ace-assign 0.70.0 → 0.71.0

data/lib/ace/assign/authority/ordinary_results.rb

@@ -44,6 +44,12 @@ module Ace
           registered = registration(params.fetch("assignment_id"), commit: commit)
           raise AttemptErrors::NotFound, "ordinary work is not registered" unless registered
           if request.fetch("operation") != "submit_result"
+            if request.fetch("operation") == "result_status" && @journal.read_events(params.fetch("assignment_id"), commit: commit)
+                .none? { |event| event.fetch("attempt_id") == params.fetch("attempt_id") }
+              authorize!(request, peer, role, deadline)
+              return {data: params.slice("assignment_id", "attempt_id").merge("project_id" => @project,
+                "state" => "not_started", "generation" => 0, "submitted_result" => nil), replayed: false}
+            end
             events = result_events(params, commit)
             result = retained_ordinary_result(params, events, commit)
             if request.fetch("operation") == "result_snapshot"
@@ -60,7 +66,11 @@ module Ace
               return {data: ordinary_result_projection(result).merge("journal_commit" => commit), transfer_parts: parts, replayed: false}
             end
             authorize!(request, peer, role, deadline)
-            return {data: {"assignment_id" => params.fetch("assignment_id"), "attempt_id" => params.fetch("attempt_id"),
+            started = events.find { |event| event["type"] == "process_start" }.fetch("payload")
+            scope = events.find { |event| event["type"] == "intent" }.fetch("payload").fetch("scope")
+            return {data: {"project_id" => @project, "assignment_id" => params.fetch("assignment_id"), "attempt_id" => params.fetch("attempt_id"),
+              "scope" => scope, "producer" => started.slice("actor", "role", "runtime"),
+              "runtime_binding" => started.fetch("runtime_binding"),
               "journal_commit" => commit, "generation" => @journal.authority_generation(events),
               "state" => Molecules::CanonicalAttemptState.derive(events), "submitted_result" => result && ordinary_result_projection(result)}, replayed: false}
           end

data/lib/ace/assign/authority/ordinary_review_evidence.rb

@@ -0,0 +1,180 @@
+# frozen_string_literal: true
+
+require_relative "candidate_transfer"
+require_relative "receipt_transfer"
+require_relative "../molecules/canonical_evidence"
+
+module Ace
+  module Assign
+    module Authority
+      # Source-owned views of the same ordinary journal used by lifecycle CAS.
+      # Caller labels, filesystem reports and protected launch tickets are not
+      # alternate evidence sources. Service and merge consumers share this owner.
+      module OrdinaryReviewEvidence
+        def with_scope(assignment:, attempt:, deadline:)
+          token!(assignment)
+          token!(attempt)
+          selected = registration(assignment, commit: @journal.ref_value)
+          raise AttemptErrors::NotFound, "ordinary assignment is not registered" unless selected
+          @exclusion.with_shared_multi([@exclusion.task_key(selected.fetch("task_id")),
+            @exclusion.assignment_key(assignment)], deadline: deadline) do
+            yield @journal, selected
+          end
+        end
+
+        def origin_at!(events:, commit:)
+          ordinary_origin_at!(events, commit, running: true)
+        end
+
+        def candidate_at!(events:, commit:, head:, generation:)
+          origin_at!(events: events, commit: commit)
+          selected = ordinary_candidate_event(events)&.dig("payload", "data")
+          unless selected && selected.values_at("head", "candidate_generation") == [head, generation]
+            raise AttemptErrors::Conflict, "ordinary candidate changed"
+          end
+          bytes = @journal.bounded_blob(selected.fetch("bundle_ref"), commit: commit, max_bytes: CandidateTransfer::MAX_BYTES)
+          unless bytes.bytesize == selected.fetch("bytes") && Digest::SHA256.hexdigest(bytes) == selected.fetch("sha256")
+            raise AttemptErrors::EvidenceUnavailable, "ordinary canonical candidate is corrupt"
+          end
+          selected.slice("head", "tree", "candidate_generation", "bundle_ref", "sha256", "bytes")
+        end
+
+        def candidate_reference_at!(events:, commit:, head:, generation:)
+          candidate_at!(events: events, commit: commit, head: head, generation: generation)
+          origin = origin_at!(events: events, commit: commit)
+          origin.slice("assignment_id", "attempt_id").merge("candidate_generation" => generation,
+            "acceptance_event_digest" => ordinary_candidate_event(events).fetch("digest"))
+        end
+
+        def review_at!(events:, commit:, head:, generation:)
