ace-assign 0.70.0 → 0.73.0

data/lib/ace/assign/authority/prepared_queue.rb

@@ -1,185 +0,0 @@
-# frozen_string_literal: true
-
-require "fileutils"
-require "securerandom"
-require "yaml"
-require_relative "prepared_work"
-require_relative "private_directory"
-require_relative "../molecules/lifecycle_exclusion"
-require_relative "../organisms/assignment_executor"
-
-module Ace
-  module Assign
-    module Authority
-      # Existing assignment/progress files, rooted only in the authenticated
-      # original worker scratch. This cache never supplies authority or a graph.
-      class PreparedQueue
-        attr_reader :cache_base, :directory, :work, :descriptor
-
-        def initialize(work:, descriptor:)
-          @work, @descriptor = work, descriptor
-          @scratch = PrivateDirectory.verify!(descriptor.fetch("original_worker_scratch_root"))
-          %w[mapping_id attempt_id assignment_id].each do |field|
-            value = descriptor.fetch(field)
-            unavailable!("queue identity") unless value.is_a?(String) && value.match?(PreparedWork::TOKEN)
-          end
-          @cache_base = File.join(@scratch, "prepared-queues", descriptor.fetch("mapping_id"), descriptor.fetch("attempt_id"))
-          @directory = File.join(cache_base, descriptor.fetch("assignment_id"))
-          definition = JSON.parse(work.definition_bytes(head: descriptor.fetch("prepared_head"), tree: descriptor.fetch("prepared_tree")))
-          unavailable!("captured assignment metadata") unless %w[name source_config created_at].all? do |field|
-            definition[field].is_a?(String) && !definition[field].empty?
-          end
-          validate_timestamp!(definition.fetch("created_at"))
-          validate_timestamp!(definition["updated_at"]) if definition.key?("updated_at")
-          @metadata = Models::Assignment.from_h(definition, cache_dir: directory).to_h
-          lock_root = File.join(@scratch, "prepared-queue-exclusion")
-          private_directory!(lock_root, create: true)
-          @exclusion = Molecules::LifecycleExclusion.new(root: lock_root)
-          @key = @exclusion.assignment_key(descriptor.values_at("mapping_id", "attempt_id", "assignment_id").join(":"))
-        end
-
-        # Called ONLY after the fixed adapter proves actual original self. Later
-        # CLI consumers use with_executor and cannot recreate a missing queue.
-        def activate_original!
-          @exclusion.with_exclusive(@key) do
-            publish_initial! unless File.exist?(directory) || File.symlink?(directory)
-            executor = verified_executor
-            result = executor.status
-            state = result.fetch(:state)
-            unavailable!("selected queue has failed progress") unless state.failed.empty?
-            return nil if state.subtree_complete?(descriptor.fetch("scope"))
-            unless state.steps.all? { |step| step.status == :pending }
-              unavailable!("original adapter has already activated queue progress")
-            end
-            root = state.find_by_number(descriptor.fetch("scope"))
-            unavailable!("original selected fork root") unless root && root.fork?
-            executor.step_writer.mark_active(root.file_path)
-            # Same held-byte consumer validates the resulting progress before
-            # returning to the adapter that may now start its provider.
