ace-assign 0.70.0 → 0.71.0

data/lib/ace/assign/authority/command_execution.rb

@@ -0,0 +1,180 @@
+# frozen_string_literal: true
+
+require "json"
+require "digest"
+require_relative "../molecules/evidence_journal"
+
+module Ace
+  module Assign
+    module Authority
+      # Project commands share the installed journal, without manufacturing a
+      # managed task or projecting command exit as completed product delivery.
+      class CommandExecution
+        OPERATIONS = %w[command_admit command_status command_claim command_bind command_complete].freeze
+        ID = /\A[a-zA-Z0-9][a-zA-Z0-9_.-]{0,63}\z/
+        SHA = /\A[0-9a-f]{64}\z/
+
+        def initialize(project:, journal:, admission:)
+          @project, @journal, @admission = project, journal, admission
+        end
+
+        attr_reader :journal
+
+        def dispatch(request:, peer:, role:, deadline:)
+          operation = request.fetch("operation")
+          params = request.fetch("params")
+          raise ArgumentError, "invalid command project" unless request.fetch("project_id") == @project
+          id = params.fetch("execution_id")
+          raise ArgumentError, "invalid command reference" unless id.is_a?(String) && ID.match?(id)
+          if operation == "command_status"
+            strict!(params, %w[execution_id])
+            raise ArgumentError, "status mutation must be null" unless request.fetch("mutation_id").nil?
+            commit = @journal.ref_value
+            data = projection(id, commit)
+            @admission.command_reader!(peer: peer, definition: data.fetch("definition"), deadline: deadline)
+            return {data: data.merge("journal_commit" => commit), replayed: false}
+          end
+          strict!(params, case operation
+          when "command_admit" then %w[execution_id selection]
+          when "command_claim" then %w[execution_id caller]
+          when "command_bind" then %w[execution_id child]
+          when "command_complete" then %w[execution_id result]
+          else raise ArgumentError, "unknown command operation"
+          end)
+          authenticated_peer = peer
+          launcher = nil
+          plan = if operation == "command_admit"
+            @admission.command_request!(selection: params.fetch("selection"), peer: peer, deadline: deadline)
+          else
+            launcher = @admission.command_launcher!(peer: authenticated_peer, deadline: deadline)
+            nil
+          end
+          authenticate = lambda do
+            if operation == "command_admit"
+              unless @admission.command_request!(selection: params.fetch("selection"), peer: peer, deadline: deadline) == plan
+                raise AttemptErrors::UnauthorizedIdentity, "command admission changed"
+              end
+            else
+              unless @admission.command_launcher!(peer: authenticated_peer, deadline: deadline) == launcher
+                raise AttemptErrors::UnauthorizedIdentity, "installed command launcher changed"
+              end
+            end
+          end
+          peer = launcher if launcher
+          expected = {"command_admit" => 0, "command_claim" => 1, "command_bind" => 2, "command_complete" => 3}.fetch(operation)
+          digest = Atoms::EvidenceDigest.digest({"project" => @project, "params" => params, "peer" => peer, "plan" => plan})
+          @journal.mutate(assignment_id: namespace(id), attempt_id: namespace(id),
+            mutation_id: request.fetch("mutation_id"), operation: operation, parameters_digest: digest,
+            expected_generation: expected, with_replay: true, deadline: deadline,
+            replay_authorizer: authenticate) do |_events, commit, _generation|
+            authenticate.call
+            prior = projection(id, commit, missing: true)
+            data = transition(operation, id, params, plan, prior, peer, deadline)
+            {events: [], data: data}
+          end
+        end
+
+        # Read only the accepted launcher-owned four-stage execution at the
+        # caller's held CAS prefix. Arbitrary allowed commands are not tests.
