ace-assign 0.70.0 → 0.71.0

data/lib/ace/assign/authority/{endcap_services.rb → fixed_service_lifecycle.rb}

@@ -3,7 +3,7 @@
 module Ace
   module Assign
     module Authority
-      class Endcap
+      module FixedServiceLifecycle
         SERVICE_IDENTITY = %w[request_id assignment_id attempt_id project_id operation input_digest target
           authorization service_id caller_uid candidate_head candidate_generation executor_uid transport policy_digest
           worker_process_binding launch_ticket reservation_generation mapping_id].freeze
@@ -17,7 +17,7 @@ module Ace
         end
 
         def service_settlement_evidence!(journal:, events:, params:, map:, commit:)
-          protected_journal!(journal)
+          service_journal!(journal)
           journal.verify_commit!(commit)
           retained = journal.read_events(params.fetch("assignment_id"), commit: commit)
             .select { |event| event["attempt_id"] == params.fetch("attempt_id") }
@@ -80,7 +80,7 @@ module Ace
         # Called only by the installed journal composition, including lower
         # service writers. It never reacquires lifecycle/authority locks.
         def authorize_service_update!(journal:, existing:, replacement:, pending:)
-          protected_journal!(journal)
+          service_journal!(journal)
           if existing && existing.key?("executor_process_binding") &&
               Atoms::EvidenceDigest.digest(existing.fetch("executor_process_binding")) != Atoms::EvidenceDigest.digest(replacement["executor_process_binding"])
             raise AttemptErrors::InvalidState, "original cleanup executor cannot change"
@@ -114,28 +114,27 @@ module Ace
           end
           bytes = pending && pending.fetch(:service_inputs, {})[replacement.fetch("request_id")]
           raise AttemptErrors::UnauthorizedIdentity, "fresh service effect requires its exact original input" unless bytes.is_a?(String)
-          map = @deployment.mapping(replacement.fetch("mapping_id"))
+          map = service_mapping!(replacement.fetch("mapping_id"))
           unless replacement["project_id"] == map["project_id"] && replacement["caller_uid"] == map["worker_uid"]
             raise AttemptErrors::UnauthorizedIdentity, "protected service mapping differs"
           end
           params = replacement.slice("mapping_id", "assignment_id", "attempt_id", "candidate_generation").merge("head" => replacement.fetch("candidate_head"))
           events = pending.fetch(:current_events)
-          @launch.scope_open_for_effect!(events: events, params: params, map: map)
-          origin = active_origin(events, params)
-          unless replacement["worker_process_binding"] == origin.fetch("process_binding").fetch("process_identity") &&
-              replacement["launch_ticket"] == origin.fetch("launch_ticket") && replacement["reservation_generation"] == origin.fetch("reservation_generation")
+          service_scope_open!(events: events, params: params, map: map)
+          origin = service_origin!(events, params)
+          unless service_origin_matches!(replacement, origin)
             raise AttemptErrors::UnauthorizedIdentity, "protected service origin differs"
           end
-          receiver = @deployment.project(map.fetch("project_id")).fetch("service_receivers").fetch(replacement.fetch("service_id"))
+          receiver = service_project!(map.fetch("project_id")).fetch("service_receivers").fetch(replacement.fetch("service_id"))
           raise AttemptErrors::UnauthorizedIdentity, "protected service executor differs" unless receiver.fetch("executor_uid") == replacement.fetch("executor_uid")
           current = exact_candidate!(candidate(events), params)
-          approved_review!(journal, events, params, map, current, service_operation: replacement.fetch("operation")) unless %w[create update].include?(replacement.fetch("operation"))
+          service_review!(journal, events, params, map, current, service_operation: replacement.fetch("operation")) unless %w[create update].include?(replacement.fetch("operation"))
           service_policy!.prepare!(replacement, input_bytes: bytes)
           if begin_dispatch && %w[prune-preserved-workspace publish].include?(replacement.fetch("operation"))
             executor = replacement.fetch("executor_process_binding")
             boot = replacement.fetch("worker_process_binding").fetch("started_at").split(":").fetch(1)
             Molecules::ExecutionScopeLineage.validate_process_identity!(executor, boot_id: boot)
-            credentials = @deployment.project(map.fetch("project_id")).fetch("peer_credentials").fetch(receiver.fetch("executor_uid").to_s)
+            credentials = service_project!(map.fetch("project_id")).fetch("peer_credentials").fetch(receiver.fetch("executor_uid").to_s)
             unless executor.slice("uid", "gid", "groups") == credentials.slice("gid", "groups").merge("uid" => receiver.fetch("executor_uid"))
               raise AttemptErrors::UnauthorizedIdentity, "original cleanup executor credentials differ"
             end
@@ -164,8 +163,8 @@ module Ace
         def authorize_service_transfer!(request, params, map, peer, role)
           service_policy!
           service_policy!.visible!(project: map.fetch("project_id"), uid: map.fetch("worker_uid")) unless request.fetch("operation") == "complete_service"
-          @launch.with_assignment(params: params, map: map) do |journal, _registration|
-            protected_journal!(journal)
+          with_service_scope(params: params, map: map) do |journal, _registration|
+            service_journal!(journal)
             if request.fetch("operation") == "request_service"
               existing = journal.service_request(params.fetch("request_id"))
               if existing
@@ -173,8 +172,8 @@ module Ace
                 service_replay_binding!(existing, params, map)
               else
                 events = attempt_events(journal, params)
-                origin = active_origin(events, params)
-                worker_or_launcher!(params.fetch("worker_process_binding"), :worker, map, origin)
+                origin = service_origin!(events, params)
+                service_worker!(params.fetch("worker_process_binding"), :worker, map, origin)
                 service_receiver!(peer, role, map, params.fetch("service_id"))
               end
             else
@@ -191,7 +190,7 @@ module Ace
         # This immutable observation grants no service claim or dispatch permit.
         def workspace_prune_preview_context(_request, params, map, peer, role, transfer)
           raise ArgumentError, "preview context forbids upload" unless transfer.nil?
-          @launch.with_assignment(params: params, map: map) do |journal, _registration|
+          with_service_scope(params: params, map: map) do |journal, _registration|
             {data: workspace_prune_preview_context_at!(journal: journal, params: params, map: map, peer: peer, role: role), replayed: false}
           end
         end
@@ -203,11 +202,11 @@ module Ace
 
