ace-assign 0.70.0 → 0.73.0

data/lib/ace/assign/authority/service_evidence.rb

@@ -1,286 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "../molecules/evidence_journal"
-require_relative "../molecules/canonical_evidence"
-require_relative "service_cleanup_evidence"
-require_relative "service_cleanup_dispatch"
-require_relative "service_publication_evidence"
-require_relative "../molecules/execution_scope_lineage"
-
-module Ace
-  module Assign
-    module Authority
-      # One source-owned context for initial and retained service evidence.
-      # The journal supplies the record and transient pending view; callers
-      # never supply an alternate reader, artifact path or trusted flag.
-      class ServiceEvidence
-        include ServiceCleanupEvidence
-        include ServiceCleanupDispatch
-        include ServicePublicationEvidence
-        FIELDS = (Molecules::EvidenceJournal::TERMINAL_BINDING_FIELDS +
-          %w[dispatch_ticket_id claim_binding candidate_generation claim_generation policy_digest]).freeze
-        CHALLENGE_FIELDS = %w[version request_id input_digest claim_binding dispatch_ticket_id no_effect_challenge
-          challenge_generation failure_event_digest failure_generation].freeze
-        INSPECTION_FIELDS = %w[version request_id input_digest claim_binding no_effect_challenge challenge_generation
-          challenge_event_digest failure_event_digest failure_generation target dispatch_phase effect_absent
-          handler_terminated writers_absent].freeze
-
-        def initialize(journal:, cleanup_artifacts: nil)
-          @journal = journal
-          @canonical = Molecules::CanonicalEvidence.new(journal: journal)
-          @cleanup_artifacts = cleanup_artifacts
-        end
-
-        # Executor-only projection from the same authenticated original record;
-        # selectors never come from the receiver or a caller-supplied target.
-        def settlement_context(record, commit: @journal.ref_value, read_view: nil)
-          pending = {commit: commit, service_read_view: read_view}
-          context(record, pending: pending)
-          challenge = challenge!(record, pending: pending, current: false) if
-            %w[no_effect_challenge challenge_generation challenge_event_digest].any? { |key| record.key?(key) }
-          proof = cleanup_dispatch_context!(record, commit: commit, pending: pending) if
-            record.values_at("operation", "dispatch_phase") == ["prune-preserved-workspace", "dispatch_started"]
-          settlement_projection(record, pending, challenge, proof)
-        rescue KeyError, TypeError
-          raise AttemptErrors::EvidenceUnavailable, "original service settlement context is incomplete"
-        end
-
-        def context(record, no_effect: false, pending: nil)
-          binding = FIELDS.to_h { |key| [key, record.fetch(key)] }
-          if record.fetch("operation") == "prune-preserved-workspace" && record["dispatch_phase"] == "dispatch_started"
-            binding["operation_owner_binding"] = record.fetch("operation_owner_binding")
-            executor = record.fetch("executor_process_binding")
-            boot = record.fetch("worker_process_binding").fetch("started_at").split(":").fetch(1)
-            Molecules::ExecutionScopeLineage.validate_process_identity!(executor, boot_id: boot)
-            raise AttemptErrors::EvidenceUnavailable, "original cleanup executor differs" unless executor.fetch("uid") == record.fetch("executor_uid")
-            binding["executor_process_binding"] = executor
-          end
-          if record["operation"] == "publish" && record["dispatch_phase"] != "issued"
-            executor = record.fetch("executor_process_binding")
-            boot = record.fetch("worker_process_binding").fetch("started_at").split(":").fetch(1)
-            Molecules::ExecutionScopeLineage.validate_process_identity!(executor, boot_id: boot)
-            raise AttemptErrors::EvidenceUnavailable, "original publication executor differs" unless executor.fetch("uid") == record.fetch("executor_uid")
-            binding["executor_process_binding"] = executor
-          end
-          unless %w[claim_binding policy_digest].all? { |key| binding[key].is_a?(String) && binding[key].match?(/\A[0-9a-f]{64}\z/) } &&
-              %w[candidate_generation claim_generation].all? { |key| binding[key].is_a?(Integer) && binding[key].positive? } &&
-              binding["dispatch_ticket_id"].is_a?(String) && binding["dispatch_ticket_id"].match?(Molecules::JournalMutation::ID)
-            raise AttemptErrors::EvidenceUnavailable, "canonical dispatch binding is invalid"
-          end
-          if no_effect
-            return context_for_challenge(record, challenge!(record, pending: pending))
-          end
-          {kind: "service", project_id: record.fetch("project_id"), assignment_id: record.fetch("assignment_id"),
-            attempt_id: record.fetch("attempt_id"), peer_uid: record.fetch("executor_uid"), binding: binding,
-            request_id_or_event_id: record.fetch("request_id"), generation: record.fetch("claim_generation")}
-        rescue KeyError
-          raise AttemptErrors::EvidenceUnavailable, "canonical service evidence binding is incomplete"
-        end
-
-        # Exact original challenge and failure selected from the same immutable
-        # canonical prefix as its import. Pending events are the journal owner's
-        # held CAS plan, never caller-supplied alternative history.
