ace-assign 0.70.0 → 0.71.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9de34921fd3a299eabfd530c8df3c76fed9405606cb0e717a0458fed9ecf614e
-  data.tar.gz: a9a2d22448d0c100b5404ce9ca9666b72ed0e6fb3d9bf158a5051ce001b703b1
+  metadata.gz: 5330cebc5f70e683451c7a69082c04f7fb6d8a5d92b24b92c73b37d30c56c4a9
+  data.tar.gz: d1687b8ba44c21a2a0618e61199c3043a67a8c6f0ecf7be38635635696c57b71
 SHA512:
-  metadata.gz: f68696b349c145768cf15634945c0fe40a659a80394f6053b37fd4270c244d8884345dbc9ba438a257de66593a0e44d88feca77c3c2580ea0e5208221d896746
-  data.tar.gz: 07c573b0f8160c1929fbba896362180ad2bd08097ab306139ca0e5a28c00762650845840f8709e16f825660add6057b6569ce49a1f7595370c2f83a6740c4e07
+  metadata.gz: e792c5dae1dda172bfa11a6bf7cc08c074796e70dd5fd67b2ba42294975b71b46ef7fbef858ca7e848675ae83fc4d567dcffb5cf5e5867ea3425b6aba25e161a
+  data.tar.gz: 564c47ff609931ae807a8a0f2cd8c1806160272ab9ecc3405a90118e42f184dc93c180b6b7b834844cc3668699f2bcc2fef3632db773ba7da4aa6e29cb0fd912

data/CHANGELOG.md

@@ -7,6 +7,26 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.71.0] - 2026-10-16
+
+### Added
+
+- Compare two independently retained candidate bundles through bounded bare Git object reads, including nonancestor rebases, full context inventories, binary patches and historical symlink bytes without executing or materializing candidate code.
+- Ground candidate and assignment-snapshot wire/expansion ceilings in closed 128MiB budgets backed by a shared fixed `cat-file --batch` codec, explicit 20,000-object bounds (per tree inventory and across the comparison's unique-blob union), and chunked batch reads instead of one Git process per blob; historical journal reads reuse the same codec.
+- Bound candidate, prepared and head-comparison tree paths to finite total/component lengths (4096/255 bytes) before any inventory, delta or filesystem prefix work, so a hostile tree cannot push unbounded path bytes into inventories or directory creation.
+- Retain built ordinary release gems as canonical binary evidence bound to the actual native producer, current accepted candidate, independent review and exact release decision. Recheck authorization on replay; preserve report limits and keep publication dispatch separate.
+- Admit ordinary candidates and independently started native reviewers into the canonical journal. Revalidate original review artifacts and root-witnessed test executions before fixed merge admission and effects; preserve strict protected-review attribution.
+- Drive ordinary work through the installed canonical owner with retained requests, accepted context snapshots and result adoption. Record coordinator replacement in the existing definition chain only after positive old-process termination; preserve worker attempts and reject stale supervisor completion.
+
+### Fixed
+
+- Preserve exact lost-response result replay while allowing canonical-generation CAS conflicts to recover without replacing original inputs.
+
+### Changed
+
+- Keep protected launch identity construction and comparison in its boundary owner while shared fixed service transitions reuse the same checks.
+- Require ace-review 0.61 for the shared complete-head-context ceiling; raise the candidate transfer deadline from 30s to a measured 60s with byte/count bounds unchanged (two full admits plus the complete comparison of the real 82,809,675-byte candidate legitimately need 23–27s on a loaded host; 30s failed closed under recorded load).
+
 ## [0.70.0] - 2026-10-16
 
 ### Added

data/handbook/skills/as-assign-drive/SKILL.md

@@ -6,12 +6,13 @@ description: Drive agent execution through an active assignment
 user-invocable: true
 allowed-tools:
   - Bash(ace-assign:*)
+  - Bash(ace-lab:*)
   - Bash(ace-bundle:*)
   - Read
   - Write
   - AskUserQuestion
   - Skill
-argument-hint: "[assignment[@scope]]"
+argument-hint: "[assignment[@scope] | --ordinary <context.json>]"
 last_modified: 2026-04-23
 source: ace-assign
 skill:
@@ -23,6 +24,8 @@ skill:
 
 Load and run `ace-bundle wfi://assign/drive` in the current project, then follow the loaded workflow as the source of truth and execute it end-to-end instead of only summarizing it.
 