-            executor.status
-            root
-          end
-        end
-
-        def with_executor
-          @exclusion.with_exclusive(@key) do
-            unavailable!("published queue is unavailable; no reconstruction") unless File.directory?(directory)
-            yield verified_executor
-          end
-        end
-
-        private
-
-        def verified_executor
-          private_directory!(directory)
-          private_directory!(File.join(directory, "steps"))
-          private_directory!(File.join(directory, "reports"))
-          metadata = work.parse_queue_metadata!(held_read(File.join(directory, "assignment.yaml"), PreparedWork::MAX_MANIFEST))
-          unavailable!("queue assignment metadata differs") unless metadata.is_a?(Hash) &&
-            metadata.reject { |key, _| key == "updated_at" } == @metadata.reject { |key, _| key == "updated_at" }
-          validate_timestamp!(metadata["updated_at"]) if metadata.key?("updated_at")
-          unavailable!("queue job differs") unless held_read(File.join(directory, "job.yaml"), PreparedWork::MAX_TEXT) == work.files.fetch("job.yaml")
-          owner = self
-          scanner = Molecules::QueueScanner.new
-          parser = scanner.method(:scan_captured)
-          scanner.define_singleton_method(:scan) do |steps_dir, assignment:|
-            raise AttemptErrors::EvidenceUnavailable, "prepared queue scanner path differs" unless steps_dir == File.join(owner.directory, "steps")
-            steps, reports = owner.send(:captured_queue)
-            parser.call(steps: steps, assignment: assignment, reports: reports)
-          end
-          Organisms::AssignmentExecutor.new(cache_base: cache_base,
-            selected_assignment: Models::Assignment.from_h(metadata, cache_dir: directory), queue_scanner: scanner)
-        end
-
-        def captured_queue
-          expected = work.manifest.fetch("steps").map { |entry| entry.fetch("filename") }
-          steps_dir = File.join(directory, "steps")
-          unavailable!("queue step inventory differs") unless Dir.children(steps_dir).sort == expected.sort
-          steps = expected.to_h do |filename|
-            bytes = held_read(File.join(steps_dir, filename), PreparedWork::MAX_TEXT)
-            parsed = work.parse_queue_step!(bytes)
-            accepted = work.parse_queue_step!(work.files.fetch("steps/" + filename))
-            projection = ->(value) { value.fetch(:frontmatter).reject { |key, _| PreparedWork::PROGRESS.include?(key) } }
-            unless projection.call(parsed) == projection.call(accepted) && parsed.fetch(:body) == accepted.fetch(:body) &&
-                %w[pending active done failed].include?(parsed.fetch(:frontmatter).fetch("status", "pending"))
-              unavailable!("queue work-bearing input differs")
-            end
-            [filename, bytes]
-          end
-          reports_dir = File.join(directory, "reports")
-          allowed = work.manifest.fetch("steps").map do |entry|
-            name = work.parse_queue_step!(work.files.fetch("steps/" + entry.fetch("filename"))).fetch(:frontmatter).fetch("name")
-            Atoms::StepFileParser.generate_report_filename(entry.fetch("number"), name)
-          end
-          reports = Dir.children(reports_dir).to_h do |filename|
-            unavailable!("queue report inventory differs") unless allowed.include?(filename)
-            bytes = held_read(File.join(reports_dir, filename), PreparedWork::MAX_TEXT)
-            work.parse_queue_step!(bytes)
-            [filename, bytes]
-          end
-          [steps.freeze, reports.freeze]
-        end
-
-        def publish_initial!
