ace-assign 0.70.0 → 0.71.0

data/lib/ace/assign/authority/release_artifact_manifest.rb

@@ -0,0 +1,91 @@
+# frozen_string_literal: true
+
+require "digest"
+require "json"
+require "stringio"
+require "zlib"
+require "rubygems/package"
+require_relative "../molecules/canonical_evidence"
+
+module Ace
+  module Assign
+    module Authority
+      # One retained gem and the source-owned publication input it binds.
+      # Inspect bounded metadata only; never extract or evaluate build files.
+      module ReleaseArtifactManifest
+        FIELDS = %w[gem_name version platform registry sha256 bytes].freeze
+        NAME = /\A[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}\z/
+        MAX_METADATA_BYTES = 1024 * 1024
+        REGISTRY = "https://rubygems.org"
+
+        def self.validate!(value)
+          unless value.is_a?(Hash) && value.keys.sort == FIELDS.sort &&
+              value["gem_name"].is_a?(String) && NAME.match?(value["gem_name"]) &&
+              value["version"].is_a?(String) && value["version"].bytesize.between?(1, 128) && Gem::Version.correct?(value["version"]) &&
+              value["platform"].is_a?(String) && NAME.match?(value["platform"]) &&
+              value["registry"] == REGISTRY && value["sha256"].is_a?(String) && value["sha256"].match?(/\A[0-9a-f]{64}\z/) &&
+              value["bytes"].is_a?(Integer) && value["bytes"].between?(1, Molecules::CanonicalEvidence::MAX_RELEASE_ARTIFACT_BYTES)
+            raise ArgumentError, "invalid release artifact manifest"
+          end
+          value
+        end
+
+        def self.verify!(bytes, manifest)
+          validate!(manifest)
+          unless bytes.is_a?(String) && bytes.bytesize == manifest.fetch("bytes") &&
+              Digest::SHA256.hexdigest(bytes.b) == manifest.fetch("sha256")
+            raise AttemptErrors::ReceiptRejected, "release artifact bytes differ from the manifest"
+          end
+          metadata = metadata!(bytes)
+          unless metadata == manifest.slice("gem_name", "version", "platform")
+            raise AttemptErrors::ReceiptRejected, "release artifact gem metadata differs from the manifest"
+          end
+          true
+        end
+
+        # Shared immutable input for retention and the later fixed publisher.
+        # Candidate/reference come from the installed canonical owner, not wire
+        # claims. Its digest is the existing service authorization input_digest.
+        def self.publication_input(manifest:, candidate:, reference:)
+          validate!(manifest)
+          {"target" => {"resource" => "rubygems:#{manifest.fetch('gem_name')}:#{manifest.fetch('version')}",
+            "artifact_digest" => manifest.fetch("sha256")},
+           "publication" => manifest.slice("gem_name", "version", "platform", "registry").merge(
+             "head" => candidate.fetch("head"), "tree" => candidate.fetch("tree"), "candidate_reference" => reference,
+             "artifact_bytes" => manifest.fetch("bytes"), "artifact_relative_path" => "artifacts/#{manifest.fetch('sha256')}.gem")}
+        end
+
+        def self.metadata!(bytes)
+          metadata = nil
+          Gem::Package::TarReader.new(StringIO.new(bytes)) do |archive|
+            archive.each do |entry|
+              next unless entry.full_name == "metadata.gz"
+              unless metadata.nil? && entry.file? && entry.header.size.between?(1, MAX_METADATA_BYTES)
+                raise AttemptErrors::ReceiptRejected, "release artifact metadata is missing, repeated or oversized"
+              end
+              compressed = entry.read
+              Zlib::GzipReader.wrap(StringIO.new(compressed)) do |reader|
+                metadata = reader.read(MAX_METADATA_BYTES + 1)
+                if metadata.bytesize > MAX_METADATA_BYTES
+                  raise AttemptErrors::ReceiptRejected, "release artifact metadata exceeds its bound"
+                end
+              end
+            end
+          end
+          raise AttemptErrors::ReceiptRejected, "release artifact metadata is unavailable" unless metadata
+          specification = Gem::Specification.from_yaml(metadata)
+          unless specification.is_a?(Gem::Specification)
+            raise AttemptErrors::ReceiptRejected, "release artifact metadata is invalid"
+          end
+          {"gem_name" => specification.name, "version" => specification.version.to_s,
+            "platform" => specification.platform.to_s}
+        rescue AttemptErrors::ReceiptRejected
+          raise
+        rescue StandardError
+          raise AttemptErrors::ReceiptRejected, "release artifact metadata is invalid"
+        end
+        private_class_method :metadata!
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/retained_input.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+require "json"
+require "digest"
+require_relative "private_directory"
+
+module Ace
+  module Assign
+    module Authority
+      # Immutable requester inputs, never evidence that an operation executed.
+      module RetainedInput
+        module_function
+
+        def read_file(path, limit)
+          File.open(path, File::RDONLY | File::NOFOLLOW | File::NONBLOCK) do |file|
+            before = file.stat
+            raise ArgumentError, "retained input is not a bounded regular file" unless before.file? && before.size.between?(0, limit)
+            bytes = (file.read(limit + 1) || "").b
+            after, selected = file.stat, File.lstat(path)
+            identity = ->(stat) { [stat.dev, stat.ino, stat.size, stat.mtime, stat.ctime] }
+            unless bytes.bytesize == before.size && identity.call(before) == identity.call(after) &&
+                identity.call(after) == identity.call(selected) && !selected.symlink?
+              raise ArgumentError, "retained input changed during read"
+            end
+            bytes.freeze
+          end
+        end
+
+        def json(path, limit = 16_384)
+          JSON.parse(read_file(path, limit), allow_duplicate_key: false, create_additions: false, max_nesting: 24)
+        end
+
+        def create_output(path)
+          raise ArgumentError, "output must be a new directory path" unless path.is_a?(String) && !path.empty?
+          directory = File.expand_path(path)
+          Dir.mkdir(directory, 0o700)
+          PrivateDirectory.verify!(directory)
+          directory
+        end
+
+        def write_file(directory, name, bytes)
+          raise ArgumentError, "retained filename is invalid" unless File.basename(name) == name && !%w[. ..].include?(name)
+          File.open(File.join(directory, name), File::WRONLY | File::CREAT | File::EXCL | File::NOFOLLOW, 0o600) do |file|
+            file.write(bytes)
+            file.flush
+            file.fsync
+          end
+          File.open(directory) { |file| file.fsync }
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/transfer_codec.rb