+When `--ordinary` or `ACE_ASSIGN_ORDINARY_CONTEXT` is present, follow the workflow’s ordinary installed branch before resolving local assignment state. Its canonical `ace-lab assignment drive` operations own status, start, progress, results and recovery; local commands below apply only outside that branch.
+
 Hard stop rule:
 
 - Do not stop after intermediate progress.
@@ -30,7 +33,7 @@ Hard stop rule:
 - Treat `ace-assign status --assignment <id>@<root>` as the source of truth for fork completion; quiet terminal output is not enough reason to stop or declare a stall.
 - If a prior terminal or drive session ended, re-enter from assignment state and continue from the next runnable work instead of depending on the old terminal handle.
 - Before any final response, re-check pinned assignment status. If any runnable `pending` or `active` work remains, continue driving.
-- If unrelated dirty files are generated side effects outside task scope, clean/reset them instead of auto-committing them.
+- Preserve unrelated dirty files; commit only task-owned changes.
 - Use progress updates for partial status only.
 - Return a final user-facing completion response only when the assignment is complete or the workflow reaches an explicit blocker/failure stop condition.
 - If pending work remains runnable, continue driving.

data/handbook/workflow-instructions/assign/drive.wf.md

@@ -3,6 +3,7 @@ name: assign-drive
 description: Drive an ace-assign assignment until completion or an explicit blocker.
 allowed-tools:
 - Bash(ace-assign:*)
+- Bash(ace-lab:*)
 - Bash(ace-bundle:*)
 - Read
 - Write
@@ -27,6 +28,82 @@ Drive agent execution through an active assignment by continuously checking stat
 - An active assignment exists (created via `ace-assign create` or `/as-assign-create`)
 - Assignment has at least one pending or active step
 