+        def test_evidence_at!(execution_id:, commit:, head:, tree:, deadline:)
+          unless execution_id.is_a?(String) && ID.match?(execution_id) && commit && @journal.ref_value == commit
+            raise AttemptErrors::EvidenceUnavailable, "test execution prefix or selector differs"
+          end
+          data = projection(execution_id, commit)
+          definition = data.fetch("definition")
+          events = @journal.read_events(namespace(execution_id), commit: commit)
+          accepted = events.select { |event| event["type"] == "authority_mutation" }
+          stages = accepted.map { |event| event.fetch("payload").fetch("data") }
+          unless accepted.size == 4 && data["phase"] == "exited" && data["result"] == {"exit_status" => 0, "signal" => nil} &&
+              definition["purpose"] == "test" && definition["source"] == {"head" => head, "tree" => tree} &&
+              [head, tree].all? { |value| value.is_a?(String) && value.match?(/\A[0-9a-f]{40}\z/) } &&
+              stages.all? { |stage| stage.fetch("definition") == definition } &&
+              stages.map { |stage| stage.fetch("phase") } == %w[admitted claimed running exited] &&
+              stages.drop(1).all? { |stage| stage.fetch("launcher") == data.fetch("launcher") } &&
+              stages[2].fetch("child") == data.fetch("child") && data.dig("launcher", "uid") == 0 &&
+              data.dig("child", "witnessed_by") == data.fetch("launcher") &&
+              data.dig("child", "kernel_identity") == data.dig("child", "root_witness")&.slice("pid", "uid", "started_at", "host") &&
+              data.dig("child", "root_witness", "cwd") == definition.dig("executor", "cwd") &&
+              data.dig("child", "kernel_identity", "uid") == definition.dig("executor", "uid")
+            raise AttemptErrors::ReceiptRejected, "candidate requires an exact successful executed test command"
+          end
+          @admission.command_test_evidence!(definition: definition, deadline: deadline)
+          command = JSON.generate(definition.fetch("argv"))
+          raise AttemptErrors::ReceiptRejected, "executed test command reference is oversized" if command.bytesize > 2048
+          {"schema" => "ace.test.execution-reference/v1", "reference" => execution_id,
+            "candidate_head" => head, "command" => command, "result" => "passed",
+            "recorded_at" => accepted.last.fetch("recorded_at"), "receipt_sha256" => Atoms::EvidenceDigest.digest(data)}
+        rescue KeyError, TypeError
+          raise AttemptErrors::EvidenceUnavailable, "canonical test execution is incomplete"
+        end
+
+        private
+
+        def transition(operation, id, params, plan, prior, peer, deadline)
+          base = {"schema" => "project-command/v1", "execution_id" => id, "project_id" => @project}
+          case operation
+          when "command_admit"
+            raise AttemptErrors::Conflict, "command already admitted" if prior
+            # Plan contains references and nonsecret context; its closed schema
+            # is owned by the installed Lab admission, never requester input.
+            base.merge("phase" => "admitted", "definition" => plan)
+          when "command_claim"
+            phase!(prior, "admitted")
+            @admission.command_claim!(definition: prior.fetch("definition"), caller: params.fetch("caller"),
+              launcher: peer, deadline: deadline)
+            prior.merge("phase" => "claimed", "launcher" => peer)
+          when "command_bind"
+            phase!(prior, "claimed")
+            launcher!(prior, peer)
+            child = @admission.command_child!(definition: prior.fetch("definition"), child: params.fetch("child"),
+              launcher: peer, deadline: deadline)
+            prior.merge("phase" => "running", "child" => child)
+          when "command_complete"
+            phase!(prior, "running")
+            launcher!(prior, peer)
+            result = params.fetch("result")
+            strict!(result, %w[exit_status signal])
+            exit_status, signal = result.values_at("exit_status", "signal")
+            unless (exit_status.is_a?(Integer) && exit_status.between?(0, 255) && signal.nil?) ||
+                (exit_status.nil? && signal.is_a?(Integer) && signal.between?(1, 127))
+              raise ArgumentError, "invalid command termination"
+            end
+            prior.merge("phase" => "exited", "result" => result)
+          end
+        end
+
+        def projection(id, commit, missing: false)
+          events = @journal.read_events(namespace(id), commit: commit)
+          unless Models::EvidenceEvent.chain_valid?(events)
+            raise AttemptErrors::EvidenceUnavailable, "command history is corrupt"
+          end
+          accepted = events.select { |event| event["type"] == "authority_mutation" }
+          if accepted.empty?
