptRejected, "ordinary candidate has no accepted independent review"
+          end
+          canonical = Molecules::CanonicalEvidence.new(journal: @journal)
+          reader = ->(_receipt, artifact) { canonical.read({"ref" => artifact.fetch("path"), "sha256" => artifact.fetch("sha256")},
+            **ordinary_review_context(data.fetch("review_binding")), commit: commit) }
+          receipt = data.fetch("review_receipt")
+          verified = ordinary_verify_review!(receipt, events, commit, assigned, reader)
+          original = canonical.read({"ref" => data.fetch("original_receipt_ref"), "sha256" => data.fetch("uploaded_receipt_sha256")},
+            **ordinary_review_context(data.fetch("review_binding")), commit: commit)
+          unless Digest::SHA256.hexdigest(original) == data.fetch("uploaded_receipt_sha256") &&
+              verified.digest == data.fetch("receipt_digest")
+            raise AttemptErrors::EvidenceUnavailable, "ordinary accepted review bytes differ"
+          end
+          original_data = JSON.parse(original)
+          original_receipt = Models::ExecutionReceipt.from_h(original_data)
+          unless original_receipt.digest == Atoms::EvidenceDigest.digest(original_receipt.digest_payload) &&
+              original_data.except("digest", "recorded_at", "artifacts") == receipt.except("digest", "recorded_at", "artifacts") &&
+              original_data.fetch("artifacts").map { |value| value.fetch("sha256") } == receipt.fetch("artifacts").map { |value| value.fetch("sha256") }
+            raise AttemptErrors::EvidenceUnavailable, "ordinary review original and canonical receipt differ"
+          end
+          data.merge("acceptance_event_digest" => accepted.fetch("digest"), "recorded_at" => accepted.fetch("recorded_at"))
+        rescue JSON::ParserError, KeyError, TypeError
+          raise AttemptErrors::EvidenceUnavailable, "ordinary accepted review is incomplete"
+        end
+
+        private
+
+        def ordinary_origin_at!(events, commit, running:)
+          raise AttemptErrors::Conflict, "ordinary evidence prefix changed" unless commit && @journal.ref_value == commit
+          intent = events.select { |event| event["type"] == "intent" }
+          starts = events.select { |event| event["type"] == "process_start" }
+          accepted = events.select { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "start_attempt" }
+          unless Models::EvidenceEvent.chain_valid?(events) && intent.one? && starts.one? && accepted.one?
+            raise AttemptErrors::EvidenceUnavailable, "ordinary native origin is unavailable"
+          end
+          assignment, attempt = intent.first.dig("payload", "assignment_id"), intent.first.fetch("attempt_id")
+          token!(assignment)
+          token!(attempt)
+          registered = registration(assignment, commit: commit)
+          retained = @journal.read_events(assignment, commit: commit).select { |event| event["attempt_id"] == attempt }
+          start, data = starts.first.fetch("payload"), accepted.first.fetch("payload").fetch("data")
+          unless registered && retained == events && data.values_at("authority", "project_id", "assignment_id", "attempt_id", "runtime_binding") ==
+              ["ordinary", @project, assignment, attempt, start.fetch("runtime_binding")] &&
+              intent.first.dig("payload", "project_id") == @project
+            raise AttemptErrors::EvidenceUnavailable, "ordinary native origin differs from accepted start"
+          end
+          if running && Molecules::CanonicalAttemptState.derive(events) != "running"
+            raise AttemptErrors::Conflict, "ordinary delivery requires its original running attempt"
+          end
