ace-assign 0.71.0 → 0.73.0

data/lib/ace/assign/authority/assignment_inventory.rb

@@ -1,290 +0,0 @@
-# frozen_string_literal: true
-
-module Ace
-  module Assign
-    module Authority
-      class LaunchLifecycle
-        # Fixed source readers reuse the complete canonical inventory and its
-        # original registration/definition proof; this is never a live grant.
-        def preview_attempt_events!(journal:, commit:, params:, map:)
-          preview_attempt_entry!(journal: journal, commit: commit, params: params, map: map).fetch(:events)
-        end
-
-        def preview_attempt_definition!(journal:, commit:, params:, map:)
-          entry = preview_attempt_entry!(journal: journal, commit: commit, params: params, map: map)
-          inventory_definition!(journal, commit, entry)
-        end
-
-        private
-
-        def preview_attempt_entry!(journal:, commit:, params:, map:)
-          entries = inventory_index!(journal, commit, params.fetch("mapping_id"), map).select do |entry|
-            entry.fetch(:selector) == params.slice("assignment_id", "attempt_id")
-          end
-          raise AttemptErrors::EvidenceUnavailable, "preview original registration is unavailable or ambiguous" unless entries.one?
-          entry = entries.first
-          inventory_definition!(journal, commit, entry)
-          entry
-        end
-
-        # Discovery authenticates the current mapped principal, then reads one
-        # immutable canonical prefix. It neither pins the original launcher nor
-        # grants permission to mutate that launch.
-        def assignment_inventory!(request:, peer:, role:)
-          params = request.fetch("params")
-          strict!(params, %w[mapping_id journal_commit after limit])
-          raise ArgumentError, "Inventory mutation ID must be null" unless request.fetch("mutation_id").nil?
-          unless %i[launcher supervisor].include?(role)
-            raise AttemptErrors::UnauthorizedIdentity, "Inventory requires mapped launcher or supervisor"
-          end
-          map = steering_principal!(params, peer, role)
-          limit = params.fetch("limit")
-          raise ArgumentError, "Inventory limit is invalid" unless limit.is_a?(Integer) && limit.between?(1, 50)
-          after = params.fetch("after")
-          unless after.nil?
-            strict!(after, %w[assignment_id attempt_id])
-            token!(after.fetch("assignment_id"))
-            token!(after.fetch("attempt_id")) unless after.fetch("attempt_id").nil?
-            raise ArgumentError, "Inventory continuation requires selected commit" if params.fetch("journal_commit").nil?
-          end
-          journal = journal_for(map)
-          canonical_commit = journal.ref_value
-          commit = params.fetch("journal_commit") || canonical_commit
-          journal.verify_canonical_prefix!(commit: commit, canonical_commit: canonical_commit)
-          indexed = inventory_index!(journal, commit, params.fetch("mapping_id"), map)
-          offset = 0
-          if after
-            position = indexed.index { |entry| entry.fetch(:selector) == after }
-            raise AttemptErrors::NotFound, "Inventory cursor does not select a visible row" unless position
-            offset = position + 1
-          end
-          data = {"project_id" => map.fetch("project_id"), "mapping_id" => params.fetch("mapping_id"),
-            "journal_commit" => commit, "items" => [], "next_after" => nil}
-          indexed.drop(offset).first(limit).each do |entry|
-            row = inventory_row!(journal, commit, entry)
-            proposed = data.merge("items" => data.fetch("items") + [row],
-              "next_after" => offset + data.fetch("items").size + 1 < indexed.size ? entry.fetch(:selector) : nil)
-            # Size the actual fixed public envelope, retaining whole rows and
-            # an honest cursor without truncating or omitting canonical facts.
-            frame = {"status" => "ok", "data" => proposed, "transport" => {"replayed" => false}}
-            if JSON.generate(frame).bytesize + 1 > 16_384
-              raise AttemptErrors::BoundedResultUnavailable, "Inventory row exceeds bounded response" if data.fetch("items").empty?
-              break
-            end
-            data = proposed
-          end
-          {data: data, replayed: false}
-        end
-
-        def inventory_index!(journal, commit, mapping_id, map)
-          authenticated = journal.canonical_event_inventory!(commit: commit)
-          raise AttemptErrors::EvidenceUnavailable, "Inventory authenticated snapshot differs" unless authenticated.fetch("commit") == commit
-          snapshots = authenticated.fetch("events")
-          introductions = authenticated.fetch("introductions")
-          entries = snapshots.flat_map do |assignment_id, events|
-            registrations = events.select { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "register_assignment" }
-            next [] if registrations.empty?
-            attempts = events.select { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "reserve_attempt" }
-            if attempts.empty?