+            return nil if missing
+            raise AttemptErrors::NotFound, "command reference is unknown"
+          end
+          operations = accepted.map { |event| event.dig("payload", "operation") }
+          unless operations == OPERATIONS.reject { |name| name == "command_status" }.take(operations.size) && operations.size <= 4
+            raise AttemptErrors::EvidenceUnavailable, "command lifecycle is corrupt"
+          end
+          data = accepted.last.fetch("payload").fetch("data")
+          unless data.values_at("schema", "project_id", "execution_id") == ["project-command/v1", @project, id]
+            raise AttemptErrors::EvidenceUnavailable, "command association differs"
+          end
+          data
+        end
+
+        def namespace(id) = "command-#{id}"
+        def strict!(value, keys)
+          raise ArgumentError, "invalid command fields" unless value.is_a?(Hash) && value.keys.sort == keys.sort
+        end
+        def phase!(prior, phase)
+          raise AttemptErrors::Conflict, "command phase differs; inspect original execution" unless prior && prior["phase"] == phase
+        end
+        def launcher!(prior, peer)
+          raise AttemptErrors::UnauthorizedIdentity, "command launcher changed" unless prior.fetch("launcher") == peer
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/endcap.rb

@@ -294,7 +294,7 @@ module Ace
               data.fetch("head") == params.fetch("head")
             raise AttemptErrors::EvidenceUnavailable, "candidate replay provenance differs"
           end
-          bytes = journal.bounded_blob(data.fetch("bundle_ref"), commit: replay.fetch("journal_commit"), max_bytes: 64 * 1024 * 1024)
+          bytes = journal.bounded_blob(data.fetch("bundle_ref"), commit: replay.fetch("journal_commit"), max_bytes: CandidateTransfer::MAX_BYTES)
           unless bytes.bytesize == data.fetch("bytes") && Digest::SHA256.hexdigest(bytes) == data.fetch("sha256")
             raise AttemptErrors::EvidenceUnavailable, "candidate replay bundle differs"
           end
@@ -434,7 +434,9 @@ module Ace
   end
 end
 
-require_relative "endcap_services"
+require_relative "fixed_service_lifecycle"
+require_relative "fixed_publication_lifecycle"
+require_relative "endcap_service_context"
 require_relative "endcap_service_settlement"
 
 require_relative "endcap_campaign_results"

data/lib/ace/assign/authority/endcap_campaign_rounds.rb

@@ -37,7 +37,7 @@ module Ace
         end
 
         def with_campaign_receipt!(journal:, commit:, events:, params:, map:, receipt:, result:, historical:)
-          unless result.is_a?(Hash) && result["schema"] == "ace.review.accepted-result/v1" &&
+          unless result.is_a?(Hash) && result["schema"] == "ace.review.accepted-result/v2" &&
               receipt["campaign"].is_a?(Hash) && receipt["campaign"].keys.sort == %w[id result] &&
               receipt["operation"] == "review" && receipt["verdict"] == "succeeded"
             raise AttemptErrors::ReceiptRejected, "parent campaign receipt differs"

data/lib/ace/assign/authority/endcap_publication.rb

@@ -35,172 +35,6 @@ module Ace
           end
         end
 
-        def publication_executor_identity?(project:, uid:)
-          @deployment.project(project).fetch("service_executor_uids").include?(uid)
-        end
-
-        def with_publication_hitl!(binding:, project:, peer:)
-          params = binding.slice("mapping_id", "assignment_id", "attempt_id", "request_id", "claim_binding", "input_digest", "candidate_generation", "head")
-          map = @deployment.mapping(params.fetch("mapping_id"))
-          raise AttemptErrors::UnauthorizedIdentity, "publication project differs" unless map.fetch("project_id") == project
-          @launch.with_assignment(params: params, map: map) do |journal, _registration|
-            protected_journal!(journal)
-            record = publication_record!(journal, params, map, peer, :executor)
-            unless record["dispatch_phase"] == "otp_pending" && record["publication_challenge_digest"] == binding.fetch("challenge_digest")
-              raise AttemptErrors::Conflict, "publication HITL challenge is no longer pending"
-            end
-            ServiceEvidence.new(journal: journal).publication_challenge!(record)
-            selection = settlement_immutable({"executor_process_binding" => record.fetch("executor_process_binding"),
-              "challenge_ref" => record.fetch("publication_challenge_ref").fetch("ref")})
-            yield selection
-          end
-        end
-
-        def authorize_publication_update!(journal:, existing:, replacement:, pending:)
-          operation = pending.fetch(:operation)
-          allowed = ServicePublicationEvidence::PUBLICATION_FIELDS + ["dispatch_phase"]
-          unless existing.except(*allowed) == replacement.except(*allowed) && existing["state"] == "uncertain"
