ace-assign 0.70.0 → 0.73.0

data/lib/ace/assign/authority/prepared_worker.rb

@@ -1,69 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "prepared_input"
-require_relative "prepared_queue"
-require_relative "../molecules/fork_session_launcher"
-
-module Ace
-  module Assign
-    module Authority
-      # Fixed gate target. Environment identifiers are untrusted lookup hints;
-      # the original issued capability and actual kernel birth decide admission.
-      class PreparedWorker
-        def initialize(kernel: Ace::Runtime::Molecules::ProtectedLinux.new, client_factory: nil, launcher: nil, env: ENV,
-          workspace_reader_factory: nil)
-          @kernel, @launcher, @env = kernel, launcher, env
-          @client_factory = client_factory || ->(mapping) { Client.new(mapping_id: mapping, kernel: @kernel) }
-          @workspace_reader_factory = workspace_reader_factory || ->(projection) {
-            Molecules::LifecycleExclusion.workspace_reader(projection: projection)
-          }
-          @started = false
-        end
-
-        def run
-          raise AttemptErrors::EvidenceUnavailable, "original adapter invocation already activated" if @started
-          mapping, assignment, attempt = %w[ACE_ASSIGN_LAUNCH_MAPPING ACE_ASSIGN_ASSIGNMENT_ID ACE_ASSIGN_ATTEMPT_ID].map do |key|
-            value = @env[key]
-            unless value.is_a?(String) && value.match?(PreparedWork::TOKEN)
-              raise AttemptErrors::EvidenceUnavailable, "prepared_input_unavailable: original worker selector"
-            end
-            value
-          end
-          input = PreparedInput.fetch(client: @client_factory.call(mapping), assignment_id: assignment, attempt_id: attempt)
-          self_identity = @kernel.capture(Process.pid)
-          @kernel.live!(self_identity)
-          original = input.descriptor.fetch("original_worker_identity")
-          unless @kernel.same?(self_identity, original)
-            raise AttemptErrors::UnauthorizedIdentity, "prepared adapter requires exact original worker self"
-          end
-          input.drive_prompt
-          @workspace_lease = @workspace_reader_factory.call(input.descriptor.fetch("workspace_exclusion"))
-          @workspace_lease.acquire!
-          @started = true
-          queue = PreparedQueue.new(work: input.work, descriptor: input.descriptor)
-          root = queue.activate_original!
-          unless root
-            @workspace_lease.verify_unchanged!
-            @workspace_lease.close!
-            return {"state" => "completed"}
-          end
-          launcher = @launcher || Molecules::ForkSessionLauncher.new(config: {})
-          result = launcher.launch_provider_session(assignment_id: assignment, fork_root: input.descriptor.fetch("scope"),
-            provider: root.fork_provider || Molecules::ForkSessionLauncher::DEFAULT_PROVIDER, cache_dir: queue.directory,
-            prepared_input: input)
-          queue.with_executor do |executor|
-            state = executor.status.fetch(:state)
-            unless state.failed.empty? && state.subtree_complete?(input.descriptor.fetch("scope"))
-              raise AttemptErrors::EvidenceUnavailable, "prepared provider exited before selected queue completed"
-            end
-          end
-          @workspace_lease.verify_unchanged!
-          @workspace_lease.close!
-          result
-        rescue SystemCallError, IOError
-          raise AttemptErrors::EvidenceUnavailable, "prepared_input_unavailable: published worker queue or provider output is unavailable"
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/authority/private_directory.rb

@@ -1,33 +0,0 @@
-# frozen_string_literal: true
-
-module Ace
-  module Assign
-    module Authority
-      module PrivateDirectory
-        module_function
-
-        # Source configuration chooses this path. Each ancestor must prevent
-        # another principal from replacing the private leaf or its contents.
-        def verify!(root)
-          path = File.expand_path(root)
-          cursor = path
-          loop do
-            stat = File.lstat(cursor)
-            unless stat.directory? && !stat.symlink? && [0, Process.uid].include?(stat.uid) && (stat.mode & 0022).zero?