-          private_directory!(File.join(@scratch, "prepared-queues"), create: true)
-          private_directory!(File.dirname(cache_base), create: true)
-          private_directory!(cache_base, create: true)
-          stage = File.join(cache_base, ".prepared-#{SecureRandom.hex(12)}")
-          Dir.mkdir(stage, 0700)
-          %w[steps reports].each { |name| Dir.mkdir(File.join(stage, name), 0700) }
-          durable_write(File.join(stage, "assignment.yaml"), @metadata.to_yaml)
-          durable_write(File.join(stage, "job.yaml"), work.files.fetch("job.yaml"))
-          work.manifest.fetch("steps").each do |entry|
-            name = entry.fetch("filename")
-            durable_write(File.join(stage, "steps", name), work.files.fetch("steps/" + name))
-          end
-          %w[steps reports].each { |name| File.open(File.join(stage, name), File::RDONLY) { |file| file.fsync } }
-          File.open(stage, File::RDONLY) { |file| file.fsync }
-          unavailable!("queue publication collision") if File.exist?(directory) || File.symlink?(directory)
-          File.rename(stage, directory)
-          File.open(cache_base, File::RDONLY) { |file| file.fsync }
-        ensure
-          FileUtils.remove_entry(stage) if stage && File.directory?(stage) && !File.symlink?(stage)
-        end
-
-        def private_directory!(path, create: false)
-          Dir.mkdir(path, 0700) if create && !File.exist?(path) && !File.symlink?(path)
-          PrivateDirectory.verify!(path)
-        end
-
-        def durable_write(path, bytes)
-          File.open(path, File::WRONLY | File::CREAT | File::EXCL | File::NOFOLLOW, 0600) do |file|
-            file.write(bytes); file.flush; file.fsync
-          end
-        end
-
-        def held_read(path, limit)
-          File.open(path, File::RDONLY | File::NOFOLLOW | File::NONBLOCK) do |file|
-            before = file.stat
-            unavailable!("queue held file kind/size") unless before.file? && before.uid == Process.uid &&
-              (before.mode & 0077).zero? && before.size.between?(1, limit)
-            bytes = file.read(limit + 1).force_encoding(Encoding::UTF_8)
-            after = file.stat
-            unavailable!("queue held file changed") unless bytes.valid_encoding? && !bytes.include?("\0") &&
-              bytes.bytesize == before.size && [before.dev, before.ino, before.size, before.mtime, before.ctime] ==
-                [after.dev, after.ino, after.size, after.mtime, after.ctime]
-            bytes.freeze
-          end
-        rescue SystemCallError
-          unavailable!("queue held file unavailable")
-        end
-
-        def unavailable!(reason)
-          raise AttemptErrors::EvidenceUnavailable, "prepared_input_unavailable: #{reason}"
-        end
-
-        def validate_timestamp!(value)
-          unavailable!("captured assignment timestamp") unless value.is_a?(String)
-          Time.iso8601(value)
-        rescue ArgumentError
-          unavailable!("captured assignment timestamp")
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/authority/prepared_task_context.rb

@@ -1,116 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "protected_assignment_context"
-require_relative "task_context_entry"
-
-module Ace
-  module Assign
-    module Authority
-      # The selected immutable Lab owner sets the hook before entry evaluation.
-      # Its presence alone never grants scope; original fetch admission decides.
-      class PreparedTaskContext
-        SCHEMA = "ace.assign.prepared-task-context/v1"
-        MAX_RESPONSE = 6_307_840
-        PRINCIPAL_SCHEMA = "ace.assign.task-context-principal/v1"
-        SELECTION_SCHEMA = "ace.assign.task-context-selection/v1"
-        MAX_PRINCIPAL = 1_024
-        MAX_SELECTION = 65_536
-
-        def initialize(context: nil)
-          @context = context
-        end
-
-        def call(mapping:, assignment:, attempt:, task:)
-          unavailable!("task-context task selector") unless task.is_a?(String) && task.match?(PreparedWork::TOKEN)
-          selected_entry = selected_entry!
-          input = resolved_input(mapping: mapping, assignment: assignment, attempt: attempt)
-          unavailable!("original protected task-context admission") unless input.descriptor.fetch("task_context_entry") == selected_entry
-          item = input.work.manifest.fetch("context").find { |entry| entry.fetch("task_id") == task }
-          unavailable!("task is outside captured original context") unless item
-          text = input.work.files.fetch(item.fetch("text").fetch("filename"))
-          record = input.descriptor.slice("mapping_id", "assignment_id", "attempt_id", "scope", "definition_digest", "selection_sha256")
-            .merge("schema" => SCHEMA, "task_id" => task, "text" => text)
-          response!(record, MAX_RESPONSE)
-        rescue ArgumentError, KeyError
-          unavailable!("task-context input or original entry differs")
-        end
-
-        def principal
-          selected_entry!
-          context = installed_context!
