ace-assign 0.69.0 → 0.71.0

data/lib/ace/assign/authority/server.rb

@@ -1,129 +1,29 @@
 # frozen_string_literal: true
-require "socket"
-require "fileutils"
+
 require_relative "deployment"
-require_relative "transfer_codec"
-require_relative "../molecules/evidence_journal"
+require_relative "socket_server"
 
 module Ace
   module Assign
     module Authority
-      # Existing assignment owner transport; kernel peers select roles, never argv.
-      class Server
-        CONNECTIONS = 16
+      # Protected admission is mandatory for this source-selected composition.
+      class Server < SocketServer
         def initialize(authority_id:, lifecycle:, deployment: Deployment.load,
-          kernel: Ace::Runtime::Molecules::ProtectedLinux.new, composition: "launch", hitl_service: nil)
-          @authority_id, @lifecycle, @deployment, @kernel = authority_id, lifecycle, deployment, kernel
-          @composition = composition
-          @hitl_service = hitl_service
+          kernel: Ace::Runtime::Molecules::ProtectedLinux.new, composition: "launch", services: [])
+          @authority_id, @deployment, @kernel, @composition = authority_id, deployment, kernel, composition
           deployment.verify_composition!(authority_id, composition: composition)
-          @service = deployment.authority(authority_id)
-          @mutex = Mutex.new
-          @connections = []
-          @handlers = []
-          @transfers = 0
-          @stopped = false
+          super(service: deployment.authority(authority_id), lifecycle: lifecycle, services: services)
         end
 
-        def serve
+        private
+
+        def verify_listener!
           @kernel.supported!
           me = @kernel.capture(Process.pid)
           unless principal?(me, @service, "uid", "gid", "groups")
             raise AttemptErrors::UnauthorizedIdentity, "listener principal differs from installed authority"
           end
           @deployment.verify_receiver_paths!(@authority_id)
-          directory = File.dirname(@service.fetch("socket_path"))
-          wire.root_path!(directory, directory: true, owner: @service.fetch("uid"))
-          lock = File.open(File.join(directory, "listener.lock"), File::RDWR | File::CREAT | File::NOFOLLOW, 0o600)
-          unless lock.flock(File::LOCK_EX | File::LOCK_NB)
-            raise AttemptErrors::Conflict, "assignment authority already owns its listener"
-          end
-          start_hitl_service!
-          path = @service.fetch("socket_path")
-          if File.exist?(path) || File.symlink?(path)
-            raise AttemptErrors::Conflict, "existing authority endpoint requires verified installer recovery"
-          end
-          @listener = UNIXServer.new(path)
-          File.chmod(0o660, path)
-          @endpoint = wire.socket_identity(path)
-          until @stopped
-            if @hitl_thread && !@hitl_thread.alive?
-              raise Ace::Runtime::RuntimeUnavailableError, "protected HITL boundary stopped before its authority"
-            end
-            ready = IO.select([@listener], nil, nil, 0.25)
-            next unless ready
-            socket = @listener.accept_nonblock(exception: false)
-            next if socket == :wait_readable
-            admitted = @mutex.synchronize do
-              if @connections.size < CONNECTIONS
-                @connections << socket
-                true
-              end
-            end
-            unless admitted
-              refusal(socket, "busy")
-              socket.close
-              next
-            end
-            @mutex.synchronize do
-              @handlers.reject! { |handler| !handler.alive? }
-              @handlers << Thread.new(socket) { |connection| receive(connection) }
-            end
-          end
-        rescue IOError, Errno::EBADF
-          raise unless @stopped
-        ensure
-          stop
-          stop_hitl_service!
-          # Closing a stream does not cancel a handler already inside dispatch.
-          # The owner lock and endpoint remain held until every handler ends.
-          @mutex.synchronize { @handlers.dup }.each(&:join)
-          @lifecycle.close if @endpoint && @lifecycle.respond_to?(:close)
-          if @endpoint && same_endpoint?(path)
-            File.unlink(path)
-          end
-          lock&.close
-        end
-
-        def request_stop
-          @stopped = true
-        end
-
-        def stop
-          @stopped = true
-          @listener&.close unless @listener&.closed?
-          @mutex.synchronize { @connections.each { |socket| socket.close unless socket.closed? } }
-        end
-
-        private
-
-        # The existing HITL boundary is a sibling owned by this listener's
-        # lifetime. It must be ready before assignment ingress is opened.
-        def start_hitl_service!
-          return unless @hitl_service
-          ready = Queue.new
-          @hitl_thread = Thread.new do
-            @hitl_service.run(on_ready: -> { ready << :ready })
-          rescue Exception => error
-            @hitl_failure = error
-            ready << error
-          end
-          @hitl_thread.report_on_exception = false
-          result = ready.pop(timeout: 5)
-          raise Ace::Runtime::RuntimeUnavailableError, "protected HITL boundary startup timed out" if result.nil?
-          raise result if result.is_a?(Exception)
-        end
-
-        def stop_hitl_service!
-          return unless @hitl_thread
-          @hitl_service.stop
-          @hitl_thread.join
-        end
-
-        def same_endpoint?(path)
-          wire.socket_identity(path) == @endpoint
-        rescue StandardError
-          false
         end
 