-              raise AttemptErrors::ReceiptRejected, "Private directory ancestry is not protected"
-            end
-            break if cursor == "/"
-            cursor = File.dirname(cursor)
-          end
-          stat = File.stat(path)
-          unless stat.uid == Process.uid && (stat.mode & 0077).zero?
-            raise AttemptErrors::ReceiptRejected, "Private directory must be owned by this peer and private"
-          end
-          path
-        rescue SystemCallError, TypeError
-          raise AttemptErrors::ReceiptRejected, "Private directory is unavailable"
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/authority/protected_assignment_context.rb

@@ -1,226 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "deployment_history"
-require_relative "prepared_input"
-require_relative "prepared_queue"
-
-module Ace
-  module Assign
-    module Authority
-      # Installed and retained deployment owners determine protected principals.
-      # A removed original mapping never silently restores ordinary local mode.
-      class ProtectedAssignmentContext
-        attr_reader :uid
-
-        def self.load(uid: Process.uid)
-          paths = [Deployment::PATH, DeploymentHistory::PATH]
-          installed = paths.any? do |path|
-            begin
-              File.lstat(path)
-              true
-            rescue Errno::ENOENT
-              false
-            end
-          end
-          return new(deployment: nil, history: nil, uid: uid) unless installed
-          deployment = Deployment.load
-          history = DeploymentHistory.load
-          unless history.selects?(deployment)
-            raise AttemptErrors::EvidenceUnavailable, "installed protected descriptor is not retained"
-          end
-          new(deployment: deployment, history: history, uid: uid)
-        end
-
-        def initialize(deployment:, history:, uid: Process.uid, kernel: nil, env: ENV,
-          artifacts_factory: -> { Ace::Runtime::Molecules::ProtectedArtifactSet.new })
-          @deployment, @history, @uid, @kernel, @env = deployment, history, uid, kernel, env
-          @artifacts_factory = artifacts_factory
-        end
-
-        # A declared installed account never falls through to local authority.
-        # This is classification only; each wire operation still authenticates
-        # the current kernel peer and its exact permitted role.
-        def protected_participant?
-          return false unless @deployment
-          raise AttemptErrors::EvidenceUnavailable, "protected retained owners are unavailable" unless @history
-          [@deployment, *@history.descriptors].any? do |owner|
-            data = owner.data
-            principals = data.fetch("authorities").values.map { |authority| authority.fetch("uid") }
-            principals.concat(data.fetch("launch_mappings").values.flat_map { |map| map.values_at("launcher_uid", "worker_uid") })
-            data.fetch("projects").each_value do |project|
-              %w[launcher_uids reviewer_uids worker_uids service_executor_uids supervisor_uids].each do |key|
-                principals.concat(project.fetch(key, []))
-              end
-              principals.concat(project.fetch("service_receivers", {}).values.map { |receiver| receiver.fetch("executor_uid") })
-              principals.concat(project.fetch("inbox_contexts", {}).values.map { |context| context.fetch("owner_credentials").fetch("uid") })
-            end
-            principals.include?(@uid)
-          end
-        rescue KeyError, TypeError, NoMethodError
-          raise AttemptErrors::EvidenceUnavailable, "protected installed principal inventory is malformed"
-        end
-
-        # Read-only current selection; no role grant or private Inbox access.
-        def inbox_context_selection(project:, mapping:, inbox_context:)
-          unless installed? && [project, mapping, inbox_context].all? { |id| id.is_a?(String) && Deployment::TOKEN.match?(id) }
-            raise AttemptErrors::EvidenceUnavailable, "installed inbox selectors differ"
-          end
-          descriptor = @deployment.artifact_reference
-          history = @history.artifact_reference
-          unless descriptor && history && @history.selects?(@deployment)
-            raise AttemptErrors::EvidenceUnavailable, "installed inbox references are unavailable"
-          end
-          @artifacts_factory.call.with do |held|
-            held.read!(descriptor)
-            held.read!(history)
-            map = @deployment.mapping(mapping)
-            unless map.fetch("project_id") == project
-              raise AttemptErrors::EvidenceUnavailable, "installed inbox project differs"
-            end
-            selected = @deployment.inbox_context(mapping, inbox_context)
-            authority = @deployment.authority(map.fetch("authority_id"))
-            result = {"uid" => @uid, "project_id" => project, "mapping_id" => mapping,
-              "inbox_context_id" => inbox_context, "descriptor" => descriptor, "history" => history,
-              "context" => selected.slice("control_socket_path", "owner_credentials", "native_mapping_id"),
-              "authority" => authority.slice("socket_path", "uid", "gid", "groups")
-                .merge("authority_id" => map.fetch("authority_id"))}
-            held.verify_unchanged!