+## Ordinary installed execution
+
+Select this branch **before resolving any local assignment** when invoked with
+`--ordinary <context.json>` or when `ACE_ASSIGN_ORDINARY_CONTEXT` is set. Require
+`ACE_ASSIGN_ORDINARY_PROJECT` and use the exact retained context path throughout.
+Conflicting explicit and environment paths are an error. In this branch every
+execution read and write uses `ace-lab assignment drive --project <project>
+--context <context.json>` against the installed owner. The local assignment
+commands below, `.current`, `.latest`, `fork-run`, and protected `work-on --project`
+are not fallback routes.
+
+1. Run `--operation status`. If `not_started`, run `--operation start` from the
+   actual native worker pane. A launch/send acknowledgement is not a start receipt.
+   Verify canonical status is `running` with the expected assignment, attempt,
+   scope, native binding and producer. Never adopt another pane's execution.
+2. Run `--operation bootstrap --output <new-private-directory>`. Read the returned
+   accepted task/context/report paths and retain their exact manifest and file
+   digests in the work report. These bytes come from canonical prepared work;
+   mutable task files in a checkout cannot replace them. Resolve referenced
+   project workflows/guides with the selected installed packages and record each
+   effective path and digest. A missing or conflicting required asset is a blocker.
+3. Run `--operation next`. Execute the returned current step, or start the returned
+   next step using `--operation step-start --step <number> --generation <observed>`.
+   The accepted root's children run in this already admitted worker; do not fork
+   another execution because a prepared root originated in a batch preset.
+4. After executing a step, write its bounded UTF-8 report and run
+   `--operation step-finish --step <number> --report <path> --generation <observed>`.
+   On an unrecoverable step failure, use `--operation fail --message <reason>
+   --generation <observed>`. Read `next` again after every acknowledged mutation.
+   Do not mark an unexecuted step successful. Nested skills may perform the work,
+   but their local Assign bookkeeping must not replace these canonical operations.
+5. When the scope is complete or failed, prepare an execution receipt and exact
+   artifact files using the receipt contract in the Lab usage documentation.
+   Its producer is the canonical start producer; HEAD is the actual committed
+   candidate; checks describe executed checks. Submit with `--operation result
+   --generation <observed> --receipt <json> --artifact <file>` in receipt order.
+   Submission is not terminal acceptance, merge, publication or installation.
+6. Keep the worker's native process and checkout available until the supervisor
+   accepts the result through `--operation adopt` and canonical `status` becomes
+   terminal. The filesystem watch emits only a hint. Never infer completion from
+   a quiet pane, a hint file, an old message or a send acknowledgement.
+
+Each mutation prints its retained original request path. After any lost reply,
+read canonical `status`/`next` first and use `--operation replay --request <path>`
+only for that original input. Preserve assignment, attempt, mutation, candidate
+and pane identities. Never edit an original request's generation or bytes. For a
+result/finish CAS refusal, reread canonical status. An accepted result replays its
+exact original input; an accepted terminal outcome needs no new finish. If no
+result/terminal was accepted and the attempt generation advanced, the original
+CAS can no longer accept: result/finish may retain a separate request at the new
+observed generation. The driver preserves all old inputs and performs these
+checks; unavailable status remains a blocker. Changed content, project or owner
+is not a generation retry, and never authorizes another worker.
+
+A supervisor installs the `watch_command` returned by `ace-overseer ordinary`
+exactly once in its native session, runs a harmless turn to persist it, and uses
+exact-session resume thereafter. Do not recreate an intentionally removed watch.
+A watch merely requests canonical inspection; recurring native progress audits
+also find accepted results when a wake or reply is lost. Wrong project/attempt
+hints carry no authority. Existing inbound Inbox settlement remains a separate
+owner configuration: without it, nonempty Inbox references refuse completion.
+
+After replacement of the coordinator process, read `--operation supervisor`.
+A new coordinator uses `--operation adopt-supervisor --pane <actual-pane>
+--generation <old-selection-generation> --previous-binding-sha256 <old-digest>`.
+The installed owner authenticates its actual placement and positively verifies
+that the original process generation ended. Live or unobservable old generations
+refuse adoption. Replay the original adoption request after a lost reply. This
+changes only the canonical supervisor selection; existing workers, uncertain
+launches, attempts, pending results and mutation IDs remain intact. Then resume
+canonical inspection and result adoption. Never re-register or relaunch workers
+because the coordinator restarted.
+
+**End of ordinary branch.** The remaining sections apply only to local assignment
+execution; do not enter them from an ordinary installed context.
+
 ## Assignment Context Propagation
 
 When working with multiple concurrent assignments, the active assignment is resolved in this order:

data/lib/ace/assign/atoms/candidate_limits.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+module Ace
+  module Assign
+    module Atoms
+      # Closed candidate-purpose budgets. Reports and release gems retain their
+      # separate bounds; callers cannot select a larger wire/storage ceiling.
+      module CandidateLimits
+        BYTES = 128 * 1024 * 1024
+        PREPARED_BYTES = 64 * 1024 * 1024
+        REVIEW_SNAPSHOT_BYTES = 64 * 1024 * 1024
+        # Explicit finite path shape (PATH_MAX/NAME_MAX-sized) so a hostile
+        # tree entry cannot push unbounded path bytes into inventories,
+        # filesystem prefix creation or per-component scans.
+        PATH_BYTES = 4096
+        PATH_COMPONENT_BYTES = 255
+      end
+    end
+  end
+end