@@ -5,6 +5,7 @@ require "tempfile"
 require "timeout"
 require "ace/runtime/molecules/protected_socket"
 require_relative "private_directory"
+require_relative "../atoms/candidate_limits"
 
 module Ace
   module Assign
@@ -13,10 +14,11 @@ module Ace
       # Server selects purpose from a source handler's fixed operation table,
       # admits a transfer slot before calling, and holds no journal lock here.
       class TransferCodec
-        LIMITS = {prompt_text: [16_384, 1, 16_384], scope_boundary_observation: [65_536, 1, 65_536], candidate: [64 * 1024 * 1024, 1, 64 * 1024 * 1024],
+        LIMITS = {prompt_text: [16_384, 1, 16_384], scope_boundary_observation: [65_536, 1, 65_536], candidate: [Atoms::CandidateLimits::BYTES, 1, Atoms::CandidateLimits::BYTES],
+                  release_artifact: [64 * 1024 * 1024, 1, 64 * 1024 * 1024],
                   artifacts: [256 * 1024, 16, 64 * 1024],
                   receipt_artifacts: [272 * 1024, 17, 64 * 1024],
-                  service_input: [64 * 1024, 1, 64 * 1024], assignment_snapshot: [64 * 1024 * 1024, 1, 64 * 1024 * 1024]}.freeze
+                  service_input: [64 * 1024, 1, 64 * 1024], assignment_snapshot: [Atoms::CandidateLimits::BYTES, 1, Atoms::CandidateLimits::BYTES]}.freeze
         SHA256 = /\A[0-9a-f]{64}\z/
 