-            value = yield result
-            held.verify_unchanged!
-            value
-          end
-        rescue ArgumentError, KeyError, TypeError, Ace::Runtime::Error
-          raise AttemptErrors::EvidenceUnavailable, "installed inbox selection is unavailable"
-        end
-
-        def protected_worker?
-          return false unless @deployment
-          [@deployment, *@history.descriptors].any? do |owner|
-            owner.data.fetch("projects").values.any? { |project| project.fetch("worker_uids").include?(@uid) }
-          end
-        end
-
-        def installed?
-          !@deployment.nil? && !@history.nil?
-        end
-
-        def refuse_graph_mutation!(options:)
-          selected = options.values_at(:mapping, :attempt).any? { |value| value && !value.to_s.empty? } ||
-            %w[ACE_ASSIGN_LAUNCH_MAPPING ACE_ASSIGN_ATTEMPT_ID].any? { |key| !@env[key].to_s.empty? }
-          if protected_worker? || selected
-            raise AttemptErrors::EvidenceUnavailable, "protected queue graph changes require a reviewed new prepared version and attempt"
-          end
-        end
-
-        def resolve(options:, assignment_id:, scope:)
-          selected = options.values_at(:mapping, :attempt).any? { |value| value && !value.to_s.empty? } ||
-            %w[ACE_ASSIGN_LAUNCH_MAPPING ACE_ASSIGN_ATTEMPT_ID].any? { |key| !@env[key].to_s.empty? }
-          return nil unless protected_worker? || selected
-          unless @deployment && assignment_id && scope && scope.match?(PreparedWork::SCOPE)
-            raise AttemptErrors::EvidenceUnavailable, "prepared_input_unavailable: explicit scoped assignment required"
-          end
-          attempt = selected_hint(options[:attempt], "ACE_ASSIGN_ATTEMPT_ID")
-          hint = @env["ACE_ASSIGN_ASSIGNMENT_ID"].to_s
-          unless hint.empty? || hint == assignment_id
-            raise AttemptErrors::EvidenceUnavailable, "prepared assignment hint differs"
-          end
-          @kernel ||= Ace::Runtime::Molecules::ProtectedLinux.new
-          input = PreparedInput.fetch(client: client(options: options),
-            assignment_id: assignment_id, attempt_id: attempt)
-          unless input.descriptor.fetch("scope") == scope
-            raise AttemptErrors::EvidenceUnavailable, "prepared_input_mismatch: scoped CLI selection"
-          end
-          input
-        rescue KeyError
-          raise AttemptErrors::EvidenceUnavailable, "prepared_input_unavailable: original installed mapping is unavailable"
-        end
-
-        def verify_attempt_hints!(assignment_id:, attempt_id:)
-          selected_hint(assignment_id, "ACE_ASSIGN_ASSIGNMENT_ID")
-          selected_hint(attempt_id, "ACE_ASSIGN_ATTEMPT_ID")
-          true
-        end
-
-        def client(options:)
-          raise AttemptErrors::EvidenceUnavailable, "protected installed authority is unavailable" unless @deployment
-          mapping = selected_hint(options[:mapping], "ACE_ASSIGN_LAUNCH_MAPPING")
-          @kernel ||= Ace::Runtime::Molecules::ProtectedLinux.new
-          Client.new(mapping_id: mapping, deployment: @deployment, kernel: @kernel)
-        end
-
-        def mapping_hint?
-          !@env["ACE_ASSIGN_LAUNCH_MAPPING"].to_s.empty?
-        end
-
-        # Observer/signer commands reuse the installed selection and held
-        # descriptor pair. This grants no effect; endpoints authorize the peer.