         def receive(socket)
@@ -200,40 +100,7 @@ module Ace
             raise AttemptErrors::UnauthorizedIdentity, "gate readiness requires worker peer" unless role == :worker
             @lifecycle.gate_ready(request: request, peer: peer, socket: socket, deadline: deadline)
           else
-            Molecules::EvidenceJournal.with_event_read_operation do
-              binding = @lifecycle.transfer_binding(request) if @lifecycle.respond_to?(:transfer_binding)
-              if binding
-                raise AttemptErrors::UnauthorizedIdentity, "transfer role differs" unless binding.fetch(:roles).include?(role)
-                raise ArgumentError, "transfer control header is oversized" if frame.fetch(:bytesize) > 16_384
-                @lifecycle.authorize_transfer!(request: request, peer: peer, role: role)
-                admitted_transfer = @mutex.synchronize do
-                  if @transfers < 2
-                    @transfers += 1
-                    true
-                  end
-                end
-                raise AttemptErrors::Conflict, "transfer capacity is busy" unless admitted_transfer
-                codec = transfer_codec
-                if binding.fetch(:direction) == :upload
-                  result = codec.receive(socket, descriptor: params.fetch("transfer"), purpose: binding.fetch(:purpose), deadline: deadline) do |input|
-                    @lifecycle.dispatch(request: request, peer: peer, role: role, transfer: input)
-                  end
-                else
-                  result = @lifecycle.dispatch(request: request, peer: peer, role: role)
-                  parts = result.fetch(:transfer_parts)
-                  descriptor = codec.descriptor(parts, purpose: binding.fetch(:purpose))
-                  result = result.merge(data: result.fetch(:data).merge("transfer" => descriptor))
-                end
-              else
-                raise ArgumentError, "unexpected transfer descriptor" if params.key?("transfer")
-                result = @lifecycle.dispatch(request: request, peer: peer, role: role)
-              end
-              wire.write(socket, {"status" => "ok", "data" => result.fetch(:data),
-                "transport" => {"replayed" => result.fetch(:replayed, false)}}, deadline: deadline, limit: 16_384)
-              if binding && binding.fetch(:direction) == :download
-                codec.send(socket, parts: parts, descriptor: descriptor, purpose: binding.fetch(:purpose), deadline: deadline)
-              end
-            end
+            dispatch_request(socket, request, peer, role, deadline, frame_bytes: frame.fetch(:bytesize))
           end
         rescue ArgumentError, KeyError, AttemptErrors::MalformedTransfer
           refusal(socket, "invalid_input")
@@ -255,45 +122,9 @@ module Ace
           end
         end
 