         def workspace_prune_preview_context_at!(journal:, params:, map:, peer:, role:)
           service_policy!.visible!(project: map.fetch("project_id"), uid: map.fetch("worker_uid"))
-          protected_journal!(journal)
+          service_journal!(journal)
           commit = journal.ref_value
-          events = @launch.preview_attempt_events!(journal: journal, commit: commit, params: params, map: map)
-          origin = active_origin(events, params)
-          worker_or_launcher!(params.fetch("worker_process_binding"), :worker, map, origin)
+          events = service_preview_events!(journal: journal, commit: commit, params: params, map: map)
+          origin = service_origin!(events, params)
+          service_worker!(params.fetch("worker_process_binding"), :worker, map, origin)
           receiver = service_receiver!(peer, role, map, params.fetch("service_id"))
           service_policy!.workspace_prune_receiver!(project: map.fetch("project_id"), uid: map.fetch("worker_uid"),
             service_id: params.fetch("service_id"), executor_uid: receiver.fetch("executor_uid"))
@@ -220,7 +219,7 @@ module Ace
             "journal_commit" => commit,
             "maintenance" => params.slice("mapping_id", "assignment_id", "attempt_id").merge("project_id" => map.fetch("project_id")),
             "head" => selected.fetch("head"), "candidate_generation" => selected.fetch("candidate_generation"),
-            "worker_process_binding" => origin.fetch("process_binding").fetch("process_identity"),
+            "worker_process_binding" => service_origin_fields!(origin).fetch("worker_process_binding"),
             "caller_process_binding" => params.fetch("worker_process_binding")
           }
           raise AttemptErrors::Conflict, "preview canonical selection changed" unless journal.ref_value == commit
@@ -232,8 +231,8 @@ module Ace
         private
 