         class Input
@@ -149,7 +151,7 @@ module Ace
                 part["bytes"].is_a?(Integer) && part["bytes"].between?(0, each) &&
                 part["sha256"].is_a?(String) && part["sha256"].match?(SHA256) } &&
               descriptor["bytes"] == descriptor["parts"].sum { |part| part["bytes"] } &&
-              (!%i[candidate service_input prompt_text assignment_snapshot].include?(purpose) || descriptor["bytes"].positive?)
+              (!%i[candidate service_input prompt_text assignment_snapshot release_artifact].include?(purpose) || descriptor["bytes"].positive?)
             reject!("Invalid or oversized transfer descriptor")
           end
           if purpose == :receipt_artifacts

data/lib/ace/assign/cli/commands/submit_candidate.rb

@@ -23,7 +23,7 @@ module Ace
             head = require_option(options, :head, usage)
             raise Ace::Support::Cli::Error, "Head must be an exact SHA-1" unless head.match?(/\A[0-9a-f]{40}\z/)
             params.merge!("head" => head, "candidate_generation" => integer_option(options, :candidate_generation, usage))
-            bytes = input_bytes(require_option(options, :bundle, usage), limit: 64 * 1024 * 1024)
+            bytes = input_bytes(require_option(options, :bundle, usage), limit: Ace::Assign::Authority::CandidateTransfer::MAX_BYTES)
             parts = [bytes]
             emit_json(upload_call(client, "submit_candidate", params, mutation, parts, :candidate))
           end

