ace-assign 0.70.0 → 0.73.0

data/lib/ace/assign/molecules/canonical_read_commands.rb

@@ -1,84 +0,0 @@
-# frozen_string_literal: true
-
-module Ace
-  module Assign
-    module Molecules
-      # Closed bounded read dialect shared by isolated protected snapshots and
-      # trusted installed journals. Neither boundary can dispatch a Git write.
-      module CanonicalReadCommands
-        BYTE_LIMIT = 256 * 1_048_576
-        OID = /\A[0-9a-f]{40}\z/
-
-        attr_reader :commit
-
-        # EvidenceJournal uses this only as its existing read command boundary.
-        def call(argv, stdin_data: "", output_limit: BYTE_LIMIT)
-          refuse!("read_outside_snapshot") unless @view && @commit
-          unless read_command?(argv, stdin_data)
-            refuse!("write_or_unsupported_command")
-          end
-          result = read_result(argv, stdin_data: stdin_data, limit: [output_limit, BYTE_LIMIT].min)
-          [result.stdout.to_s.strip, result.stderr.to_s.strip, result.status]
-        end
-
-        def blob_batch(entries, output_limit:)
-          refuse!("read_outside_snapshot") unless @view && @commit
-          unless entries.is_a?(Array) && entries.all? { |oid| oid.is_a?(String) && oid.match?(OID) }
-            refuse!("unsupported_command")
-          end
-          result = run!(["cat-file", "--batch"], stdin_data: entries.join("\n") + "\n",
-            limit: [output_limit, BYTE_LIMIT].min)
-          result.stdout.to_s.b
-        end
-
-        def history_diff(commits, paths, output_limit:)
-          refuse!("read_outside_snapshot") unless @view && @commit
-          unless commits.is_a?(Array) && commits.size.between?(1, 64) && commits.uniq.size == commits.size &&
-              commits.all? { |commit| commit.is_a?(String) && commit.match?(OID) } &&
-              paths.is_a?(Array) && !paths.empty? && paths.uniq.size == paths.size &&
-              (paths == ["execution/"] || paths.all? { |path| path.is_a?(String) && path.match?(%r{\Aexecution/[a-zA-Z0-9_.:-]+/events/\z}) }) &&
-              output_limit.is_a?(Integer) && output_limit.positive?
-            refuse!("unsupported_command")
-          end
-          result = run!(%w[diff-tree --stdin --always --root -r --raw -z --no-renames --no-ext-diff
-            --no-textconv --no-abbrev --] + paths, stdin_data: commits.join("\n") + "\n",
-            limit: [output_limit, BYTE_LIMIT].min)
-          result.stdout.to_s.b
-        end
-
-        def blob_sizes(oids)
-          refuse!("read_outside_snapshot") unless @view && @commit
-          unless oids.is_a?(Array) && oids.size.between?(1, 64) && oids.all? { |oid| oid.is_a?(String) && oid.match?(OID) }
-            refuse!("unsupported_command")
-          end
-          run!(%w[cat-file --batch-check], stdin_data: oids.join("\n") + "\n", limit: oids.size * 128).stdout.to_s.b
-        end
-
-        def blob(path, commit:, max_bytes:)
-          refuse!("read_outside_snapshot") unless @view && @commit
-          unless commit.is_a?(String) && commit.match?(OID) && max_bytes.is_a?(Integer) && max_bytes.positive?
-            refuse!("unsupported_command")
-          end
-          result = run!(["cat-file", "blob", "#{commit}:#{path}"], limit: [max_bytes, BYTE_LIMIT].min)
-          result.stdout.to_s.b
-        end
-
-        private
-
-        def read_result(argv, **options)
-          run!(argv, **options)
-        end
-
-        def read_command?(argv, stdin)
-          return false unless argv.is_a?(Array) && argv.all? { |item| item.is_a?(String) && !item.include?("\0") } && stdin.empty?