-        def with_inbox_workflow(options:)
-          mapping = selected_hint(options[:mapping], "ACE_ASSIGN_LAUNCH_MAPPING")
-          project, inbox_context = options.values_at(:project, :inbox_context)
-          inbox_context_selection(project: project, mapping: mapping, inbox_context: inbox_context) do |_selection|
-            @kernel ||= Ace::Runtime::Molecules::ProtectedLinux.new
-            yield @deployment, @kernel, @deployment.mapping(mapping)
-          end
-        end
-
-        # Consumers call only after original PreparedInput admission. These
-        # existing owners select transport; they do not confer a new grant.
-        def with_installed_selection(options:, input:)
-          raise AttemptErrors::EvidenceUnavailable, "protected installed authority is unavailable" unless @deployment
-          mapping = selected_hint(options[:mapping], "ACE_ASSIGN_LAUNCH_MAPPING")
-          begin
-            map = @deployment.mapping(mapping)
-            unless input && input.descriptor.fetch("mapping_id") == mapping &&
-                input.descriptor.fetch("project_id") == map.fetch("project_id")
-              raise AttemptErrors::EvidenceUnavailable, "original prepared installed selection differs"
-            end
-          rescue KeyError
-            raise AttemptErrors::EvidenceUnavailable, "original installed mapping is unavailable"
-          end
-          @kernel ||= Ace::Runtime::Molecules::ProtectedLinux.new
-          yield @deployment, @kernel, mapping
-        end
-
-        private
-
-        def selected_hint(explicit, key)
-          hint = @env[key].to_s
-          value = explicit || hint
-          unless value.is_a?(String) && value.match?(PreparedWork::TOKEN) && (hint.empty? || hint == value)
-            raise AttemptErrors::EvidenceUnavailable, "prepared selector hint differs"
-          end
-          value
-        end
-      end
-
-      # Each supported operation holds the existing private queue exclusion and
-      # consumes its authenticated held snapshot. No graph-changing API exists.
-      class PreparedExecutor
-        def initialize(input)
-          @queue = PreparedQueue.new(work: input.work, descriptor: input.descriptor)
-          @scope = input.descriptor.fetch("scope")
-        end
-
-        def status
-          @queue.with_executor(&:status)
-        end
-
-        %i[start_step finish_step fail].each do |operation|
-          define_method(operation) do |*args, **options|
-            unless options[:fork_root] == @scope && (!options[:step_number] ||
-                options[:step_number] == @scope || options[:step_number].start_with?(@scope + "."))
-              raise AttemptErrors::EvidenceUnavailable, "prepared operation scope differs"
-            end
-            @queue.with_executor { |executor| executor.public_send(operation, *args, **options) }
-          end
-        end
-
-        def method_missing(*)
-          raise AttemptErrors::EvidenceUnavailable, "prepared queue graph changes require a reviewed new prepared version and attempt"
-        end
-
-        def respond_to_missing?(*); false; end
-      end
-    end
-  end
-end

data/lib/ace/assign/authority/readiness_hook.rb

@@ -1,120 +0,0 @@
-# frozen_string_literal: true
-require "ace/runtime/molecules/execution_network_selection"
-require "socket"
-require_relative "../errors"
-require "ace/runtime/molecules/readiness_configuration"
-require "ace/runtime/molecules/server_resource_observation"
-require "ace/runtime/molecules/protected_linux"
-require "ace/runtime/molecules/protected_socket"
-require_relative "transfer_codec"
-
-module Ace
-  module Assign
-    module Authority
-      # Fixed ExecStartPost action, deliberately independent of Deployment.load.
-      class ReadinessHook
-        class Files
-          def boundary_manifest!(config)
-            bytes = nil
-            Ace::Runtime::Molecules::ProtectedArtifactSet.new.with do |reader|
-              bytes, = reader.read_path!(config.dig("boundary_manifest", "path"), limit: 65_536)
-              unless Digest::SHA256.hexdigest(bytes) == config.dig("boundary_manifest", "sha256")
-                raise AttemptErrors::EvidenceUnavailable, "readiness boundary bytes differ"
-              end
-              reader.verify_unchanged!