-          response!({"schema" => PRINCIPAL_SCHEMA, "uid" => context.uid, "protected_worker" => context.protected_worker?}, MAX_PRINCIPAL)
-        end
-
-        def selection(mapping:, assignment:, attempt:)
-          selected_entry!
-          # Current discovery selects a trusted classifier only. Original fetch
-          # independently selects the retained entry; no text leaves this mode.
-          input = resolved_input(mapping: mapping, assignment: assignment, attempt: attempt)
-          response!(input.descriptor.slice("mapping_id", "assignment_id", "attempt_id", "scope", "definition_digest", "selection_sha256", "task_context_entry")
-            .merge("schema" => SELECTION_SCHEMA), MAX_SELECTION)
-        rescue ArgumentError, KeyError
-          unavailable!("task-context original selection differs")
-        end
-
-        def inbox_principal
-          selected_entry!
-          context = installed_context!
-          response!({"schema" => "ace.assign.inbox-context-principal/v1", "uid" => context.uid,
-            "protected_participant" => context.protected_participant?}, MAX_PRINCIPAL)
-        end
-
-        def inbox_selection(project:, mapping:, inbox_context:)
-          selected_entry!
-          installed_context!.inbox_context_selection(project: project, mapping: mapping, inbox_context: inbox_context) do |record|
-            response!(record.merge("schema" => "ace.assign.inbox-context-selection/v1"), 16_384)
-          end
-        end
-
-        private
-
-        def selected_entry!
-          unless Object.const_defined?(:ACE_PROTECTED_TASK_CONTEXT_ENTRY, false)
-            unavailable!("selected original task-context entry is absent")
-          end
-          selected_entry = Object.const_get(:ACE_PROTECTED_TASK_CONTEXT_ENTRY, false)
-          TaskContextEntry.validate!(selected_entry)
-          objects = [selected_entry, *selected_entry.keys, *selected_entry.values]
-          selected_entry.values.each { |reference| objects.concat(reference.keys); objects.concat(reference.values) }
-          unavailable!("selected task-context entry is mutable") unless objects.all?(&:frozen?)
-          selected_entry
-        rescue ArgumentError, KeyError, TypeError
-          unavailable!("task-context selected entry differs")
-        end
-
-        def installed_context!
-          @context ||= ProtectedAssignmentContext.load
-          unavailable!("published task-context installed owner is absent") unless @context.installed?
-          @context
-        end
-
-        def resolved_input(mapping:, assignment:, attempt:)
-          unless [mapping, attempt].all? { |value| value.is_a?(String) && value.match?(PreparedWork::TOKEN) } && assignment.is_a?(String)
-            unavailable!("task-context selectors")
-          end
-          assignment_id, scope = assignment.split("@", 2)
-          unless assignment_id&.match?(PreparedWork::TOKEN) && scope&.match?(PreparedWork::SCOPE)
-            unavailable!("task-context scoped assignment")
-          end
-          input = installed_context!.resolve(options: {mapping: mapping, attempt: attempt}, assignment_id: assignment_id, scope: scope)
-          unavailable!("original protected task-context admission") unless input
-          input
-        end
-
-        def response!(record, limit)
-          response = JSON.generate(record) + "\n"
-          unavailable!("task-context response bound") if response.bytesize > limit
-          response.freeze
-        end
-
-        def unavailable!(reason)
-          raise AttemptErrors::EvidenceUnavailable, "prepared_input_unavailable: #{reason}"
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/authority/prepared_work.rb

@@ -1,304 +0,0 @@
-# frozen_string_literal: true
-
-require "json"
-require "digest"
-require "yaml"
-require "date"
-require_relative "../atoms/step_file_parser"
-require_relative "candidate_transfer"
-
-module Ace
-  module Assign
-    module Authority
-      # Closed prepared-input tree. Git transport and canonical publication are
-      # owned by CandidateTransfer/LaunchLifecycle; this object owns their shared
-      # byte contract, never a registration, attempt or progress ledger.
