ace-assign 0.70.0 → 0.73.0

data/lib/ace/assign/cli/commands/submit_candidate.rb

@@ -1,34 +0,0 @@
-# frozen_string_literal: true
-require_relative "protected_submission"
-module Ace
-  module Assign
-    module CLI
-      module Commands
-        class SubmitCandidate < Ace::Support::Cli::Command
-          include Ace::Support::Cli::Base
-          include ProtectedSubmission
-          desc "Submit original protected worker bundle bytes"
-          option :mapping, desc: "Installed mapping"
-          option :assignment, desc: "Original assignment"
-          option :attempt, desc: "Original attempt"
-          option :head, desc: "Exact candidate head"
-          option :candidate_generation, desc: "Expected current candidate generation (zero before first submission)"
-          option :expected_generation, desc: "Persisted authority generation"
-          option :mutation, desc: "Stable original mutation"
-          option :bundle, desc: "Bounded local byte file"
-
-          def call(**options)
-            usage = "submit-candidate with original selectors, generation, mutation and --bundle FILE"
-            client, params, mutation = submission_request(options, usage)
-            head = require_option(options, :head, usage)
-            raise Ace::Support::Cli::Error, "Head must be an exact SHA-1" unless head.match?(/\A[0-9a-f]{40}\z/)
-            params.merge!("head" => head, "candidate_generation" => integer_option(options, :candidate_generation, usage))
-            bytes = input_bytes(require_option(options, :bundle, usage), limit: 64 * 1024 * 1024)
-            parts = [bytes]
-            emit_json(upload_call(client, "submit_candidate", params, mutation, parts, :candidate))
-          end
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/cli/commands/submit_result.rb

@@ -1,61 +0,0 @@
-# frozen_string_literal: true
-require_relative "protected_submission"
-require_relative "../../authority/receipt_transfer"
-module Ace
-  module Assign
-    module CLI
-      module Commands
-        class SubmitResult < Ace::Support::Cli::Command
-          include Ace::Support::Cli::Base
-          include ProtectedSubmission
-          desc "Submit original protected worker receipt bytes"
-          option :mapping, desc: "Installed mapping"
-          option :assignment, desc: "Original assignment"
-          option :attempt, desc: "Original attempt"
-          option :head, desc: "Exact candidate head"
-          option :candidate_generation, desc: "Positive candidate generation"
-          option :expected_generation, desc: "Persisted authority generation"
-          option :mutation, desc: "Stable original mutation"
-          option :receipt, desc: "Bounded local byte file"
-          option :artifact, type: :array, desc: "Ordered artifact byte files"
-
-          def call(**options)
-            usage = "submit-result with original selectors, generation, mutation and --receipt FILE"
-            client, params, mutation = submission_request(options, usage)
-            head = require_option(options, :head, usage)
-            raise Ace::Support::Cli::Error, "Head must be an exact SHA-1" unless head.match?(/\A[0-9a-f]{40}\z/)
-            params.merge!("head" => head, "candidate_generation" => integer_option(options, :candidate_generation, usage, positive: true))
-            bytes = input_bytes(require_option(options, :receipt, usage), limit: 16 * 1024)
-            receipt = input_json(bytes)
-            raise Ace::Support::Cli::Error, "Receipt must be an object" unless receipt.is_a?(Hash)
-            allowed = Models::ExecutionReceipt.from_h(receipt).to_h.keys
-            if (receipt.keys - allowed).any? || Models::ExecutionReceipt.forbidden_field?(receipt)
-              raise Ace::Support::Cli::Error, "Receipt contains unsupported fields"
-            end
-            unless receipt.values_at("assignment_id", "attempt_id", "head") == params.values_at("assignment_id", "attempt_id", "head") &&
-                Models::ExecutionReceipt::VERDICTS.include?(receipt["verdict"])
-              raise Ace::Support::Cli::Error, "Receipt identity or verdict differs"
-            end
-            files = options.fetch(:artifact, [])
-            unless files.is_a?(Array) && files.size <= 16 && !(receipt["verdict"] == "succeeded" && files.empty?)