-            end
-            bytes = bytes.dup.force_encoding(Encoding::UTF_8)
-            raise AttemptErrors::EvidenceUnavailable, "readiness boundary encoding differs" unless bytes.valid_encoding?
-            JSON.parse(bytes, create_additions: false, max_nesting: 8, allow_duplicate_key: false, allow_comments: false)
-          end
-
-          def verify_native!(server, config)
-            File.open("/proc/#{server.fetch('pid')}/exe", File::RDONLY) do |executable|
-              unless Digest::SHA256.hexdigest(executable.read(268_435_457)) == config.dig("native", "executable_sha256") &&
-                  File.read("/proc/#{server.fetch('pid')}/cmdline", 16_385).split("\0") == [config.dig("native", "executable"), "server"]
-                raise AttemptErrors::EvidenceUnavailable, "readiness native executable differs"
-              end
-            end
-          end
-        end
-
-        def initialize(slot:, configuration: nil, kernel: Ace::Runtime::Molecules::ProtectedLinux.new,
-          resources: nil, wire: Ace::Runtime::Molecules::ProtectedSocket, files: Files.new)
-          @configuration = configuration || Ace::Runtime::Molecules::ReadinessConfiguration.load(slot: slot)
-          @kernel, @wire = kernel, wire
-          @files = files
-          @resources = resources || Ace::Runtime::Molecules::ServerResourceObservation.new(kernel: kernel)
-        end
-
-        def run
-          config = @configuration.data
-          @kernel.supported!
-          hook = @kernel.capture(Process.pid)
-          expected = config.fetch("worker")
-          unless hook.values_at("uid", "gid", "groups") == expected.values_at("uid", "gid", "groups")
-            raise AttemptErrors::UnauthorizedIdentity, "readiness hook principal differs"
-          end
-          deadline = @wire.deadline(10)
-          authority = config.fetch("authority")
-          path = authority.fetch("socket_path")
-          @wire.root_path!(File.dirname(path), directory: true, owner: authority.fetch("uid"))
-          endpoint = @wire.socket_identity(path)
-          @wire.connect(path) do |socket|
-            peer = @kernel.peer(socket)
-            unless peer.values_at("uid", "gid", "groups") == authority.values_at("uid", "gid", "groups") &&
-                @wire.socket_identity(path) == endpoint
-              raise AttemptErrors::UnauthorizedIdentity, "readiness authority peer differs"
-            end
-            @wire.write(socket, {"version" => 1, "operation" => "native_readiness", "mutation_id" => nil,
-              "project_id" => config.fetch("project_id"), "params" => {"mapping_id" => config.fetch("mapping_id")}},
-              deadline: deadline, limit: 16_384)
-            challenge = @wire.read(socket, deadline: deadline, limit: 16_384)
-            unless challenge.is_a?(Hash) && challenge.keys.sort == %w[challenge_id server_identity version] &&
-                challenge["version"] == 1 && challenge["challenge_id"].is_a?(String) &&
-                challenge["challenge_id"].match?(/\A[0-9a-f]{64}\z/)
-              raise AttemptErrors::EvidenceUnavailable, "private readiness challenge differs"
-            end
-            manifest = @files.boundary_manifest!(config)
-            unless manifest.is_a?(Hash) && manifest.keys.sort == %w[network_installation resources schema slot_id] &&
-                manifest["schema"] == "ace.execution-boundary-manifest/v1" && manifest["slot_id"] == config.fetch("slot_id") &&
-                manifest["resources"].is_a?(Array) && manifest["resources"].size.between?(1, 64)
-              raise AttemptErrors::EvidenceUnavailable, "readiness boundary shape differs"
-            end
-            Ace::Runtime::Molecules::ExecutionNetworkSelection.validate_static!(manifest.fetch("network_installation"), slot_id: config.fetch("slot_id"))
-            manifest.fetch("resources").each do |entry|
-              paths = entry.is_a?(Hash) ? entry.values_at("host_path", "view_path") : []
-              unless entry.is_a?(Hash) && entry.keys.sort == %w[host_path read_only stage view_path worker_visible] &&
-                  paths.size == 2 && paths.all? { |path| path.is_a?(String) && path.bytesize.between?(1, 4096) && path.start_with?("/") && !path.include?("\0") && File.expand_path(path) == path } &&
-                  %w[parent native].include?(entry["stage"]) && [true, false].include?(entry["worker_visible"]) && [true, false].include?(entry["read_only"])
-                raise AttemptErrors::EvidenceUnavailable, "readiness resource declaration differs"
-              end
-            end
-            entries = manifest.fetch("resources").select { |entry| entry.fetch("worker_visible") }