+          current = candidate_at!(events: events, commit: commit, head: head, generation: generation)
+          assigned = ordinary_review_assignment!(events, current)
+          ordinary_review_origins!(events, commit, assigned)
+          accepted = events.reverse.find { |event| event["type"] == "authority_mutation" &&
+            event.dig("payload", "operation") == "accept_review" && event.dig("payload", "data", "review_id") == assigned.fetch("review_id") }
+          data = accepted && accepted.dig("payload", "data")
+          unless data && data.fetch("review_binding") == assigned.except("generation", "journal_commit")
+            raise AttemptErrors::ReceiptRejected, "ordinary candidate has no accepted independent review"
+          end
+          canonical = Molecules::CanonicalEvidence.new(journal: @journal)
+          reader = ->(_receipt, artifact) { canonical.read({"ref" => artifact.fetch("path"), "sha256" => artifact.fetch("sha256")},
+            **ordinary_review_context(data.fetch("review_binding")), commit: commit) }
+          receipt = data.fetch("review_receipt")
+          verified = ordinary_verify_review!(receipt, events, commit, assigned, reader)
+          original = canonical.read({"ref" => data.fetch("original_receipt_ref"), "sha256" => data.fetch("uploaded_receipt_sha256")},
+            **ordinary_review_context(data.fetch("review_binding")), commit: commit)
+          unless Digest::SHA256.hexdigest(original) == data.fetch("uploaded_receipt_sha256") &&
+              verified.digest == data.fetch("receipt_digest")
+            raise AttemptErrors::EvidenceUnavailable, "ordinary accepted review bytes differ"
+          end
+          original_data = JSON.parse(original)
+          original_receipt = Models::ExecutionReceipt.from_h(original_data)
+          unless original_receipt.digest == Atoms::EvidenceDigest.digest(original_receipt.digest_payload) &&
+              original_data.except("digest", "recorded_at", "artifacts") == receipt.except("digest", "recorded_at", "artifacts") &&
+              original_data.fetch("artifacts").map { |value| value.fetch("sha256") } == receipt.fetch("artifacts").map { |value| value.fetch("sha256") }
+            raise AttemptErrors::EvidenceUnavailable, "ordinary review original and canonical receipt differ"
+          end
+          data.merge("acceptance_event_digest" => accepted.fetch("digest"), "recorded_at" => accepted.fetch("recorded_at"))
+        rescue JSON::ParserError, KeyError, TypeError
+          raise AttemptErrors::EvidenceUnavailable, "ordinary accepted review is incomplete"
+        end
+
+        private
+
+        def ordinary_origin_at!(events, commit, running:)
+          raise AttemptErrors::Conflict, "ordinary evidence prefix changed" unless commit && @journal.ref_value == commit
+          intent = events.select { |event| event["type"] == "intent" }
+          starts = events.select { |event| event["type"] == "process_start" }
+          accepted = events.select { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "start_attempt" }
+          unless Models::EvidenceEvent.chain_valid?(events) && intent.one? && starts.one? && accepted.one?
+            raise AttemptErrors::EvidenceUnavailable, "ordinary native origin is unavailable"
+          end
+          assignment, attempt = intent.first.dig("payload", "assignment_id"), intent.first.fetch("attempt_id")
+          token!(assignment)
+          token!(attempt)
+          registered = registration(assignment, commit: commit)
+          retained = @journal.read_events(assignment, commit: commit).select { |event| event["attempt_id"] == attempt }
+          start, data = starts.first.fetch("payload"), accepted.first.fetch("payload").fetch("data")
+          unless registered && retained == events && data.values_at("authority", "project_id", "assignment_id", "attempt_id", "runtime_binding") ==
+              ["ordinary", @project, assignment, attempt, start.fetch("runtime_binding")] &&
+              intent.first.dig("payload", "project_id") == @project
+            raise AttemptErrors::EvidenceUnavailable, "ordinary native origin differs from accepted start"
+          end
+          if running && Molecules::CanonicalAttemptState.derive(events) != "running"
+            raise AttemptErrors::Conflict, "ordinary delivery requires its original running attempt"
+          end
+          {"authority" => "ordinary", "project_id" => @project, "assignment_id" => assignment, "attempt_id" => attempt,
+            "intent_digest" => intent.first.fetch("digest"), "process_start_digest" => starts.first.fetch("digest"),
+            "runtime_binding" => start.fetch("runtime_binding"), "scope" => intent.first.dig("payload", "scope"),