-        # These closed read operations have no request body. Half-close proves
-        # framing completion before status or artifact data can be exposed.
-        def bodyless_read!(socket, deadline)
-          loop do
-            remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
-            raise ArgumentError, "read request framing is incomplete" unless remaining.positive? && IO.select([socket], nil, nil, remaining)
-            bytes = socket.read_nonblock(1, exception: false)
-            next if bytes == :wait_readable
-            raise ArgumentError, "unexpected read request body" unless bytes.nil?
-            return
-          end
-        end
-
-        def transfer_codec
-          @mutex.synchronize do
-            @transfer_codec ||= begin
-              root = @service.fetch("state_root")
-              PrivateDirectory.verify!(root)
-              spool = File.join(root, "transfers")
-              Dir.mkdir(spool, 0o700) unless File.exist?(spool) || File.symlink?(spool)
-              TransferCodec.new(root: spool)
-            end
-          end
-        end
-
         def principal?(identity, mapping, uid, gid, groups)
           identity["uid"] == mapping[uid] && identity["gid"] == mapping[gid] && identity["groups"] == mapping[groups]
         end
-
-        def refusal(socket, code)
-          wire.write(socket, {"status" => "error", "error" => {"code" => code, "message" => "Protected authority refused #{code}"}},
-            deadline: wire.deadline(0.1))
-        rescue StandardError
-          nil
-        end
-
-        def wire
-          Ace::Runtime::Molecules::ProtectedSocket
-        end
       end
     end
   end