-            raise AttemptErrors::InvalidState, "publication transition changed original binding"
-          end
-          owner = ServiceEvidence.new(journal: journal)
-          if operation == "publication_challenge"
-            unless %w[dispatch_started issuing].include?(existing["dispatch_phase"]) && replacement["dispatch_phase"] == "otp_pending" &&
-                replacement["publication_issuing_event_digest"] == existing["publication_issuing_event_digest"]
-              raise AttemptErrors::InvalidState, "publication need has no source-owned rejected push"
-            end
-            need = owner.publication_challenge!(replacement, pending: pending)
-            unless need["previous_challenge_digest"] == existing["publication_challenge_digest"]
-              raise AttemptErrors::InvalidState, "publication need predecessor differs"
-            end
-          elsif operation == "publication_continue"
-            unless existing["dispatch_phase"] == "otp_pending" && replacement["dispatch_phase"] == "issuing" &&
-                (allowed - %w[dispatch_phase publication_issuing_event_digest]).all? { |key| existing[key] == replacement[key] }
-              raise AttemptErrors::InvalidState, "publication continuation is not a unique pending challenge"
-            end
-            owner.publication_challenge!(replacement, pending: pending)
-            events = pending.fetch(:current_events) + pending.fetch(:pending_events)
-            event = events.find { |row| row["digest"] == replacement["publication_issuing_event_digest"] }
-            unless event && event["type"] == "service_publication_issuing" &&
-                %w[request_id input_digest claim_binding publication_challenge_digest].all? { |key| event.dig("payload", key) == replacement[key] }
-              raise AttemptErrors::EvidenceUnavailable, "publication issuing event is unavailable"
-            end
-          else
-            raise AttemptErrors::InvalidState, "publication transition has no fixed source owner"
-          end
-          true
-        end
-
-        def publication_record!(journal, params, map, peer, role, events: nil)
-          record = journal.service_request(params.fetch("request_id"))
-          unless record && record["operation"] == "publish" && record["state"] == "uncertain" &&
-              %w[dispatch_started otp_pending issuing].include?(record["dispatch_phase"]) &&
-              %w[claim_binding input_digest candidate_generation].all? { |key| record[key] == params[key] } &&
-              record["candidate_head"] == params["head"] && record["mapping_id"] == params["mapping_id"]
-            raise AttemptErrors::Conflict, "publication original tuple or phase differs"
-          end
-          service_executor!(peer, role, record)
-          service_ticket!(record, params, map, peer)
-          events ||= attempt_events(journal, params)
-          current = exact_candidate!(candidate(events), params)
-          origin = active_origin(events, params)
-          worker_or_launcher!(record.fetch("worker_process_binding"), :worker, map, origin)
-          approved_review!(journal, events, params, map, current)
-          @launch.scope_open_for_effect!(events: events, params: params, map: map)
-          service_policy!.authorize!(record)
-          ServiceEvidence.new(journal: journal).context(record)
-          record
-        end
-
-        def authorize_publication_transfer!(request, params, map, peer, role)
-          @launch.with_assignment(params: params, map: map) do |journal, _registration|
-            protected_journal!(journal)
-            publication_record!(journal, params, map, peer, role)
-          end
-          true
-        end
-
-        def dispatch_publication(request, params, map, peer, role, transfer)
-          authorize_publication_transfer!(request, params, map, peer, role)
-          challenge = request.fetch("operation") == "publication_challenge"
-          bytes = nil
-          if challenge
-            unless transfer && transfer.count == 1
-              raise ArgumentError, "publication need requires one bounded artifact"
-            end
-            bytes = transfer.bytes.dup.freeze
-            unless Digest::SHA256.hexdigest(bytes) == params.fetch("receipt_sha256")
-              raise AttemptErrors::ReceiptRejected, "publication need transfer digest differs"
-            end
-          elsif transfer
-            raise ArgumentError, "publication continuation forbids upload"
-          end
-          @launch.with_assignment(params: params, map: map) do |journal, _registration|
-            publication_record!(journal, params, map, peer, role)
-            result = journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
-              mutation_id: request.fetch("mutation_id"), operation: request.fetch("operation"),