-              raise Ace::Support::Cli::Error, "Receipt artifact declarations are invalid"
-            end
-            artifacts = files.map { |path| input_bytes(path, limit: 64 * 1024, nonempty: false) }
-            parts = [bytes, *artifacts]
-            digest = Digest::SHA256.hexdigest(bytes)
-            input = Struct.new(:parts) do
-              def count = parts.length
-              def bytes(index: 0) = parts.fetch(index)
-            end.new(parts)
-            # Reuse the maintained ordered artifact validator. This is input
-            # checking only; canonical result/producer admission remains Endcap's.
-            Ace::Assign::Authority::ReceiptTransfer.decode(input: input, receipt_sha256: digest,
-              artifact_field: "artifacts", reference_key: "path")
-            params["receipt_sha256"] = digest
-            emit_json(upload_call(client, "submit_result", params, mutation, parts, :receipt_artifacts))
-          end
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/models/attempt.rb

@@ -1,178 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "../atoms/attempt_state_machine"
-require_relative "attempt_binding"
-
-module Ace
-  module Assign
-    module Models
-      # Mutable derived state of an assignment attempt.
-      #
-      # The binding is immutable; an Attempt carries the derived execution
-      # state: the current state-machine state, the pinned candidate head,
-      # the latest evidence journal commit, accepted receipts (by digest),
-      # recorded effects, and the append-only local event trail for
-      # taskless attempts. `base_head` (binding) and `candidate_head`
-      # (deliverable) are always tracked separately.
-      class Attempt
-        attr_reader :binding, :state, :candidate_head, :journal_commit,
-          :accepted_receipts, :effects, :events, :updated_at
-
-        # @param binding [Models::AttemptBinding] Immutable start-time binding
-        # @param state [String] State-machine state
-        # @param candidate_head [String, nil] Pinned deliverable head
-        # @param journal_commit [String, nil] Latest evidence journal commit SHA
-        # @param accepted_receipts [Array<Hash>] Accepted receipt payloads (digests included)
-        # @param effects [Array<Hash>] Recorded effects with intent/receipt linkage
-        # @param events [Array<Hash>] Local event trail (taskless attempts only)
-        # @param updated_at [Time] Last state change
-        def initialize(binding:, state: "reserved", candidate_head: nil, journal_commit: nil,
-          accepted_receipts: [], effects: [], events: [], updated_at: nil)
-          @binding = binding
-          @state = state.to_s
-          @candidate_head = candidate_head
-          @journal_commit = journal_commit
-          @accepted_receipts = accepted_receipts.dup.freeze
-          @effects = effects.dup.freeze
-          @events = events.dup.freeze
-          @updated_at = updated_at || binding.created_at
-        end
-
-        # @return [String] Immutable attempt ID
-        def attempt_id
-          binding.attempt_id
-        end
-
-        # @return [Boolean] True if no further transitions or effects are allowed
-        def terminal?
-          Atoms::AttemptStateMachine.terminal?(state)
-        end
-
-        # @return [Boolean] True if the attempt awaits reconciliation
-        def uncertain?
-          state == "uncertain"
-        end
-
-        # @return [Boolean] True if the attempt owns an active subtree slot
-        def active?
-          %w[reserved running uncertain].include?(state)
-        end
-
-        # @return [String] "git" or "local_only" recovery mode
-        def recovery_mode
-          binding.recovery_mode
-        end
-
-        # @return [Boolean] True when managed evidence-ref journaling applies
-        def managed?
-          binding.managed?
-        end
-
-        # Effects whose intent was recorded but whose accepted receipt is missing.
-        #
-        # @return [Array<Hash>] Unresolved effect records
-        def unresolved_effects
-          effects.reject { |effect| effect["receipt_digest"] }
-        end
-
-        # Return a new Attempt with the state transitioned.