+          {"authority" => "ordinary", "project_id" => @project, "assignment_id" => assignment, "attempt_id" => attempt,
+            "intent_digest" => intent.first.fetch("digest"), "process_start_digest" => starts.first.fetch("digest"),
+            "runtime_binding" => start.fetch("runtime_binding"), "scope" => intent.first.dig("payload", "scope"),
+            "base_head" => intent.first.dig("payload", "base_head")}
+        end
+
+        def ordinary_candidate_event(events)
+          events.reverse.find { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "submit_candidate" }
+        end
+
+        def ordinary_review_assignment!(events, candidate)
+          selected = events.reverse.find { |event| event["type"] == "authority_mutation" &&
+            event.dig("payload", "operation") == "assign_review" &&
+            event.dig("payload", "data", "candidate_generation") == candidate.fetch("candidate_generation") }
+          data = selected && selected.dig("payload", "data")
+          cancelled = selected && events.any? { |event| event["type"] == "authority_mutation" &&
+            event.dig("payload", "operation") == "cancel_review" && event.dig("payload", "data", "review_id") == data.fetch("review_id") }
+          unless data && data.fetch("head") == candidate.fetch("head") && !cancelled
+            raise AttemptErrors::ReceiptRejected, "ordinary independent review assignment is absent or revoked"
+          end
+          data
+        end
+
+        def ordinary_review_origins!(events, commit, assigned, reviewer_running: false)
+          producer = origin_at!(events: events, commit: commit)
+          reviewer_events = @journal.read_events(assigned.fetch("reviewer_assignment_id"), commit: commit)
+            .select { |event| event["attempt_id"] == assigned.fetch("reviewer_attempt_id") }
+          reviewer = ordinary_origin_at!(reviewer_events, commit, running: reviewer_running)
+          unless producer == assigned.fetch("producer_origin") && reviewer == assigned.fetch("reviewer_origin")
+            raise AttemptErrors::EvidenceUnavailable, "ordinary review origins differ"
+          end
+          ordinary_independent_agents!(producer.fetch("runtime_binding"), reviewer.fetch("runtime_binding"))
+          [producer, reviewer]
+        end
+
+        def ordinary_independent_agents!(producer, reviewer)
+          sessions = [producer, reviewer].map { |binding|
+            Ace::Herdr::Atoms::NativeAgentSession.normalize(binding.fetch("agent_session"), agent: binding.fetch("agent")) }
+          identities = [producer, reviewer].map { |binding|
+            identity = binding.fetch("process_identity")
+            unless identity.is_a?(Hash) && %w[pid uid started_at host].all? { |key| identity.key?(key) }
+              raise AttemptErrors::EvidenceUnavailable, "ordinary agent process generation is missing"
+            end
+            identity.values_at("pid", "uid", "started_at", "host") }
+          unless sessions.all? && sessions[0].fetch("value").downcase != sessions[1].fetch("value").downcase && identities[0] != identities[1] && producer.fetch("pane") != reviewer.fetch("pane")
+            raise AttemptErrors::ReceiptRejected, "review requires an independently started native agent and session"
+          end
+          true
+        rescue KeyError
+          raise AttemptErrors::EvidenceUnavailable, "ordinary agent identity is incomplete"
+        end
+
+        def ordinary_review_context(binding)
+          {kind: "review", project_id: @project, assignment_id: binding.fetch("producer_origin").fetch("assignment_id"),
+            attempt_id: binding.fetch("producer_origin").fetch("attempt_id"), peer_uid: binding.fetch("reviewer_uid"),