+            "base_head" => intent.first.dig("payload", "base_head")}
+        end
+
+        def ordinary_candidate_event(events)
+          events.reverse.find { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "submit_candidate" }
+        end
+
+        def ordinary_review_assignment!(events, candidate)
+          selected = events.reverse.find { |event| event["type"] == "authority_mutation" &&
+            event.dig("payload", "operation") == "assign_review" &&
+            event.dig("payload", "data", "candidate_generation") == candidate.fetch("candidate_generation") }
+          data = selected && selected.dig("payload", "data")
+          cancelled = selected && events.any? { |event| event["type"] == "authority_mutation" &&
+            event.dig("payload", "operation") == "cancel_review" && event.dig("payload", "data", "review_id") == data.fetch("review_id") }
+          unless data && data.fetch("head") == candidate.fetch("head") && !cancelled
+            raise AttemptErrors::ReceiptRejected, "ordinary independent review assignment is absent or revoked"
+          end
+          data
+        end
+
+        def ordinary_review_origins!(events, commit, assigned, reviewer_running: false)
+          producer = origin_at!(events: events, commit: commit)
+          reviewer_events = @journal.read_events(assigned.fetch("reviewer_assignment_id"), commit: commit)
+            .select { |event| event["attempt_id"] == assigned.fetch("reviewer_attempt_id") }
+          reviewer = ordinary_origin_at!(reviewer_events, commit, running: reviewer_running)
+          unless producer == assigned.fetch("producer_origin") && reviewer == assigned.fetch("reviewer_origin")
+            raise AttemptErrors::EvidenceUnavailable, "ordinary review origins differ"
+          end
+          ordinary_independent_agents!(producer.fetch("runtime_binding"), reviewer.fetch("runtime_binding"))
+          [producer, reviewer]
+        end
+
+        def ordinary_independent_agents!(producer, reviewer)
+          sessions = [producer, reviewer].map { |binding|
+            Ace::Herdr::Atoms::NativeAgentSession.normalize(binding.fetch("agent_session"), agent: binding.fetch("agent")) }
+          identities = [producer, reviewer].map { |binding|
+            identity = binding.fetch("process_identity")
+            unless identity.is_a?(Hash) && %w[pid uid started_at host].all? { |key| identity.key?(key) }
+              raise AttemptErrors::EvidenceUnavailable, "ordinary agent process generation is missing"
+            end
+            identity.values_at("pid", "uid", "started_at", "host") }
+          unless sessions.all? && sessions[0].fetch("value").downcase != sessions[1].fetch("value").downcase && identities[0] != identities[1] && producer.fetch("pane") != reviewer.fetch("pane")
+            raise AttemptErrors::ReceiptRejected, "review requires an independently started native agent and session"
+          end
+          true
+        rescue KeyError
+          raise AttemptErrors::EvidenceUnavailable, "ordinary agent identity is incomplete"
+        end
+
+        def ordinary_review_context(binding)
+          {kind: "review", project_id: @project, assignment_id: binding.fetch("producer_origin").fetch("assignment_id"),
+            attempt_id: binding.fetch("producer_origin").fetch("attempt_id"), peer_uid: binding.fetch("reviewer_uid"),
+            binding: binding, request_id_or_event_id: binding.fetch("review_id"), generation: binding.fetch("candidate_generation")}
+        end
+
+        def ordinary_verify_review!(receipt, events, commit, assigned, reader)
+          origin = origin_at!(events: events, commit: commit)
+          producer = events.find { |event| event["type"] == "process_start" }.fetch("payload").slice("actor", "role", "runtime")
+          unless receipt["operation"] == "review" && receipt["verdict"] == "succeeded" && !receipt["campaign"] &&
+              receipt["producer"] == producer && receipt.dig("review", "reviewer", "actor") == assigned.fetch("reviewer_actor")
+            raise AttemptErrors::ReceiptRejected, "ordinary review receipt attribution differs"
+          end
+          attempt = @journal.derived_attempts(origin.fetch("assignment_id"), commit: commit)
+            .find { |value| value.attempt_id == origin.fetch("attempt_id") }
+          independence = ->(_data) { ordinary_review_origins!(events, commit, assigned); true }
+          Molecules::ReceiptVerifier.new(artifact_reader: reader, review_independence_verifier: independence)
+            .verify_result!(receipt, attempt: attempt, live_head: assigned.fetch("head"), repo_root: @journal.repo_root)
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/ordinary_reviews.rb