-          allowed = {"rev-parse" => %w[--verify --quiet --git-dir], "cat-file" => %w[-t -s blob],
-            "rev-list" => %w[--first-parent --parents], "ls-tree" => %w[-r -l -d --name-only --],
-            "show" => [], "log" => %w[--diff-filter=A -1 --format=%H --]}
-          flags = allowed[argv.first]
-          flags && argv.drop(1).all? { |item| !item.start_with?("-") || flags.include?(item) || item == "--max-count=100001" }
-        end
-
-      end
-    end
-  end
-end

data/lib/ace/assign/molecules/canonical_read_snapshot.rb

@@ -1,313 +0,0 @@
-# frozen_string_literal: true
-
-require "digest"
-require "fileutils"
-require "tmpdir"
-require "ace/herdr/molecules/bounded_process"
-require_relative "evidence_journal"
-require_relative "canonical_read_commands"
-require_relative "../authority/private_directory"
-
-module Ace
-  module Assign
-    module Molecules
-      # Isolates read-only Git from an installed authority's live configuration.
-      # The copied view never publishes evidence or mutates the source journal.
-      class CanonicalReadSnapshot
-        include CanonicalReadCommands
-        class Unavailable < AttemptErrors::EvidenceUnavailable; end
-        BYTE_LIMIT = 256 * 1_048_576
-        ENTRY_LIMIT = 4096
-        OID = /\A[0-9a-f]{40}\z/
-        ENVIRONMENT = {"PATH" => "/usr/bin:/bin", "LC_ALL" => "C",
-          "GIT_CONFIG_NOSYSTEM" => "1", "GIT_CONFIG_SYSTEM" => "/dev/null",
-          "GIT_CONFIG_GLOBAL" => "/dev/null", "GIT_TERMINAL_PROMPT" => "0",
-          "GIT_ALLOW_PROTOCOL" => "", "GIT_NO_REPLACE_OBJECTS" => "1",
-          "GIT_NO_LAZY_FETCH" => "1", "GIT_OPTIONAL_LOCKS" => "0"}.freeze
-
-        # These selections come from installed source composition, not frames.
-        def initialize(repo_root:, checkout_root:, ref:, private_root:, git_executable: "/usr/bin/git")
-          paths = [repo_root, checkout_root, private_root, git_executable]
-          unless paths.all? { |path| path.is_a?(String) && path.start_with?("/") &&
-              !path.include?("\0") && File.expand_path(path) == path } &&
-              ref.is_a?(String) && ref.match?(/\Arefs\/[a-zA-Z0-9_-]+(?:\/[a-zA-Z0-9_-]+)+\z/)
-            raise ArgumentError, "canonical snapshot source selection is malformed"
-          end
-          @repo_root, @checkout_root, @private_root, @git = paths.map { |path| path.dup.freeze }
-          @ref = ref.dup.freeze
-          @verification = Mutex.new
-        end
-
-        def with(deadline:)
-          refuse!("snapshot_busy") unless @verification.try_lock
-          begin
-            with_snapshot(deadline: deadline) { |snapshot| yield snapshot }
-          ensure
-            @verification.unlock
-          end
-        end
-
-        def with_snapshot(deadline:)
-          validate_deadline!(deadline)
-          verify_private_root!
-          private_stat = directory!(@private_root)
-          unless private_stat.uid == Process.uid && (private_stat.mode & 0o7777) == 0o700
-            refuse!("private_storage_unprotected")
-          end
-          Dir.mktmpdir("canonical-read-", @private_root) do |view|
-            verify_private_root!
-            refuse!("private_storage_unprotected") unless directory_identity(File.lstat(@private_root)) == directory_identity(private_stat)
-            @view, @deadline = view, deadline
-            @held, @directories, @inventory, @inventory_files, @metadata_files = [], [], [], [], []
-            @bytes, @entries = 0, 0
-            git_dir = File.join(@repo_root, ".git")
-            directory!(git_dir)
-            %w[commondir reftable shallow].each do |name|
-              refuse!("unsupported_source") if exists?(File.join(git_dir, name))
-            end
-            lock, original_lock = held_file!(File.join(@checkout_root, ".evidence.lock"), limit: 128)
-            begin
-              acquire!(lock)
-              begin
-                source_config!(git_dir)
-                @commit = select_ref!(git_dir)
-                objects = File.join(git_dir, "objects")
-                inventory = inventory!(objects)
-                inventory.each { |relative, handle| copy!(relative, handle) }
-                verify_held!