+            binding: binding, request_id_or_event_id: binding.fetch("review_id"), generation: binding.fetch("candidate_generation")}
+        end
+
+        def ordinary_verify_review!(receipt, events, commit, assigned, reader)
+          origin = origin_at!(events: events, commit: commit)
+          producer = events.find { |event| event["type"] == "process_start" }.fetch("payload").slice("actor", "role", "runtime")
+          unless receipt["operation"] == "review" && receipt["verdict"] == "succeeded" && !receipt["campaign"] &&
+              receipt["producer"] == producer && receipt.dig("review", "reviewer", "actor") == assigned.fetch("reviewer_actor")
+            raise AttemptErrors::ReceiptRejected, "ordinary review receipt attribution differs"
+          end
+          attempt = @journal.derived_attempts(origin.fetch("assignment_id"), commit: commit)
+            .find { |value| value.attempt_id == origin.fetch("attempt_id") }
+          independence = ->(_data) { ordinary_review_origins!(events, commit, assigned); true }
+          Molecules::ReceiptVerifier.new(artifact_reader: reader, review_independence_verifier: independence)
+            .verify_result!(receipt, attempt: attempt, live_head: assigned.fetch("head"), repo_root: @journal.repo_root)
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/ordinary_reviews.rb

@@ -0,0 +1,214 @@
+# frozen_string_literal: true
+
+require_relative "ordinary_review_evidence"
+
+module Ace
+  module Assign
+    module Authority
+      module OrdinaryReviews
+        include OrdinaryReviewEvidence
+        REVIEW_OPERATIONS = %w[submit_candidate assign_review cancel_review export_candidate accept_review review_status].freeze
+        REVIEW_TRANSFERS = {
+          "submit_candidate" => {direction: :upload, purpose: :candidate, roles: %i[worker supervisor]},
+          "export_candidate" => {direction: :download, purpose: :candidate, roles: %i[worker supervisor]},
+          "accept_review" => {direction: :upload, purpose: :receipt_artifacts, roles: %i[worker supervisor]}
+        }.freeze
+        REVIEW_COMMON = %w[assignment_id attempt_id head candidate_generation pane].freeze
+        REVIEW_PARAMETERS = {
+          "submit_candidate" => REVIEW_COMMON + %w[expected_generation transfer],
+          "assign_review" => REVIEW_COMMON + %w[expected_generation reviewer_assignment_id reviewer_attempt_id],
+          "cancel_review" => REVIEW_COMMON + %w[expected_generation review_id],
+          "export_candidate" => REVIEW_COMMON + %w[review_id],
+          "accept_review" => REVIEW_COMMON + %w[expected_generation review_id receipt_sha256 transfer],
+          "review_status" => %w[assignment_id attempt_id head candidate_generation]
+        }.freeze
+
+        private
+
+        def validate_ordinary_review!(request)
+          operation, params = request.values_at("operation", "params")
+          strict!(params, REVIEW_PARAMETERS.fetch(operation))
+          %w[assignment_id attempt_id reviewer_assignment_id reviewer_attempt_id review_id].each { |key| token!(params[key]) if params.key?(key) }
+          unless params["head"].is_a?(String) && CandidateTransfer::SHA.match?(params["head"]) &&
+              params["candidate_generation"].is_a?(Integer) && params["candidate_generation"] >= 0
+            raise ArgumentError, "ordinary candidate selection is invalid"
+          end
+          if %w[export_candidate review_status].include?(operation)
+            raise ArgumentError, "ordinary review read mutation must be null" unless request["mutation_id"].nil?
+          else
+            token!(request["mutation_id"])
+            unless params["expected_generation"].is_a?(Integer) && params["expected_generation"].positive?