-        def challenge!(record, pending: nil, current: true)
-          context(record)
-          selector = record.slice("no_effect_challenge", "challenge_generation", "challenge_event_digest")
-          unless selector.keys.sort == %w[no_effect_challenge challenge_generation challenge_event_digest].sort &&
-              selector["no_effect_challenge"].is_a?(String) && selector["no_effect_challenge"].match?(/\A[0-9a-f]{32}\z/) &&
-              selector["challenge_generation"].is_a?(Integer) && selector["challenge_generation"].positive? &&
-              selector["challenge_event_digest"].is_a?(String) && selector["challenge_event_digest"].match?(/\A[0-9a-f]{64}\z/)
-            raise AttemptErrors::EvidenceUnavailable, "canonical challenge selector is invalid"
-          end
-          commit = pending && pending[:commit] || @journal.ref_value
-          events = if pending && pending[:pending_events]
-            pending.fetch(:current_events) + pending.fetch(:pending_events)
-          else
-            service_read_events(record, pending)
-          end
-          unless Models::EvidenceEvent.chain_valid?(events)
-            raise AttemptErrors::EvidenceUnavailable, "canonical challenge chain is corrupt"
-          end
-          selected = events.select { |event| event["digest"] == record.fetch("challenge_event_digest") }
-          unless selected.size == 1 && selected.first["type"] == "service_no_effect_challenge"
-            raise AttemptErrors::EvidenceUnavailable, "canonical challenge event is missing"
-          end
-          challenge = selected.first
-          payload = challenge.fetch("payload")
-          before = events.take_while { |event| event["digest"] != challenge.fetch("digest") }
-          failures = events.select do |event|
-            %w[service_claim service_transition].include?(event["type"]) &&
-              event.dig("payload", "request_id") == record.fetch("request_id") &&
-              %w[uncertain failed].include?(event.dig("payload", "state"))
-          end
-          failure = before.reverse.find { |event| failures.include?(event) }
-          failure_prefix = before.take_while { |event| event["digest"] != failure&.fetch("digest") }
-          generation = failure_prefix.count { |event| event["type"] == "authority_mutation" } + 1
-          unless payload.is_a?(Hash) && payload.keys.sort == CHALLENGE_FIELDS.sort &&
-              payload["version"].is_a?(Integer) && payload["version"] == 1 &&
-              %w[challenge_generation failure_generation].all? { |key| payload[key].is_a?(Integer) && payload[key].positive? } &&
-              payload["no_effect_challenge"].is_a?(String) && payload["no_effect_challenge"].match?(/\A[0-9a-f]{32}\z/) &&
-              %w[request_id input_digest claim_binding dispatch_ticket_id no_effect_challenge challenge_generation].all? { |key| payload[key] == record[key] } &&
-              failure && (!current || failures.last == failure) && before.any? { |event| event["digest"] == failure.fetch("digest") } &&
-              payload["failure_event_digest"] == failure.fetch("digest") && payload["failure_generation"] == generation &&
-              payload["challenge_generation"] == before.count { |event| event["type"] == "authority_mutation" } + 1
-            raise AttemptErrors::EvidenceUnavailable, "canonical challenge or current failure binding differs"
-          end
-          position = events.index(challenge)
-          if pending && pending[:pending_events]&.any? { |event| event["digest"] == challenge.fetch("digest") }
-            unless pending[:operation] == "claim_service_settlement"
-              raise AttemptErrors::EvidenceUnavailable, "pending challenge has no fixed authority owner"