-              parameters_digest: Atoms::EvidenceDigest.digest(params), expected_generation: params.fetch("expected_generation"),
-              with_replay: true) do |events, _commit, generation|
-              record = publication_record!(journal, params, map, peer, role, events: events)
-              if challenge
-                publication_challenge_plan(journal, events, record, params, bytes, generation)
-              else
-                publication_continue_plan(journal, events, record, params, generation)
-              end
-            end
-            if !challenge && result.fetch(:replayed)
-              result = result.merge(data: result.fetch(:data).merge("invocation" => "already_issued"))
-            end
-            result
-          end
-        end
-
-        def publication_challenge_plan(journal, events, record, params, bytes, generation)
-          owner = ServiceEvidence.new(journal: journal)
-          digest = Digest::SHA256.hexdigest(bytes)
-          if record["dispatch_phase"] == "otp_pending"
-            owner.publication_challenge!(record)
-            raise AttemptErrors::Conflict, "publication pending challenge differs" unless record["publication_challenge_digest"] == digest
-            return {data: service_projection(record).merge("challenge" => "retained")}
-          end
-          unless %w[dispatch_started issuing].include?(record["dispatch_phase"])
-            raise AttemptErrors::InvalidState, "publication has no rejected push"
-          end
-          previous = record["publication_challenge_digest"]
-          owner.publication_challenge!(record) if previous
-          owner.publication_need!(bytes, record, previous: previous)
-          payload = record.slice("request_id", "input_digest", "claim_binding").merge(
-            "challenge_digest" => digest, "previous_challenge_digest" => previous, "generation" => generation + 1)
-          time = Time.now.utc
-          event = Models::EvidenceEvent.build(type: "service_publication_challenge", attempt_id: record.fetch("attempt_id"),
-            payload: payload, previous_digest: events.last&.fetch("digest"), recorded_at: time)
-          plan = Molecules::CanonicalEvidence.new(journal: journal).import_plan(**owner.context(record),
-            artifacts: [bytes], admitted_after_event_digest: event.fetch("digest"))
-          replacement = record.merge("dispatch_phase" => "otp_pending", "publication_challenge_digest" => digest,
-            "publication_challenge_ref" => plan.fetch(:references).fetch(0),
-            "publication_challenge_event_digest" => event.fetch("digest"), "publication_challenge_generation" => generation + 1)
-          plan.merge(events: [{type: "service_publication_challenge", payload: payload, recorded_at: time}] + plan.fetch(:events),
-            data: service_projection(replacement).merge("challenge" => "created"), service_updates: [{request_id: record.fetch("request_id"),
-              expected: record, replacement: replacement, event_type: "service_transition"}])
-        end
-
-        def publication_continue_plan(journal, events, record, params, generation)
-          ServiceEvidence.new(journal: journal).publication_challenge!(record)
-          unless record["publication_challenge_digest"] == params.fetch("challenge_digest")
-            raise AttemptErrors::Conflict, "publication continuation challenge differs"
-          end
-          if record["dispatch_phase"] == "issuing"
-            return {data: service_projection(record).merge("invocation" => "already_issued")}
-          end
-          raise AttemptErrors::InvalidState, "publication is not pending" unless record["dispatch_phase"] == "otp_pending"
-          payload = record.slice("request_id", "input_digest", "claim_binding", "publication_challenge_digest").merge("generation" => generation + 1)
-          time = Time.now.utc
-          event = Models::EvidenceEvent.build(type: "service_publication_issuing", attempt_id: record.fetch("attempt_id"),
-            payload: payload, previous_digest: events.last&.fetch("digest"), recorded_at: time)
-          replacement = record.merge("dispatch_phase" => "issuing", "publication_issuing_event_digest" => event.fetch("digest"))
-          {events: [{type: "service_publication_issuing", payload: payload, recorded_at: time}],
-            data: service_projection(replacement).merge("invocation" => "permitted"), service_updates: [{request_id: record.fetch("request_id"),
-              expected: record, replacement: replacement, event_type: "service_transition"}]}
-        end
       end
     end
   end

data/lib/ace/assign/authority/endcap_service_context.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+module Ace
+  module Assign
+    module Authority
+      # Protected admission remains here. The shared fixed service transitions
+      # never manufacture a Deployment mapping or a protected launch origin.