+              raise ArgumentError, "ordinary review generation is invalid"
+            end
+          end
+        end
+
+        def authorize_ordinary_review!(request, peer, role, deadline, events: nil, commit: nil)
+          authorize!(request, peer, role, deadline)
+          validate_ordinary_review!(request)
+          params = request.fetch("params")
+          commit ||= @journal.ref_value
+          events ||= result_events(params, commit)
+          origin = origin_at!(events: events, commit: commit)
+          operation = request.fetch("operation")
+          return origin if operation == "review_status"
+          identity = @admission.identity!(peer: peer, pane: params.fetch("pane"), deadline: deadline)
+          case operation
+          when "submit_candidate"
+            unless identity.runtime_binding == origin.fetch("runtime_binding")
+              raise AttemptErrors::UnauthorizedIdentity, "candidate belongs to its original native producer"
+            end
+          when "assign_review", "cancel_review"
+            registered = registration(params.fetch("assignment_id"), commit: commit)
+            unless role == :supervisor && identity.role == "coordinator" && identity.runtime_binding == supervisor_selection(registered, commit).fetch("binding")
+              raise AttemptErrors::UnauthorizedIdentity, "review selection belongs to the current canonical supervisor"
+            end
+          when "export_candidate", "accept_review"
+            candidate = candidate_at!(events: events, commit: commit, head: params.fetch("head"), generation: params.fetch("candidate_generation"))
+            assigned = ordinary_review_assignment!(events, candidate)
+            _, reviewer = ordinary_review_origins!(events, commit, assigned, reviewer_running: true)
+            unless assigned.fetch("review_id") == params.fetch("review_id") && identity.runtime_binding == reviewer.fetch("runtime_binding") &&
+                identity.actor == assigned.fetch("reviewer_actor") && peer.fetch("uid") == assigned.fetch("reviewer_uid")
+              raise AttemptErrors::UnauthorizedIdentity, "review belongs to its assigned native agent"
+            end
+          end
+          origin
+        end
+
+        def ordinary_review_operation(request, peer, role, deadline, transfer)
+          params, operation = request.values_at("params", "operation")
+          authorize_ordinary_review!(request, peer, role, deadline)
+          admitted = if operation == "submit_candidate"
+            raise ArgumentError, "ordinary candidate requires one bundle" unless transfer && transfer.count == 1
+            descriptor = params.fetch("transfer")
+            CandidateTransfer.new(root: @input_root).admit(bytes: transfer.bytes, sha256: descriptor.fetch("sha256"),
+              size: descriptor.fetch("bytes"), head: params.fetch("head"), deadline: deadline)
+          elsif operation == "accept_review"
+            ReceiptTransfer.decode(input: transfer, receipt_sha256: params.fetch("receipt_sha256"), artifact_field: "artifacts", reference_key: "path")
+          elsif transfer
+            raise ArgumentError, "ordinary review operation forbids upload"
+          end
+          with_scope(assignment: params.fetch("assignment_id"), attempt: params.fetch("attempt_id"), deadline: deadline) do
+            commit = @journal.ref_value
+            events = result_events(params, commit)
+            authorize_ordinary_review!(request, peer, role, deadline, events: events, commit: commit)
+            if %w[export_candidate review_status].include?(operation)
+              current = candidate_at!(events: events, commit: commit, head: params.fetch("head"), generation: params.fetch("candidate_generation"))
+              assigned = ordinary_review_assignment!(events, current)
+              if operation == "export_candidate"
+                bytes = @journal.bounded_blob(current.fetch("bundle_ref"), commit: commit, max_bytes: CandidateTransfer::MAX_BYTES)
+                return {data: current.merge("review_id" => assigned.fetch("review_id")), transfer_parts: [bytes], replayed: false}
+              end
+              accepted = events.any? { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "accept_review" && event.dig("payload", "data", "review_id") == assigned.fetch("review_id") }
+              value = accepted ? review_at!(events: events, commit: commit, head: params.fetch("head"), generation: params.fetch("candidate_generation")) : assigned