-      class PreparedWork
-        MAX_TEXT = 1024 * 1024
-        MAX_TOTAL = 64 * 1024 * 1024
-        MAX_MANIFEST = 32_768
-        TOKEN = /\A[a-zA-Z0-9][a-zA-Z0-9._-]{0,199}\z/
-        SCOPE = /\A[0-9]+(?:\.[0-9]+)*\z/
-        SHA = /\A[0-9a-f]{64}\z/
-        TOP = %w[version assignment_id project_id task_id scope job steps context].freeze
-        RECORD = %w[bytes filename sha256].freeze
-        PROGRESS = %w[status started_at completed_at error stall_reason fork_launch_pid fork_tracked_pids fork_pid_updated_at fork_pid_file].freeze
-        attr_reader :manifest, :files, :definition, :selection_sha256, :manifest_sha256
-
-        def initialize(files:)
-          invalid!("file inventory") unless files.is_a?(Hash) && files.size.between?(4, 4096)
-          @files = files.to_h do |path, bytes|
-            invalid!("file path") unless path.is_a?(String) && !path.start_with?("/") && path.split("/", -1).all? { |part| !part.empty? && !%w[. .. .git].include?(part.downcase) }
-            invalid!("text size") unless bytes.is_a?(String) && bytes.bytesize.between?(1, MAX_TEXT)
-            text = bytes.dup.force_encoding(Encoding::UTF_8)
-            invalid!("UTF-8") unless text.valid_encoding? && !text.include?("\0")
-            [path.dup.freeze, text.freeze]
-          end.freeze
-          invalid!("expanded size") if @files.values.sum(&:bytesize) > MAX_TOTAL
-          manifest_bytes = @files.fetch("manifest.json")
-          invalid!("manifest size") if manifest_bytes.bytesize > MAX_MANIFEST
-          @manifest = parse_json(manifest_bytes)
-          closed!(@manifest, TOP)
-          invalid!("version") unless @manifest["version"].is_a?(Integer) && @manifest["version"] == 1
-          %w[assignment_id project_id task_id].each { |key| token!(@manifest[key]) }
-          scope!(@manifest["scope"])
-          canonical = self.class.canonical_manifest(@manifest)
-          invalid!("manifest serialization") unless manifest_bytes == canonical + "\n"
-          @selection_sha256 = Digest::SHA256.hexdigest(canonical).freeze
-          @manifest_sha256 = Digest::SHA256.hexdigest(manifest_bytes).freeze
-          @used = %w[manifest.json definition.json]
-          record!(@manifest["job"], "job.yaml")
-          @job = yaml!(@files.fetch("job.yaml"))
-          steps!
-          context!
-          task_closure!
-          selected_root!
-          invalid!("undeclared file") unless @used.sort == @files.keys.sort
-          definition_bytes = @files.fetch("definition.json")
-          invalid!("definition size") if definition_bytes.bytesize > MAX_MANIFEST
-          @definition = parse_json(definition_bytes)
-          invalid!("base definition") unless @definition.is_a?(Hash) && !@definition.key?("prepared_work") &&
-            @definition["session_id"] == @manifest["assignment_id"] && @definition["project_id"] == @manifest["project_id"] && @definition["task_id"] == @manifest["task_id"]
-          deep_freeze(@definition)
-          deep_freeze(@manifest)
-          freeze
-        rescue KeyError, JSON::ParserError, Psych::Exception => error
-          invalid!(error.message)
-        end
-
-        # The existing transport verifies complete Git objects before this
-        # shared byte contract parses anything. Preserve the original input for
-        # the eventual registration journal; CandidateTransfer may reexport it.