-        #
-        # @param to [String] Target state (validated against the state machine)
-        # @param at [Time] Transition time
-        # @return [Attempt] New attempt instance
-        # @raise [Ace::Assign::AttemptErrors::InvalidTransition] if illegal
-        def transition(to, at: Time.now.utc)
-          Atoms::AttemptStateMachine.transition!(state, to)
-          with(state: to.to_s, updated_at: at)
-        end
-
-        # Return a new Attempt with updated derived fields. The binding is
-        # never replaced.
-        #
-        # @param attrs [Hash] Fields to override (state, candidate_head,
-        #   journal_commit, accepted_receipts, effects, events, updated_at)
-        # @return [Attempt] New attempt instance
-        def with(**attrs)
-          Attempt.new(
-            binding: binding,
-            state: attrs.fetch(:state, state),
-            candidate_head: attrs.fetch(:candidate_head, candidate_head),
-            journal_commit: attrs.fetch(:journal_commit, journal_commit),
-            accepted_receipts: attrs.fetch(:accepted_receipts, accepted_receipts),
-            effects: attrs.fetch(:effects, effects),
-            events: attrs.fetch(:events, events),
-            updated_at: attrs.fetch(:updated_at, Time.now.utc)
-          )
-        end
-
-        # Convert to a hash for canonical serialization.
-        # @return [Hash] Attempt data with string keys
-        def to_h
-          {
-            "binding" => binding.to_h,
-            "state" => state,
-            "candidate_head" => candidate_head,
-            "journal_commit" => journal_commit,
-            "accepted_receipts" => accepted_receipts,
-            "effects" => effects,
-            "events" => events,
-            "updated_at" => updated_at.iso8601
-          }
-        end
-
-        # JSON projection exposed by public commands. Contains attempt
-        # ID, state, binding facts, references and digests only — never
-        # credentials, receipt bytes, or terminal output.
-        #
-        # @return [Hash] Redacted projection
-        def projection
-          {
-            "attempt_id" => attempt_id,
-            "state" => state,
-            "assignment_id" => binding.assignment_id,
-            "scope" => binding.scope,
-            "project_id" => binding.project_id,
-            "task_id" => binding.task_id,
-            "actor" => binding.actor,
-            "role" => binding.role,
-            "runtime" => binding.runtime,
-            "base_head" => binding.base_head,
-            "candidate_head" => candidate_head,
-            "evidence_git_ref" => binding.evidence_git_ref,
-            "journal_commit" => journal_commit,
-            "recovery_mode" => recovery_mode,
-            "accepted_receipt_digests" => accepted_receipts.map { |receipt| receipt["digest"] },
-            "unresolved_effects" => unresolved_effects.map { |effect| effect["operation"] },
-            "created_at" => binding.created_at.iso8601,
-            "updated_at" => updated_at.iso8601
-          }
-        end
-
-        # Rebuild an attempt from serialized data.
-        #
-        # @param data [Hash] Serialized attempt (string keys)
-        # @return [Attempt] Rebuilt attempt
-        def self.from_h(data)
-          new(
-            binding: AttemptBinding.from_h(data["binding"]),
-            state: data["state"],
-            candidate_head: data["candidate_head"],
-            journal_commit: data["journal_commit"],
-            accepted_receipts: data["accepted_receipts"] || [],
-            effects: data["effects"] || [],
-            events: data["events"] || [],
-            updated_at: parse_time(data["updated_at"])
-          )
-        end
-
-        def self.parse_time(value)
-          return nil if value.nil?
-          return value if value.is_a?(Time)
-          require "time"
-          Time.parse(value)
-        end
-        private_class_method :parse_time
-      end
-    end
-  end
-end

data/lib/ace/assign/models/attempt_binding.rb

@@ -1,116 +0,0 @@
-# frozen_string_literal: true
-
-module Ace
-  module Assign
-    module Models
-      # Immutable start-time facts for an assignment attempt.
-      #
-      # A binding freezes exactly what an attempt owns: the immutable attempt
-      # ID, the assignment and step/subtree scope, the project, the
-      # authenticated actor/role and runtime identity resolved at the
-      # execution boundary, the source task ID, the base head captured once at
-      # start, and the configured evidence ref. Bindings are never mutated;
-      # changes require a new attempt.