         def service_status(_request, params, map, peer, role)
-          @launch.with_assignment(params: params, map: map) do |journal, _registration|
-            protected_journal!(journal)
+          with_service_scope(params: params, map: map) do |journal, _registration|
+            service_journal!(journal)
             commit = journal.ref_value
             read = role == :executor && journal.service_settlement_read(params.fetch("request_id"), commit: commit)
             record = read ? read.fetch(:record) : journal.service_request(params.fetch("request_id"), commit: commit)
@@ -261,7 +260,7 @@ module Ace
                 review && review["reviewer_uid"] == peer["uid"] && review["head"] == params["head"] &&
                   review["candidate_generation"] == params["candidate_generation"] && @kernel.descendant?(peer, review.fetch("reviewer_process_binding"))
               when :supervisor
-                @deployment.project(map.fetch("project_id")).fetch("supervisor_uids").include?(peer["uid"])
+                service_project!(map.fetch("project_id")).fetch("supervisor_uids").include?(peer["uid"])
               else
                 false
               end
@@ -287,8 +286,8 @@ module Ace
           authorize_service_transfer!(request, params, map, peer, role)
           raise ArgumentError, "structured service input transfer is missing" unless transfer && transfer.count == 1
           bytes = transfer.bytes.dup.freeze
-          @launch.with_assignment(params: params, map: map) do |journal, _registration|
-            protected_journal!(journal)
+          with_service_scope(params: params, map: map) do |journal, _registration|
+            service_journal!(journal)
             record = journal.service_request(params.fetch("request_id"))
             service_executor!(peer, role, record)
             service_ticket!(record, params, map, peer)
@@ -296,10 +295,9 @@ module Ace
               raise AttemptErrors::Conflict, "authorization input binding differs"
             end
             events = attempt_events(journal, params)
-            @launch.scope_open_for_effect!(events: events, params: params, map: map)
-            origin = active_origin(events, params)
-            unless record["worker_process_binding"] == origin.fetch("process_binding").fetch("process_identity") &&
-                record["launch_ticket"] == origin.fetch("launch_ticket") && record["reservation_generation"] == origin.fetch("reservation_generation")
+            service_scope_open!(events: events, params: params, map: map)
+            origin = service_origin!(events, params)
+            unless service_origin_matches!(record, origin)
               raise AttemptErrors::UnauthorizedIdentity, "authorization launch origin differs"
             end
             current = exact_candidate!(candidate(events), params)
@@ -307,7 +305,7 @@ module Ace
               raise AttemptErrors::Conflict, "authorization candidate changed"
             end
             service_receiver!(peer, role, map, record.fetch("service_id"))
-            approved_review!(journal, events, params, map, current, service_operation: record.fetch("operation")) unless %w[create update].include?(record.fetch("operation"))
+            service_review!(journal, events, params, map, current, service_operation: record.fetch("operation")) unless %w[create update].include?(record.fetch("operation"))
             prepared = service_policy!.prepare!(record, input_bytes: bytes)
             data = params.slice("request_id", "claim_binding", "head", "candidate_generation").merge(
               "policy_digest" => prepared.fetch(:policy_digest), "operation_digest" => prepared.fetch(:operation_digest))
@@ -324,8 +322,8 @@ module Ace
             raise ArgumentError, "structured service input transfer is missing" unless transfer && transfer.count == 1
             transfer.bytes.dup.freeze
           end
-          @launch.with_assignment(params: params, map: map) do |journal, _registration|
-            protected_journal!(journal)
+          with_service_scope(params: params, map: map) do |journal, _registration|
+            service_journal!(journal)
             unless request.fetch("operation") == "complete_service"
               input_record = request.fetch("operation") == "request_service" ? params : journal.service_request(params.fetch("request_id"))
               # Replay bypasses the mutation callback, never input validation.
@@ -348,8 +346,8 @@ module Ace
               service_ticket!(record, params, map, peer)
               completion_binding!(record, params, admitted) if request.fetch("operation") == "complete_service"
             elsif !retained
-              origin = active_origin(attempt_events(journal, params), params)
-              worker_or_launcher!(params.fetch("worker_process_binding"), :worker, map, origin)
+              origin = service_origin!(attempt_events(journal, params), params)
+              service_worker!(params.fetch("worker_process_binding"), :worker, map, origin)
               service_receiver!(peer, role, map, params.fetch("service_id"))
             end
             result = journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
@@ -433,7 +431,7 @@ module Ace
         end
 
         def service_receiver!(peer, role, map, service_id)
-          project = @deployment.project(map.fetch("project_id"))
+          project = service_project!(map.fetch("project_id"))
           receiver = project.fetch("service_receivers").fetch(service_id)
           unless role == :executor && peer["uid"] == receiver.fetch("executor_uid") &&
               project.fetch("service_executor_uids").include?(peer["uid"]) &&
@@ -447,18 +445,17 @@ module Ace
         end
 
         def service_claim_plan(journal, events, params, map, peer, role, input_bytes)
-          origin = active_origin(events, params)
+          origin = service_origin!(events, params)
           worker = params.fetch("worker_process_binding")
-          worker_or_launcher!(worker, :worker, map, origin)
+          service_worker!(worker, :worker, map, origin)
           current = exact_candidate!(candidate(events), params)
-          approved_review!(journal, events, params, map, current, service_operation: params.fetch("operation")) unless %w[create update].include?(params.fetch("operation"))
+          service_review!(journal, events, params, map, current, service_operation: params.fetch("operation")) unless %w[create update].include?(params.fetch("operation"))
           receiver = service_receiver!(peer, role, map, params.fetch("service_id"))
           binding = params.slice("request_id", "assignment_id", "attempt_id", "operation", "input_digest", "target",
             "authorization", "service_id").merge("project_id" => map.fetch("project_id"),
               "caller_uid" => map.fetch("worker_uid"), "mapping_id" => params.fetch("mapping_id"), "candidate_head" => current.fetch("head"),
-              "candidate_generation" => current.fetch("candidate_generation"),
-              "worker_process_binding" => origin.fetch("process_binding").fetch("process_identity"),
-              "launch_ticket" => origin.fetch("launch_ticket"), "reservation_generation" => origin.fetch("reservation_generation"))
+              "candidate_generation" => current.fetch("candidate_generation"))
+            .merge(service_origin_fields!(origin))
           prepared = service_policy!.prepare!(binding, input_bytes: input_bytes)
           binding = prepared.fetch(:binding).merge("policy_digest" => prepared.fetch(:policy_digest))
           unless binding["executor_uid"] == receiver.fetch("executor_uid")
@@ -488,16 +485,15 @@ module Ace
           # A repeated begin never grants a second invocation, including after
           # lease expiry or terminality. It reports only retained ticket truth.
           return {data: service_projection(record).merge("invocation" => "already_started")} unless record["dispatch_phase"] == "issued"
-          origin = active_origin(events, params)
-          unless record["worker_process_binding"] == origin.fetch("process_binding").fetch("process_identity") &&
-              record["launch_ticket"] == origin.fetch("launch_ticket") && record["reservation_generation"] == origin.fetch("reservation_generation")
+          origin = service_origin!(events, params)
+          unless service_origin_matches!(record, origin)
             raise AttemptErrors::UnauthorizedIdentity, "dispatch launch origin differs"
           end
           current = exact_candidate!(candidate(events), params)
           unless record["candidate_head"] == current["head"] && record["candidate_generation"] == current["candidate_generation"]
             raise AttemptErrors::Conflict, "dispatch candidate changed"
           end
-          approved_review!(journal, events, params, map, current, service_operation: record.fetch("operation")) unless %w[create update].include?(record.fetch("operation"))
+          service_review!(journal, events, params, map, current, service_operation: record.fetch("operation")) unless %w[create update].include?(record.fetch("operation"))
           service_policy!.prepare!(record, input_bytes: input_bytes)
           replacement = record.merge("dispatch_phase" => "dispatch_started")
           if record.fetch("operation") == "prune-preserved-workspace"