-        def self.admit(bytes:, head:, tree:, sha256:, size:, root:, deadline: nil)
-          transfer = CandidateTransfer.new(root: root)
-          transfer.admit(bytes: bytes, head: head, sha256: sha256, size: size, deadline: deadline) do |repository, deadline, result|
-            raise ArgumentError, "prepared_input_invalid: Git tree differs" unless result.fetch("tree") == tree
-            new(files: transfer.prepared_files(repository: repository, deadline: deadline, head: head))
-          end
-        end
-
-        def reference(head:, tree:)
-          invalid!("Git identity") unless [head, tree].all? { |id| id.is_a?(String) && id.match?(/\A[0-9a-f]{40}\z/) }
-          {"version" => 1, "task_id" => manifest.fetch("task_id"), "scope" => manifest.fetch("scope"),
-            "prepared_head" => head, "prepared_tree" => tree, "manifest_bytes" => files.fetch("manifest.json").bytesize,
-            "manifest_sha256" => manifest_sha256, "selection_sha256" => selection_sha256}.freeze
-        end
-
-        def definition_bytes(head:, tree:)
-          bytes = JSON.generate(definition.merge("prepared_work" => reference(head: head, tree: tree)))
-          invalid!("final definition size") if bytes.bytesize > MAX_MANIFEST
-          bytes.freeze
-        end
-
-        # Mutable queue progress still uses the accepted YAML grammar/bounds.
-        # Return the same parsed bytes that the queue decision will consume.
-        def parse_queue_step!(bytes)
-          invalid!("queue step size") unless bytes.is_a?(String) && bytes.bytesize.between?(1, MAX_TEXT)
-          match = Atoms::StepFileParser::FRONTMATTER_REGEX.match(bytes)
-          invalid!("queue step frontmatter") unless match
-          frontmatter = yaml!(match[1])
-          invalid!("queue step frontmatter") unless frontmatter.is_a?(Hash)
-          {frontmatter: frontmatter, body: bytes[match.end(0)..].strip}
-        rescue Psych::Exception => error
-          invalid!(error.message)
-        end
-
-        def parse_queue_metadata!(bytes)
-          invalid!("queue metadata size") unless bytes.is_a?(String) && bytes.bytesize.between?(1, MAX_MANIFEST)
-          yaml!(bytes)
-        rescue Psych::Exception => error
-          invalid!(error.message)
-        end
-
-        # StepFileParser owns body/frontmatter semantics; only these progress
-        # fields differ from accepted work. Reports are separate mutable output.
-        def self.work_projection(bytes)
-          parsed = Atoms::StepFileParser.parse(bytes)
-          {"frontmatter" => parsed.fetch(:frontmatter).reject { |key, _| PROGRESS.include?(key) }, "body" => parsed.fetch(:body)}
-        end
-
-        def self.canonical_manifest(value)
-          sorted = lambda do |item|
-            case item
-            when Hash then item.keys.sort.to_h { |key| [key, sorted.call(item.fetch(key))] }
-            when Array then item.map { |entry| sorted.call(entry) }
-            else item
-            end
-          end
-          JSON.generate(TOP.to_h { |key| [key, sorted.call(value.fetch(key))] })
-        end
-
-        private
-
-        def steps!
-          steps = @manifest["steps"]
-          invalid!("steps") unless steps.is_a?(Array) && steps.size.between?(1, 256)
-          @step_frontmatter = {}
-          numbers = steps.map do |step|
-            closed!(step, %w[number filename bytes sha256])
-            number = step.fetch("number"); scope!(number)
-            invalid!("step scope") unless number == @manifest["scope"] || number.start_with?(@manifest["scope"] + ".")
-            filename = step.fetch("filename")
-            record!(step.reject { |key, _| key == "number" }, "steps/" + filename)
-            # Step record filenames are basenames; inventory paths add steps/.
-            content = @files.fetch("steps/" + filename)
-            match = Atoms::StepFileParser::FRONTMATTER_REGEX.match(content)
-            invalid!("step frontmatter") unless match
-            fm = yaml!(match[1])
-            invalid!("initial status") unless fm.is_a?(Hash) && fm.fetch("status", "pending") == "pending"
-            @step_frontmatter[number] = fm
-            invalid!("step name") unless fm["name"].is_a?(String) && !fm["name"].empty?
