ace-assign 0.69.0 → 0.71.0

data/lib/ace/assign/authority/ordinary_server.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+require_relative "socket_server"
+
+module Ace
+  module Assign
+    module Authority
+      # Explicit ordinary admission over Assign's existing wire/transfer owner.
+      # The Lab composition supplies a trusted installed admission object and
+      # closed handlers. No protected Deployment or kernel adapter is replaced.
+      class OrdinaryServer < SocketServer
+        def initialize(admission:, lifecycle:, services: [])
+          @admission = admission
+          super(service: admission.service, lifecycle: lifecycle, services: services)
+        end
+
+        private
+
+        def verify_listener!
+          @admission.verify_listener!
+        end
+
+        def authorize_transfer!(request:, peer:, role:, deadline:)
+          @lifecycle.authorize_transfer!(request: request, peer: peer, role: role, deadline: deadline)
+        end
+
+        def dispatch_lifecycle(request:, peer:, role:, deadline:, transfer: nil)
+          @lifecycle.dispatch(request: request, peer: peer, role: role, deadline: deadline, transfer: transfer)
+        end
+
+        def receive(socket)
+          deadline = wire.deadline(30)
+          peer = @admission.peer(socket, deadline: deadline)
+          ingress = Ace::Runtime::Molecules::ProtectedSocket::Ingress.new(socket)
+          frame = wire.read(ingress, deadline: [deadline, wire.deadline(5)].min, limit: 16_384, with_size: true)
+          request = frame.fetch(:data)
+          unless request.is_a?(Hash) && request.keys.sort == %w[mutation_id operation params project_id version] &&
+              request["version"].is_a?(Integer) && request["version"] == 1 &&
+              request["operation"].is_a?(String) && request["params"].is_a?(Hash)
+            raise ArgumentError, "invalid ordinary authority envelope"
+          end
+          role = @admission.authorize!(request: request, peer: peer, deadline: deadline)
+          binding = @lifecycle.transfer_binding(request)
+          bodyless_read!(ingress, deadline) unless binding && binding.fetch(:direction) == :upload
+          # Both binary bodies and EOF use ancillary-rejecting reads. Replies
+          # use the original duplex socket through the wrapper below.
+          dispatch_request(Duplex.new(socket, ingress), request, peer, role, deadline, frame_bytes: frame.fetch(:bytesize))
+        rescue ArgumentError, KeyError, AttemptErrors::MalformedTransfer
+          refusal(socket, "invalid_input")
+        rescue AttemptErrors::UnauthorizedIdentity, SecurityError
+          refusal(socket, "unauthorized")
+        rescue AttemptErrors::Conflict
+          refusal(socket, "conflict")
+        rescue AttemptErrors::NotFound
+          refusal(socket, "missing")
+        rescue AttemptErrors::BoundedResultUnavailable
+          refusal(socket, "bounded_result")
+        rescue StandardError
+          refusal(socket, "evidence_unavailable")
+        ensure
+          socket.close unless socket.closed?
+          @mutex.synchronize { @connections.delete(socket) }
+        end
+
+        class Duplex
+          def initialize(socket, ingress) = (@socket, @ingress = socket, ingress)
+          def to_io = @socket
+          def read_nonblock(*args, **options) = @ingress.read_nonblock(*args, **options)
+          def write_nonblock(*args, **options) = @socket.write_nonblock(*args, **options)
+        end
+        private_constant :Duplex
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/ordinary_supervisor.rb