data/lib/ace/assign/molecules/canonical_evidence.rb

@@ -14,8 +14,12 @@ module Ace
         MAX_TOTAL_BYTES = 256 * 1024
         MAX_ARTIFACTS = 16
         ID = /\A[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}\z/
+        MAX_RELEASE_ARTIFACT_BYTES = 64 * 1024 * 1024
         ROLES = {"service" => "executor", "review" => "reviewer",
-                 "result" => "worker"}.freeze
+                 "result" => "worker", "release-artifact" => "worker"}.freeze
+        REPORT_LIMITS = [MAX_ARTIFACT_BYTES, MAX_TOTAL_BYTES, MAX_ARTIFACTS].freeze
+        LIMITS = {"service" => REPORT_LIMITS, "review" => REPORT_LIMITS, "result" => REPORT_LIMITS,
+          "release-artifact" => [MAX_RELEASE_ARTIFACT_BYTES, MAX_RELEASE_ARTIFACT_BYTES, 1].freeze}.freeze
         DESCRIPTOR_FIELDS = %w[version artifact_id kind project_id assignment_id attempt_id peer_uid role
           binding_digest sha256 bytes admitted_at admitted_after_event_digest request_id_or_event_id
           candidate_generation_or_claim_generation].freeze
@@ -27,7 +31,8 @@ module Ace
             %w[artifact_id project_id assignment_id attempt_id request_id_or_event_id].all? { |key| descriptor[key].is_a?(String) && descriptor[key].match?(ID) } &&
             %w[binding_digest sha256 admitted_after_event_digest].all? { |key| descriptor[key].is_a?(String) && descriptor[key].match?(/\A[0-9a-f]{64}\z/) } &&
             descriptor["peer_uid"].is_a?(Integer) && descriptor["peer_uid"] >= 0 &&
-            descriptor["bytes"].is_a?(Integer) && descriptor["bytes"].between?(0, MAX_ARTIFACT_BYTES) &&
+            descriptor["bytes"].is_a?(Integer) && descriptor["bytes"].between?(descriptor["kind"] == "release-artifact" ? 1 : 0,
+              LIMITS.fetch(descriptor["kind"]).first) &&
             descriptor["candidate_generation_or_claim_generation"].is_a?(Integer) && descriptor["candidate_generation_or_claim_generation"] >= 0 &&
             descriptor["admitted_at"].is_a?(String)
           Time.iso8601(descriptor.fetch("admitted_at"))
@@ -46,13 +51,15 @@ module Ace
         def import_plan(kind:, project_id:, assignment_id:, attempt_id:, peer_uid:, binding:,
           request_id_or_event_id:, generation:, admitted_after_event_digest:, artifacts:)
           role = ROLES.fetch(kind) { raise ArgumentError, "invalid evidence kind" }
+          max_each, max_total, max_count = LIMITS.fetch(kind)
+          minimum = kind == "release-artifact" ? 1 : 0
           ids = [project_id, assignment_id, attempt_id, request_id_or_event_id]
           unless ids.all? { |id| id.is_a?(String) && id.match?(ID) } && binding.is_a?(Hash) &&
               admitted_after_event_digest.is_a?(String) && admitted_after_event_digest.match?(/\A[0-9a-f]{64}\z/) &&
               peer_uid.is_a?(Integer) && peer_uid >= 0 && generation.is_a?(Integer) && generation >= 0 &&
-              artifacts.is_a?(Array) && !artifacts.empty? && artifacts.length <= MAX_ARTIFACTS &&
-              artifacts.all? { |bytes| bytes.is_a?(String) && bytes.bytesize <= MAX_ARTIFACT_BYTES } &&
-              artifacts.sum(&:bytesize) <= MAX_TOTAL_BYTES
+              artifacts.is_a?(Array) && !artifacts.empty? && artifacts.length <= max_count &&
+              artifacts.all? { |bytes| bytes.is_a?(String) && bytes.bytesize.between?(minimum, max_each) } &&
+              artifacts.sum(&:bytesize) <= max_total
             raise ArgumentError, "invalid or oversized canonical evidence import"
           end
           events = []
@@ -85,7 +92,11 @@ module Ace
           verified_bytes(reference, events: events, kind: kind, project_id: project_id,
             assignment_id: assignment_id, attempt_id: attempt_id, peer_uid: peer_uid, binding: binding,
             request_id_or_event_id: request_id_or_event_id, generation: generation) do |path|
-            @journal.blob(path, commit: commit)
+            if kind == "release-artifact"
+              @journal.bounded_blob(path, commit: commit, max_bytes: MAX_RELEASE_ARTIFACT_BYTES)
+            else
+              @journal.blob(path, commit: commit)
+            end
           end
         end
 
@@ -102,7 +113,13 @@ module Ace
           verified_bytes(reference, events: events, kind: kind, project_id: project_id,
             assignment_id: assignment_id, attempt_id: attempt_id, peer_uid: peer_uid, binding: binding,
             request_id_or_event_id: request_id_or_event_id, generation: generation) do |path|
-            blobs.key?(path) ? blobs.fetch(path) : @journal.blob(path, commit: commit)
+            if blobs.key?(path)
+              blobs.fetch(path)
+            elsif kind == "release-artifact"
+              @journal.bounded_blob(path, commit: commit, max_bytes: MAX_RELEASE_ARTIFACT_BYTES)
+            else
+              @journal.blob(path, commit: commit)
+            end
           end
         end
 
@@ -137,7 +154,7 @@ module Ace
           end
           Time.iso8601(descriptor.fetch("admitted_at"))
           bytes = yield(reference.fetch("ref"))
-          unavailable! unless bytes.is_a?(String) && bytes.bytesize <= MAX_ARTIFACT_BYTES && bytes.bytesize == descriptor["bytes"] &&
+          unavailable! unless bytes.is_a?(String) && bytes.bytesize <= LIMITS.fetch(kind).first && bytes.bytesize == descriptor["bytes"] &&
             Digest::SHA256.hexdigest(bytes) == descriptor["sha256"]
           bytes
         rescue ArgumentError, KeyError, TypeError