-            end
-          else
-            update, accepted = events.values_at(position + 1, position + 2)
-            expected_params = record.slice("mapping_id", "assignment_id", "attempt_id", "request_id", "candidate_generation").merge(
-              "head" => record.fetch("candidate_head"), "expected_generation" => payload.fetch("challenge_generation") - 1)
-            unless update && update["type"] == "service_challenge" && update.dig("payload", "request_id") == record.fetch("request_id") &&
-                accepted && accepted["type"] == "authority_mutation" && accepted.dig("payload", "operation") == "claim_service_settlement" &&
-                accepted.dig("payload", "assignment_id") == record.fetch("assignment_id") && accepted.dig("payload", "attempt_id") == record.fetch("attempt_id") &&
-                accepted.dig("payload", "parameters_digest") == Atoms::EvidenceDigest.digest(expected_params) &&
-                accepted.dig("payload", "data", "generation").is_a?(Integer) &&
-                accepted.dig("payload", "data", "generation") == payload.fetch("challenge_generation") &&
-                accepted.dig("payload", "data", "reconciliation_challenge", "challenge_generation").is_a?(Integer) &&
-                accepted.dig("payload", "data", "request_id") == record.fetch("request_id") &&
-                accepted.dig("payload", "data", "reconciliation_challenge") == record.slice("no_effect_challenge", "challenge_generation", "challenge_event_digest")
-              raise AttemptErrors::EvidenceUnavailable, "canonical challenge lacks its accepted authority mutation"
-            end
-            commits = service_read_introductions(record,
-              [challenge.fetch("digest"), failure.fetch("digest"), update.fetch("digest"), accepted.fetch("digest")], pending)
-            unless commits.fetch(challenge.fetch("digest")) == commits.fetch(update.fetch("digest")) &&
-                commits.fetch(challenge.fetch("digest")) == commits.fetch(accepted.fetch("digest"))
-              raise AttemptErrors::EvidenceUnavailable, "challenge record and authority acceptance were not atomic"
-            end
-            original = @journal.service_request(record.fetch("request_id"), commit: commits.fetch(challenge.fetch("digest")))
-            unless original && %w[uncertain failed].include?(original["state"]) &&
-                update.dig("payload", "record_digest") == Atoms::EvidenceDigest.digest(original) &&
-                (FIELDS + %w[mapping_id service_id caller_uid authorization worker_process_binding launch_ticket reservation_generation dispatch_phase]).all? { |key| original[key] == record[key] } &&
-                original.slice("no_effect_challenge", "challenge_generation", "challenge_event_digest") ==
-                  record.slice("no_effect_challenge", "challenge_generation", "challenge_event_digest")
-              raise AttemptErrors::EvidenceUnavailable, "challenge accepted record differs from original binding"
-            end
-          end
-          challenge
-        rescue KeyError, TypeError, NoMethodError
-          raise AttemptErrors::EvidenceUnavailable, "canonical challenge binding is incomplete"
-        end
-
-        def inspection!(content, record, challenge)
-          unless content.is_a?(String) && content.bytesize <= Molecules::CanonicalEvidence::MAX_ARTIFACT_BYTES
-            raise AttemptErrors::EvidenceUnavailable, "no-effect inspection exceeds artifact bounds"
-          end
-          text = content.dup.force_encoding(Encoding::UTF_8)
-          raise AttemptErrors::EvidenceUnavailable, "no-effect inspection is invalid UTF8" unless text.valid_encoding?