@@ -0,0 +1,214 @@
+# frozen_string_literal: true
+
+require_relative "ordinary_review_evidence"
+
+module Ace
+  module Assign
+    module Authority
+      module OrdinaryReviews
+        include OrdinaryReviewEvidence
+        REVIEW_OPERATIONS = %w[submit_candidate assign_review cancel_review export_candidate accept_review review_status].freeze
+        REVIEW_TRANSFERS = {
+          "submit_candidate" => {direction: :upload, purpose: :candidate, roles: %i[worker supervisor]},
+          "export_candidate" => {direction: :download, purpose: :candidate, roles: %i[worker supervisor]},
+          "accept_review" => {direction: :upload, purpose: :receipt_artifacts, roles: %i[worker supervisor]}
+        }.freeze
+        REVIEW_COMMON = %w[assignment_id attempt_id head candidate_generation pane].freeze
+        REVIEW_PARAMETERS = {
+          "submit_candidate" => REVIEW_COMMON + %w[expected_generation transfer],
+          "assign_review" => REVIEW_COMMON + %w[expected_generation reviewer_assignment_id reviewer_attempt_id],
+          "cancel_review" => REVIEW_COMMON + %w[expected_generation review_id],
+          "export_candidate" => REVIEW_COMMON + %w[review_id],
+          "accept_review" => REVIEW_COMMON + %w[expected_generation review_id receipt_sha256 transfer],
+          "review_status" => %w[assignment_id attempt_id head candidate_generation]
+        }.freeze
+
+        private
+
+        def validate_ordinary_review!(request)
+          operation, params = request.values_at("operation", "params")
+          strict!(params, REVIEW_PARAMETERS.fetch(operation))
+          %w[assignment_id attempt_id reviewer_assignment_id reviewer_attempt_id review_id].each { |key| token!(params[key]) if params.key?(key) }
+          unless params["head"].is_a?(String) && CandidateTransfer::SHA.match?(params["head"]) &&
+              params["candidate_generation"].is_a?(Integer) && params["candidate_generation"] >= 0
+            raise ArgumentError, "ordinary candidate selection is invalid"
+          end
+          if %w[export_candidate review_status].include?(operation)
+            raise ArgumentError, "ordinary review read mutation must be null" unless request["mutation_id"].nil?
+          else
+            token!(request["mutation_id"])
+            unless params["expected_generation"].is_a?(Integer) && params["expected_generation"].positive?
+              raise ArgumentError, "ordinary review generation is invalid"
+            end
+          end
+        end
+
+        def authorize_ordinary_review!(request, peer, role, deadline, events: nil, commit: nil)
+          authorize!(request, peer, role, deadline)
+          validate_ordinary_review!(request)
+          params = request.fetch("params")
+          commit ||= @journal.ref_value
+          events ||= result_events(params, commit)
+          origin = origin_at!(events: events, commit: commit)
+          operation = request.fetch("operation")
+          return origin if operation == "review_status"
+          identity = @admission.identity!(peer: peer, pane: params.fetch("pane"), deadline: deadline)
+          case operation
+          when "submit_candidate"
+            unless identity.runtime_binding == origin.fetch("runtime_binding")
+              raise AttemptErrors::UnauthorizedIdentity, "candidate belongs to its original native producer"
+            end
+          when "assign_review", "cancel_review"
+            registered = registration(params.fetch("assignment_id"), commit: commit)
+            unless role == :supervisor && identity.role == "coordinator" && identity.runtime_binding == supervisor_selection(registered, commit).fetch("binding")
+              raise AttemptErrors::UnauthorizedIdentity, "review selection belongs to the current canonical supervisor"
+            end
+          when "export_candidate", "accept_review"
+            candidate = candidate_at!(events: events, commit: commit, head: params.fetch("head"), generation: params.fetch("candidate_generation"))
+            assigned = ordinary_review_assignment!(events, candidate)
+            _, reviewer = ordinary_review_origins!(events, commit, assigned, reviewer_running: true)
+            unless assigned.fetch("review_id") == params.fetch("review_id") && identity.runtime_binding == reviewer.fetch("runtime_binding") &&
+                identity.actor == assigned.fetch("reviewer_actor") && peer.fetch("uid") == assigned.fetch("reviewer_uid")
+              raise AttemptErrors::UnauthorizedIdentity, "review belongs to its assigned native agent"
+            end
+          end
+          origin
+        end
+
+        def ordinary_review_operation(request, peer, role, deadline, transfer)
+          params, operation = request.values_at("params", "operation")