data/lib/ace/assign/atoms/git_blob_batch.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+require "digest"
+
+module Ace
+  module Assign
+    module Atoms
+      # Git's fixed cat-file batch framing. Owners select process, immutable
+      # repository, deadline and byte/count limits before invoking this codec.
+      module GitBlobBatch
+        OID = /\A[0-9a-f]{40}\z/
+        class Invalid < StandardError
+          attr_reader :reason
+          def initialize(reason)
+            @reason = reason
+            super("invalid Git blob batch #{reason}")
+          end
+        end
+
+        def self.sizes(oids, output)
+          unless oids.is_a?(Array) && oids.all? { |oid| oid.is_a?(String) && OID.match?(oid) } && output.is_a?(String)
+            raise Invalid, :selector
+          end
+          lines = output.b.lines
+          raise Invalid, :count unless lines.size == oids.size
+          lines.zip(oids).map do |line, oid|
+            match = /\A([0-9a-f]{40}) blob (0|[1-9][0-9]*)\n\z/.match(line)
+            raise Invalid, :metadata unless match && match[1] == oid
+            match[2].to_i
+          end
+        end
+
+        def self.decode(entries, output)
+          unless entries.is_a?(Array) && entries.all? { |entry|
+              entry.is_a?(Array) && entry.size == 2 && entry[0].is_a?(String) && OID.match?(entry[0]) &&
+                entry[1].is_a?(Integer) && entry[1] >= 0 } && output.is_a?(String)
+            raise Invalid, :selector
+          end
+          output = output.b
+          offset = 0
+          entries.map do |oid, size|
+            ending = output.index("\n", offset)
+            unless ending && ending - offset <= 127 && output.byteslice(offset, ending - offset) == "#{oid} blob #{size}"
+              raise Invalid, :header
+            end
+            offset = ending + 1
+            content = output.byteslice(offset, size)
+            unless content&.bytesize == size && output.byteslice(offset + size, 1) == "\n" &&
+                Digest::SHA1.new.update("blob #{size}\0").update(content).hexdigest == oid
+              raise Invalid, :bytes
+            end
+            offset += size + 1
+            content
+          end.tap { raise Invalid, :trailing unless offset == output.bytesize }
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/candidate_blob_batch.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+require_relative "../atoms/git_blob_batch"
+
+module Ace
+  module Assign
+    module Authority
+      # Same cat-file batch dialect/codec as the canonical journal. Chunked
+      # bodies avoid retaining the entire expanded tree a second time.
+      module CandidateBlobBatch
+        BATCH_BYTES = 8 * 1024 * 1024
+        BATCH_OBJECTS = 512
+        MAX_OBJECTS = 20_000
+
+        private
+
+        def candidate_blob_sizes(repository, deadline, oids)
+          unless oids.is_a?(Array) && oids.size <= MAX_OBJECTS &&
+              oids.all? { |oid| oid.is_a?(String) && self.class::SHA.match?(oid) }
+            reject!("Candidate blob inventory is invalid or oversized")
+          end
+          oids.each_slice(64).flat_map do |slice|
+            raw = git(repository, deadline, "cat-file", "--batch-check", stdin_data: slice.join("\n") + "\n", limit: slice.size * 128)
+            Atoms::GitBlobBatch.sizes(slice, raw)
+          end
+        rescue Atoms::GitBlobBatch::Invalid => error
+          reject!("Candidate blob batch #{error.reason} differs")
+        end
+
+        def each_candidate_blob(repository, deadline, entries)
+          batch = []
+          bytes = 0
+          entries.each do |entry|
+            if !batch.empty? && (batch.size >= BATCH_OBJECTS || bytes + entry.last > BATCH_BYTES)
+              yield_candidate_blob_batch(repository, deadline, batch) { |oid, content| yield oid, content }
+              batch = []
+              bytes = 0
+            end
+            batch << entry
+            bytes += entry.last
+          end
+          yield_candidate_blob_batch(repository, deadline, batch) { |oid, content| yield oid, content } unless batch.empty?
+        end
+
+        def yield_candidate_blob_batch(repository, deadline, entries)
+          limit = entries.sum { |_oid, size| size + 128 }
+          raw = git(repository, deadline, "cat-file", "--batch", stdin_data: entries.map { |oid, _size| "#{oid}\n" }.join, limit: limit)
+          Atoms::GitBlobBatch.decode(entries, raw).zip(entries).each { |content, (oid, _size)| yield oid, content }
+        rescue Atoms::GitBlobBatch::Invalid => error
+          reject!("Candidate blob batch #{error.reason} differs")
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/candidate_head_comparison.rb