-          lines = text.lines.filter_map { |line| line.delete_prefix("ace-service-no-effect ").chomp if line.start_with?("ace-service-no-effect ") }
-          raise AttemptErrors::EvidenceUnavailable, "no-effect inspection is missing or repeated" unless lines.size == 1
-          inspection = JSON.parse(lines.first, create_additions: false, max_nesting: 8,
-            allow_duplicate_key: false, allow_comments: false)
-          inspection_projection!(inspection, record, challenge)
-        rescue JSON::ParserError, KeyError, TypeError
-          raise AttemptErrors::EvidenceUnavailable, "no-effect inspection is malformed"
-        end
-
-        def inspection_projection!(inspection, record, challenge)
-          expected = challenge.fetch("payload").slice("request_id", "input_digest", "claim_binding", "no_effect_challenge",
-            "challenge_generation", "failure_event_digest", "failure_generation").merge("version" => 1,
-              "challenge_event_digest" => challenge.fetch("digest"), "target" => record.fetch("target"),
-              "dispatch_phase" => record.fetch("dispatch_phase"), "effect_absent" => true,
-              "handler_terminated" => true, "writers_absent" => true)
-          unless inspection.is_a?(Hash) && inspection.keys.sort == INSPECTION_FIELDS.sort &&
-              %w[version challenge_generation failure_generation].all? { |key| inspection[key].is_a?(Integer) } &&
-              inspection == expected
-            raise AttemptErrors::EvidenceUnavailable, "no-effect inspection differs from original challenge"
-          end
-          true
-        rescue KeyError, TypeError
-          raise AttemptErrors::EvidenceUnavailable, "no-effect inspection is malformed"
-        end
-
-        def call(reference, record, state, pending)
-          if reference.is_a?(Array)
-            return publication_collection!(reference, record, state, pending) if record["operation"] == "publish"
-            return cleanup_collection!(reference, record, state, pending)
-          end
-          no_effect = state == "failed-settled"
-          expected = context(record, no_effect: no_effect, pending: pending)
-          bytes = if pending && pending[:pending_events]
-            @canonical.read_pending(reference, **expected, **pending.slice(:current_events, :pending_events, :blobs, :commit))
-          else
-            @canonical.read(reference, **expected, commit: pending && pending[:commit] || @journal.ref_value)
-          end
-          if no_effect
-            challenge = challenge!(record, pending: pending)
-            inspection!(bytes, record, challenge)
-          end
-          bytes
-        end
-
-        private
-
-        def settlement_projection(record, pending, challenge, proof)
-          selected = nil
-          if challenge
-            latest_failure = service_read_events(record, pending).reverse.find do |event|
-              event["attempt_id"] == record.fetch("attempt_id") &&
-                %w[service_claim service_transition].include?(event["type"]) &&
-                event.dig("payload", "request_id") == record.fetch("request_id") &&
-                %w[uncertain failed].include?(event.dig("payload", "state"))
-            end
-            if latest_failure && latest_failure.fetch("digest") == challenge.dig("payload", "failure_event_digest")
-              selected = challenge.fetch("payload").slice("request_id", "input_digest", "claim_binding",
-                "no_effect_challenge", "challenge_generation", "failure_event_digest", "failure_generation")
-                .merge("challenge_event_digest" => challenge.fetch("digest"))
-            end
-          end
-          execution = record.slice("mapping_id", "candidate_generation", "claim_binding", "dispatch_phase")
-            .merge("head" => record.fetch("candidate_head"))
-          if record["operation"] == "prune-preserved-workspace" && record["dispatch_phase"] == "dispatch_started"
-            execution.merge!(record.slice("operation_owner_binding", "executor_process_binding"))
-            execution.merge!(proof.slice("request_event_digest", "dispatch_event_digest"))
-          end
-          value = {"version" => 1, "request" => record.slice(*Molecules::EvidenceJournal::TERMINAL_BINDING_FIELDS),
-            "execution" => execution, "challenge" => selected}
-          freeze_projection(JSON.parse(JSON.generate(value)))
-        end
-
-        def context_for_challenge(record, selection)
-          expected = context(record)
-          binding = expected.fetch(:binding)
-          binding.merge!(record.slice("no_effect_challenge", "challenge_generation", "challenge_event_digest"))
-          binding.merge!(selection.fetch("payload").slice("failure_event_digest", "failure_generation"))
-          binding["dispatch_phase"] = record.fetch("dispatch_phase")
-          expected
-        end
-
-        def service_read_view(pending)
-          view = pending && pending[:service_read_view]
-          return nil unless view
-          unless view.is_a?(Molecules::EvidenceJournal::ServiceReadView) && view.journal.equal?(@journal) &&
-              view.commit == pending.fetch(:commit) && view.inventory.fetch("commit") == view.commit
-            raise AttemptErrors::EvidenceUnavailable, "service read view differs from its selected owner"
-          end
-          view
-        end
-
-        def service_read_events(record, pending)
-          view = service_read_view(pending)
-          selected = view ? view.inventory.fetch("events").fetch(record.fetch("assignment_id")) :
-            @journal.read_events(record.fetch("assignment_id"), commit: pending && pending[:commit] || @journal.ref_value)
-          selected.select { |event| event.fetch("attempt_id") == record.fetch("attempt_id") }
-        end
-
-        def service_read_introductions(record, selectors, pending)
-          view = service_read_view(pending)
-          return @journal.event_commits!(assignment_id: record.fetch("assignment_id"), event_digests: selectors,
-            commit: pending && pending[:commit] || @journal.ref_value) unless view
-          facts = view.inventory.fetch("introductions").fetch(record.fetch("assignment_id"))
-          selectors.to_h { |selector| [selector, facts.fetch(selector)] }.freeze
-        end
-
-        def freeze_projection(value)
-          value.each_value { |child| freeze_projection(child) } if value.is_a?(Hash)
-          value.each { |child| freeze_projection(child) } if value.is_a?(Array)
-          value.freeze
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/authority/service_publication_evidence.rb

@@ -1,110 +0,0 @@
-# frozen_string_literal: true
-
-module Ace
-  module Assign
-    module Authority
-      # Publication-specific facts remain artifacts of the existing service
-      # record and canonical import owner, not a second publication journal.