-            invalid!("step filename") unless filename == Atoms::StepFileParser.generate_filename(number, fm["name"])
-            number
-          end
-          invalid!("step ordering/root") unless numbers.uniq == numbers && numbers == numbers.sort_by { |n| n.split(".").map(&:to_i) } && numbers.first == @manifest["scope"]
-        end
-
-        def context!
-          context = @manifest["context"]
-          invalid!("context") unless context.is_a?(Array) && context.size.between?(1, 256)
-          uris = context.map do |entry|
-            closed!(entry, %w[uri task_id spec text reports]); token!(entry["task_id"])
-            uri = "task://" + entry.fetch("task_id")
-            invalid!("context URI") unless entry["uri"] == uri
-            prefix = "context/" + entry.fetch("task_id")
-            record!(entry["spec"], prefix + "/spec.md")
-            record!(entry["text"], prefix + "/bundle.txt")
-            reports = entry["reports"]
-            invalid!("reports") unless reports.is_a?(Array)
-            identities = reports.map do |report|
-              closed!(report, %w[assignment_id number file]); token!(report["assignment_id"]); scope!(report["number"])
-              record!(report["file"], prefix + "/reports/" + report.fetch("assignment_id") + "/" + report.fetch("number") + ".r.md")
-              [report["assignment_id"], report["number"].split(".").map(&:to_i)]
-            end
-            invalid!("report ordering") unless identities.uniq == identities && identities == identities.sort
-            uri
-          end
-          invalid!("context ordering/selected task") unless uris.uniq == uris && uris == uris.sort && uris.include?("task://" + @manifest["task_id"])
-        end
-
-        def selected_root!
-          scope = @manifest.fetch("scope"); task = @manifest.fetch("task_id")
-          root = @step_frontmatter.fetch(scope)
-          invalid!("selected fork root") unless root["context"] == "fork" && root["taskref"] == task
-          @step_frontmatter.each do |number, fm|
-            invalid!("selected taskref") if fm.key?("taskref") && fm["taskref"] != task
-            next if number == scope
-            parent = number.split(".")[0...-1].join(".")
-            invalid!("selected parent association") unless fm["parent"] == parent && @step_frontmatter.key?(parent)
-          end
-          invalid!("job steps") unless @job.is_a?(Hash) && @job["steps"].is_a?(Array)
-          roots = @job.fetch("steps").select { |step| step.is_a?(Hash) && step["context"] == "fork" && step["taskref"] == task }
-          invalid!("job selected root") unless roots.one? && roots.first.values_at("number", "taskref") == [scope, task]
-        end
-
-        def task_closure!
-          specs = @manifest.fetch("context").to_h do |entry|
-            content = @files.fetch(entry.fetch("spec").fetch("filename"))
-            match = Atoms::StepFileParser::FRONTMATTER_REGEX.match(content)
-            invalid!("task frontmatter") unless match
-            task = yaml!(match[1])
-            invalid!("task association") unless task.is_a?(Hash) && task["id"] == entry["task_id"] && task.fetch("needs_review", false) == false
-            dependencies = task.fetch("dependencies", [])
-            invalid!("task dependencies") unless dependencies.is_a?(Array) && dependencies.uniq == dependencies
-            dependencies.each { |dependency| token!(dependency) }
-            [entry.fetch("task_id"), task]
-          end
-          selected = specs.fetch(@manifest.fetch("task_id"))
-          invalid!("selected reviewed status") unless %w[pending in-progress].include?(selected["status"])
-          visiting = []; visited = []
-          walk = lambda do |id|
-            invalid!("dependency cycle: " + (visiting + [id]).join(" -> ")) if visiting.include?(id)
-            return if visited.include?(id)
-            visiting << id
-            specs.fetch(id).fetch("dependencies", []).each { |dependency| walk.call(dependency) }
-            visiting.pop; visited << id
-          end
-          walk.call(@manifest.fetch("task_id"))
-          invalid!("undeclared context") unless visited.sort == specs.keys.sort
-        end
-
-        def record!(record, path)
-          closed!(record, RECORD)
-          # Selected step record uses an exact basename; other records use the
-          # exact canonical relative artifact path.