@@ -0,0 +1,139 @@
+# frozen_string_literal: true
+
+module Ace
+  module Assign
+    module Authority
+      # Compare retained Git objects in a private bare repository. Historical
+      # links are object bytes, never paths to materialize or follow. This view
+      # supplies evidence; it does not classify a change or grant acceptance.
+      # Host: CandidateTransfer supplies bounded Git/admission, byte encoding,
+      # private-root storage, monotonic deadlines and rejection helpers.
+      module CandidateHeadComparison
+        class ReadView
+          def initialize(owner:, repository:, reviewed:, candidate:, deadline:)
+            @owner, @repository, @reviewed, @candidate, @deadline = owner, repository, reviewed, candidate, deadline
+            @thread, @active = Thread.current, true
+          end
+
+          def close = @active = false
+
+          def context
+            unless @active && Thread.current.equal?(@thread)
+              raise AttemptErrors::EvidenceUnavailable, "head comparison escaped its source lifetime"
+            end
+            @owner.send(:head_comparison_context, @repository, @deadline, @reviewed, @candidate)
+          rescue Timeout::Error
+            raise AttemptErrors::EvidenceUnavailable, "head comparison deadline expired"
+          end
+        end
+
+        def with_head_comparison(before:, after:, before_base:, after_base:)
+          raise ArgumentError, "head comparison requires a block" unless block_given?
+          [before, after].each do |input|
+            unless input.is_a?(Hash) && input.keys.sort == %i[bytes head sha256 size tree] &&
+                input[:tree].is_a?(String) && input[:tree].match?(self.class::SHA)
+              reject!("Head comparison candidate binding is invalid")
+            end
+          end
+          [before_base, after_base].each do |base|
+            reject!("Head comparison base is invalid") unless base.is_a?(String) && base.match?(self.class::SHA)
+          end
+          deadline = monotonic + self.class::DEADLINE
+          # Each complete bundle is independently verified against an empty
+          # repository before either can contribute objects to the comparison.
+          admit(**before.reject { |key, _| key == :tree }, deadline: deadline) do |_old_repo, _old_deadline, reviewed|
+            reject!("Reviewed tree differs from accepted tree") unless reviewed.fetch("tree") == before[:tree]
+            admit(**after.reject { |key, _| key == :tree }, deadline: deadline) do |repository, _new_deadline, candidate|
+              reject!("Candidate tree differs from accepted tree") unless candidate.fetch("tree") == after[:tree]
+              Tempfile.create(["reviewed-", ".bundle"], @root) do |file|
+                file.binmode
+                file.write(reviewed.fetch("bundle")); file.flush
+                git(repository, deadline, "fetch", "--no-tags", file.path, "#{before[:head]}:refs/heads/reviewed")
+                reader = ReadView.new(owner: self, repository: repository,
+                  reviewed: {"head" => before[:head], "base" => before_base, "tree" => before[:tree]},
+                  candidate: {"head" => after[:head], "base" => after_base, "tree" => after[:tree]}, deadline: deadline)
+                yield reader
+              ensure
+                reader&.close
+              end
+            end
+          end
+        end
+
+        private
+
+        def head_comparison_context(repository, deadline, reviewed, candidate)
+          context = {"schema" => "ace.candidate-head-comparison/v1", "reviewed" => reviewed,
+            "candidate" => candidate, "inventories" => {}, "objects" => {}, "changes" => {}}
+          remaining = self.class::MAX_REVIEW_BYTES
+          {"reviewed_head" => reviewed["head"], "reviewed_base" => reviewed["base"],
+            "candidate_head" => candidate["head"], "candidate_base" => candidate["base"]}.each do |label, commit|
+            git(repository, deadline, "cat-file", "-e", "#{commit}^{commit}")
+            tree = git(repository, deadline, "rev-parse", "#{commit}^{tree}").strip
+            inventory = head_comparison_inventory(repository, deadline, tree)
+            remaining -= JSON.generate(inventory).bytesize
+            reject!("Complete head comparison context is oversized") if remaining.negative?