@@ -0,0 +1,99 @@
+# frozen_string_literal: true
+
+module Ace
+  module Assign
+    module Authority
+      # Replacement transfers only result ownership, never worker execution.
+      # The existing definition chain serializes it with canonical generation.
+      module OrdinarySupervisor
+        SUPERVISOR_OPERATIONS = %w[supervisor_status adopt_supervisor].freeze
+
+        private
+
+        def supervisor_operation(request, peer, role, deadline)
+          params = request.fetch("params")
+          assignment = params.fetch("assignment_id")
+          token!(assignment)
+          registered = registration(assignment, commit: @journal.ref_value)
+          raise AttemptErrors::NotFound, "ordinary work is not registered" unless registered
+          if request.fetch("operation") == "supervisor_status"
+            strict!(params, %w[assignment_id])
+            raise ArgumentError, "supervisor status mutation must be null" unless request.fetch("mutation_id").nil?
+            commit = @journal.ref_value
+            selected = supervisor_selection(registered, commit)
+            authorize!(request, peer, role, deadline)
+            return {data: selected.merge("journal_commit" => commit), replayed: false}
+          end
+          strict!(params, %w[assignment_id expected_generation pane previous_binding_sha256])
+          token!(request.fetch("mutation_id"))
+          unless role == :supervisor && params.fetch("expected_generation").is_a?(Integer) &&
+              params.fetch("expected_generation").positive? && params.fetch("previous_binding_sha256").is_a?(String) &&
+              params.fetch("previous_binding_sha256").match?(/\A[0-9a-f]{64}\z/)
+            raise AttemptErrors::UnauthorizedIdentity, "supervisor adoption requires exact current selection"
+          end
+          observed = @admission.identity!(peer: peer, pane: params.fetch("pane"), deadline: deadline)
+          raise AttemptErrors::UnauthorizedIdentity, "replacement is not an installed coordinator" unless observed.role == "coordinator"
+          binding = observed.runtime_binding
+          digest = Atoms::EvidenceDigest.digest({"project_id" => @project, "params" => params, "binding" => binding})
+          @exclusion.with_shared_multi([@exclusion.task_key(registered.fetch("task_id")), @exclusion.assignment_key(assignment)], deadline: deadline) do
+            @journal.mutate(assignment_id: assignment, attempt_id: "definition-#{assignment}",
+              mutation_id: request.fetch("mutation_id"), operation: "adopt_supervisor", parameters_digest: digest,
+              expected_generation: params.fetch("expected_generation"), with_replay: true, deadline: deadline,
+              replay_authorizer: -> {
+                verify_new_supervisor!(request, peer, role, deadline, observed)
+                unless supervisor_selection(registered, @journal.ref_value).fetch("binding") == binding
+                  raise AttemptErrors::UnauthorizedIdentity, "supervisor adoption was superseded"
+                end
+              }) do |_events, prefix, _generation|
+              verify_new_supervisor!(request, peer, role, deadline, observed)
+              previous = supervisor_selection(registered, prefix)
+              unless previous.fetch("binding_sha256") == params.fetch("previous_binding_sha256") && previous.fetch("binding") != binding
+                raise AttemptErrors::Conflict, "original supervisor selection changed"
+              end
+              ended = @admission.supervisor_ended!(binding: previous.fetch("binding"), deadline: deadline)
+              unless ended.is_a?(Hash) && ended["liveness"] == "ended"
+                raise AttemptErrors::EvidenceUnavailable, "original supervisor generation has not ended"
+              end
+              verify_new_supervisor!(request, peer, role, deadline, observed)
+              {events: [], data: {"authority" => "ordinary", "assignment_id" => assignment, "project_id" => @project,
+                "previous_binding" => previous.fetch("binding"), "binding" => binding,
+                "binding_sha256" => Atoms::EvidenceDigest.digest(binding), "ended_observation" => ended}}
+            end
+          end
+        end
+
+        def verify_new_supervisor!(request, peer, role, deadline, observed)
+          authorize!(request, peer, role, deadline)
+          unless @admission.identity!(peer: peer, pane: request.fetch("params").fetch("pane"), deadline: deadline) == observed