+              return {data: value.merge("accepted" => accepted, "journal_commit" => commit), replayed: false}
+            end
+            digest = Atoms::EvidenceDigest.digest({"params" => params, "project_id" => @project, "peer_uid" => peer.fetch("uid")})
+            replay = lambda do
+              authorize_ordinary_review!(request, peer, role, deadline)
+              if operation == "submit_candidate"
+                ordinary_candidate_replay!(request, admitted)
+              elsif operation == "accept_review"
+                prefix = @journal.ref_value
+                review_at!(events: result_events(params, prefix), commit: prefix, head: params.fetch("head"), generation: params.fetch("candidate_generation"))
+              end
+            end
+            @journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
+              mutation_id: request.fetch("mutation_id"), operation: operation, parameters_digest: digest,
+              expected_generation: params.fetch("expected_generation"), with_replay: true, deadline: deadline,
+              replay_authorizer: replay) do |current_events, prefix, _generation|
+              authorize_ordinary_review!(request, peer, role, deadline, events: current_events, commit: prefix)
+              ordinary_review_plan(operation, params, peer, deadline, current_events, prefix, admitted, transfer)
+            end
+          end
+        end
+
+        def ordinary_review_plan(operation, params, peer, deadline, events, commit, admitted, transfer)
+          if operation == "submit_candidate"
+            current = ordinary_candidate_event(events)&.dig("payload", "data")
+            unless (current && current.fetch("candidate_generation") || 0) == params.fetch("candidate_generation")
+              raise AttemptErrors::Conflict, "ordinary candidate generation changed"
+            end
+            observed = @admission.execution!(peer: peer, pane: params.fetch("pane"), head: params.fetch("head"), deadline: deadline)
+            unless observed.fetch(:identity).runtime_binding == origin_at!(events: events, commit: commit).fetch("runtime_binding")
+              raise AttemptErrors::UnauthorizedIdentity, "ordinary candidate worker changed"
+            end
+            path = "candidates/bundles/#{SecureRandom.hex(16)}"
+            return {events: [], blobs: {path => admitted.fetch("bundle")}, data: admitted.except("bundle").merge(
+              "bundle_ref" => path, "candidate_generation" => params.fetch("candidate_generation") + 1,
+              "producer_origin" => origin_at!(events: events, commit: commit))}
+          end
+          current = candidate_at!(events: events, commit: commit, head: params.fetch("head"), generation: params.fetch("candidate_generation"))
+          if operation == "assign_review"
+            prior = events.reverse.find { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "assign_review" &&
+              event.dig("payload", "data", "candidate_generation") == current.fetch("candidate_generation") }
+            if prior && !events.any? { |event| event.dig("payload", "operation") == "cancel_review" && event.dig("payload", "data", "review_id") == prior.dig("payload", "data", "review_id") }
+              raise AttemptErrors::Conflict, "ordinary review is already assigned"
+            end
+            producer = origin_at!(events: events, commit: commit)
+            reviewer_events = @journal.read_events(params.fetch("reviewer_assignment_id"), commit: commit)
+              .select { |event| event["attempt_id"] == params.fetch("reviewer_attempt_id") }
+            reviewer = ordinary_origin_at!(reviewer_events, commit, running: true)
+            ordinary_independent_agents!(producer.fetch("runtime_binding"), reviewer.fetch("runtime_binding"))
+            observed = @admission.recorded_binding!(binding: reviewer.fetch("runtime_binding"), deadline: deadline)
+            unless observed == reviewer.fetch("runtime_binding")
+              raise AttemptErrors::UnauthorizedIdentity, "ordinary reviewer native binding changed"
+            end
+            start = reviewer_events.find { |event| event["type"] == "process_start" }.fetch("payload")
+            return {events: [], data: current.slice("head", "candidate_generation").merge(
+              "review_id" => SecureRandom.hex(16), "reviewer_assignment_id" => params.fetch("reviewer_assignment_id"),