+            context.fetch("inventories")[label] = {"tree" => tree, "entries" => inventory}
+          end
+          oids = context.fetch("inventories").values.flat_map { |inventory| inventory.fetch("entries").map { |entry| entry.fetch("oid") } }.uniq
+          sizes = oids.zip(candidate_blob_sizes(repository, deadline, oids)).to_h
+          reject!("Complete head comparison object content is oversized") if sizes.values.sum > remaining
+          each_candidate_blob(repository, deadline, sizes.to_a) do |oid, content|
+            object = {"size" => content.bytesize, "sha256" => Digest::SHA256.hexdigest(content), "content" => review_bytes(content)}
+            remaining -= JSON.generate(object).bytesize
+            reject!("Complete head comparison context is oversized") if remaining.negative?
+            context.fetch("objects")[oid] = object
+          end
+          {"candidate_delta" => [reviewed["head"], candidate["head"]],
+            "base_delta" => [reviewed["base"], candidate["base"]],
+            "original_scope" => [reviewed["base"], reviewed["head"]],
+            "current_scope" => [candidate["base"], candidate["head"]]}.each do |label, revisions|
+            delta = head_comparison_delta(repository, deadline, revisions, remaining)
+            remaining -= JSON.generate(delta).bytesize
+            reject!("Complete head comparison context is oversized") if remaining.negative?
+            context.fetch("changes")[label] = delta
+          end
+          # Include structural JSON overhead in the final bound as well as all
+          # original bytes. No partial inventory or truncated patch is returned.
+          reject!("Complete head comparison context is oversized") if JSON.generate(context).bytesize > self.class::MAX_REVIEW_BYTES
+          context
+        rescue AttemptErrors::ReceiptRejected => error
+          reject!("Head comparison read failed: #{error.message}")
+        end
+
+        def head_comparison_inventory(repository, deadline, tree)
+          entries = git(repository, deadline, "ls-tree", "-r", "-z", tree, limit: self.class::MAX_BYTES).b.split("\0")
+          reject!("Complete head comparison inventory is oversized") if entries.size > self.class::MAX_OBJECTS
+          entries.map do |entry|
+            metadata, path = entry.split("\t", 2)
+            mode, kind, oid = metadata.to_s.split(" ")
+            # Inventory entries carry whole paths only; bound their bytes
+            # before JSON encoding or delta cross-checks consume them.
+            reject!("Complete head comparison path exceeds bounded length") unless path && !path.empty? &&
+              path.bytesize <= Atoms::CandidateLimits::PATH_BYTES
+            unless kind == "blob" && %w[100644 100755 120000].include?(mode) && oid&.match?(self.class::SHA)
+              reject!("Complete head comparison contains an unsupported Git entry")
+            end
+            {"path" => review_bytes(path), "mode" => mode, "oid" => oid}
+          end
+        end
+
+        def head_comparison_delta(repository, deadline, revisions, remaining)
+          options = ["--no-ext-diff", "--no-textconv", "--no-renames", "--ignore-submodules=none"]
+          patch = git(repository, deadline, "diff", *options, "--binary", "--full-index", "--src-prefix=a/", "--dst-prefix=b/",
+            *revisions, "--", limit: [remaining, 1].max).b
+          paths = git(repository, deadline, "diff", *options, "--name-only", "-z", *revisions, "--", limit: [remaining, 1].max).b.split("\0")
+          stats = git(repository, deadline, "diff", *options, "--numstat", "-z", *revisions, "--", limit: [remaining, 1].max).b.split("\0")
+          binary = stats.filter_map do |entry|
+            added, removed, path = entry.split("\t", 3)
+            reject!("Complete head comparison diff inventory is invalid") unless path && paths.include?(path)
+            path if added == "-" || removed == "-"
+          end
+          {"from" => revisions.first, "to" => revisions.last, "patch" => review_bytes(patch),
+            "patch_sha256" => Digest::SHA256.hexdigest(patch), "paths" => paths.map { |path| review_bytes(path) },
+            "binary_paths" => binary.map { |path| review_bytes(path) }}
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/candidate_transfer.rb