+          authorize_ordinary_review!(request, peer, role, deadline)
+          admitted = if operation == "submit_candidate"
+            raise ArgumentError, "ordinary candidate requires one bundle" unless transfer && transfer.count == 1
+            descriptor = params.fetch("transfer")
+            CandidateTransfer.new(root: @input_root).admit(bytes: transfer.bytes, sha256: descriptor.fetch("sha256"),
+              size: descriptor.fetch("bytes"), head: params.fetch("head"), deadline: deadline)
+          elsif operation == "accept_review"
+            ReceiptTransfer.decode(input: transfer, receipt_sha256: params.fetch("receipt_sha256"), artifact_field: "artifacts", reference_key: "path")
+          elsif transfer
+            raise ArgumentError, "ordinary review operation forbids upload"
+          end
+          with_scope(assignment: params.fetch("assignment_id"), attempt: params.fetch("attempt_id"), deadline: deadline) do
+            commit = @journal.ref_value
+            events = result_events(params, commit)
+            authorize_ordinary_review!(request, peer, role, deadline, events: events, commit: commit)
+            if %w[export_candidate review_status].include?(operation)
+              current = candidate_at!(events: events, commit: commit, head: params.fetch("head"), generation: params.fetch("candidate_generation"))
+              assigned = ordinary_review_assignment!(events, current)
+              if operation == "export_candidate"
+                bytes = @journal.bounded_blob(current.fetch("bundle_ref"), commit: commit, max_bytes: CandidateTransfer::MAX_BYTES)
+                return {data: current.merge("review_id" => assigned.fetch("review_id")), transfer_parts: [bytes], replayed: false}
+              end
+              accepted = events.any? { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "accept_review" && event.dig("payload", "data", "review_id") == assigned.fetch("review_id") }
+              value = accepted ? review_at!(events: events, commit: commit, head: params.fetch("head"), generation: params.fetch("candidate_generation")) : assigned
+              return {data: value.merge("accepted" => accepted, "journal_commit" => commit), replayed: false}
+            end
+            digest = Atoms::EvidenceDigest.digest({"params" => params, "project_id" => @project, "peer_uid" => peer.fetch("uid")})
+            replay = lambda do
+              authorize_ordinary_review!(request, peer, role, deadline)
+              if operation == "submit_candidate"
+                ordinary_candidate_replay!(request, admitted)
+              elsif operation == "accept_review"
+                prefix = @journal.ref_value
+                review_at!(events: result_events(params, prefix), commit: prefix, head: params.fetch("head"), generation: params.fetch("candidate_generation"))
+              end
+            end
+            @journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
+              mutation_id: request.fetch("mutation_id"), operation: operation, parameters_digest: digest,
+              expected_generation: params.fetch("expected_generation"), with_replay: true, deadline: deadline,
+              replay_authorizer: replay) do |current_events, prefix, _generation|
+              authorize_ordinary_review!(request, peer, role, deadline, events: current_events, commit: prefix)
+              ordinary_review_plan(operation, params, peer, deadline, current_events, prefix, admitted, transfer)
+            end
+          end
+        end
+
+        def ordinary_review_plan(operation, params, peer, deadline, events, commit, admitted, transfer)
+          if operation == "submit_candidate"
+            current = ordinary_candidate_event(events)&.dig("payload", "data")
+            unless (current && current.fetch("candidate_generation") || 0) == params.fetch("candidate_generation")
+              raise AttemptErrors::Conflict, "ordinary candidate generation changed"
+            end
+            observed = @admission.execution!(peer: peer, pane: params.fetch("pane"), head: params.fetch("head"), deadline: deadline)
+            unless observed.fetch(:identity).runtime_binding == origin_at!(events: events, commit: commit).fetch("runtime_binding")
+              raise AttemptErrors::UnauthorizedIdentity, "ordinary candidate worker changed"
+            end
+            path = "candidates/bundles/#{SecureRandom.hex(16)}"
+            return {events: [], blobs: {path => admitted.fetch("bundle")}, data: admitted.except("bundle").merge(
+              "bundle_ref" => path, "candidate_generation" => params.fetch("candidate_generation") + 1,
+              "producer_origin" => origin_at!(events: events, commit: commit))}