data/lib/ace/assign/authority/socket_server.rb

@@ -0,0 +1,255 @@
+# frozen_string_literal: true
+
+require "socket"
+require "fileutils"
+require_relative "transfer_codec"
+require_relative "../molecules/evidence_journal"
+
+module Ace
+  module Assign
+    module Authority
+      # Shared endpoint lifetime and bounded wire protocol. Concrete source
+      # compositions authenticate their own installed principals before dispatch.
+      # Protected deployment/kernel requirements remain in Server.
+      class SocketServer
+        CONNECTIONS = 16
+
+        def initialize(service:, lifecycle:, services: [])
+          unless services.is_a?(Array) && services.uniq.size == services.size &&
+              services.all? { |owned| owned.respond_to?(:run) && owned.respond_to?(:stop) }
+            raise ArgumentError, "authority services require distinct source-owned run/stop lifetimes"
+          end
+          @service, @lifecycle, @services = service, lifecycle, services.dup.freeze
+          @service_threads = []
+          @activation_gates = []
+          @mutex = Mutex.new
+          @connections = []
+          @handlers = []
+          @transfers = 0
+          @stopped = false
+        end
+
+        def serve
+          verify_listener!
+          directory = File.dirname(@service.fetch("socket_path"))
+          wire.root_path!(directory, directory: true, owner: @service.fetch("uid"))
+          lock = File.open(File.join(directory, "listener.lock"), File::RDWR | File::CREAT | File::NOFOLLOW, 0o600)
+          unless lock.flock(File::LOCK_EX | File::LOCK_NB)
+            raise AttemptErrors::Conflict, "assignment authority already owns its listener"
+          end
+          path = @service.fetch("socket_path")
+          if File.exist?(path) || File.symlink?(path)
+            raise AttemptErrors::Conflict, "existing authority endpoint requires verified installer recovery"
+          end
+          @listener = UNIXServer.new(path)
+          @endpoint = wire.socket_identity(path)
+          File.chmod(0o660, path)
+          start_services!
+          verify_services!
+          @activation_gates.each { |gate| gate << :activate }
+          until @stopped
+            verify_services!
+            ready = IO.select([@listener], nil, nil, 0.25)
+            next unless ready
+            socket = @listener.accept_nonblock(exception: false)
+            next if socket == :wait_readable
+            admitted = @mutex.synchronize do
+              if @connections.size < CONNECTIONS
+                @connections << socket
+                true
+              end
+            end
+            unless admitted
+              refusal(socket, "busy")
+              socket.close
+              next
+            end
+            @mutex.synchronize do
+              @handlers.reject! { |handler| !handler.alive? }
+              @handlers << Thread.new(socket) { |connection| receive(connection) }
+            end
+          end
+        rescue IOError, Errno::EBADF
+          raise unless @stopped
+        ensure
+          begin
+            stop
+            stop_services!
+          ensure
+            # Closing a stream does not cancel an admitted transaction. Hold
+            # the owner lock and endpoint until every handler has ended.
+            begin
+              @mutex.synchronize { @handlers.dup }.each(&:join)
+              @lifecycle.close if @endpoint && @lifecycle.respond_to?(:close)
+            ensure
+              begin
+                File.unlink(path) if @endpoint && same_endpoint?(path)
+              ensure
+                lock&.close
+              end
+            end
+          end
+        end
+
+        def request_stop
+          @stopped = true
+        end
+
+        def stop
+          @stopped = true
+          @listener&.close unless @listener&.closed?
+          @mutex.synchronize { @connections.each { |socket| socket.close unless socket.closed? } }
+        end
+
+        private
+
+        # Installed HITL and merge listeners share the assignment owner lock.
+        # Every selected boundary must be ready before assignment ingress opens;
+        # a stopped boundary closes admission until the complete owner restarts.
+        def start_services!
+          @services.each do |owned|
+            ready = Queue.new
+            activation = Queue.new
+            @activation_gates << activation
+            thread = Thread.new do
+              owned.run(on_ready: lambda do
+                ready << :ready
+                unless activation.pop == :activate
+                  raise Ace::Runtime::RuntimeUnavailableError, "authority startup was cancelled"
+                end
+              end)
+            rescue Exception => error
+              ready << error
+            ensure
+              ready << :stopped
+            end
+            thread.report_on_exception = false
+            @service_threads << [owned, thread]
+            result = ready.pop(timeout: 5)
+            raise Ace::Runtime::RuntimeUnavailableError, "authority service startup did not become ready" unless result == :ready || result.is_a?(Exception)
+            raise result if result.is_a?(Exception)
+          end
+        end
+
+        def verify_services!
+          unless @service_threads.all? { |_, thread| thread.alive? }
+            raise Ace::Runtime::RuntimeUnavailableError, "an owned service stopped before its authority"
+          end
+        end
+
+        def stop_services!
+          errors = []
+          @activation_gates.each { |gate| gate << :cancel }
+          @service_threads.reverse_each do |owned, _|
+            owned.stop
+          rescue Exception => error
+            errors << error
+          end
+          @service_threads.each do |_, thread|
+            thread.join
+          rescue Exception => error
+            errors << error
+          end
+          raise errors.first unless errors.empty?
+        end
+
+        def same_endpoint?(path)
+          wire.socket_identity(path) == @endpoint
+        rescue StandardError
+          false
+        end
+
+        def verify_listener!
+          raise NotImplementedError, "source composition must verify its installed listener"
+        end
+
+        def dispatch_request(socket, request, peer, role, deadline, frame_bytes:)
+          params = request.fetch("params")
+          admitted_transfer = false
+          Molecules::EvidenceJournal.with_event_read_operation do
+            binding = @lifecycle.transfer_binding(request) if @lifecycle.respond_to?(:transfer_binding)
+            if binding
+              raise AttemptErrors::UnauthorizedIdentity, "transfer role differs" unless binding.fetch(:roles).include?(role)
+              raise ArgumentError, "transfer control header is oversized" if frame_bytes > 16_384
+              authorize_transfer!(request: request, peer: peer, role: role, deadline: deadline)
+              admitted_transfer = @mutex.synchronize do
+                if @transfers < 2
+                  @transfers += 1
+                  true
+                end
+              end
+              raise AttemptErrors::Conflict, "transfer capacity is busy" unless admitted_transfer
+              codec = transfer_codec
+              if binding.fetch(:direction) == :upload
+                result = codec.receive(socket, descriptor: params.fetch("transfer"), purpose: binding.fetch(:purpose), deadline: deadline) do |input|
+                  dispatch_lifecycle(request: request, peer: peer, role: role, transfer: input, deadline: deadline)
+                end
+              else
+                result = dispatch_lifecycle(request: request, peer: peer, role: role, deadline: deadline)
+                parts = result.fetch(:transfer_parts)
+                descriptor = codec.descriptor(parts, purpose: binding.fetch(:purpose))
+                result = result.merge(data: result.fetch(:data).merge("transfer" => descriptor))
+              end
+            else
+              raise ArgumentError, "unexpected transfer descriptor" if params.key?("transfer")
+              result = dispatch_lifecycle(request: request, peer: peer, role: role, deadline: deadline)
+            end
+            wire.write(socket, {"status" => "ok", "data" => result.fetch(:data),
+              "transport" => {"replayed" => result.fetch(:replayed, false)}}, deadline: deadline, limit: 16_384)
+            if binding && binding.fetch(:direction) == :download
+              codec.send(socket, parts: parts, descriptor: descriptor, purpose: binding.fetch(:purpose), deadline: deadline)
+            end
+          end
+        ensure
+          @mutex.synchronize { @transfers -= 1 } if admitted_transfer
+        end
+
+        def authorize_transfer!(request:, peer:, role:, deadline:)
+          @lifecycle.authorize_transfer!(request: request, peer: peer, role: role)
+        end
+
+        def dispatch_lifecycle(request:, peer:, role:, deadline:, transfer: nil)
+          options = {request: request, peer: peer, role: role}
+          options[:transfer] = transfer if transfer
+          @lifecycle.dispatch(**options)
+        end
+
+        # These closed read operations have no request body. Half-close proves
+        # framing completion before status or artifact data can be exposed.
+        def bodyless_read!(socket, deadline)
+          loop do
+            remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+            raise ArgumentError, "read request framing is incomplete" unless remaining.positive? && IO.select([socket], nil, nil, remaining)
+            bytes = socket.read_nonblock(1, exception: false)
+            next if bytes == :wait_readable
+            raise ArgumentError, "unexpected read request body" unless bytes.nil?
+            return
+          end
+        end
+
+        def transfer_codec
+          @mutex.synchronize do
+            @transfer_codec ||= begin
+              root = @service.fetch("state_root")
+              PrivateDirectory.verify!(root)
+              spool = File.join(root, "transfers")
+              Dir.mkdir(spool, 0o700) unless File.exist?(spool) || File.symlink?(spool)
+              TransferCodec.new(root: spool)
+            end
+          end
+        end
+
+        def refusal(socket, code)
+          wire.write(socket, {"status" => "error", "error" => {"code" => code, "message" => "Protected authority refused #{code}"}},
+            deadline: wire.deadline(0.1))
+        rescue StandardError
+          nil
+        end
+
+        def wire
+          Ace::Runtime::Molecules::ProtectedSocket
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/transfer_codec.rb