@@ -6,7 +6,11 @@ require "fileutils"
 require "tmpdir"
 require "tempfile"
 require "ace/herdr/molecules/bounded_process"
+require "ace/review/atoms/campaign_contract"
 require_relative "private_directory"
+require_relative "../atoms/candidate_limits"
+require_relative "candidate_head_comparison"
+require_relative "candidate_blob_batch"
 
 module Ace
   module Assign
@@ -14,8 +18,17 @@ module Ace
       # Untrusted bundles enter a clean bare quarantine. Only complete verified
       # objects are retained; no uploader configuration or worktree is read.
       class CandidateTransfer
-        MAX_BYTES = 64 * 1024 * 1024
-        DEADLINE = 30
+        include CandidateHeadComparison
+        include CandidateBlobBatch
+        MAX_BYTES = Atoms::CandidateLimits::BYTES
+        MAX_REVIEW_BYTES = Ace::Review::Atoms::CampaignContract::MAX_HEAD_CONTEXT_BYTES
+        # Measured on the real 82,809,675-byte candidate (9,203 entries,
+        # 71,583,200 expanded bytes): two full admits alone need ~14s of
+        # bounded Git work and the complete comparison ~23s on a loaded host
+        # (evidence in .ace-tasks/8xf.t.ei9-wave-3 evidence). 30s failed
+        # closed under legitimate load; 60s keeps a finite secondary guard
+        # with measured headroom. Inputs stay byte/count-bounded separately.
+        DEADLINE = 60
         SHA = /\A[0-9a-f]{40}\z/
 
         class CampaignReadView
@@ -165,20 +178,29 @@ module Ace
             File.chmod(0700, destination)
             begin
               entries = git(repository, deadline, "ls-tree", "-r", "-z", head, limit: MAX_BYTES).b.split("\0")
-              total = 0
-              links = []
-              entries.each do |entry|
+              reject!("Candidate file inventory is oversized") if entries.size > MAX_OBJECTS
+              parsed = entries.map do |entry|
                 metadata, path = entry.split("\t", 2)
                 mode, kind, oid = metadata.to_s.split(" ")
-                parts = path.to_s.split("/", -1)
-                unless path && !path.start_with?("/") &&
-                    parts.none? { |part| part.empty? || %w[. .. .git].include?(part.downcase) } &&
-                    kind == "blob" && %w[100644 100755 120000].include?(mode) && oid.match?(SHA)
+                # Total path bytes are bounded before any component or
+                # filesystem prefix work consumes them.
+                reject!("Candidate path exceeds bounded length") unless path && !path.start_with?("/") &&
+                  path.bytesize <= Atoms::CandidateLimits::PATH_BYTES
+                parts = path.split("/", -1)
+                unless parts.none? { |part| part.empty? || part.bytesize > Atoms::CandidateLimits::PATH_COMPONENT_BYTES ||
+                    %w[. .. .git].include?(part.downcase) } &&
+                    kind == "blob" && %w[100644 100755 120000].include?(mode) && oid&.match?(SHA)
                   reject!("Candidate contains unsafe filesystem entry")
                 end
-                content = git(repository, deadline, "cat-file", "blob", oid, limit: MAX_BYTES).b
-                total += content.bytesize
-                reject!("Candidate expanded content is oversized") if total > MAX_BYTES
+                [path, mode, oid]
+              end
+              by_oid = parsed.group_by(&:last)
+              sizes = by_oid.keys.zip(candidate_blob_sizes(repository, deadline, by_oid.keys)).to_h
+              reject!("Candidate expanded content is oversized") if parsed.sum { |_path, _mode, oid| sizes.fetch(oid) } > MAX_BYTES
+              links = []
+              ordered = parsed.each
+              each_candidate_blob(repository, deadline, parsed.map { |_path, _mode, oid| [oid, sizes.fetch(oid)] }) do |oid, content|
+                path, mode, _oid = ordered.next
                 target = File.join(destination, path)
                 FileUtils.mkdir_p(File.dirname(target), mode: 0700)
                 if mode == "120000"
@@ -242,7 +264,7 @@ module Ace
           result = materialize(bytes: bytes, sha256: sha256, size: size, head: head, tree: tree, root: root) do |path, mode, oid, content|
             entry = JSON.generate("path" => review_bytes(path), "mode" => mode, "oid" => oid, "content" => review_bytes(content))
             separator = first ? "" : ","
-            reject!("Complete candidate review snapshot is oversized") if subject.bytesize + separator.bytesize + entry.bytesize + 2 > MAX_BYTES
+            reject!("Complete candidate review snapshot is oversized") if subject.bytesize + separator.bytesize + entry.bytesize + 2 > Atoms::CandidateLimits::REVIEW_SNAPSHOT_BYTES
             subject << separator << entry
             first = false
           end
@@ -256,19 +278,26 @@ module Ace
         def prepared_files(repository:, deadline:, head:)
           entries = git(repository, deadline, "ls-tree", "-r", "-z", head, limit: MAX_BYTES).b.split("\0")
           reject!("Prepared file inventory is oversized") unless entries.size.between?(4, 4096)
-          total = 0
-          files = entries.to_h do |entry|
+          parsed = entries.map do |entry|
             metadata, path = entry.split("\t", 2)
             mode, kind, oid = metadata.to_s.split(" ")
-            unless path && mode == "100644" && kind == "blob" && oid.match?(SHA) &&
-                !path.start_with?("/") && path.split("/", -1).none? { |part| part.empty? || %w[. .. .git].include?(part.downcase) }
+            reject!("Prepared tree path exceeds bounded length") unless path && !path.start_with?("/") &&
+              path.bytesize <= Atoms::CandidateLimits::PATH_BYTES
+            unless mode == "100644" && kind == "blob" && oid&.match?(SHA) &&
+                path.split("/", -1).none? { |part| part.empty? || part.bytesize > Atoms::CandidateLimits::PATH_COMPONENT_BYTES ||
+                  %w[. .. .git].include?(part.downcase) }
               reject!("Prepared tree contains unsafe entry")
             end
-            size = git(repository, deadline, "cat-file", "-s", oid).strip
-            reject!("Prepared text is oversized") unless size.match?(/\A[0-9]+\z/) && size.to_i.between?(1, 1024 * 1024)
-            total += size.to_i
-            reject!("Prepared expanded content is oversized") if total > MAX_BYTES
-            [path, git(repository, deadline, "cat-file", "blob", oid, limit: 1024 * 1024).b]
+            [path, oid]
+          end
+          by_oid = parsed.group_by(&:last)
+          sizes = by_oid.keys.zip(candidate_blob_sizes(repository, deadline, by_oid.keys)).to_h
+          reject!("Prepared text is oversized") unless sizes.values.all? { |size| size.between?(1, 1024 * 1024) }
+          reject!("Prepared expanded content is oversized") if parsed.sum { |_path, oid| sizes.fetch(oid) } > Atoms::CandidateLimits::PREPARED_BYTES
+          files = {}
+          ordered = parsed.each
+          each_candidate_blob(repository, deadline, parsed.map { |_path, oid| [oid, sizes.fetch(oid)] }) do |_oid, content|
+            files[ordered.next.first] = content
           end
           reject!("Prepared inventory has duplicate paths") unless files.size == entries.size
           files
@@ -289,18 +318,19 @@ module Ace
           PrivateDirectory.verify!(@root)
         end
 