data/lib/ace/assign/molecules/evidence_journal.rb

@@ -7,6 +7,7 @@ require_relative "../atoms/fixed_merge_schemas"
 require "digest"
 require "fileutils"
 require "json"
+require_relative "../atoms/git_blob_batch"
 require "open3"
 require "pathname"
 require "ace/herdr/molecules/bounded_process"
@@ -375,13 +376,10 @@ module Ace
           else
             bounded_history_read!(%w[cat-file --batch-check], oids.join("\n") + "\n", oids.size * 128)
           end
-          lines = raw.lines
-          raise AttemptErrors::EvidenceUnavailable, "historical blob metadata count differs" unless lines.size == oids.size
-          lines.zip(oids).map do |line, oid|
-            match = /\A([0-9a-f]{40}) blob (0|[1-9][0-9]*)\n\z/.match(line)
-            raise AttemptErrors::EvidenceUnavailable, "historical blob metadata differs" unless match && match[1] == oid
-            match[2].to_i
-          end
+          Atoms::GitBlobBatch.sizes(oids, raw)
+        rescue Atoms::GitBlobBatch::Invalid => error
+          message = error.reason == :count ? "historical blob metadata count differs" : "historical blob metadata differs"
+          raise AttemptErrors::EvidenceUnavailable, message
         end
 
         def bounded_history_read!(argv, stdin, limit)
@@ -1086,26 +1084,11 @@ module Ace
         end
 
         def decode_event_blobs!(entries, output)
-          output = output.b
-          offset = 0
-          entries.map do |oid, size|
-            ending = output.index("\n", offset)
-            unless ending && ending - offset <= 127 && output.byteslice(offset, ending - offset) == "#{oid} blob #{size}"
-              raise AttemptErrors::EvidenceUnavailable, "canonical blob batch header is invalid"
-            end
-            offset = ending + 1
-            content = output.byteslice(offset, size)
-            unless content&.bytesize == size && output.byteslice(offset + size, 1) == "\n" &&
-                Digest::SHA1.hexdigest("blob #{size}\0" + content) == oid
-              raise AttemptErrors::EvidenceUnavailable, "canonical blob batch bytes are invalid"
-            end
-            offset += size + 1
-            content
-          end.tap do
-            unless offset == output.bytesize
-              raise AttemptErrors::EvidenceUnavailable, "canonical blob batch has unexpected trailing bytes"
-            end
-          end
+          Atoms::GitBlobBatch.decode(entries, output)
+        rescue Atoms::GitBlobBatch::Invalid => error
+          message = {header: "canonical blob batch header is invalid", bytes: "canonical blob batch bytes are invalid",
+            trailing: "canonical blob batch has unexpected trailing bytes"}.fetch(error.reason, "canonical blob batch selector is invalid")
+          raise AttemptErrors::EvidenceUnavailable, message
         end
 
         def update_service_request(request_id, expected:, replacement:, event_type:, guard: nil)
@@ -1360,7 +1343,7 @@ module Ace
         # CAS transition, so a receiver restart can never dispatch a second
         # merge for the same admitted record. An already-started claim refuses;
         # only the winning effect may later settle it.
-        def begin_fixed_merge_request(request_id)
+        def begin_fixed_merge_request(request_id, guard: nil)
           current = fixed_merge_request(request_id)
           raise AttemptErrors::NotFound, "Fixed merge request #{request_id} not found" unless current
           if current["state"] == "uncertain"
@@ -1371,7 +1354,7 @@ module Ace
           end
           update_fixed_merge_request(request_id, expected: current,
             replacement: current.merge("state" => "uncertain", "claimed_at" => Time.now.utc.iso8601(9)),
-            event_type: "merge_transition", guard: -> { verify_fixed_proposal!(current) })
+            event_type: "merge_transition", guard: -> { guard&.call; verify_fixed_proposal!(current) })
         end
 