-                refuse!("source_changed") unless inventory_names!(objects) == @inventory &&
-                  select_ref!(git_dir) == @commit && identity(File.lstat(lock.path)) == original_lock
-                verify_held!
-              ensure
-                lock.flock(File::LOCK_UN)
-              end
-            end
-            prepare_view!
-            run!(%w[fsck --full --strict --no-reflogs], limit: 65_536)
-            yield self
-          ensure
-            @held&.each { |handle| handle.close unless handle.closed? }
-            @held = @directories = @inventory = @inventory_files = @metadata_files = @view = @deadline = @commit = nil
-          end
-        rescue Timeout::Error
-          refuse!("resource_limit")
-        rescue IOError, SystemCallError, Herdr::Molecules::BoundedProcess::PostLaunchError
-          refuse!("source_unavailable")
-        end
-        private :with_snapshot
-
-        private
-
-        def refuse!(reason)
-          raise Unavailable, "canonical read snapshot unavailable: #{reason}"
-        end
-
-        def validate_deadline!(deadline)
-          unless deadline.is_a?(Numeric) && deadline.finite? && deadline > Process.clock_gettime(Process::CLOCK_MONOTONIC)
-            refuse!("resource_limit")
-          end
-        end
-
-        def remaining
-          value = @deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
-          refuse!("resource_limit") unless value.positive?
-          value
-        end
-
-        def acquire!(lock)
-          until lock.flock(File::LOCK_SH | File::LOCK_NB)
-            sleep [remaining, 0.005].min
-          end
-        end
-
-        def identity(stat)
-          [stat.dev, stat.ino, stat.mode, stat.uid, stat.gid, stat.size, stat.mtime, stat.ctime]
-        end
-
-        def verify_private_root!
-          Authority::PrivateDirectory.verify!(@private_root)
-        rescue AttemptErrors::ReceiptRejected
-          refuse!("private_storage_unprotected")
-        end
-
-        def directory_identity(stat)
-          [stat.dev, stat.ino, stat.mode, stat.uid, stat.gid]
-        end
-
-        def directory!(path)
-          stat = File.lstat(path)
-          refuse!("unsupported_source") unless stat.directory? && !stat.symlink?
-          stat
-        end
-
-        def exists?(path)
-          File.lstat(path)
-          true
-        rescue Errno::ENOENT
-          false
-        end
-
-        def held_file!(path, limit:)
-          remaining
-          parent = File.dirname(path)
-          until parent == "/"
-            stat = directory!(parent)
-            @directories << [parent, directory_identity(stat)]
-            parent = File.dirname(parent)
-          end
-          handle = File.open(path, File::RDONLY | File::NOFOLLOW | File::NONBLOCK)
-          @held << handle
-          stat = handle.stat
-          refuse!("unsupported_source") unless stat.file?
-          refuse!("resource_limit") if stat.size > limit
-          [handle, identity(stat)]
-        end
-
-        def select_ref!(git_dir)
-          loose = File.join(git_dir, @ref)
-          if exists?(loose)
-            handle, before = held_file!(loose, limit: 128)
-            bytes = handle.read(129)
-            @metadata_files << [loose, handle, before]
-            refuse!("source_changed") unless identity(handle.stat) == before
-            refuse!("unsupported_ref") unless bytes.match?(/\A[0-9a-f]{40}\n?\z/)
-            return bytes.strip
-          end
-          packed = File.join(git_dir, "packed-refs")
-          handle, before = held_file!(packed, limit: 65_536)
-          bytes = handle.read(65_537)
-          @metadata_files << [packed, handle, before]
-          refuse!("source_changed") unless identity(handle.stat) == before
-          entries = {}
-          bytes.lines.each do |line|
-            next if line.start_with?("#") || line.match?(/\A\^[0-9a-f]{40}\n?\z/)
-            match = /\A([0-9a-f]{40}) (refs\/[^\s\0]+)\n?\z/.match(line)
-            refuse!("unsupported_ref") unless match && !entries.key?(match[2])
-            entries[match[2]] = match[1]
-          end
-          entries.fetch(@ref) { refuse!("unsupported_ref") }
-        end
-
-        def source_config!(git_dir)
-          path = File.join(git_dir, "config")
-          handle, before = held_file!(path, limit: 65_536)
-          bytes = handle.read(65_537)
-          @metadata_files << [path, handle, before]
-          refuse!("source_changed") unless identity(handle.stat) == before
-          # Standalone file parsing does not select the target repository,
-          # follow includes or execute aliases/hooks/helpers. No source config
-          # is installed into the private administrative view.