-      module ServicePublicationEvidence
-        PUBLICATION_NEED_FIELDS = %w[schema classification request_id input_digest claim_binding
-          candidate_generation head registry gem_name version artifact_digest dispatch_event_digest previous_challenge_digest].freeze
-        PUBLICATION_FIELDS = %w[publication_challenge_digest publication_challenge_ref publication_challenge_event_digest
-          publication_challenge_generation publication_issuing_event_digest].freeze
-
-        def publication_result!(bytes, record, state:)
-          value = JSON.parse(bytes, allow_duplicate_key: false, allow_nan: false, max_nesting: 16)
-          fields = %w[schema publication target classification code request_id input_digest claim_binding]
-          publication = value.fetch("publication")
-          allowed = state == "succeeded" ? ["registry_exact_artifact"] :
-            %w[provider_rejected_non_otp executor_credentials_unavailable registry_artifact_conflict]
-          unless bytes.bytesize.between?(1, 65536) && value.is_a?(Hash) && value.keys.sort == fields.sort &&
-              value["schema"] == "ace.publication-result/v1" && value["classification"] == state && allowed.include?(value["code"]) &&
-              %w[request_id input_digest claim_binding target].all? { |key| value[key] == record[key] } &&
-              publication.is_a?(Hash) && publication.keys.sort == %w[gem_name version head registry artifact_relative_path].sort &&
-              publication["head"] == record.fetch("candidate_head") && publication["registry"] == "https://rubygems.org" &&
-              publication["gem_name"].is_a?(String) && publication["gem_name"].match?(/\A[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}\z/) &&
-              publication["version"].is_a?(String) && publication["version"].bytesize.between?(1, 128) &&
-              publication["version"].match?(/\A[0-9]+(?:\.[0-9A-Za-z]+)*(?:-[0-9A-Za-z]+(?:\.[0-9A-Za-z]+)*)?\z/) &&
-              "rubygems:#{publication['gem_name']}:#{publication['version']}" == record.dig("target", "resource") &&
-              publication["artifact_relative_path"].is_a?(String) && publication["artifact_relative_path"].bytesize.between?(1, 4096) &&
-              publication["artifact_relative_path"].end_with?(".gem") &&
-              publication["artifact_relative_path"].split("/", -1).all? { |part| part.match?(/\A[a-zA-Z0-9_.-]+\z/) && !%w[. ..].include?(part) }
-            raise AttemptErrors::ReceiptRejected, "publication result differs from original artifact"
-          end
-          value
-        rescue JSON::ParserError, KeyError, TypeError, NoMethodError
-          raise AttemptErrors::ReceiptRejected, "publication result is invalid"
-        end
-
-        def publication_collection!(references, record, state, pending)
-          unless %w[succeeded failed].include?(state) && references.size == 1
-            raise AttemptErrors::ReceiptRejected, "publication requires one exact result artifact"
-          end
-          expected = context(record, pending: pending)
-          bytes = if pending && pending[:pending_events]
-            @canonical.read_pending(references.first, **expected, **pending.slice(:current_events, :pending_events, :blobs, :commit))
-          else
-            @canonical.read(references.first, **expected, commit: pending && pending[:commit] || @journal.ref_value)
-          end
-          publication_result!(bytes, record, state: state)
-          [bytes].freeze
-        end
-
-        def publication_need!(bytes, record, previous:)
-          value = JSON.parse(bytes, allow_duplicate_key: false, allow_comments: false,
-            allow_nan: false, create_additions: false, max_nesting: 16)
-          unless bytes.bytesize.between?(1, 65536) && value.is_a?(Hash) &&
-              value.keys.sort == PUBLICATION_NEED_FIELDS.sort && value["schema"] == "ace.publication-otp-need/v1" &&
-              %w[otp-required otp-rejected otp-expired].include?(value["classification"]) &&