+              "reviewer_attempt_id" => params.fetch("reviewer_attempt_id"), "reviewer_actor" => start.fetch("actor"),
+              "reviewer_uid" => reviewer.dig("runtime_binding", "process_identity", "uid"),
+              "reviewer_runtime_binding" => reviewer.fetch("runtime_binding"), "producer_origin" => producer, "reviewer_origin" => reviewer)}
+          end
+          assigned = ordinary_review_assignment!(events, current)
+          raise AttemptErrors::Conflict, "ordinary review selection changed" unless assigned.fetch("review_id") == params.fetch("review_id")
+          return {events: [], data: current.slice("head", "candidate_generation").merge("review_id" => assigned.fetch("review_id"))} if operation == "cancel_review"
+          if events.any? { |event| event.dig("payload", "operation") == "accept_review" && event.dig("payload", "data", "review_id") == assigned.fetch("review_id") }
+            raise AttemptErrors::Conflict, "ordinary review already accepted; retain original request"
+          end
+          observed = @admission.execution!(peer: peer, pane: params.fetch("pane"), head: current.fetch("head"), deadline: deadline)
+          unless observed.fetch(:identity).runtime_binding == assigned.fetch("reviewer_runtime_binding") &&
+              observed.fetch(:identity).actor == assigned.fetch("reviewer_actor")
+            raise AttemptErrors::UnauthorizedIdentity, "ordinary reviewer changed before receipt acceptance"
+          end
+          ordinary_accept_review_plan(params, events, commit, assigned, admitted, transfer.bytes(index: 0))
+        end
+
+        def ordinary_candidate_replay!(request, admitted)
+          retained = @journal.mutation_result(request.fetch("mutation_id"))
+          data = retained.fetch("data")
+          bytes = @journal.bounded_blob(data.fetch("bundle_ref"), commit: retained.fetch("journal_commit"), max_bytes: CandidateTransfer::MAX_BYTES)
+          unless data.values_at("head", "tree", "sha256", "bytes") == admitted.values_at("head", "tree", "sha256", "bytes") &&
+              bytes.bytesize == data.fetch("bytes") && Digest::SHA256.hexdigest(bytes) == data.fetch("sha256")
+            raise AttemptErrors::EvidenceUnavailable, "ordinary retained candidate bytes differ"
+          end
+        end
+
+        def ordinary_accept_review_plan(params, events, commit, assigned, admitted, original_bytes)
+          original = admitted.fetch(:receipt)
+          original_model = Models::ExecutionReceipt.from_h(original)
+          unless (original.keys - original_model.to_h.keys).empty? &&
+              original_model.digest == Atoms::EvidenceDigest.digest(original_model.digest_payload)
+            raise AttemptErrors::ReceiptRejected, "ordinary uploaded review digest differs"
+          end
+          binding = assigned.except("generation", "journal_commit")
+          canonical = Molecules::CanonicalEvidence.new(journal: @journal)
+          plan = canonical.import_plan(**ordinary_review_context(binding), artifacts: [original_bytes] + admitted.fetch(:artifacts),
+            admitted_after_event_digest: events.last.fetch("digest"))
+          normalized = original.except("digest", "recorded_at").merge("artifacts" => plan.fetch(:references).drop(1).map { |ref| {"path" => ref.fetch("ref"), "sha256" => ref.fetch("sha256")} })
+          pending = @journal.send(:chain_mutation_events, params.fetch("attempt_id"), events.last.fetch("digest"), plan.fetch(:events))
+          reader = ->(_receipt, artifact) { canonical.read_pending({"ref" => artifact.fetch("path"), "sha256" => artifact.fetch("sha256")},
+            **ordinary_review_context(binding), current_events: events, pending_events: pending, blobs: plan.fetch(:blobs), commit: commit) }
+          verified = ordinary_verify_review!(normalized, events, commit, assigned, reader)
+          path = plan.fetch(:references).first.fetch("ref")
+          data = binding.slice("head", "candidate_generation", "review_id", "reviewer_uid", "reviewer_actor", "reviewer_runtime_binding", "producer_origin")
+            .merge("review_binding" => binding, "review_receipt" => verified.to_h, "receipt_digest" => verified.digest,
+              "original_receipt_ref" => path, "uploaded_receipt_sha256" => admitted.fetch(:receipt_sha256))
+          raise AttemptErrors::ReceiptRejected, "ordinary review reply is oversized" if JSON.generate(data).bytesize > 12_000
+          plan.merge(data: data)
+        end
+      end
+    end
+  end
+end