data/lib/ace/assign/authority/ordinary_completion.rb

@@ -28,6 +28,7 @@ module Ace
           end
           registered = registration(params.fetch("assignment_id"), commit: @journal.ref_value)
           raise AttemptErrors::NotFound, "ordinary work is not registered" unless registered
+          verify_result_owner!(request, peer, role, deadline, registered)
           digest = Atoms::EvidenceDigest.digest({"params" => params, "project_id" => @project, "peer_uid" => peer.fetch("uid")})
           @exclusion.with_shared_multi([@exclusion.task_key(registered.fetch("task_id"))], deadline: deadline) do
             @exclusion.with_exclusive(@exclusion.assignment_key(params.fetch("assignment_id")), deadline: deadline) do
@@ -36,8 +37,8 @@ module Ace
                 @journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
                   mutation_id: request.fetch("mutation_id"), operation: "finish", parameters_digest: digest,
                   expected_generation: params.fetch("expected_generation"), with_replay: true, deadline: deadline,
-                  replay_authorizer: -> { authorize!(request, peer, role, deadline) }) do |events, prefix, _generation|
-                  authorize!(request, peer, role, deadline)
+                  replay_authorizer: -> { verify_result_owner!(request, peer, role, deadline, registered) }) do |events, prefix, _generation|
+                  verify_result_owner!(request, peer, role, deadline, registered)
                   unless Molecules::CanonicalAttemptState.derive(events) == "running"
                     raise AttemptErrors::Conflict, "ordinary completion requires a running attempt"
                   end
@@ -61,7 +62,7 @@ module Ace
                   raise AttemptErrors::Conflict, "ordinary result scope has unfinished progress" unless complete
                   settlement = OrdinaryEffectSettlement.new(journal: @journal).verify!(project: @project,
                     assignment: params.fetch("assignment_id"), attempt: params.fetch("attempt_id"), events: events, commit: prefix)
-                  authorize!(request, peer, role, deadline)
+                  verify_result_owner!(request, peer, role, deadline, registered)
                   plan = Organisms::AttemptCoordinator.finished_transition_plan(events: events, receipt: result.fetch("receipt"), authority: :ordinary)
                   plan.merge(data: params.slice("assignment_id", "attempt_id", "result_id", "head", "receipt_digest").merge(
                     "authority" => "ordinary", "scope" => scope, "state" => verdict, "settlement" => settlement, "inbox_deliveries" => delivery))
@@ -73,6 +74,15 @@ module Ace
           raise AttemptErrors::EvidenceUnavailable, "ordinary transport settlement is unavailable: #{error.message}"
         end
 
+        def verify_result_owner!(request, peer, role, deadline, registered)
+          authorize!(request, peer, role, deadline)
+          supervisor = @admission.identity!(peer: peer, pane: request.fetch("params").fetch("pane"), deadline: deadline)
+          unless supervisor.role == "coordinator" &&
+              supervisor.runtime_binding == supervisor_selection(registered, @journal.ref_value).fetch("binding")
+            raise AttemptErrors::UnauthorizedIdentity, "ordinary completion belongs to its original supervisor"
+          end
+        end
+
         def with_result_transport(request, deadline)
           if @journal.mutation_result(request.fetch("mutation_id"), commit: @journal.ref_value)
             # A terminal reply is immutable. Current peer authority is still