+          end
+          current = candidate_at!(events: events, commit: commit, head: params.fetch("head"), generation: params.fetch("candidate_generation"))
+          if operation == "assign_review"
+            prior = events.reverse.find { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "assign_review" &&
+              event.dig("payload", "data", "candidate_generation") == current.fetch("candidate_generation") }
+            if prior && !events.any? { |event| event.dig("payload", "operation") == "cancel_review" && event.dig("payload", "data", "review_id") == prior.dig("payload", "data", "review_id") }
+              raise AttemptErrors::Conflict, "ordinary review is already assigned"
+            end
+            producer = origin_at!(events: events, commit: commit)
+            reviewer_events = @journal.read_events(params.fetch("reviewer_assignment_id"), commit: commit)
+              .select { |event| event["attempt_id"] == params.fetch("reviewer_attempt_id") }
+            reviewer = ordinary_origin_at!(reviewer_events, commit, running: true)
+            ordinary_independent_agents!(producer.fetch("runtime_binding"), reviewer.fetch("runtime_binding"))
+            observed = @admission.recorded_binding!(binding: reviewer.fetch("runtime_binding"), deadline: deadline)
+            unless observed == reviewer.fetch("runtime_binding")
+              raise AttemptErrors::UnauthorizedIdentity, "ordinary reviewer native binding changed"
+            end
+            start = reviewer_events.find { |event| event["type"] == "process_start" }.fetch("payload")
+            return {events: [], data: current.slice("head", "candidate_generation").merge(
+              "review_id" => SecureRandom.hex(16), "reviewer_assignment_id" => params.fetch("reviewer_assignment_id"),
+              "reviewer_attempt_id" => params.fetch("reviewer_attempt_id"), "reviewer_actor" => start.fetch("actor"),
+              "reviewer_uid" => reviewer.dig("runtime_binding", "process_identity", "uid"),
+              "reviewer_runtime_binding" => reviewer.fetch("runtime_binding"), "producer_origin" => producer, "reviewer_origin" => reviewer)}
+          end
+          assigned = ordinary_review_assignment!(events, current)
+          raise AttemptErrors::Conflict, "ordinary review selection changed" unless assigned.fetch("review_id") == params.fetch("review_id")
+          return {events: [], data: current.slice("head", "candidate_generation").merge("review_id" => assigned.fetch("review_id"))} if operation == "cancel_review"
+          if events.any? { |event| event.dig("payload", "operation") == "accept_review" && event.dig("payload", "data", "review_id") == assigned.fetch("review_id") }
+            raise AttemptErrors::Conflict, "ordinary review already accepted; retain original request"
+          end
+          observed = @admission.execution!(peer: peer, pane: params.fetch("pane"), head: current.fetch("head"), deadline: deadline)
+          unless observed.fetch(:identity).runtime_binding == assigned.fetch("reviewer_runtime_binding") &&
+              observed.fetch(:identity).actor == assigned.fetch("reviewer_actor")
+            raise AttemptErrors::UnauthorizedIdentity, "ordinary reviewer changed before receipt acceptance"
+          end
+          ordinary_accept_review_plan(params, events, commit, assigned, admitted, transfer.bytes(index: 0))
+        end
+
+        def ordinary_candidate_replay!(request, admitted)
+          retained = @journal.mutation_result(request.fetch("mutation_id"))
+          data = retained.fetch("data")
+          bytes = @journal.bounded_blob(data.fetch("bundle_ref"), commit: retained.fetch("journal_commit"), max_bytes: CandidateTransfer::MAX_BYTES)
+          unless data.values_at("head", "tree", "sha256", "bytes") == admitted.values_at("head", "tree", "sha256", "bytes") &&
+              bytes.bytesize == data.fetch("bytes") && Digest::SHA256.hexdigest(bytes) == data.fetch("sha256")
+            raise AttemptErrors::EvidenceUnavailable, "ordinary retained candidate bytes differ"
+          end
+        end
+
+        def ordinary_accept_review_plan(params, events, commit, assigned, admitted, original_bytes)
+          original = admitted.fetch(:receipt)
+          original_model = Models::ExecutionReceipt.from_h(original)
+          unless (original.keys - original_model.to_h.keys).empty? &&
+              original_model.digest == Atoms::EvidenceDigest.digest(original_model.digest_payload)
+            raise AttemptErrors::ReceiptRejected, "ordinary uploaded review digest differs"
+          end
+          binding = assigned.except("generation", "journal_commit")
+          canonical = Molecules::CanonicalEvidence.new(journal: @journal)