         # Terminal settlement: succeeded/failed with the exact receipt
@@ -1527,7 +1510,11 @@ module Ace
               raise AttemptErrors::InvalidState, "Fixed merge request needs an initial admission"
             end
             if existing
-              return {record: existing, replayed: true} if fixed_replay?(existing, replacement)
+              if fixed_replay?(existing, replacement)
+                conflict = guard&.call
+                raise_authorization_conflict!(conflict) if conflict
+                return {record: existing, replayed: true}
+              end
               raise AttemptErrors::Conflict, "Fixed merge request #{request_id} has different input"
             end
             unless Molecules::FixedEffectReference.valid?(replacement.fetch("reference"))

data/lib/ace/assign/molecules/journal_mutation.rb

@@ -4,6 +4,7 @@ require "json"
 require "digest"
 require "ace/herdr/molecules/bounded_process"
 require_relative "journal_prompt_mutation"
+require_relative "../atoms/candidate_limits"
 require_relative "journal_input_inhibition"
 
 module Ace
@@ -192,7 +193,7 @@ module Ace
         def bounded_blob(path, commit:, max_bytes:)
           validate_blob_path!(path)
           unless commit.is_a?(String) && commit.match?(/\A[0-9a-f]{40}(?:[0-9a-f]{24})?\z/) &&
-              max_bytes.is_a?(Integer) && max_bytes.between?(1, 64 * 1024 * 1024)
+              max_bytes.is_a?(Integer) && max_bytes.between?(1, Atoms::CandidateLimits::BYTES)
             raise AttemptErrors::EvidenceUnavailable, "Canonical prepared blob selector differs"
           end
           return @read_boundary.blob(path, commit: commit, max_bytes: max_bytes) if @read_boundary

data/lib/ace/assign/molecules/receipt_verifier.rb

@@ -24,7 +24,7 @@ module Ace
         # @param identity_resolver [ExecutionIdentityResolver] Trust boundary
         # @param artifact_reader [#call, nil] Source-owned canonical byte
         #   reader for protected composition; nil selects explicit local files
-        def initialize(identity_resolver: nil, artifact_reader: nil, campaign_verifier: nil)
+        def initialize(identity_resolver: nil, artifact_reader: nil, campaign_verifier: nil, review_independence_verifier: nil)
           @identity_resolver = identity_resolver || ExecutionIdentityResolver.new
           unless artifact_reader.nil? || artifact_reader.respond_to?(:call)
             raise ArgumentError, "artifact reader must be a source-owned callable"
@@ -34,6 +34,10 @@ module Ace
             raise ArgumentError, "campaign verifier must be a source-owned callable"
           end
           @campaign_verifier = campaign_verifier
+          unless review_independence_verifier.nil? || review_independence_verifier.respond_to?(:call)
+            raise ArgumentError, "review independence verifier must be a source-owned callable"
+          end
+          @review_independence_verifier = review_independence_verifier
         end
 
         # Validate a submitted receipt against an attempt.
@@ -222,7 +226,9 @@ module Ace
           reject_unless(reviewer.is_a?(Hash) && !reviewer["actor"].to_s.strip.empty?, "review must name an executed reviewer")
 
           producer_actor = data.dig("producer", "actor").to_s.strip
-          if reviewer["actor"].to_s.strip == producer_actor
+          if @review_independence_verifier
+            reject("canonical reviewer independence is unverifiable") unless @review_independence_verifier.call(data) == true
+          elsif reviewer["actor"].to_s.strip == producer_actor
             reject("reviewer and producer must differ (self-approval rejected)")
           end
 

data/lib/ace/assign/molecules/runtime_control_surface_runner.rb

@@ -12,9 +12,10 @@ module Ace
       # operation delegates to the resolved Ace::Runtime adapter; assign
       # never calls a runtime-native API directly (k86.3 interface rule).
       class RuntimeControlSurfaceRunner
-        def initialize(runtime: nil, env: ENV)
+        def initialize(runtime: nil, env: ENV, adapter: nil)
           @runtime_name = runtime
           @env = env
+          @runtime = adapter
         end
 