+            raise AttemptErrors::UnauthorizedIdentity, "replacement supervisor changed during adoption"
+          end
+        end
+
+        def supervisor_selection(registered, commit)
+          assignment = registered.fetch("assignment_id")
+          events = @journal.read_events(assignment, commit: commit).select { |event| event.fetch("attempt_id") == "definition-#{assignment}" }
+          unless Models::EvidenceEvent.chain_valid?(events)
+            raise AttemptErrors::EvidenceUnavailable, "ordinary supervisor history is corrupt"
+          end
+          selected = registered.fetch("supervisor_binding")
+          generation = 1
+          # Validate the entire old→new chain rather than trusting a local cache.
+          events.select { |event| event["type"] == "authority_mutation" }.each do |event|
+            payload = event.fetch("payload")
+            next if payload.fetch("operation") == "register_assignment"
+            data = payload.fetch("data")
+            unless payload.fetch("operation") == "adopt_supervisor" && data.fetch("previous_binding") == selected &&
+                data.values_at("authority", "assignment_id", "project_id", "generation") == ["ordinary", assignment, @project, generation + 1] &&
+                data.fetch("binding_sha256") == Atoms::EvidenceDigest.digest(data.fetch("binding")) &&
+                data.dig("ended_observation", "liveness") == "ended"
+              raise AttemptErrors::EvidenceUnavailable, "ordinary supervisor adoption chain differs"
+            end
+            selected, generation = data.fetch("binding"), data.fetch("generation")
+          end
+          {"project_id" => @project, "assignment_id" => assignment, "generation" => generation,
+            "binding" => selected, "binding_sha256" => Atoms::EvidenceDigest.digest(selected)}
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/prepared_work.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative "../atoms/candidate_limits"
+
 require "json"
 require "digest"
 require "yaml"
@@ -15,7 +17,7 @@ module Ace
       # byte contract, never a registration, attempt or progress ledger.
       class PreparedWork
         MAX_TEXT = 1024 * 1024
-        MAX_TOTAL = 64 * 1024 * 1024
+        MAX_TOTAL = Atoms::CandidateLimits::PREPARED_BYTES
         MAX_MANIFEST = 32_768
         TOKEN = /\A[a-zA-Z0-9][a-zA-Z0-9._-]{0,199}\z/
         SCOPE = /\A[0-9]+(?:\.[0-9]+)*\z/
@@ -28,7 +30,10 @@ module Ace
         def initialize(files:)
           invalid!("file inventory") unless files.is_a?(Hash) && files.size.between?(4, 4096)
           @files = files.to_h do |path, bytes|
-            invalid!("file path") unless path.is_a?(String) && !path.start_with?("/") && path.split("/", -1).all? { |part| !part.empty? && !%w[. .. .git].include?(part.downcase) }
+            invalid!("file path") unless path.is_a?(String) && !path.start_with?("/") &&
+              path.bytesize <= Atoms::CandidateLimits::PATH_BYTES &&
+              path.split("/", -1).all? { |part| !part.empty? && part.bytesize <= Atoms::CandidateLimits::PATH_COMPONENT_BYTES &&
+                !%w[. .. .git].include?(part.downcase) }
             invalid!("text size") unless bytes.is_a?(String) && bytes.bytesize.between?(1, MAX_TEXT)
             text = bytes.dup.force_encoding(Encoding::UTF_8)
             invalid!("UTF-8") unless text.valid_encoding? && !text.include?("\0")
@@ -69,9 +74,9 @@ module Ace
         # The existing transport verifies complete Git objects before this
         # shared byte contract parses anything. Preserve the original input for
         # the eventual registration journal; CandidateTransfer may reexport it.
-        def self.admit(bytes:, head:, tree:, sha256:, size:, root:)
+        def self.admit(bytes:, head:, tree:, sha256:, size:, root:, deadline: nil)
           transfer = CandidateTransfer.new(root: root)
-          transfer.admit(bytes: bytes, head: head, sha256: sha256, size: size) do |repository, deadline, result|
+          transfer.admit(bytes: bytes, head: head, sha256: sha256, size: size, deadline: deadline) do |repository, deadline, result|
             raise ArgumentError, "prepared_input_invalid: Git tree differs" unless result.fetch("tree") == tree
             new(files: transfer.prepared_files(repository: repository, deadline: deadline, head: head))
           end