data/lib/ace/assign/authority/ordinary_lifecycle.rb

@@ -8,6 +8,10 @@ require_relative "ordinary_attempt_start"
 require_relative "ordinary_progress"
 require_relative "ordinary_results"
 require_relative "ordinary_completion"
+require_relative "ordinary_supervisor"
+require_relative "ordinary_reviews"
+require_relative "ordinary_merge_evidence"
+require_relative "ordinary_release_artifacts"
 require_relative "../molecules/lifecycle_exclusion"
 
 module Ace
@@ -21,22 +25,37 @@ module Ace
         include OrdinaryProgress
         include OrdinaryResults
         include OrdinaryCompletion
-        OPERATIONS = (%w[register_assignment registration_status start_attempt finish] + OrdinaryProgress::PROGRESS_OPERATIONS + OrdinaryResults::RESULT_OPERATIONS).freeze
+        include OrdinarySupervisor
+        include OrdinaryReviews
+        include OrdinaryMergeEvidence
+        include OrdinaryReleaseArtifacts
+        OPERATIONS = (%w[register_assignment registration_status start_attempt finish merge_evidence] + OrdinaryProgress::PROGRESS_OPERATIONS + OrdinaryResults::RESULT_OPERATIONS + OrdinarySupervisor::SUPERVISOR_OPERATIONS + OrdinaryReviews::REVIEW_OPERATIONS + OrdinaryReleaseArtifacts::RELEASE_OPERATIONS).freeze
         TRANSFER_OPERATIONS = {"register_assignment" => {direction: :upload, purpose: :candidate, roles: [:supervisor]}}
-          .merge(OrdinaryProgress::PROGRESS_TRANSFERS).merge(OrdinaryResults::RESULT_TRANSFERS).freeze
+          .merge(OrdinaryProgress::PROGRESS_TRANSFERS).merge(OrdinaryResults::RESULT_TRANSFERS).merge(OrdinaryReviews::REVIEW_TRANSFERS).merge(OrdinaryReleaseArtifacts::RELEASE_TRANSFERS).freeze
         REGISTER_KEYS = %w[assignment_id definition_digest prepared_head prepared_tree manifest_sha256 expected_generation pane transfer].freeze
 
-        def initialize(project:, admission:, journal:, exclusion:, input_root:, inbox: nil)
+        def initialize(project:, admission:, journal:, exclusion:, input_root:, inbox: nil, command_evidence: nil, release_authorizer: nil)
           @project, @admission, @journal, @exclusion = project, admission, journal, exclusion
           @input_root = PrivateDirectory.verify!(input_root)
           unless inbox.nil? || inbox.is_a?(Ace::Herdr::Organisms::Inbox)
             raise ArgumentError, "ordinary completion requires the installed Inbox owner"
           end
-          @inbox = inbox
+          unless release_authorizer.nil? || release_authorizer.respond_to?(:call)
+            raise ArgumentError, "release artifact authorization requires its installed policy owner"
+          end
+          @inbox, @command_evidence, @release_authorizer = inbox, command_evidence, release_authorizer
         end
 
         def authorize_transfer!(request:, peer:, role:, deadline:)
           authorize!(request, peer, role, deadline)
+          if OrdinaryReleaseArtifacts::RELEASE_TRANSFERS.key?(request.fetch("operation"))
+            authorize_ordinary_release!(request, peer, role, deadline)
+            return
+          end
+          if OrdinaryReviews::REVIEW_TRANSFERS.key?(request.fetch("operation"))
+            authorize_ordinary_review!(request, peer, role, deadline)
+            return
+          end
           if OrdinaryResults::RESULT_TRANSFERS.key?(request.fetch("operation"))
             validate_result!(request)
             authorize_start_replay!(request, peer, role, deadline) if request.fetch("operation") == "submit_result"
@@ -54,7 +73,16 @@ module Ace
 