-          result = run!(["config", "--no-includes", "--null", "--list", "--file", "/dev/stdin"],
-            stdin_data: bytes, limit: 65_536)
-          versions = []
-          result.stdout.split("\0").each do |entry|
-            key, value = entry.split("\n", 2)
-            refuse!("unsupported_source") if key.start_with?("extensions.") || key == "core.worktree"
-            versions << value if key == "core.repositoryformatversion"
-          end
-          refuse!("unsupported_source") unless versions.empty? || versions == ["0"]
-        end
-
-        def inventory_names!(objects)
-          names = []
-          walk = lambda do |path, relative|
-            remaining
-            stat = File.lstat(path)
-            names << [relative, stat.directory? ? "directory" : "file"]
-            refuse!("resource_limit") if names.size > ENTRY_LIMIT
-            refuse!("unsupported_source") if stat.symlink? || !(stat.directory? || stat.file?)
-            if stat.directory?
-              unless relative.empty? || %w[pack info].include?(relative) || relative.match?(/\A[0-9a-f]{2}\z/)
-                refuse!("unsupported_source")
-              end
-              children = []
-              Dir.each_child(path) do |name|
-                remaining
-                children << name
-                refuse!("resource_limit") if children.size + names.size > ENTRY_LIMIT
-              end
-              children.sort.each { |name| walk.call(File.join(path, name), relative.empty? ? name : "#{relative}/#{name}") }
-            end
-          end
-          walk.call(objects, "")
-          names
-        end
-
-        def inventory!(objects)
-          @inventory = inventory_names!(objects)
-          files = @inventory.select { |_relative, kind| kind == "file" }.map(&:first)
-          packs = files.grep(/\Apack\/pack-[0-9a-f]{40}\.pack\z/)
-          unless packs.all? { |pack| files.include?(pack.sub(/\.pack\z/, ".idx")) } &&
-              files.grep(/\Apack\/pack-[0-9a-f]{40}\.(?:idx|rev)\z/).all? { |file| packs.include?(file.sub(/\.(?:idx|rev)\z/, ".pack")) }
-            refuse!("unsupported_source")
-          end
-          @inventory.filter_map do |relative, kind|
-            path = relative.empty? ? objects : File.join(objects, relative)
-            if kind == "directory"
-              unless relative.empty? || relative == "pack" || relative == "info" || relative.match?(/\A[0-9a-f]{2}\z/)
-                refuse!("unsupported_source")
-              end
-              @directories << [path, directory_identity(File.lstat(path))]
-              next
-            end
-            # These ordinary Git indexes/retention hints do not redirect
-            # storage. The clean view never reads them; only object bytes and
-            # pack indexes are copied. Redirect/lazy-fetch metadata refuses.