data/lib/ace/assign/authority/protected_assignment_context.rb

@@ -12,7 +12,7 @@ module Ace
       class ProtectedAssignmentContext
         attr_reader :uid
 
-        def self.load
+        def self.load(uid: Process.uid)
           paths = [Deployment::PATH, DeploymentHistory::PATH]
           installed = paths.any? do |path|
             begin
@@ -22,13 +22,13 @@ module Ace
               false
             end
           end
-          return new(deployment: nil, history: nil) unless installed
+          return new(deployment: nil, history: nil, uid: uid) unless installed
           deployment = Deployment.load
           history = DeploymentHistory.load
           unless history.selects?(deployment)
             raise AttemptErrors::EvidenceUnavailable, "installed protected descriptor is not retained"
           end
-          new(deployment: deployment, history: history)
+          new(deployment: deployment, history: history, uid: uid)
         end
 
         def initialize(deployment:, history:, uid: Process.uid, kernel: nil, env: ENV,

data/lib/ace/assign/authority/release_artifact_manifest.rb

@@ -0,0 +1,91 @@
+# frozen_string_literal: true
+
+require "digest"
+require "json"
+require "stringio"
+require "zlib"
+require "rubygems/package"
+require_relative "../molecules/canonical_evidence"
+
+module Ace
+  module Assign
+    module Authority
+      # One retained gem and the source-owned publication input it binds.
+      # Inspect bounded metadata only; never extract or evaluate build files.
+      module ReleaseArtifactManifest
+        FIELDS = %w[gem_name version platform registry sha256 bytes].freeze
+        NAME = /\A[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}\z/
+        MAX_METADATA_BYTES = 1024 * 1024
+        REGISTRY = "https://rubygems.org"
+
+        def self.validate!(value)
+          unless value.is_a?(Hash) && value.keys.sort == FIELDS.sort &&
+              value["gem_name"].is_a?(String) && NAME.match?(value["gem_name"]) &&
+              value["version"].is_a?(String) && value["version"].bytesize.between?(1, 128) && Gem::Version.correct?(value["version"]) &&
+              value["platform"].is_a?(String) && NAME.match?(value["platform"]) &&
+              value["registry"] == REGISTRY && value["sha256"].is_a?(String) && value["sha256"].match?(/\A[0-9a-f]{64}\z/) &&
+              value["bytes"].is_a?(Integer) && value["bytes"].between?(1, Molecules::CanonicalEvidence::MAX_RELEASE_ARTIFACT_BYTES)
+            raise ArgumentError, "invalid release artifact manifest"
+          end
+          value
+        end
+
+        def self.verify!(bytes, manifest)
+          validate!(manifest)
+          unless bytes.is_a?(String) && bytes.bytesize == manifest.fetch("bytes") &&
+              Digest::SHA256.hexdigest(bytes.b) == manifest.fetch("sha256")
+            raise AttemptErrors::ReceiptRejected, "release artifact bytes differ from the manifest"
+          end
+          metadata = metadata!(bytes)
+          unless metadata == manifest.slice("gem_name", "version", "platform")
+            raise AttemptErrors::ReceiptRejected, "release artifact gem metadata differs from the manifest"
+          end
+          true
+        end
+
+        # Shared immutable input for retention and the later fixed publisher.
+        # Candidate/reference come from the installed canonical owner, not wire
+        # claims. Its digest is the existing service authorization input_digest.
+        def self.publication_input(manifest:, candidate:, reference:)
+          validate!(manifest)
+          {"target" => {"resource" => "rubygems:#{manifest.fetch('gem_name')}:#{manifest.fetch('version')}",
+            "artifact_digest" => manifest.fetch("sha256")},
+           "publication" => manifest.slice("gem_name", "version", "platform", "registry").merge(
+             "head" => candidate.fetch("head"), "tree" => candidate.fetch("tree"), "candidate_reference" => reference,
+             "artifact_bytes" => manifest.fetch("bytes"), "artifact_relative_path" => "artifacts/#{manifest.fetch('sha256')}.gem")}
+        end
+
+        def self.metadata!(bytes)
+          metadata = nil
+          Gem::Package::TarReader.new(StringIO.new(bytes)) do |archive|
+            archive.each do |entry|
+              next unless entry.full_name == "metadata.gz"
+              unless metadata.nil? && entry.file? && entry.header.size.between?(1, MAX_METADATA_BYTES)
+                raise AttemptErrors::ReceiptRejected, "release artifact metadata is missing, repeated or oversized"
+              end
+              compressed = entry.read
+              Zlib::GzipReader.wrap(StringIO.new(compressed)) do |reader|
+                metadata = reader.read(MAX_METADATA_BYTES + 1)
+                if metadata.bytesize > MAX_METADATA_BYTES
+                  raise AttemptErrors::ReceiptRejected, "release artifact metadata exceeds its bound"
+                end
+              end
+            end
+          end
+          raise AttemptErrors::ReceiptRejected, "release artifact metadata is unavailable" unless metadata
+          specification = Gem::Specification.from_yaml(metadata)
+          unless specification.is_a?(Gem::Specification)
+            raise AttemptErrors::ReceiptRejected, "release artifact metadata is invalid"
+          end
+          {"gem_name" => specification.name, "version" => specification.version.to_s,
+            "platform" => specification.platform.to_s}
+        rescue AttemptErrors::ReceiptRejected
+          raise
+        rescue StandardError
+          raise AttemptErrors::ReceiptRejected, "release artifact metadata is invalid"
+        end
+        private_class_method :metadata!
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/retained_input.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+require "json"
+require "digest"
+require_relative "private_directory"
+
+module Ace
+  module Assign
+    module Authority
+      # Immutable requester inputs, never evidence that an operation executed.
+      module RetainedInput
+        module_function
+
+        def read_file(path, limit)
+          File.open(path, File::RDONLY | File::NOFOLLOW | File::NONBLOCK) do |file|
+            before = file.stat
+            raise ArgumentError, "retained input is not a bounded regular file" unless before.file? && before.size.between?(0, limit)
+            bytes = (file.read(limit + 1) || "").b
+            after, selected = file.stat, File.lstat(path)
+            identity = ->(stat) { [stat.dev, stat.ino, stat.size, stat.mtime, stat.ctime] }
+            unless bytes.bytesize == before.size && identity.call(before) == identity.call(after) &&
+                identity.call(after) == identity.call(selected) && !selected.symlink?
+              raise ArgumentError, "retained input changed during read"
+            end
+            bytes.freeze
+          end
+        end
+
+        def json(path, limit = 16_384)
+          JSON.parse(read_file(path, limit), allow_duplicate_key: false, create_additions: false, max_nesting: 24)
+        end
+
+        def create_output(path)
+          raise ArgumentError, "output must be a new directory path" unless path.is_a?(String) && !path.empty?
+          directory = File.expand_path(path)
+          Dir.mkdir(directory, 0o700)
+          PrivateDirectory.verify!(directory)
+          directory
+        end
+
+        def write_file(directory, name, bytes)
+          raise ArgumentError, "retained filename is invalid" unless File.basename(name) == name && !%w[. ..].include?(name)
+          File.open(File.join(directory, name), File::WRONLY | File::CREAT | File::EXCL | File::NOFOLLOW, 0o600) do |file|
+            file.write(bytes)
+            file.flush
+            file.fsync
+          end
+          File.open(directory) { |file| file.fsync }
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/router.rb