-      class AttemptBinding
-        attr_reader :attempt_id, :assignment_id, :scope, :project_id, :task_id,
-          :actor, :role, :runtime, :base_head, :evidence_git_ref, :created_at
-
-        # @param attempt_id [String] Immutable attempt ID (ace-b36ts)
-        # @param assignment_id [String] Owning assignment ID
-        # @param scope [String] Canonical step/subtree scope
-        # @param project_id [String] Project the attempt executes in
-        # @param actor [String] Authenticated actor from the execution boundary
-        # @param role [String] Trusted role (coordinator, service, worker)
-        # @param runtime [String] Runtime identity of the executing boundary
-        # @param base_head [String] Git HEAD captured exactly once at start
-        # @param task_id [String, nil] Source task ID (nil for taskless assignments)
-        # @param evidence_git_ref [String, nil] Evidence ref for managed attempts
-        # @param created_at [Time] Binding creation time
-        def initialize(attempt_id:, assignment_id:, scope:, project_id:, actor:, role:, runtime:, base_head:,
-          task_id: nil, evidence_git_ref: nil, created_at:)
-          @attempt_id = attempt_id.freeze
-          @assignment_id = assignment_id.freeze
-          @scope = scope.freeze
-          @project_id = project_id.freeze
-          @task_id = task_id&.freeze
-          @actor = actor.freeze
-          @role = role.freeze
-          @runtime = runtime.freeze
-          @base_head = base_head.freeze
-          @evidence_git_ref = evidence_git_ref&.freeze
-          @created_at = created_at
-        end
-
-        # @return [Boolean] True when the attempt is bound to a source task and
-        #   eligible for managed evidence-ref delivery
-        def managed?
-          !task_id.nil? && !task_id.to_s.strip.empty?
-        end
-
-        # Recovery mode implied by task attachment: git-backed journaling for
-        # task-attached attempts, disposable local state otherwise.
-        #
-        # @return [String] "git" or "local_only"
-        def recovery_mode
-          managed? ? "git" : "local_only"
-        end
-
-        # Identity facts repeated by receipts must match the binding exactly.
-        #
-        # @param other [AttemptBinding] Binding to compare
-        # @return [Boolean] True if both bindings own the same attempt identity
-        def same_identity?(other)
-          attempt_id == other.attempt_id &&
-            assignment_id == other.assignment_id &&
-            scope == other.scope &&
-            project_id == other.project_id
-        end
-
-        # Convert to a hash for canonical serialization.
-        # @return [Hash] Binding data with string keys
-        def to_h
-          {
-            "attempt_id" => attempt_id,
-            "assignment_id" => assignment_id,
-            "scope" => scope,
-            "project_id" => project_id,
-            "task_id" => task_id,
-            "actor" => actor,
-            "role" => role,
-            "runtime" => runtime,
-            "base_head" => base_head,
-            "evidence_git_ref" => evidence_git_ref,
-            "created_at" => created_at.iso8601
-          }
-        end
-
-        # Rebuild a binding from serialized data.
-        #
-        # @param data [Hash] Serialized binding (string keys)
-        # @return [AttemptBinding] Rebuilt binding
-        def self.from_h(data)
-          new(
-            attempt_id: data["attempt_id"],
-            assignment_id: data["assignment_id"],
-            scope: data["scope"],
-            project_id: data["project_id"],
-            task_id: data["task_id"],
-            actor: data["actor"],
-            role: data["role"],
-            runtime: data["runtime"],
-            base_head: data["base_head"],
-            evidence_git_ref: data["evidence_git_ref"],
-            created_at: parse_time(data["created_at"])
-          )
-        end
-
-        def self.parse_time(value)
-          return value if value.is_a?(Time)
-          require "time"
-          Time.parse(value)
-        end
-        private_class_method :parse_time
-      end
-    end
-  end
-end

data/lib/ace/assign/models/evidence_event.rb

@@ -1,86 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "../atoms/evidence_digest"
-
-module Ace
-  module Assign
-    module Models
-      # Append-only accepted evidence event.