+      class Endcap
+        include FixedServiceLifecycle
+        include FixedPublicationLifecycle
+
+        private
+
+        def with_service_scope(**options, &block) = @launch.with_assignment(**options, &block)
+        def service_journal!(journal) = protected_journal!(journal)
+        def service_mapping!(id) = @deployment.mapping(id)
+        def service_project!(id) = @deployment.project(id)
+        def service_scope_open!(**options) = @launch.scope_open_for_effect!(**options)
+        def service_preview_events!(**options) = @launch.preview_attempt_events!(**options)
+        def service_origin!(events, params) = active_origin(events, params)
+
+        def service_origin_fields!(origin)
+          {"worker_process_binding" => origin.fetch("process_binding").fetch("process_identity"),
+            "launch_ticket" => origin.fetch("launch_ticket"),
+            "reservation_generation" => origin.fetch("reservation_generation")}
+        end
+
+        def service_origin_matches!(record, origin)
+          expected = service_origin_fields!(origin)
+          record.slice(*expected.keys) == expected
+        end
+
+        def service_worker!(*args, **options) = worker_or_launcher!(*args, **options)
+        def service_review!(*args, **options) = approved_review!(*args, **options)
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/fixed_publication_lifecycle.rb

@@ -0,0 +1,176 @@
+# frozen_string_literal: true
+
+module Ace
+  module Assign
+    module Authority
+      module FixedPublicationLifecycle
+        def publication_executor_identity?(project:, uid:)
+          service_project!(project).fetch("service_executor_uids").include?(uid)
+        end
+
+        def with_publication_hitl!(binding:, project:, peer:)
+          params = binding.slice("mapping_id", "assignment_id", "attempt_id", "request_id", "claim_binding", "input_digest", "candidate_generation", "head")
+          map = service_mapping!(params.fetch("mapping_id"))
+          raise AttemptErrors::UnauthorizedIdentity, "publication project differs" unless map.fetch("project_id") == project
+          with_service_scope(params: params, map: map) do |journal, _registration|
+            service_journal!(journal)
+            record = publication_record!(journal, params, map, peer, :executor)
+            unless record["dispatch_phase"] == "otp_pending" && record["publication_challenge_digest"] == binding.fetch("challenge_digest")
+              raise AttemptErrors::Conflict, "publication HITL challenge is no longer pending"
+            end
+            ServiceEvidence.new(journal: journal).publication_challenge!(record)
+            selection = settlement_immutable({"executor_process_binding" => record.fetch("executor_process_binding"),
+              "challenge_ref" => record.fetch("publication_challenge_ref").fetch("ref")})
+            yield selection
+          end
+        end
+
+        def authorize_publication_update!(journal:, existing:, replacement:, pending:)
+          operation = pending.fetch(:operation)
+          allowed = ServicePublicationEvidence::PUBLICATION_FIELDS + ["dispatch_phase"]
+          unless existing.except(*allowed) == replacement.except(*allowed) && existing["state"] == "uncertain"
+            raise AttemptErrors::InvalidState, "publication transition changed original binding"
+          end
+          owner = ServiceEvidence.new(journal: journal)
+          if operation == "publication_challenge"
+            unless %w[dispatch_started issuing].include?(existing["dispatch_phase"]) && replacement["dispatch_phase"] == "otp_pending" &&
+                replacement["publication_issuing_event_digest"] == existing["publication_issuing_event_digest"]
+              raise AttemptErrors::InvalidState, "publication need has no source-owned rejected push"
+            end
+            need = owner.publication_challenge!(replacement, pending: pending)
+            unless need["previous_challenge_digest"] == existing["publication_challenge_digest"]
+              raise AttemptErrors::InvalidState, "publication need predecessor differs"
+            end
+          elsif operation == "publication_continue"