@@ -4,10 +4,10 @@ module Ace
     module Authority
       # Source-owned handlers share one listener. Requests never name a method.
       class Router
-        def initialize(launch:, handlers: [])
+        def initialize(launch: nil, handlers: [])
           @launch = launch
           @routes = {}
-          ([launch] + handlers).each do |handler|
+          ([launch].compact + handlers).each do |handler|
             handler.class::OPERATIONS.each do |operation|
               raise ArgumentError, "duplicate authority operation" if @routes.key?(operation)
               @routes[operation] = handler
@@ -16,11 +16,12 @@ module Ace
           @routes.freeze
         end
 
-        def dispatch(request:, peer:, role:, transfer: nil)
+        def dispatch(request:, peer:, role:, transfer: nil, deadline: nil)
           validate_review_namespace!(request)
           handler = @routes.fetch(request.fetch("operation")) { raise ArgumentError, "unknown authority operation" }
           options = {request: request, peer: peer, role: role}
           options[:transfer] = transfer if transfer
+          options[:deadline] = deadline if deadline
           handler.dispatch(**options)
         end
 
@@ -42,10 +43,12 @@ module Ace
           binding
         end
 
-        def authorize_transfer!(request:, peer:, role:)
+        def authorize_transfer!(request:, peer:, role:, deadline: nil)
           validate_review_namespace!(request)
           handler = @routes.fetch(request.fetch("operation"))
-          handler.authorize_transfer!(request: request, peer: peer, role: role)
+          options = {request: request, peer: peer, role: role}
+          options[:deadline] = deadline if deadline
+          handler.authorize_transfer!(**options)
         end
 
         def validate_review_namespace!(request)
@@ -60,14 +63,16 @@ module Ace
         private :validate_review_namespace!
 
         def close
-          @launch.close
+          @routes.values.uniq.each { |handler| handler.close if handler.respond_to?(:close) }
         end
 
         def serve_launch_control!(**options)
+          raise AttemptErrors::EvidenceUnavailable, "launch control is unavailable in this composition" unless @launch
           @launch.serve_launch_control!(**options)
         end
 
         def gate_ready(**options)
+          raise AttemptErrors::EvidenceUnavailable, "launch gate is unavailable in this composition" unless @launch
           @launch.gate_ready(**options)
         end
       end