-      #
-      # Evidence events are the journal trail of an attempt: intent,
-      # process start, accepted receipts, state transitions, candidate
-      # invalidations, and reconciliations. Each event chains to the digest
-      # of its predecessor for the attempt, so accepted history cannot be
-      # reordered or silently rewritten. Events carry bounded, non-secret
-      # metadata only.
-      module EvidenceEvent
-        TYPES = %w[
-          intent process_start receipt_accepted transition attempt_stopped
-          candidate_invalidated reconciliation
-          service_claim service_transition service_challenge service_no_effect_challenge service_publication_challenge service_publication_issuing recovery_observation inbox_binding delivery
-          authority_mutation evidence_import proposal_state result_submitted prompt_issued prompt_outcome prompt_completion_observed input_inhibited
-          scope_provisioning scope_bound scope_native_bound scope_child_bound scope_sealed scope_closed_no_writers
-          merge_admission merge_transition
-        ].freeze
-
-        # Build an event chained to a previous digest.
-        #
-        # @param type [String] Event type (see TYPES)
-        # @param attempt_id [String] Owning attempt ID
-        # @param payload [Hash] Bounded, non-secret event metadata
-        # @param previous_digest [String, nil] Digest of the previous event (chain)
-        # @param recorded_at [Time] Event creation time
-        # @return [Hash] Serializable event with type, payload, digests, timestamp
-        # @raise [ArgumentError] for unknown event types
-        def self.build(type:, attempt_id:, payload:, previous_digest: nil, recorded_at: Time.now.utc)
-          raise ArgumentError, "Unknown evidence event type: #{type}" unless TYPES.include?(type.to_s)
-
-          recorded_at = recorded_at.utc
-          body = {
-            "type" => type.to_s,
-            "attempt_id" => attempt_id,
-            "payload" => payload,
-            "previous_digest" => previous_digest,
-            "recorded_at" => recorded_at.iso8601
-          }
-          body.merge("digest" => Atoms::EvidenceDigest.digest(body))
-        end
-
-        # Validate that a stored event is intact: its digest must match a
-        # recomputation over its own body.
-        #
-        # @param event [Hash] Stored event
-        # @return [Boolean] True if the event digest verifies
-        def self.valid?(event)
-          stored = event["digest"]
-          return false if stored.nil?
-
-          body = {
-            "type" => event["type"],
-            "attempt_id" => event["attempt_id"],
-            "payload" => event["payload"],
-            "previous_digest" => event["previous_digest"],
-            "recorded_at" => event["recorded_at"]
-          }
-          Atoms::EvidenceDigest.digest(body) == stored
-        end
-
-        # Validate a whole chain: every event verifies and links to its
-        # predecessor.
-        #
-        # @param events [Array<Hash>] Ordered event list
-        # @return [Boolean] True if the chain is intact
-        def self.chain_valid?(events)
-          previous = nil
-          events.all? do |event|
-            return false unless valid?(event)
-            return false unless event["previous_digest"] == previous
-
-            previous = event["digest"]
-            true
-          end
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/models/execution_receipt.rb

@@ -1,139 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "../atoms/evidence_digest"
-
-module Ace
-  module Assign
-    module Models
-      # Structured, non-secret execution receipt.
-      #
-      # A receipt is the only accepted proof that an attempted operation
-      # completed: it names the attributed producer, the attempted operation,
-      # the actual tested/reviewed head, the scope, a verdict, the required
-      # artifacts with SHA-256 digests, and executed checks. Receipts never
-      # carry credentials, terminal bytes, or receipt-file payloads; journal
-      # entries keep metadata and digests only.
-      class ExecutionReceipt
-        VERDICTS = %w[succeeded failed].freeze
-
-        # Field names rejected outright in receipt payloads: accepted evidence
-        # is structured metadata, never raw process output or credentials.