-            next if relative.match?(/\Ainfo\/(?:packs|commit-graph)\z/) ||
-              relative.match?(/\Apack\/pack-[0-9a-f]{40}\.(?:bitmap|keep)\z/)
-            unless relative.match?(/\A[0-9a-f]{2}\/[0-9a-f]{38}\z/) ||
-                relative.match?(/\Apack\/pack-[0-9a-f]{40}\.(?:pack|idx|rev)\z/)
-              refuse!("unsupported_source")
-            end
-            handle, before = held_file!(path, limit: BYTE_LIMIT)
-            @bytes += handle.stat.size
-            refuse!("resource_limit") if @bytes > BYTE_LIMIT
-            @inventory_files << [path, handle, before]
-            [relative, handle]
-          end
-        end
-
-        def copy!(relative, source)
-          destination = File.join(@view, "objects", relative)
-          FileUtils.mkdir_p(File.dirname(destination), mode: 0o700)
-          File.open(destination, File::WRONLY | File::CREAT | File::EXCL, 0o600) do |target|
-            copied = 0
-            expected = source.stat.size
-            while (chunk = source.read(65_536))
-              remaining
-              copied += chunk.bytesize
-              refuse!("source_changed") if copied > expected
-              target.write(chunk)
-            end
-            refuse!("source_changed") unless copied == expected
-          end
-        end
-
-        def verify_held!
-          @directories.each { |path, before| refuse!("source_changed") unless directory_identity(File.lstat(path)) == before }
-          (@inventory_files + @metadata_files).each do |path, handle, before|
-            refuse!("source_changed") unless identity(handle.stat) == before && identity(File.lstat(path)) == before
-          end
-        end
-
-        def prepare_view!
-          FileUtils.mkdir_p(File.join(@view, "objects"), mode: 0o700)
-          FileUtils.mkdir_p(File.join(@view, "refs"), mode: 0o700)
-          File.binwrite(File.join(@view, "HEAD"), "#{@commit}\n")
-          File.binwrite(File.join(@view, "config"), "[core]\nrepositoryformatversion = 0\nbare = true\n")
-          ref = File.join(@view, @ref)
-          FileUtils.mkdir_p(File.dirname(ref), mode: 0o700)
-          File.binwrite(ref, "#{@commit}\n")
-        end
-
-        def run!(argv, stdin_data: "", limit:)
-          result = Herdr::Molecules::BoundedProcess.call([@git, "--git-dir=#{@view}", "--no-pager", *argv],
-            environment: ENVIRONMENT, chdir: @view, stdin_data: stdin_data,
-            timeout_s: remaining, output_limit: limit, stderr_limit: 65_536)
-          refuse!(result.oversized ? "resource_limit" : "git_unavailable") unless result.status.success? && !result.oversized
-          result
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/molecules/evidence_calculator.rb

@@ -1,237 +0,0 @@
-# frozen_string_literal: true
-
-require "digest"
-require "open3"
-require "ace/support/fs"
-
-module Ace
-  module Assign
-    module Molecules
-      # Computes delivery evidence for an assignment from accepted,
-      # current-head execution evidence.
-      #
-      # Decisions are derived exclusively from accepted receipts recorded in
-      # the evidence journal (managed attempts) or the durable attempt store
-      # (taskless attempts). Report files on disk, exit codes, and prose never
-      # establish review or merge authorization, and no feedback state is
-      # hardcoded: an attempt that may have completed without a durable
-      # receipt yields `uncertain`, never success.
-      class EvidenceCalculator
-        def self.calculate(pr_number: nil, auto_merge: false, assignment_id: nil)
-          new.calculate(pr_number: pr_number, auto_merge: auto_merge, assignment_id: assignment_id)
-        end
-
-        # @param cache_base [String, nil] Assignment cache base (default config)
-        # @param repo_root [String, nil] Candidate repository root (default project root)
-        # @param journal [EvidenceJournal, nil] Evidence journal (default built lazily)
-        def initialize(cache_base: nil, repo_root: nil, journal: nil)
-          @cache_base = cache_base
-          @repo_root = repo_root || Ace::Support::Fs::Molecules::ProjectRootFinder.find_or_current
-          @journal = journal
-        end
-
-        def calculate(pr_number: nil, auto_merge: false, assignment_id: nil)
-          head, tree, changed_scope_digest = git_facts
-          assignment = find_assignment(assignment_id)
-          attempts = assignment ? attempts_for(assignment) : []
-          receipts = assignment ? accepted_receipts(assignment) : []
-
-          review_receipt = receipt_currency(receipts, "review", head)
-          release_receipt = receipt_currency(receipts, "release", head)
-          unresolved_effects = collect_unresolved_effects(attempts)
-          if assignment&.managed?