@@ -5,6 +5,7 @@ require "tempfile"
 require "timeout"
 require "ace/runtime/molecules/protected_socket"
 require_relative "private_directory"
+require_relative "../atoms/candidate_limits"
 
 module Ace
   module Assign
@@ -13,10 +14,11 @@ module Ace
       # Server selects purpose from a source handler's fixed operation table,
       # admits a transfer slot before calling, and holds no journal lock here.
       class TransferCodec
-        LIMITS = {prompt_text: [16_384, 1, 16_384], scope_boundary_observation: [65_536, 1, 65_536], candidate: [64 * 1024 * 1024, 1, 64 * 1024 * 1024],
+        LIMITS = {prompt_text: [16_384, 1, 16_384], scope_boundary_observation: [65_536, 1, 65_536], candidate: [Atoms::CandidateLimits::BYTES, 1, Atoms::CandidateLimits::BYTES],
+                  release_artifact: [64 * 1024 * 1024, 1, 64 * 1024 * 1024],
                   artifacts: [256 * 1024, 16, 64 * 1024],
                   receipt_artifacts: [272 * 1024, 17, 64 * 1024],
-                  service_input: [64 * 1024, 1, 64 * 1024]}.freeze
+                  service_input: [64 * 1024, 1, 64 * 1024], assignment_snapshot: [Atoms::CandidateLimits::BYTES, 1, Atoms::CandidateLimits::BYTES]}.freeze
         SHA256 = /\A[0-9a-f]{64}\z/
 