-            server = challenge.fetch("server_identity")
-            @files.verify_native!(server, config)
-            report = @resources.observe!(server: server, entries: entries, authority_socket: path)
-            report = report.merge("version" => 1, "challenge_id" => challenge.fetch("challenge_id"),
-              "server_identity" => challenge.fetch("server_identity"), "resource_observer_identity" => hook)
-            bytes = JSON.generate(report)
-            codec = TransferCodec.new
-            transfer = codec.descriptor([bytes], purpose: :scope_boundary_observation)
-            @wire.write(socket, {"version" => 1, "challenge_id" => challenge.fetch("challenge_id"), "transfer" => transfer},
-              deadline: deadline, limit: 16_384)
-            codec.send(socket, parts: [bytes], descriptor: transfer, purpose: :scope_boundary_observation, deadline: deadline)
-            socket.shutdown(Socket::SHUT_WR)
-            acknowledgment = @wire.read(socket, deadline: deadline, limit: 16_384)
-            unless acknowledgment == {"version" => 1, "challenge_id" => challenge.fetch("challenge_id"), "status" => "ready"}
-              raise AttemptErrors::EvidenceUnavailable, "private readiness acknowledgement differs"
-            end
-            @kernel.live!(hook)
-            @kernel.live!(peer)
-            raise AttemptErrors::EvidenceUnavailable, "readiness endpoint changed" unless @wire.socket_identity(path) == endpoint
-          end
-          true
-        rescue SystemCallError, IOError, JSON::ParserError, KeyError, TypeError
-          raise AttemptErrors::EvidenceUnavailable, "private readiness observation unavailable"
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/authority/receipt_transfer.rb

@@ -1,48 +0,0 @@
-# frozen_string_literal: true
-
-require "json"
-require "digest"
-
-module Ace
-  module Assign
-    module Authority
-      # Receipt-first binary framing. Field names come from source operations,
-      # never from the wire. Artifact order and declared digests are exact.
-      module ReceiptTransfer
-        def self.decode(input:, receipt_sha256:, artifact_field:, reference_key:)
-          unless input && input.count.between?(1, 17) && %w[artifacts evidence].include?(artifact_field) &&
-              %w[path ref].include?(reference_key) && receipt_sha256.is_a?(String) && receipt_sha256.match?(/\A[0-9a-f]{64}\z/)
-            raise AttemptErrors::ReceiptRejected, "receipt transfer binding is invalid"
-          end
-          bytes = input.bytes(index: 0)
-          unless bytes.bytesize.between?(1, 16 * 1024) && Digest::SHA256.hexdigest(bytes) == receipt_sha256
-            raise AttemptErrors::ReceiptRejected, "first transfer part must be the exact receipt"
-          end
-          receipt = JSON.parse(bytes)
-          unless receipt.is_a?(Hash) && !Models::ExecutionReceipt.forbidden_field?(receipt)
-            raise AttemptErrors::ReceiptRejected, "receipt must contain bounded structured evidence"
-          end
-          references = receipt.fetch(artifact_field)
-          unless references.is_a?(Array) && references.length == input.count - 1 && references.length <= 16 &&
-              references.all? { |entry| entry.is_a?(Hash) && entry.keys.sort == [reference_key, "sha256"].sort &&
-                entry[reference_key].is_a?(String) && entry[reference_key].bytesize.between?(1, 256) &&
-                entry["sha256"].is_a?(String) && entry["sha256"].match?(/\A[0-9a-f]{64}\z/) } &&
-              references.map { |entry| entry[reference_key] }.uniq.length == references.length
-            raise AttemptErrors::ReceiptRejected, "receipt artifact parts are incomplete or duplicated"
-          end
-          artifacts = references.each_with_index.map do |reference, index|
-            artifact = input.bytes(index: index + 1)
-            unless artifact.bytesize <= 64 * 1024 && Digest::SHA256.hexdigest(artifact) == reference.fetch("sha256")
-              raise AttemptErrors::ReceiptRejected, "receipt artifact part differs from declaration"
-            end
-            artifact
-          end
-          raise AttemptErrors::ReceiptRejected, "receipt evidence exceeds its transfer limit" if artifacts.sum(&:bytesize) > 256 * 1024
-          {receipt: receipt, artifacts: artifacts, receipt_sha256: receipt_sha256}
-        rescue JSON::ParserError, KeyError
-          raise AttemptErrors::ReceiptRejected, "receipt transfer schema is invalid"
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/authority/router.rb

@@ -1,81 +0,0 @@
-# frozen_string_literal: true
-module Ace
-  module Assign
-    module Authority
-      # Source-owned handlers share one listener. Requests never name a method.