-            requests = journal.service_requests(assignment.id)
-            # A rejected effect stays unresolved when its claim had been
-            # dispatched (authorization consumed): only attributable evidence
-            # that no effect occurred settles it, never the bare rejection.
-            unresolved_effects.concat(requests
-              .select { |request| unresolved_service_state?(request) }
-              .map { |request| "#{request["request_id"]}:#{request["operation"]}:#{request["state"]}" })
-            # Settled requests keep their authorization only while their
-            # receipt evidence remains intact in the candidate repository:
-            # a deleted or modified artifact drops the outcome back to
-            # unresolved instead of trusting an unverifiable receipt.
-            unresolved_effects.concat(requests
-              .select { |request| request["state"] == "succeeded" || request["state"] == "failed-settled" }
-              .reject { |request| evidence_intact?(request) }
-              .map { |request| "#{request["request_id"]}:#{request["operation"]}:evidence-unavailable" })
-            unresolved_effects.uniq!
-          end
-          feedback_state = derive_feedback_state(attempts, receipts, head, unresolved_effects)
-
-          # Authorization requires managed evidence, settled work (no active
-          # attempts), no unresolved effects, and a current independent
-          # review verdict. Taskless assignments never authorize merges.
-          merge_decision = if auto_merge && assignment&.managed? &&
-              review_receipt == "current" && unresolved_effects.empty? && attempts.none?(&:active?)
-            "authorized"
-          else
-            "approval-required"
-          end
-
-          latest = attempts.first
-          active = attempts.find(&:active?)
-          evidence = {
-            pr: pr_number || "none",
-            head: head,
-            tree: tree,
-            changed_scope_digest: changed_scope_digest,
-            review_receipt: review_receipt,
-            release_receipt: release_receipt,
-            feedback_state: feedback_state,
-            merge_decision: merge_decision,
-            decision_digest: nil,
-            attempt: latest ? attempt_summary(latest, active: active) : nil,
-            base_head: latest&.binding&.base_head,
-            candidate_head: latest&.candidate_head,
-            evidence_git_ref: evidence_git_ref(assignment),
-            journal_commit: assignment&.managed? ? journal.ref_value : latest&.journal_commit,
-            unresolved_effects: unresolved_effects
-          }
-          evidence[:decision_digest] = Digest::SHA256.hexdigest(
-            Atoms::EvidenceDigest.canonical_json(evidence)
-          )
-          evidence
-        end
-
-        private
-
-        # Accepted, uncertain, and failed effects are unresolved by
-        # definition; a rejected effect stays unresolved when its claim was
-        # dispatched (authorization consumed), because the effect may have
-        # happened.
-        def unresolved_service_state?(request)
-          %w[accepted uncertain failed].include?(request["state"]) ||
-            (request["state"] == "rejected" && request["consumed"] != false)
-        end
-
-        # Every receipt evidence artifact must still exist in the candidate
-        # repository with its recorded digest; evidence lives in the working
-        # tree, so its integrity is re-checked on every calculation.