         class Input
@@ -149,7 +151,7 @@ module Ace
                 part["bytes"].is_a?(Integer) && part["bytes"].between?(0, each) &&
                 part["sha256"].is_a?(String) && part["sha256"].match?(SHA256) } &&
               descriptor["bytes"] == descriptor["parts"].sum { |part| part["bytes"] } &&
-              (!%i[candidate service_input prompt_text].include?(purpose) || descriptor["bytes"].positive?)
+              (!%i[candidate service_input prompt_text assignment_snapshot release_artifact].include?(purpose) || descriptor["bytes"].positive?)
             reject!("Invalid or oversized transfer descriptor")
           end
           if purpose == :receipt_artifacts

data/lib/ace/assign/cli/commands/attempt/evidence.rb

@@ -7,12 +7,12 @@ module Ace
         module Attempt
           class Evidence < Ace::Support::Cli::Command
             include Attempt::Base
-            desc "Read coordinator-accepted live execution or historical review authority"
+            desc "Read coordinator-accepted live execution or historical execution authority"
             option :attempt, required: true, desc: "Accepted execution attempt ID"
             option :receipt_digest, required: true, desc: "Accepted receipt digest"
             option :kind, default: "check", desc: "Evidence purpose: check, review-collection or review-approval"
             option :check_name, default: "tests", desc: "Required check name (tests binds operation test)"
-            option :historical_head, desc: "Recorded collection/approval head for historical authority only"
+            option :historical_head, desc: "Exact recorded head for historical authority only (never current-head evidence)"
             option :format, default: "json", desc: "JSON evidence projection"
 
             def call(**options)

data/lib/ace/assign/cli/commands/submit_candidate.rb

@@ -23,7 +23,7 @@ module Ace
             head = require_option(options, :head, usage)
             raise Ace::Support::Cli::Error, "Head must be an exact SHA-1" unless head.match?(/\A[0-9a-f]{40}\z/)
             params.merge!("head" => head, "candidate_generation" => integer_option(options, :candidate_generation, usage))
-            bytes = input_bytes(require_option(options, :bundle, usage), limit: 64 * 1024 * 1024)
+            bytes = input_bytes(require_option(options, :bundle, usage), limit: Ace::Assign::Authority::CandidateTransfer::MAX_BYTES)
             parts = [bytes]
             emit_json(upload_call(client, "submit_candidate", params, mutation, parts, :candidate))
           end