-              %w[request_id input_digest claim_binding candidate_generation].all? { |key| value[key] == record[key] } &&
-              value["head"] == record["candidate_head"] && value["registry"] == "https://rubygems.org" &&
-              value["previous_challenge_digest"] == previous && value["artifact_digest"] == record.dig("target", "artifact_digest") &&
-              "rubygems:#{value['gem_name']}:#{value['version']}" == record.dig("target", "resource") &&
-              value["dispatch_event_digest"].is_a?(String) && value["dispatch_event_digest"].match?(/\A[0-9a-f]{64}\z/)
-            raise AttemptErrors::ReceiptRejected, "publication OTP need differs from original dispatch"
-          end
-          value
-        rescue JSON::ParserError, KeyError, TypeError
-          raise AttemptErrors::ReceiptRejected, "publication OTP need is invalid"
-        end
-
-        def publication_challenge!(record, pending: nil)
-          context(record)
-          commit = pending && pending[:commit] || @journal.ref_value
-          events = pending && pending[:pending_events] ? pending.fetch(:current_events) + pending.fetch(:pending_events) :
-            @journal.read_events(record.fetch("assignment_id"), commit: commit).select { |event| event["attempt_id"] == record.fetch("attempt_id") }
-          unless Models::EvidenceEvent.chain_valid?(events)
-            raise AttemptErrors::EvidenceUnavailable, "publication challenge chain is corrupt"
-          end
-          event = events.find { |row| row["digest"] == record["publication_challenge_event_digest"] }
-          unless event && event["type"] == "service_publication_challenge" &&
-              event.dig("payload", "challenge_digest") == record["publication_challenge_digest"] &&
-              event.dig("payload", "request_id") == record["request_id"] &&
-              event.dig("payload", "generation") == record["publication_challenge_generation"]
-            raise AttemptErrors::EvidenceUnavailable, "publication challenge introduction is unavailable"
-          end
-          reference = record.fetch("publication_challenge_ref")
-          bytes = if pending && pending[:pending_events]
-            @canonical.read_pending(reference, **context(record), current_events: pending.fetch(:current_events),
-              pending_events: pending.fetch(:pending_events), blobs: pending.fetch(:blobs), commit: commit)
-          else
-            @canonical.read(reference, **context(record), commit: commit)
-          end
-          unless Digest::SHA256.hexdigest(bytes) == record.fetch("publication_challenge_digest")
-            raise AttemptErrors::EvidenceUnavailable, "publication challenge digest differs"
-          end
-          need = publication_need!(bytes, record, previous: event.dig("payload", "previous_challenge_digest"))
-          dispatch = events.find { |row| row["digest"] == need.fetch("dispatch_event_digest") }
-          unless dispatch && dispatch["type"] == "authority_mutation" && dispatch.dig("payload", "operation") == "begin_dispatch" &&
-              dispatch.dig("payload", "data", "request_id") == record.fetch("request_id") &&
-              dispatch.dig("payload", "data", "executor_process_binding") == record.fetch("executor_process_binding")
-            raise AttemptErrors::EvidenceUnavailable, "publication need has no original executor dispatch"
-          end
-          need
-        rescue KeyError, TypeError
-          raise AttemptErrors::EvidenceUnavailable, "publication challenge evidence is incomplete"
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/authority/socket_server.rb

@@ -1,255 +0,0 @@
-# frozen_string_literal: true
-
-require "socket"
-require "fileutils"
-require_relative "transfer_codec"
-require_relative "../molecules/evidence_journal"
-
-module Ace
-  module Assign
-    module Authority
-      # Shared endpoint lifetime and bounded wire protocol. Concrete source
-      # compositions authenticate their own installed principals before dispatch.
-      # Protected deployment/kernel requirements remain in Server.