+          plan = canonical.import_plan(**ordinary_review_context(binding), artifacts: [original_bytes] + admitted.fetch(:artifacts),
+            admitted_after_event_digest: events.last.fetch("digest"))
+          normalized = original.except("digest", "recorded_at").merge("artifacts" => plan.fetch(:references).drop(1).map { |ref| {"path" => ref.fetch("ref"), "sha256" => ref.fetch("sha256")} })
+          pending = @journal.send(:chain_mutation_events, params.fetch("attempt_id"), events.last.fetch("digest"), plan.fetch(:events))
+          reader = ->(_receipt, artifact) { canonical.read_pending({"ref" => artifact.fetch("path"), "sha256" => artifact.fetch("sha256")},
+            **ordinary_review_context(binding), current_events: events, pending_events: pending, blobs: plan.fetch(:blobs), commit: commit) }
+          verified = ordinary_verify_review!(normalized, events, commit, assigned, reader)
+          path = plan.fetch(:references).first.fetch("ref")
+          data = binding.slice("head", "candidate_generation", "review_id", "reviewer_uid", "reviewer_actor", "reviewer_runtime_binding", "producer_origin")
+            .merge("review_binding" => binding, "review_receipt" => verified.to_h, "receipt_digest" => verified.digest,
+              "original_receipt_ref" => path, "uploaded_receipt_sha256" => admitted.fetch(:receipt_sha256))
+          raise AttemptErrors::ReceiptRejected, "ordinary review reply is oversized" if JSON.generate(data).bytesize > 12_000
+          plan.merge(data: data)
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/ordinary_supervisor.rb

@@ -0,0 +1,99 @@
+# frozen_string_literal: true
+
+module Ace
+  module Assign
+    module Authority
+      # Replacement transfers only result ownership, never worker execution.
+      # The existing definition chain serializes it with canonical generation.
+      module OrdinarySupervisor
+        SUPERVISOR_OPERATIONS = %w[supervisor_status adopt_supervisor].freeze
+
+        private
+
+        def supervisor_operation(request, peer, role, deadline)
+          params = request.fetch("params")
+          assignment = params.fetch("assignment_id")
+          token!(assignment)
+          registered = registration(assignment, commit: @journal.ref_value)
+          raise AttemptErrors::NotFound, "ordinary work is not registered" unless registered
+          if request.fetch("operation") == "supervisor_status"
+            strict!(params, %w[assignment_id])
+            raise ArgumentError, "supervisor status mutation must be null" unless request.fetch("mutation_id").nil?
+            commit = @journal.ref_value
+            selected = supervisor_selection(registered, commit)
+            authorize!(request, peer, role, deadline)
+            return {data: selected.merge("journal_commit" => commit), replayed: false}
+          end
+          strict!(params, %w[assignment_id expected_generation pane previous_binding_sha256])
+          token!(request.fetch("mutation_id"))
+          unless role == :supervisor && params.fetch("expected_generation").is_a?(Integer) &&
+              params.fetch("expected_generation").positive? && params.fetch("previous_binding_sha256").is_a?(String) &&
+              params.fetch("previous_binding_sha256").match?(/\A[0-9a-f]{64}\z/)
+            raise AttemptErrors::UnauthorizedIdentity, "supervisor adoption requires exact current selection"
+          end
+          observed = @admission.identity!(peer: peer, pane: params.fetch("pane"), deadline: deadline)
+          raise AttemptErrors::UnauthorizedIdentity, "replacement is not an installed coordinator" unless observed.role == "coordinator"
+          binding = observed.runtime_binding
+          digest = Atoms::EvidenceDigest.digest({"project_id" => @project, "params" => params, "binding" => binding})
+          @exclusion.with_shared_multi([@exclusion.task_key(registered.fetch("task_id")), @exclusion.assignment_key(assignment)], deadline: deadline) do
+            @journal.mutate(assignment_id: assignment, attempt_id: "definition-#{assignment}",
+              mutation_id: request.fetch("mutation_id"), operation: "adopt_supervisor", parameters_digest: digest,
+              expected_generation: params.fetch("expected_generation"), with_replay: true, deadline: deadline,
+              replay_authorizer: -> {
+                verify_new_supervisor!(request, peer, role, deadline, observed)
+                unless supervisor_selection(registered, @journal.ref_value).fetch("binding") == binding
+                  raise AttemptErrors::UnauthorizedIdentity, "supervisor adoption was superseded"
+                end
+              }) do |_events, prefix, _generation|
+              verify_new_supervisor!(request, peer, role, deadline, observed)