-        def evidence_intact?(request)
-          receipt = request["receipt"]
-          return false unless receipt.is_a?(Hash)
-          repo_root = File.realpath(@repo_root)
-          Array(receipt["evidence"]).all? do |item|
-            path = File.expand_path(item["ref"].to_s, repo_root)
-            real = begin
-              File.realpath(path)
-            rescue Errno::ENOENT, Errno::EACCES, Errno::ELOOP
-              next false
-            end
-            begin
-              real.start_with?(repo_root + File::SEPARATOR) &&
-                Digest::SHA256.file(real).hexdigest == item["sha256"]
-            rescue Errno::EACCES, Errno::ELOOP
-              false
-            end
-          end
-        end
-
-        def git_facts
-          head, _s = Open3.capture2("git", "rev-parse", "HEAD", chdir: @repo_root, stdin_data: "")
-          tree, _s = Open3.capture2("git", "rev-parse", "HEAD^{tree}", chdir: @repo_root, stdin_data: "")
-          diff_output, _s = Open3.capture2("git", "diff", "HEAD", chdir: @repo_root, stdin_data: "")
-
-          [head.to_s.strip, tree.to_s.strip, Digest::SHA256.hexdigest(diff_output.to_s)]
-        end
-
-        def find_assignment(assignment_id)
-          manager = Molecules::AssignmentManager.new(cache_base: @cache_base)
-          assignment_id ? manager.load(assignment_id) : manager.find_active
-        end
-
-        def store
-          @store ||= Molecules::AssignmentManager.new(cache_base: @cache_base).attempt_store
-        end
-
-        def journal
-          @journal ||= Molecules::EvidenceJournal.new(repo_root: @repo_root)
-        end
-
-        # Attempt state for evidence decisions. Managed assignments treat the
-        # journal as authoritative: ALL journal-derived attempts (including
-        # terminal states) replace local records with the same ID, so a crash
-        # between journaling and the local save cannot leave stale open state.
-        def attempts_for(assignment)
-          attempts = store.list(assignment.id)
-          return attempts unless assignment.managed?
-
-          journal_by_id = {}
-          journal.derived_attempts(assignment.id).each { |attempt| journal_by_id[attempt.attempt_id] = attempt }
-          merged = attempts.map { |attempt| journal_by_id.delete(attempt.attempt_id) || attempt }
-          merged + journal_by_id.values
-        end
-
-        # Accepted receipts for evidence currency. Managed assignments use
-        # journal receipts only — the journal is the authority; local records
-        # are disposable projections.
-        def accepted_receipts(assignment)
-          if assignment.managed?
-            return journal.accepted_receipts(assignment.id).uniq { |receipt| receipt["digest"] }
-          end
-
-          store.list(assignment.id).flat_map(&:accepted_receipts)
-            .uniq { |receipt| receipt["digest"] }
-        end
-
-        # Currency against the current head. Review approval requires an
-        # executed independent reviewer verdict; receipts were verified at
-        # acceptance and the independence guard is re-checked here defensively
-        # (a review receipt without a reviewer verdict is not review evidence
-        # at all).
-        def receipt_currency(receipts, operation, head)
-          succeeded = receipts.select do |receipt|
-            next false unless receipt["operation"] == operation && receipt["verdict"] == "succeeded"
-            next false if operation == "review" && receipt.dig("review", "reviewer", "actor").nil?
-
-            true
-          end
-
-          current = succeeded.any? { |receipt| receipt["head"] == head }
-
-          return "missing" if succeeded.empty?
-          return "current" if current
-
-          "stale"
-        end
-
-        def collect_unresolved_effects(attempts)
-          attempts.flat_map { |attempt| attempt.unresolved_effects.map { |effect| effect["operation"] } }
-            .concat(attempts.select(&:uncertain?).map { |attempt| "#{attempt.attempt_id}:uncertain" })
-            .uniq
-        end
-
-        # Feedback is derived: uncertain evidence wins, active attempts keep
-        # the loop open, accepted current-head evidence closes it.
-        def derive_feedback_state(attempts, receipts, head, unresolved_effects)
-          return "unknown" if attempts.empty? && receipts.empty?
-
-          return "uncertain" if unresolved_effects.any?
-
-          return "terminal" if attempts.none?(&:active?) && receipts.any? do |receipt|
-            receipt["verdict"] == "succeeded" && receipt["head"] == head
-          end
-
-          "open"
-        end
-
-        def attempt_summary(attempt, active: nil)
-          {
-            "attempt_id" => attempt.attempt_id,
-            "state" => attempt.state,
-            "scope" => attempt.binding.scope,
-            "recovery_mode" => attempt.recovery_mode,
-            "active" => active ? active.attempt_id == attempt.attempt_id : false
-          }
-        end
-
-        def evidence_git_ref(assignment)
-          return nil unless assignment&.managed?
-
-          journal.ref
-        end
-      end
-    end
-  end
-end