-      class SocketServer
-        CONNECTIONS = 16
-
-        def initialize(service:, lifecycle:, services: [])
-          unless services.is_a?(Array) && services.uniq.size == services.size &&
-              services.all? { |owned| owned.respond_to?(:run) && owned.respond_to?(:stop) }
-            raise ArgumentError, "authority services require distinct source-owned run/stop lifetimes"
-          end
-          @service, @lifecycle, @services = service, lifecycle, services.dup.freeze
-          @service_threads = []
-          @activation_gates = []
-          @mutex = Mutex.new
-          @connections = []
-          @handlers = []
-          @transfers = 0
-          @stopped = false
-        end
-
-        def serve
-          verify_listener!
-          directory = File.dirname(@service.fetch("socket_path"))
-          wire.root_path!(directory, directory: true, owner: @service.fetch("uid"))
-          lock = File.open(File.join(directory, "listener.lock"), File::RDWR | File::CREAT | File::NOFOLLOW, 0o600)
-          unless lock.flock(File::LOCK_EX | File::LOCK_NB)
-            raise AttemptErrors::Conflict, "assignment authority already owns its listener"
-          end
-          path = @service.fetch("socket_path")
-          if File.exist?(path) || File.symlink?(path)
-            raise AttemptErrors::Conflict, "existing authority endpoint requires verified installer recovery"
-          end
-          @listener = UNIXServer.new(path)
-          @endpoint = wire.socket_identity(path)
-          File.chmod(0o660, path)
-          start_services!
-          verify_services!
-          @activation_gates.each { |gate| gate << :activate }
-          until @stopped
-            verify_services!
-            ready = IO.select([@listener], nil, nil, 0.25)
-            next unless ready
-            socket = @listener.accept_nonblock(exception: false)
-            next if socket == :wait_readable
-            admitted = @mutex.synchronize do
-              if @connections.size < CONNECTIONS
-                @connections << socket
-                true
-              end
-            end
-            unless admitted
-              refusal(socket, "busy")
-              socket.close
-              next
-            end
-            @mutex.synchronize do
-              @handlers.reject! { |handler| !handler.alive? }
-              @handlers << Thread.new(socket) { |connection| receive(connection) }
-            end
-          end
-        rescue IOError, Errno::EBADF
-          raise unless @stopped
-        ensure
-          begin
-            stop
-            stop_services!
-          ensure
-            # Closing a stream does not cancel an admitted transaction. Hold
-            # the owner lock and endpoint until every handler has ended.
-            begin
-              @mutex.synchronize { @handlers.dup }.each(&:join)
-              @lifecycle.close if @endpoint && @lifecycle.respond_to?(:close)
-            ensure
-              begin
-                File.unlink(path) if @endpoint && same_endpoint?(path)
-              ensure
-                lock&.close
-              end
-            end
-          end
-        end
-
-        def request_stop
-          @stopped = true
-        end
-
-        def stop
-          @stopped = true
-          @listener&.close unless @listener&.closed?
-          @mutex.synchronize { @connections.each { |socket| socket.close unless socket.closed? } }
-        end
-
-        private
-
-        # Installed HITL and merge listeners share the assignment owner lock.
-        # Every selected boundary must be ready before assignment ingress opens;
-        # a stopped boundary closes admission until the complete owner restarts.
-        def start_services!
-          @services.each do |owned|
-            ready = Queue.new
-            activation = Queue.new
-            @activation_gates << activation
-            thread = Thread.new do
-              owned.run(on_ready: lambda do
-                ready << :ready
-                unless activation.pop == :activate
-                  raise Ace::Runtime::RuntimeUnavailableError, "authority startup was cancelled"
-                end
-              end)
-            rescue Exception => error
-              ready << error
-            ensure
-              ready << :stopped
-            end
-            thread.report_on_exception = false
-            @service_threads << [owned, thread]
-            result = ready.pop(timeout: 5)
-            raise Ace::Runtime::RuntimeUnavailableError, "authority service startup did not become ready" unless result == :ready || result.is_a?(Exception)
-            raise result if result.is_a?(Exception)
-          end
-        end
-
-        def verify_services!
-          unless @service_threads.all? { |_, thread| thread.alive? }
-            raise Ace::Runtime::RuntimeUnavailableError, "an owned service stopped before its authority"
-          end
-        end
-
-        def stop_services!
-          errors = []
-          @activation_gates.each { |gate| gate << :cancel }
-          @service_threads.reverse_each do |owned, _|
-            owned.stop
-          rescue Exception => error
-            errors << error
-          end
-          @service_threads.each do |_, thread|
-            thread.join
-          rescue Exception => error
-            errors << error
-          end
-          raise errors.first unless errors.empty?