         def dispatch(request:, peer:, role:, deadline:, transfer: nil)
           authorize!(request, peer, role, deadline)
+          return ordinary_review_operation(request, peer, role, deadline, transfer) if OrdinaryReviews::REVIEW_OPERATIONS.include?(request.fetch("operation"))
           case request.fetch("operation")
+          when "retain_release_artifact"
+            retain_release_artifact(request, peer, role, deadline, transfer)
+          when "merge_evidence"
+            raise ArgumentError, "merge evidence read forbids transfer" if transfer
+            ordinary_merge_evidence(request, peer, role, deadline)
+          when "supervisor_status", "adopt_supervisor"
+            raise ArgumentError, "ordinary supervisor operation forbids transfer" if transfer
+            supervisor_operation(request, peer, role, deadline)
           when "registration_status"
             strict!(request.fetch("params"), %w[assignment_id])
             raise ArgumentError, "status mutation must be null" unless request.fetch("mutation_id").nil?
@@ -134,6 +162,7 @@ module Ace
               {events: [], blobs: {definition_path => definition, bundle_path => bytes, queue_path => queue.bytes}, data: {
                 "authority" => "ordinary", "assignment_id" => assignment.id, "project_id" => @project,
                 "task_id" => assignment.task_id, "registered_by" => principal, "phase" => "registered",
+                "supervisor_binding" => identity.runtime_binding,
                 "definition_ref" => definition_path, "definition_digest" => params.fetch("definition_digest"),
                 "queue_ref" => queue_path, "queue_sha256" => queue_sha,
                 "prepared_work" => work.reference(head: params.fetch("prepared_head"), tree: params.fetch("prepared_tree")),
@@ -165,6 +194,13 @@ module Ace
           unless request.fetch("project_id") == @project && @admission.authorize!(request: request, peer: peer, deadline: deadline) == role
             raise AttemptErrors::UnauthorizedIdentity, "ordinary lifecycle principal differs"
           end
+          # Project commands share the canonical journal but never the managed
+          # assignment namespace. Reserve their prefix on every ordinary route,
+          # including transfer admission, status and registration replay.
+          assignment = request.fetch("params")["assignment_id"]
+          if assignment.is_a?(String) && assignment.start_with?("command-")
+            raise ArgumentError, "ordinary assignment uses the reserved project-command namespace"
+          end
         end
 
         def validate_registration!(request)

data/lib/ace/assign/authority/ordinary_merge_evidence.rb

@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+
+module Ace
+  module Assign
+    module Authority
+      # The installed fixed merge consumes this same lifecycle, never a local
+      # receipt file. Locks precede journal CAS; no callback acquires an inverted
+      # lifecycle lock while holding the journal writer lock.
+      module OrdinaryMergeEvidence
+        def with_merge_scope(record:, deadline:, exclusive: false)
+          assignment, attempt = record.values_at("assignment_id", "attempt_id")
+          token!(assignment)
+          token!(attempt)
+          registered = registration(assignment, commit: @journal.ref_value)
+          raise AttemptErrors::EvidenceUnavailable, "merge assignment is unregistered" unless registered
+          @exclusion.with_shared_multi([@exclusion.task_key(registered.fetch("task_id"))], deadline: deadline) do
+            key = @exclusion.assignment_key(assignment)
+            if exclusive
+              @exclusion.with_exclusive(key, deadline: deadline) { yield }
+            else
+              @exclusion.with_shared_multi([key], deadline: deadline) { yield }
+            end
+          end
+        end
+
+        def verify_merge_evidence_at!(record:, commit:, deadline:)
+          unless record.fetch("project_id") == @project
+            raise AttemptErrors::ReceiptRejected, "merge evidence project differs"
+          end
+          request = record.fetch("request")
+          events = result_events(record, commit)
+          current = ordinary_candidate_event(events)&.dig("payload", "data")
+          raise AttemptErrors::ReceiptRejected, "merge candidate is unavailable" unless current
+          projection = merge_evidence_at!(events: events, commit: commit, head: request.fetch("candidate_head"),
+            generation: current.fetch("candidate_generation"), execution_ids: request.fetch("test_evidence").map { |reference| reference.fetch("reference") }, deadline: deadline)
+          unless request.fetch("review_evidence") == projection.fetch("review_evidence") && request.fetch("test_evidence") == projection.fetch("test_evidence")
+            raise AttemptErrors::ReceiptRejected, "merge requires exact canonical review and executed test references"
+          end
+          origin = origin_at!(events: events, commit: commit)
+          observed = @admission.recorded_execution!(binding: origin.fetch("runtime_binding"), head: request.fetch("candidate_head"), deadline: deadline)
+          unless observed.fetch(:runtime_binding) == origin.fetch("runtime_binding")
+            raise AttemptErrors::UnauthorizedIdentity, "merge producer native identity changed"
+          end
+          true
+        rescue KeyError, TypeError
+          raise AttemptErrors::ReceiptRejected, "canonical merge evidence is incomplete"
+        end
+
+        def merge_evidence_at!(events:, commit:, head:, generation:, execution_ids:, deadline:)
+          unless @command_evidence && @command_evidence.journal.equal?(@journal) && execution_ids.is_a?(Array) &&
+              execution_ids.size.between?(1, 16) && execution_ids.uniq == execution_ids
+            raise AttemptErrors::EvidenceUnavailable, "merge requires the installed canonical executed-test owner"
+          end
+          candidate = candidate_at!(events: events, commit: commit, head: head, generation: generation)
+          review = review_at!(events: events, commit: commit, head: head, generation: generation)
+          tests = execution_ids.map { |id| @command_evidence.test_evidence_at!(execution_id: id, commit: commit,
+            head: head, tree: candidate.fetch("tree"), deadline: deadline) }
+          {"review_evidence" => {"schema" => "ace.review.acceptance-reference/v1", "reference" => review.fetch("review_id"),
+            "reviewer" => review.fetch("reviewer_actor"), "verdict" => "approved", "reviewed_head" => head,
+            "recorded_at" => review.fetch("recorded_at"), "record_sha256" => review.fetch("acceptance_event_digest")},
+            "test_evidence" => tests}
+        end
+
+        private
+
+        def ordinary_merge_evidence(request, peer, role, deadline)
+          params = request.fetch("params")
+          strict!(params, %w[assignment_id attempt_id head candidate_generation test_execution_ids])
+          raise ArgumentError, "merge evidence read mutation must be null" unless request.fetch("mutation_id").nil?
+          with_scope(assignment: params.fetch("assignment_id"), attempt: params.fetch("attempt_id"), deadline: deadline) do
+            prefix = @journal.ref_value
+            projection = merge_evidence_at!(events: result_events(params, prefix), commit: prefix, head: params.fetch("head"),
+              generation: params.fetch("candidate_generation"), execution_ids: params.fetch("test_execution_ids"), deadline: deadline)
+            authorize!(request, peer, role, deadline)
+            {data: projection.merge("journal_commit" => prefix), replayed: false}
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/ordinary_release_artifacts.rb