-        FORBIDDEN_FIELDS = %w[
-          stdout stderr terminal_output log logs credentials secret secrets
-          token password api_key private_key env environment
-        ].freeze
-
-        attr_reader :attempt_id, :assignment_id, :project_id, :scope, :operation,
-          :producer, :head, :verdict, :artifacts, :checks, :review, :campaign, :recorded_at, :digest
-
-        # @param attempt_id [String] Attempt the receipt belongs to
-        # @param assignment_id [String] Owning assignment ID
-        # @param project_id [String] Project the operation ran in
-        # @param scope [String] Canonical step/subtree scope
-        # @param operation [String] Attempted operation name
-        # @param producer [Hash] Attributed producer (actor, role, runtime)
-        # @param head [String] Actual tested/reviewed head
-        # @param verdict [String] "succeeded" or "failed"
-        # @param artifacts [Array<Hash>] Artifacts with path + sha256
-        # @param checks [Array<Hash>] Executed checks with name + verdict
-        # @param review [Hash, nil] Reviewer verdict for review receipts
-        # @param recorded_at [Time] Receipt creation time
-        # @param digest [String, nil] Canonical digest (computed when nil)
-        def initialize(attempt_id:, assignment_id:, project_id:, scope:, operation:, producer:, head:, verdict:,
-          artifacts: [], checks: [], review: nil, campaign: nil, recorded_at:, digest: nil)
-          @attempt_id = attempt_id
-          @assignment_id = assignment_id
-          @project_id = project_id
-          @scope = scope
-          @operation = operation
-          @producer = producer
-          @head = head
-          @verdict = verdict
-          @artifacts = artifacts
-          @checks = checks
-          @review = review
-          @campaign = campaign
-          @recorded_at = recorded_at
-          @digest = digest || Atoms::EvidenceDigest.digest(digest_payload)
-        end
-
-        # Canonical payload covered by the receipt digest (excludes the digest
-        # itself and the record timestamp, which is assigned at acceptance).
-        #
-        # @return [Hash] Digest payload
-        def digest_payload
-          payload = {
-            "attempt_id" => attempt_id,
-            "assignment_id" => assignment_id,
-            "project_id" => project_id,
-            "scope" => scope,
-            "operation" => operation,
-            "producer" => producer,
-            "head" => head,
-            "verdict" => verdict,
-            "artifacts" => artifacts,
-            "checks" => checks,
-            "review" => review
-          }
-          payload["campaign"] = campaign if campaign
-          payload
-        end
-
-        # Convert to a hash for serialization.
-        # @return [Hash] Receipt data with string keys
-        def to_h
-          digest_payload.merge(
-            "recorded_at" => recorded_at.iso8601,
-            "digest" => digest
-          )
-        end
-
-        # Rebuild a receipt from serialized or submitted data.
-        #
-        # @param data [Hash] Receipt data (string keys); missing digest is computed
-        # @return [ExecutionReceipt] Receipt instance
-        def self.from_h(data)
-          new(
-            attempt_id: data["attempt_id"],
-            assignment_id: data["assignment_id"],
-            project_id: data["project_id"],
-            scope: data["scope"],
-            operation: data["operation"],
-            producer: data["producer"] || {},
-            head: data["head"],
-            verdict: data["verdict"],
-            artifacts: data["artifacts"] || [],
-            checks: data["checks"] || [],
-            review: data["review"],
-            campaign: data["campaign"],
-            recorded_at: parse_time(data["recorded_at"]) || Time.now.utc,
-            digest: data["digest"]
-          )
-        end
-
-        # Reject payloads that carry forbidden fields anywhere in the tree.
-        #
-        # @param data [Hash] Raw submitted receipt data
-        # @return [Boolean] True if a forbidden field is present
-        def self.forbidden_field?(data)
-          case data
-          when Hash
-            data.any? { |key, value| FORBIDDEN_FIELDS.include?(key.to_s) || forbidden_field?(value) }
-          when Array
-            data.any? { |item| forbidden_field?(item) }
-          else
-            false
-          end
-        end
-
-        def self.parse_time(value)
-          return nil if value.nil?
-          return value if value.is_a?(Time)
-          require "time"
-          Time.parse(value)
-        end
-        private_class_method :parse_time
-      end
-    end
-  end
-end