data/lib/ace/assign/molecules/canonical_evidence.rb

@@ -14,8 +14,12 @@ module Ace
         MAX_TOTAL_BYTES = 256 * 1024
         MAX_ARTIFACTS = 16
         ID = /\A[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}\z/
+        MAX_RELEASE_ARTIFACT_BYTES = 64 * 1024 * 1024
         ROLES = {"service" => "executor", "review" => "reviewer",
-                 "result" => "worker"}.freeze
+                 "result" => "worker", "release-artifact" => "worker"}.freeze
+        REPORT_LIMITS = [MAX_ARTIFACT_BYTES, MAX_TOTAL_BYTES, MAX_ARTIFACTS].freeze
+        LIMITS = {"service" => REPORT_LIMITS, "review" => REPORT_LIMITS, "result" => REPORT_LIMITS,
+          "release-artifact" => [MAX_RELEASE_ARTIFACT_BYTES, MAX_RELEASE_ARTIFACT_BYTES, 1].freeze}.freeze
         DESCRIPTOR_FIELDS = %w[version artifact_id kind project_id assignment_id attempt_id peer_uid role
           binding_digest sha256 bytes admitted_at admitted_after_event_digest request_id_or_event_id
           candidate_generation_or_claim_generation].freeze
@@ -27,7 +31,8 @@ module Ace
             %w[artifact_id project_id assignment_id attempt_id request_id_or_event_id].all? { |key| descriptor[key].is_a?(String) && descriptor[key].match?(ID) } &&
             %w[binding_digest sha256 admitted_after_event_digest].all? { |key| descriptor[key].is_a?(String) && descriptor[key].match?(/\A[0-9a-f]{64}\z/) } &&
             descriptor["peer_uid"].is_a?(Integer) && descriptor["peer_uid"] >= 0 &&
-            descriptor["bytes"].is_a?(Integer) && descriptor["bytes"].between?(0, MAX_ARTIFACT_BYTES) &&
+            descriptor["bytes"].is_a?(Integer) && descriptor["bytes"].between?(descriptor["kind"] == "release-artifact" ? 1 : 0,
+              LIMITS.fetch(descriptor["kind"]).first) &&
             descriptor["candidate_generation_or_claim_generation"].is_a?(Integer) && descriptor["candidate_generation_or_claim_generation"] >= 0 &&
             descriptor["admitted_at"].is_a?(String)
           Time.iso8601(descriptor.fetch("admitted_at"))
@@ -46,13 +51,15 @@ module Ace
         def import_plan(kind:, project_id:, assignment_id:, attempt_id:, peer_uid:, binding:,
           request_id_or_event_id:, generation:, admitted_after_event_digest:, artifacts:)
           role = ROLES.fetch(kind) { raise ArgumentError, "invalid evidence kind" }
+          max_each, max_total, max_count = LIMITS.fetch(kind)
+          minimum = kind == "release-artifact" ? 1 : 0
           ids = [project_id, assignment_id, attempt_id, request_id_or_event_id]
           unless ids.all? { |id| id.is_a?(String) && id.match?(ID) } && binding.is_a?(Hash) &&
               admitted_after_event_digest.is_a?(String) && admitted_after_event_digest.match?(/\A[0-9a-f]{64}\z/) &&
               peer_uid.is_a?(Integer) && peer_uid >= 0 && generation.is_a?(Integer) && generation >= 0 &&
-              artifacts.is_a?(Array) && !artifacts.empty? && artifacts.length <= MAX_ARTIFACTS &&
-              artifacts.all? { |bytes| bytes.is_a?(String) && bytes.bytesize <= MAX_ARTIFACT_BYTES } &&
-              artifacts.sum(&:bytesize) <= MAX_TOTAL_BYTES
+              artifacts.is_a?(Array) && !artifacts.empty? && artifacts.length <= max_count &&
+              artifacts.all? { |bytes| bytes.is_a?(String) && bytes.bytesize.between?(minimum, max_each) } &&
+              artifacts.sum(&:bytesize) <= max_total
             raise ArgumentError, "invalid or oversized canonical evidence import"
           end
           events = []
@@ -85,7 +92,11 @@ module Ace
           verified_bytes(reference, events: events, kind: kind, project_id: project_id,
             assignment_id: assignment_id, attempt_id: attempt_id, peer_uid: peer_uid, binding: binding,
             request_id_or_event_id: request_id_or_event_id, generation: generation) do |path|
-            @journal.blob(path, commit: commit)
+            if kind == "release-artifact"
+              @journal.bounded_blob(path, commit: commit, max_bytes: MAX_RELEASE_ARTIFACT_BYTES)
+            else
+              @journal.blob(path, commit: commit)
+            end
           end
         end
 
@@ -102,7 +113,13 @@ module Ace
           verified_bytes(reference, events: events, kind: kind, project_id: project_id,
             assignment_id: assignment_id, attempt_id: attempt_id, peer_uid: peer_uid, binding: binding,
             request_id_or_event_id: request_id_or_event_id, generation: generation) do |path|
-            blobs.key?(path) ? blobs.fetch(path) : @journal.blob(path, commit: commit)
+            if blobs.key?(path)
+              blobs.fetch(path)
+            elsif kind == "release-artifact"
+              @journal.bounded_blob(path, commit: commit, max_bytes: MAX_RELEASE_ARTIFACT_BYTES)
+            else
+              @journal.blob(path, commit: commit)
+            end
           end
         end
 
@@ -137,7 +154,7 @@ module Ace
           end
           Time.iso8601(descriptor.fetch("admitted_at"))
           bytes = yield(reference.fetch("ref"))
-          unavailable! unless bytes.is_a?(String) && bytes.bytesize <= MAX_ARTIFACT_BYTES && bytes.bytesize == descriptor["bytes"] &&
+          unavailable! unless bytes.is_a?(String) && bytes.bytesize <= LIMITS.fetch(kind).first && bytes.bytesize == descriptor["bytes"] &&
             Digest::SHA256.hexdigest(bytes) == descriptor["sha256"]
           bytes
         rescue ArgumentError, KeyError, TypeError