@@ -0,0 +1,143 @@
+# frozen_string_literal: true
+
+require_relative "release_artifact_manifest"
+require_relative "candidate_transfer"
+
+module Ace
+  module Assign
+    module Authority
+      # Retention is a canonical input, never a publication permit or result.
+      # Native/candidate/review and release policy are rechecked at every CAS.
+      module OrdinaryReleaseArtifacts
+        RELEASE_OPERATIONS = %w[retain_release_artifact].freeze
+        RELEASE_TRANSFERS = {"retain_release_artifact" =>
+          {direction: :upload, purpose: :release_artifact, roles: %i[worker supervisor]}}.freeze
+        RELEASE_PARAMETERS = %w[assignment_id attempt_id head candidate_generation pane expected_generation
+          authorization manifest transfer].freeze
+
+        # Read an accepted import at the current immutable canonical prefix only.
+        # Historical commit selection is not supported by the native origin reader.
+        # The later effect consumer must independently admit its fresh scope,
+        # candidate, review, authorization and fixed executor before dispatch.
+        def release_artifact_at!(events:, commit:, artifact_id:)
+          token!(artifact_id)
+          unless commit && Models::EvidenceEvent.chain_valid?(events)
+            raise AttemptErrors::EvidenceUnavailable, "release artifact history is unavailable"
+          end
+          accepted = events.select { |event| event["type"] == "authority_mutation" &&
+            event.dig("payload", "operation") == "retain_release_artifact" && event.dig("payload", "mutation_id") == artifact_id }
+          data = accepted.one? && accepted.first.dig("payload", "data")
+          unless data && data["artifact_id"] == artifact_id && data["input_digest"] == Atoms::EvidenceDigest.digest(data.fetch("input"))
+            raise AttemptErrors::EvidenceUnavailable, "release artifact acceptance is unavailable"
+          end
+          origin = data.fetch("producer_origin")
+          retained = @journal.read_events(origin.fetch("assignment_id"), commit: commit)
+            .select { |event| event["attempt_id"] == origin.fetch("attempt_id") }
+          unless retained == events && ordinary_origin_at!(events, commit, running: false) == origin
+            raise AttemptErrors::EvidenceUnavailable, "release artifact original scope differs"
+          end
+          context = release_evidence_context(data.fetch("input"), origin, data.fetch("authorization"), artifact_id)
+          bytes = Molecules::CanonicalEvidence.new(journal: @journal).read(data.fetch("artifact"), **context, commit: commit)
+          unless bytes.bytesize == data.dig("input", "publication", "artifact_bytes") &&
+              Digest::SHA256.hexdigest(bytes) == data.dig("input", "target", "artifact_digest")
+            raise AttemptErrors::EvidenceUnavailable, "release artifact retained bytes differ"
+          end
+          data.merge("bytes" => bytes)
+        rescue KeyError, TypeError
+          raise AttemptErrors::EvidenceUnavailable, "release artifact acceptance is incomplete"
+        end
+
+        private
+
+        def validate_ordinary_release!(request)
+          params = request.fetch("params")
+          strict!(params, RELEASE_PARAMETERS)
+          %w[assignment_id attempt_id authorization].each { |key| token!(params.fetch(key)) }
+          token!(request.fetch("mutation_id"))
+          unless params["head"].is_a?(String) && CandidateTransfer::SHA.match?(params["head"]) &&
+              %w[candidate_generation expected_generation].all? { |key| params[key].is_a?(Integer) && params[key].positive? }
+            raise ArgumentError, "invalid release artifact candidate selection"
+          end
+          ReleaseArtifactManifest.validate!(params.fetch("manifest"))
+        end
+
+        def authorize_ordinary_release!(request, peer, role, deadline)
+          validate_ordinary_release!(request)
+          params = request.fetch("params")
+          with_scope(assignment: params.fetch("assignment_id"), attempt: params.fetch("attempt_id"), deadline: deadline) do
+            prefix = @journal.ref_value
+            release_context_at!(request, peer, role, deadline, result_events(params, prefix), prefix)
+          end
+        end
+
+        # Caller holds lifecycle exclusion before entering the journal writer.
+        # This method never acquires another lifecycle lock or trusts a path.
+        def release_context_at!(request, peer, role, deadline, events, commit)
+          authorize!(request, peer, role, deadline)
+          unless %i[worker supervisor].include?(role) && @release_authorizer
+            raise AttemptErrors::UnauthorizedIdentity, "installed release artifact authorization is unavailable"