+            unless existing["dispatch_phase"] == "otp_pending" && replacement["dispatch_phase"] == "issuing" &&
+                (allowed - %w[dispatch_phase publication_issuing_event_digest]).all? { |key| existing[key] == replacement[key] }
+              raise AttemptErrors::InvalidState, "publication continuation is not a unique pending challenge"
+            end
+            owner.publication_challenge!(replacement, pending: pending)
+            events = pending.fetch(:current_events) + pending.fetch(:pending_events)
+            event = events.find { |row| row["digest"] == replacement["publication_issuing_event_digest"] }
+            unless event && event["type"] == "service_publication_issuing" &&
+                %w[request_id input_digest claim_binding publication_challenge_digest].all? { |key| event.dig("payload", key) == replacement[key] }
+              raise AttemptErrors::EvidenceUnavailable, "publication issuing event is unavailable"
+            end
+          else
+            raise AttemptErrors::InvalidState, "publication transition has no fixed source owner"
+          end
+          true
+        end
+
+        def publication_record!(journal, params, map, peer, role, events: nil)
+          record = journal.service_request(params.fetch("request_id"))
+          unless record && record["operation"] == "publish" && record["state"] == "uncertain" &&
+              %w[dispatch_started otp_pending issuing].include?(record["dispatch_phase"]) &&
+              %w[claim_binding input_digest candidate_generation].all? { |key| record[key] == params[key] } &&
+              record["candidate_head"] == params["head"] && record["mapping_id"] == params["mapping_id"]
+            raise AttemptErrors::Conflict, "publication original tuple or phase differs"
+          end
+          service_executor!(peer, role, record)
+          service_ticket!(record, params, map, peer)
+          events ||= attempt_events(journal, params)
+          current = exact_candidate!(candidate(events), params)
+          origin = service_origin!(events, params)
+          service_worker!(record.fetch("worker_process_binding"), :worker, map, origin)
+          service_review!(journal, events, params, map, current)
+          service_scope_open!(events: events, params: params, map: map)
+          service_policy!.authorize!(record)
+          ServiceEvidence.new(journal: journal).context(record)
+          record
+        end
+
+        def authorize_publication_transfer!(request, params, map, peer, role)
+          with_service_scope(params: params, map: map) do |journal, _registration|
+            service_journal!(journal)
+            publication_record!(journal, params, map, peer, role)
+          end
+          true
+        end
+
+        def dispatch_publication(request, params, map, peer, role, transfer)
+          authorize_publication_transfer!(request, params, map, peer, role)
+          challenge = request.fetch("operation") == "publication_challenge"
+          bytes = nil
+          if challenge
+            unless transfer && transfer.count == 1
+              raise ArgumentError, "publication need requires one bounded artifact"
+            end
+            bytes = transfer.bytes.dup.freeze
+            unless Digest::SHA256.hexdigest(bytes) == params.fetch("receipt_sha256")
+              raise AttemptErrors::ReceiptRejected, "publication need transfer digest differs"
+            end
+          elsif transfer
+            raise ArgumentError, "publication continuation forbids upload"
+          end
+          with_service_scope(params: params, map: map) do |journal, _registration|
+            publication_record!(journal, params, map, peer, role)
+            result = journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
+              mutation_id: request.fetch("mutation_id"), operation: request.fetch("operation"),
+              parameters_digest: Atoms::EvidenceDigest.digest(params), expected_generation: params.fetch("expected_generation"),
+              with_replay: true) do |events, _commit, generation|
+              record = publication_record!(journal, params, map, peer, role, events: events)
+              if challenge
+                publication_challenge_plan(journal, events, record, params, bytes, generation)