-      class Router
-        def initialize(launch: nil, handlers: [])
-          @launch = launch
-          @routes = {}
-          ([launch].compact + handlers).each do |handler|
-            handler.class::OPERATIONS.each do |operation|
-              raise ArgumentError, "duplicate authority operation" if @routes.key?(operation)
-              @routes[operation] = handler
-            end
-          end
-          @routes.freeze
-        end
-
-        def dispatch(request:, peer:, role:, transfer: nil, deadline: nil)
-          validate_review_namespace!(request)
-          handler = @routes.fetch(request.fetch("operation")) { raise ArgumentError, "unknown authority operation" }
-          options = {request: request, peer: peer, role: role}
-          options[:transfer] = transfer if transfer
-          options[:deadline] = deadline if deadline
-          handler.dispatch(**options)
-        end
-
-        def transfer_binding(request)
-          validate_review_namespace!(request)
-          operation = request.fetch("operation")
-          handler = @routes.fetch(operation) { raise ArgumentError, "unknown authority operation" }
-          return nil unless handler.class.const_defined?(:TRANSFER_OPERATIONS, false)
-          binding = handler.class::TRANSFER_OPERATIONS[operation]
-          if operation == "evidence_fetch" && %w[prepared_work campaign_candidate].include?(request.dig("params", "kind"))
-            binding = {direction: :download, purpose: :candidate, roles: [:worker]}
-          end
-          return nil unless binding
-          unless binding.is_a?(Hash) && binding.keys.sort == %i[direction purpose roles] &&
-              %i[upload download].include?(binding[:direction]) && TransferCodec::LIMITS.key?(binding[:purpose]) &&
-              binding[:roles].is_a?(Array) && binding[:roles].all? { |role| %i[worker launcher reviewer executor supervisor observer signer].include?(role) }
-            raise ArgumentError, "invalid source transfer binding"
-          end
-          binding
-        end
-
-        def authorize_transfer!(request:, peer:, role:, deadline: nil)
-          validate_review_namespace!(request)
-          handler = @routes.fetch(request.fetch("operation"))
-          options = {request: request, peer: peer, role: role}
-          options[:deadline] = deadline if deadline
-          handler.authorize_transfer!(**options)
-        end
-
-        def validate_review_namespace!(request)
-          if request["mutation_id"].is_a?(String) && request["mutation_id"].start_with?("review-reply.")
-            raise ArgumentError, "reserved review reply namespace"
-          end
-          if request["mutation_id"].is_a?(String) && request["mutation_id"].start_with?("review-delegate.") &&
-              request["operation"] != "assign_review"
-            raise ArgumentError, "reserved review delegation namespace"
-          end
-        end
-        private :validate_review_namespace!
-
-        def close
-          @routes.values.uniq.each { |handler| handler.close if handler.respond_to?(:close) }
-        end
-
-        def serve_launch_control!(**options)
-          raise AttemptErrors::EvidenceUnavailable, "launch control is unavailable in this composition" unless @launch
-          @launch.serve_launch_control!(**options)
-        end
-
-        def gate_ready(**options)
-          raise AttemptErrors::EvidenceUnavailable, "launch gate is unavailable in this composition" unless @launch
-          @launch.gate_ready(**options)
-        end
-      end
-    end
-  end
-end