-          expected = path.start_with?("steps/") ? path.delete_prefix("steps/") : path
-          invalid!("content reference") unless record["filename"] == expected && record["bytes"].is_a?(Integer) && record["bytes"].positive? && record["sha256"].is_a?(String) && record["sha256"].match?(SHA)
-          bytes = @files.fetch(path)
-          invalid!("content digest") unless record["bytes"] == bytes.bytesize && record["sha256"] == Digest::SHA256.hexdigest(bytes)
-          invalid!("duplicate file") if @used.include?(path)
-          @used << path
-        end
-
-        def yaml!(bytes)
-          ast = Psych.parse_stream(bytes)
-          invalid!("YAML requires one document") unless ast.children.size == 1
-          scanner = Psych::ScalarScanner.new(Psych::ClassLoader::Restricted.new([], []))
-          pending = [[ast, 0]]
-          until pending.empty?
-            node, depth = pending.pop
-            invalid!("YAML nesting exceeds 32") if depth > 32
-            invalid!("YAML alias") if node.is_a?(Psych::Nodes::Alias)
-            if node.is_a?(Psych::Nodes::Mapping)
-              keys = node.children.each_slice(2).map(&:first)
-              decoded = keys.map do |key|
-                invalid!("YAML mapping keys") unless key.is_a?(Psych::Nodes::Scalar) && [nil, "tag:yaml.org,2002:str"].include?(key.tag)
-                value = key.plain && key.tag.nil? ? scanner.tokenize(key.value) : key.value
-                invalid!("YAML mapping keys must be strings") unless value.is_a?(String)
-                value
-              end
-              invalid!("duplicate YAML key") unless decoded.uniq.size == decoded.size
-            end
-            (node.children || []).each { |child| pending << [child, depth + 1] }
-          end
-          value = YAML.safe_load(bytes, permitted_classes: [Time, Date], aliases: false)
-          values = [value]
-          until values.empty?
-            item = values.pop
-            case item
-            when Hash
-              invalid!("YAML mapping keys must be strings") unless item.keys.all? { |key| key.is_a?(String) }
-              values.concat(item.values)
-            when Array then values.concat(item)
-            when String
-              invalid!("YAML string encoding") unless item.valid_encoding? && !item.include?("\0")
-            when Float then invalid!("YAML nonfinite number") unless item.finite?
-            when Integer, TrueClass, FalseClass, NilClass, Time, Date
-              # Managed files retain StepFileParser's standard timestamp types.
-            else invalid!("unsupported YAML value")
-            end
-          end
-          value
-        end
-
-        def parse_json(bytes)
-          JSON.parse(bytes, create_additions: false, max_nesting: 32, allow_duplicate_key: false, allow_comments: false)
-        end
-
-        def closed!(value, keys)
-          invalid!("closed fields") unless value.is_a?(Hash) && value.keys.sort == keys.sort
-        end
-
-        def token!(value)
-          invalid!("identity") unless value.is_a?(String) && value.match?(TOKEN)
-        end
-
-        def scope!(value)
-          invalid!("scope") unless value.is_a?(String) && value.match?(SCOPE)
-        end
-
-        def deep_freeze(value)
-          case value
-          when Hash then value.each { |key, item| deep_freeze(key); deep_freeze(item) }
-          when Array then value.each { |item| deep_freeze(item) }
-          end
-          value.freeze
-        end
-
-        def invalid!(reason)
-          raise ArgumentError, "prepared_input_invalid: #{reason}"
-        end
-      end
-    end
-  end
-end