-        end
-
-        def same_endpoint?(path)
-          wire.socket_identity(path) == @endpoint
-        rescue StandardError
-          false
-        end
-
-        def verify_listener!
-          raise NotImplementedError, "source composition must verify its installed listener"
-        end
-
-        def dispatch_request(socket, request, peer, role, deadline, frame_bytes:)
-          params = request.fetch("params")
-          admitted_transfer = false
-          Molecules::EvidenceJournal.with_event_read_operation do
-            binding = @lifecycle.transfer_binding(request) if @lifecycle.respond_to?(:transfer_binding)
-            if binding
-              raise AttemptErrors::UnauthorizedIdentity, "transfer role differs" unless binding.fetch(:roles).include?(role)
-              raise ArgumentError, "transfer control header is oversized" if frame_bytes > 16_384
-              authorize_transfer!(request: request, peer: peer, role: role, deadline: deadline)
-              admitted_transfer = @mutex.synchronize do
-                if @transfers < 2
-                  @transfers += 1
-                  true
-                end
-              end
-              raise AttemptErrors::Conflict, "transfer capacity is busy" unless admitted_transfer
-              codec = transfer_codec
-              if binding.fetch(:direction) == :upload
-                result = codec.receive(socket, descriptor: params.fetch("transfer"), purpose: binding.fetch(:purpose), deadline: deadline) do |input|
-                  dispatch_lifecycle(request: request, peer: peer, role: role, transfer: input, deadline: deadline)
-                end
-              else
-                result = dispatch_lifecycle(request: request, peer: peer, role: role, deadline: deadline)
-                parts = result.fetch(:transfer_parts)
-                descriptor = codec.descriptor(parts, purpose: binding.fetch(:purpose))
-                result = result.merge(data: result.fetch(:data).merge("transfer" => descriptor))
-              end
-            else
-              raise ArgumentError, "unexpected transfer descriptor" if params.key?("transfer")
-              result = dispatch_lifecycle(request: request, peer: peer, role: role, deadline: deadline)
-            end
-            wire.write(socket, {"status" => "ok", "data" => result.fetch(:data),
-              "transport" => {"replayed" => result.fetch(:replayed, false)}}, deadline: deadline, limit: 16_384)
-            if binding && binding.fetch(:direction) == :download
-              codec.send(socket, parts: parts, descriptor: descriptor, purpose: binding.fetch(:purpose), deadline: deadline)
-            end
-          end
-        ensure
-          @mutex.synchronize { @transfers -= 1 } if admitted_transfer
-        end
-
-        def authorize_transfer!(request:, peer:, role:, deadline:)
-          @lifecycle.authorize_transfer!(request: request, peer: peer, role: role)
-        end
-
-        def dispatch_lifecycle(request:, peer:, role:, deadline:, transfer: nil)
-          options = {request: request, peer: peer, role: role}
-          options[:transfer] = transfer if transfer
-          @lifecycle.dispatch(**options)
-        end
-
-        # These closed read operations have no request body. Half-close proves
-        # framing completion before status or artifact data can be exposed.
-        def bodyless_read!(socket, deadline)
-          loop do
-            remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
-            raise ArgumentError, "read request framing is incomplete" unless remaining.positive? && IO.select([socket], nil, nil, remaining)
-            bytes = socket.read_nonblock(1, exception: false)
-            next if bytes == :wait_readable
-            raise ArgumentError, "unexpected read request body" unless bytes.nil?
-            return
-          end
-        end
-
-        def transfer_codec
-          @mutex.synchronize do
-            @transfer_codec ||= begin
-              root = @service.fetch("state_root")
-              PrivateDirectory.verify!(root)
-              spool = File.join(root, "transfers")
-              Dir.mkdir(spool, 0o700) unless File.exist?(spool) || File.symlink?(spool)
-              TransferCodec.new(root: spool)
-            end
-          end
-        end
-
-        def refusal(socket, code)
-          wire.write(socket, {"status" => "error", "error" => {"code" => code, "message" => "Protected authority refused #{code}"}},
-            deadline: wire.deadline(0.1))
-        rescue StandardError
-          nil
-        end
-
-        def wire
-          Ace::Runtime::Molecules::ProtectedSocket
-        end
-      end
-    end
-  end
-end