         attr_reader :runtime_name, :env

data/lib/ace/assign/organisms/attempt_coordinator.rb

@@ -37,7 +37,7 @@ module Ace
         # @param identity_resolver [Molecules::ExecutionIdentityResolver, nil] Trust boundary
         # @param verifier [Molecules::ReceiptVerifier, nil] Receipt verifier
         def initialize(cache_base: nil, repo_root: nil, journal: nil, identity_resolver: nil, verifier: nil,
-          lifecycle_exclusion: nil, recorded_binding_observer: nil)
+          lifecycle_exclusion: nil, recorded_binding_observer: nil, ordinary_merge_evidence: nil)
           unless recorded_binding_observer.nil? || recorded_binding_observer.respond_to?(:call)
             raise ArgumentError, "recorded native binding observer must be callable"
           end
@@ -49,6 +49,7 @@ module Ace
           @verifier = verifier || Molecules::ReceiptVerifier.new(identity_resolver: @identity_resolver)
           @lifecycle_exclusion = lifecycle_exclusion
           @recorded_binding_observer = recorded_binding_observer
+          @ordinary_merge_evidence = ordinary_merge_evidence
         end
 
         attr_reader :store
@@ -328,6 +329,7 @@ module Ace
           # never need message-string discrimination: replay/binding conflicts
           # stay Conflict, a consumed authorization is AuthorizationConflict.
           guard = lambda do
+            verify_fixed_merge_evidence!(record)
             conflict = journal_for.fixed_authorization_conflict(record)
             if conflict
               raise AttemptErrors::AuthorizationConflict,
@@ -335,15 +337,50 @@ module Ace
             end
             nil
           end
-          journal_for.admit_fixed_merge_request(record, guard: guard)
+          with_fixed_merge_scope(record) do
+            journal_for.admit_fixed_merge_request(record, guard: guard)
+          end
         end
 
         # Begin the fixed effect (pending -> uncertain). The single CAS
         # transition is the at-most-one-merge proof: a restarted receiver
         # refuses an already-started claim and must not dispatch again.
         def begin_fixed_merge_effect(request_id)
-          journal_for.begin_fixed_merge_request(request_id)
+          record = journal_for.fixed_merge_request(request_id)
+          raise AttemptErrors::NotFound, "fixed merge record is unavailable" unless record
+          with_fixed_merge_scope(record) do
+            journal_for.begin_fixed_merge_request(request_id, guard: -> { verify_fixed_merge_evidence!(record) })
+          end
+        end
+
+        # Hold the existing assignment exclusion through the external effect.
+        # Review cancellation/head changes/finish cannot race this interval.
+        def with_fixed_merge_evidence(record)
+          with_fixed_merge_scope(record, exclusive: true) do
+            verify_fixed_merge_evidence!(record)
+            yield
+          end
+        end
+
+        def verify_fixed_merge_evidence!(record)
+          unless @ordinary_merge_evidence
+            raise AttemptErrors::ReceiptRejected, "canonical ordinary merge evidence owner is not installed"
+          end
+          @ordinary_merge_evidence.verify_merge_evidence_at!(record: record, commit: journal_for.ref_value,
+            deadline: Process.clock_gettime(Process::CLOCK_MONOTONIC) + 30)
+          nil
+        rescue AttemptErrors::EvidenceUnavailable, AttemptErrors::UnauthorizedIdentity, AttemptErrors::Conflict, AttemptErrors::NotFound
+          raise AttemptErrors::ReceiptRejected, "canonical ordinary review or executed test evidence is unavailable"
+        end
+
+        def with_fixed_merge_scope(record, exclusive: false, &block)
+          unless @ordinary_merge_evidence
+            raise AttemptErrors::ReceiptRejected, "canonical ordinary merge evidence owner is not installed"
+          end
+          @ordinary_merge_evidence.with_merge_scope(record: record, exclusive: exclusive,
+            deadline: Process.clock_gettime(Process::CLOCK_MONOTONIC) + 30, &block)
         end
+        private :with_fixed_merge_scope
 
         # Settle the fixed effect with the exact terminal receipt. The
         # journal validates the closed receipt schema and its binding to the