-        def git(repository, deadline, *arguments, limit: 65_536)
+        def git(repository, deadline, *arguments, limit: 65_536, stdin_data: "")
           remaining = deadline - monotonic
           raise Timeout::Error if remaining <= 0
           # Git variables may redirect object/config storage even in a clean
           # repository. Strip every inherited Git setting and global config.
           environment = ENV.keys.to_h { |key| [key, nil] }
           environment.merge!("GIT_CONFIG_NOSYSTEM" => "1", "GIT_CONFIG_GLOBAL" => "/dev/null",
+            "GIT_ATTR_NOSYSTEM" => "1",
             "GIT_TERMINAL_PROMPT" => "0", "GIT_ALLOW_PROTOCOL" => "file",
             "GIT_NO_REPLACE_OBJECTS" => "1", "PATH" => "/usr/bin:/bin", "LC_ALL" => "C")
           result = Herdr::Molecules::BoundedProcess.call([environment, "/usr/bin/git", "-C", repository,
-            "-c", "core.hooksPath=/dev/null", "-c", "protocol.file.allow=always", *arguments],
-            stdin_data: "", timeout_s: remaining, output_limit: limit)
+            "-c", "core.hooksPath=/dev/null", "-c", "core.attributesFile=/dev/null", "-c", "protocol.file.allow=always", *arguments],
+            stdin_data: stdin_data, timeout_s: remaining, output_limit: limit)
           reject!("Candidate Git verification failed") unless result.status.success? && !result.oversized
           result.stdout
         end