+              previous = supervisor_selection(registered, prefix)
+              unless previous.fetch("binding_sha256") == params.fetch("previous_binding_sha256") && previous.fetch("binding") != binding
+                raise AttemptErrors::Conflict, "original supervisor selection changed"
+              end
+              ended = @admission.supervisor_ended!(binding: previous.fetch("binding"), deadline: deadline)
+              unless ended.is_a?(Hash) && ended["liveness"] == "ended"
+                raise AttemptErrors::EvidenceUnavailable, "original supervisor generation has not ended"
+              end
+              verify_new_supervisor!(request, peer, role, deadline, observed)
+              {events: [], data: {"authority" => "ordinary", "assignment_id" => assignment, "project_id" => @project,
+                "previous_binding" => previous.fetch("binding"), "binding" => binding,
+                "binding_sha256" => Atoms::EvidenceDigest.digest(binding), "ended_observation" => ended}}
+            end
+          end
+        end
+
+        def verify_new_supervisor!(request, peer, role, deadline, observed)
+          authorize!(request, peer, role, deadline)
+          unless @admission.identity!(peer: peer, pane: request.fetch("params").fetch("pane"), deadline: deadline) == observed
+            raise AttemptErrors::UnauthorizedIdentity, "replacement supervisor changed during adoption"
+          end
+        end
+
+        def supervisor_selection(registered, commit)
+          assignment = registered.fetch("assignment_id")
+          events = @journal.read_events(assignment, commit: commit).select { |event| event.fetch("attempt_id") == "definition-#{assignment}" }
+          unless Models::EvidenceEvent.chain_valid?(events)
+            raise AttemptErrors::EvidenceUnavailable, "ordinary supervisor history is corrupt"
+          end
+          selected = registered.fetch("supervisor_binding")
+          generation = 1
+          # Validate the entire old→new chain rather than trusting a local cache.
+          events.select { |event| event["type"] == "authority_mutation" }.each do |event|
+            payload = event.fetch("payload")
+            next if payload.fetch("operation") == "register_assignment"
+            data = payload.fetch("data")
+            unless payload.fetch("operation") == "adopt_supervisor" && data.fetch("previous_binding") == selected &&
+                data.values_at("authority", "assignment_id", "project_id", "generation") == ["ordinary", assignment, @project, generation + 1] &&
+                data.fetch("binding_sha256") == Atoms::EvidenceDigest.digest(data.fetch("binding")) &&
+                data.dig("ended_observation", "liveness") == "ended"
+              raise AttemptErrors::EvidenceUnavailable, "ordinary supervisor adoption chain differs"
+            end
+            selected, generation = data.fetch("binding"), data.fetch("generation")
+          end
+          {"project_id" => @project, "assignment_id" => assignment, "generation" => generation,
+            "binding" => selected, "binding_sha256" => Atoms::EvidenceDigest.digest(selected)}
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/prepared_work.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative "../atoms/candidate_limits"
+
 require "json"
 require "digest"
 require "yaml"
@@ -15,7 +17,7 @@ module Ace
       # byte contract, never a registration, attempt or progress ledger.
       class PreparedWork
         MAX_TEXT = 1024 * 1024
-        MAX_TOTAL = 64 * 1024 * 1024
+        MAX_TOTAL = Atoms::CandidateLimits::PREPARED_BYTES
         MAX_MANIFEST = 32_768
         TOKEN = /\A[a-zA-Z0-9][a-zA-Z0-9._-]{0,199}\z/
         SCOPE = /\A[0-9]+(?:\.[0-9]+)*\z/
@@ -28,7 +30,10 @@ module Ace
         def initialize(files:)
           invalid!("file inventory") unless files.is_a?(Hash) && files.size.between?(4, 4096)
           @files = files.to_h do |path, bytes|
-            invalid!("file path") unless path.is_a?(String) && !path.start_with?("/") && path.split("/", -1).all? { |part| !part.empty? && !%w[. .. .git].include?(part.downcase) }
+            invalid!("file path") unless path.is_a?(String) && !path.start_with?("/") &&
+              path.bytesize <= Atoms::CandidateLimits::PATH_BYTES &&
+              path.split("/", -1).all? { |part| !part.empty? && part.bytesize <= Atoms::CandidateLimits::PATH_COMPONENT_BYTES &&
+                !%w[. .. .git].include?(part.downcase) }
             invalid!("text size") unless bytes.is_a?(String) && bytes.bytesize.between?(1, MAX_TEXT)
             text = bytes.dup.force_encoding(Encoding::UTF_8)
             invalid!("UTF-8") unless text.valid_encoding? && !text.include?("\0")