+          end
+          params = request.fetch("params")
+          origin = origin_at!(events: events, commit: commit)
+          current = candidate_at!(events: events, commit: commit, head: params.fetch("head"), generation: params.fetch("candidate_generation"))
+          reference = candidate_reference_at!(events: events, commit: commit, head: params.fetch("head"), generation: params.fetch("candidate_generation"))
+          observed = @admission.execution!(peer: peer, pane: params.fetch("pane"), head: current.fetch("head"), deadline: deadline)
+          unless observed.fetch(:identity).runtime_binding == origin.fetch("runtime_binding")
+            raise AttemptErrors::UnauthorizedIdentity, "release artifact producer native identity changed"
+          end
+          review_at!(events: events, commit: commit, head: current.fetch("head"), generation: current.fetch("candidate_generation"))
+          input = ReleaseArtifactManifest.publication_input(manifest: params.fetch("manifest"), candidate: current, reference: reference)
+          binding = params.slice("assignment_id", "attempt_id", "authorization").merge(
+            "operation" => "publish", "project_id" => @project, "candidate_head" => current.fetch("head"),
+            "caller_uid" => origin.dig("runtime_binding", "process_identity", "uid"),
+            "input_digest" => Atoms::EvidenceDigest.digest(input), "target" => input.fetch("target"))
+          unless @release_authorizer.call(binding)
+            raise AttemptErrors::UnauthorizedIdentity, "release artifact manifest is not authorized"
+          end
+          {input: input, binding: binding, origin: origin}
+        rescue SecurityError
+          raise AttemptErrors::UnauthorizedIdentity, "release artifact manifest authorization is unavailable"
+        end
+
+        def retain_release_artifact(request, peer, role, deadline, transfer)
+          validate_ordinary_release!(request)
+          unless transfer && transfer.count == 1
+            raise AttemptErrors::MalformedTransfer, "release artifact requires its one bounded binary transfer"
+          end
+          params = request.fetch("params")
+          with_scope(assignment: params.fetch("assignment_id"), attempt: params.fetch("attempt_id"), deadline: deadline) do
+            prefix = @journal.ref_value
+            release_context_at!(request, peer, role, deadline, result_events(params, prefix), prefix)
+            bytes = transfer.bytes.dup.freeze
+            ReleaseArtifactManifest.verify!(bytes, params.fetch("manifest"))
+            digest = Atoms::EvidenceDigest.digest("project_id" => @project, "params" => params)
+            recheck = lambda do
+              current = @journal.ref_value
+              release_context_at!(request, peer, role, deadline, result_events(params, current), current)
+            end
+            @journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
+              mutation_id: request.fetch("mutation_id"), operation: "retain_release_artifact", parameters_digest: digest,
+              expected_generation: params.fetch("expected_generation"), with_replay: true, deadline: deadline,
+              replay_authorizer: recheck) do |events, commit, _generation|
+              selected = release_context_at!(request, peer, role, deadline, events, commit)
+              artifact_id = request.fetch("mutation_id")
+              context = release_evidence_context(selected.fetch(:input), selected.fetch(:origin), params.fetch("authorization"), artifact_id)
+              plan = Molecules::CanonicalEvidence.new(journal: @journal).import_plan(**context,
+                artifacts: [bytes], admitted_after_event_digest: events.last.fetch("digest"))
+              plan.merge(data: {"artifact_id" => artifact_id, "input" => selected.fetch(:input),
+                "input_digest" => selected.fetch(:binding).fetch("input_digest"), "artifact" => plan.fetch(:references).first,
+                "authorization" => params.fetch("authorization"), "producer_origin" => selected.fetch(:origin)})
+            end
+          end
+        end
+
+        def release_evidence_context(input, origin, authorization, artifact_id)
+          {kind: "release-artifact", project_id: @project, assignment_id: origin.fetch("assignment_id"),
+            attempt_id: origin.fetch("attempt_id"), peer_uid: origin.dig("runtime_binding", "process_identity", "uid"),
+            binding: {"input" => input, "producer_origin" => origin, "authorization" => authorization},
+            request_id_or_event_id: artifact_id, generation: input.fetch("publication").fetch("candidate_reference").fetch("candidate_generation")}
+        end
+      end
+    end
+  end
+end