+              else
+                publication_continue_plan(journal, events, record, params, generation)
+              end
+            end
+            if !challenge && result.fetch(:replayed)
+              result = result.merge(data: result.fetch(:data).merge("invocation" => "already_issued"))
+            end
+            result
+          end
+        end
+
+        def publication_challenge_plan(journal, events, record, params, bytes, generation)
+          owner = ServiceEvidence.new(journal: journal)
+          digest = Digest::SHA256.hexdigest(bytes)
+          if record["dispatch_phase"] == "otp_pending"
+            owner.publication_challenge!(record)
+            raise AttemptErrors::Conflict, "publication pending challenge differs" unless record["publication_challenge_digest"] == digest
+            return {data: service_projection(record).merge("challenge" => "retained")}
+          end
+          unless %w[dispatch_started issuing].include?(record["dispatch_phase"])
+            raise AttemptErrors::InvalidState, "publication has no rejected push"
+          end
+          previous = record["publication_challenge_digest"]
+          owner.publication_challenge!(record) if previous
+          owner.publication_need!(bytes, record, previous: previous)
+          payload = record.slice("request_id", "input_digest", "claim_binding").merge(
+            "challenge_digest" => digest, "previous_challenge_digest" => previous, "generation" => generation + 1)
+          time = Time.now.utc
+          event = Models::EvidenceEvent.build(type: "service_publication_challenge", attempt_id: record.fetch("attempt_id"),
+            payload: payload, previous_digest: events.last&.fetch("digest"), recorded_at: time)
+          plan = Molecules::CanonicalEvidence.new(journal: journal).import_plan(**owner.context(record),
+            artifacts: [bytes], admitted_after_event_digest: event.fetch("digest"))
+          replacement = record.merge("dispatch_phase" => "otp_pending", "publication_challenge_digest" => digest,
+            "publication_challenge_ref" => plan.fetch(:references).fetch(0),
+            "publication_challenge_event_digest" => event.fetch("digest"), "publication_challenge_generation" => generation + 1)
+          plan.merge(events: [{type: "service_publication_challenge", payload: payload, recorded_at: time}] + plan.fetch(:events),
+            data: service_projection(replacement).merge("challenge" => "created"), service_updates: [{request_id: record.fetch("request_id"),
+              expected: record, replacement: replacement, event_type: "service_transition"}])
+        end
+
+        def publication_continue_plan(journal, events, record, params, generation)
+          ServiceEvidence.new(journal: journal).publication_challenge!(record)
+          unless record["publication_challenge_digest"] == params.fetch("challenge_digest")
+            raise AttemptErrors::Conflict, "publication continuation challenge differs"
+          end
+          if record["dispatch_phase"] == "issuing"
+            return {data: service_projection(record).merge("invocation" => "already_issued")}
+          end
+          raise AttemptErrors::InvalidState, "publication is not pending" unless record["dispatch_phase"] == "otp_pending"
+          payload = record.slice("request_id", "input_digest", "claim_binding", "publication_challenge_digest").merge("generation" => generation + 1)
+          time = Time.now.utc
+          event = Models::EvidenceEvent.build(type: "service_publication_issuing", attempt_id: record.fetch("attempt_id"),
+            payload: payload, previous_digest: events.last&.fetch("digest"), recorded_at: time)
+          replacement = record.merge("dispatch_phase" => "issuing", "publication_issuing_event_digest" => event.fetch("digest"))
+          {events: [{type: "service_publication_issuing", payload: payload, recorded_at: time}],
+            data: service_projection(replacement).merge("invocation" => "permitted"), service_updates: [{request_id: record.fetch("request_id"),
+              expected: record, replacement: replacement, event_type: "service_transition"}]}
+        end
+      end
+    end
+  end
+end