-              registration = registrations.last.fetch("payload").fetch("data")
-              next [] unless registration["mapping_id"] == mapping_id
-              authenticate_inventory_registration!(journal, assignment_id, events, registration, mapping_id, map, commit, introductions.fetch(assignment_id))
-              next [{selector: {"assignment_id" => assignment_id, "attempt_id" => nil}, registration: registration, map: map}]
-            end
-            selected = attempts.select { |event| event.dig("payload", "data", "mapping_id") == mapping_id }
-            next [] if selected.empty?
-            prefixes = introductions.fetch(assignment_id)
-            selected.map do |reserve|
-              attempt_id = reserve.fetch("attempt_id")
-              chain = events.select { |event| event["attempt_id"] == attempt_id }
-              registration = definition(journal, assignment_id, commit: prefixes.fetch(reserve.fetch("digest")))
-              unless registration && registration.values_at("assignment_id", "project_id", "mapping_id") == [assignment_id, map.fetch("project_id"), mapping_id]
-                raise AttemptErrors::EvidenceUnavailable, "Inventory reservation registration differs"
-              end
-              registration_events = journal.read_events(assignment_id, commit: prefixes.fetch(reserve.fetch("digest")))
-              authenticate_inventory_registration!(journal, assignment_id, registration_events, registration, mapping_id, map, prefixes.fetch(reserve.fetch("digest")), prefixes)
-              {selector: {"assignment_id" => assignment_id, "attempt_id" => attempt_id},
-                registration: registration, events: chain, map: map, introductions: prefixes}
-            end
-          end
-          selectors = entries.map { |entry| entry.fetch(:selector).values_at("assignment_id", "attempt_id") }
-          raise AttemptErrors::EvidenceUnavailable, "Inventory row identity is ambiguous" unless selectors.uniq.size == selectors.size
-          entries.sort_by { |entry| [entry.fetch(:selector).fetch("assignment_id").b, entry.fetch(:selector).fetch("attempt_id").to_s.b] }
-        rescue KeyError, TypeError, NoMethodError
-          raise AttemptErrors::EvidenceUnavailable, "Inventory canonical index is malformed"
-        end
-
-        def authenticate_inventory_registration!(journal, assignment_id, events, registration, mapping_id, map, commit, introductions)
-          unless registration.is_a?(Hash) && registration.values_at("assignment_id", "project_id", "mapping_id", "phase") ==
-              [assignment_id, map.fetch("project_id"), mapping_id, "registered"]
-            raise AttemptErrors::EvidenceUnavailable, "Inventory accepted registration association differs"
-          end
-          chain = events.select { |event| event["attempt_id"] == "definition-#{assignment_id}" }
-          journal.authority_generation(chain)
-          accepted = chain.select { |event| event["type"] == "authority_mutation" &&
-            event.dig("payload", "operation") == "register_assignment" && event.dig("payload", "data") == registration }
-          raise AttemptErrors::EvidenceUnavailable, "Inventory registration provenance is ambiguous" unless accepted.one?
-          event = accepted.first
-          prefix = introductions.fetch(event.fetch("digest"))
-          original_chain = journal.read_events(assignment_id, commit: prefix).select { |item| item["attempt_id"] == "definition-#{assignment_id}" }
-          unless original_chain.last == event && registration["generation"].is_a?(Integer) &&
-              registration["generation"] == journal.authority_generation(original_chain)
-            raise AttemptErrors::EvidenceUnavailable, "Inventory registration generation/introduction differs"
-          end
-        end
-
-        def inventory_definition!(journal, commit, entry)
-          selector, registration = entry.values_at(:selector, :registration)
-          bytes = journal.blob(registration.fetch("definition_ref"), commit: commit)
-          unless bytes.is_a?(String) && bytes.bytesize <= 32_768 &&
-              Digest::SHA256.hexdigest(bytes) == registration.fetch("definition_digest")
-            raise AttemptErrors::EvidenceUnavailable, "Inventory definition content differs"
-          end
-          value = JSON.parse(bytes)
-          prepared = value.fetch("prepared_work")
-          unless registration.fetch("prepared_work") == prepared && prepared.fetch("task_id") == registration.fetch("task_id") &&
-              registration.fetch("selection_sha256") == prepared.fetch("selection_sha256") &&
-              registration.fetch("prepared_bundle_sha256").is_a?(String) && registration.fetch("prepared_bundle_sha256").match?(PreparedWork::SHA) &&
-              registration.fetch("prepared_bundle_bytes").is_a?(Integer) && registration.fetch("prepared_bundle_bytes").between?(1, PreparedWork::MAX_TOTAL) &&
-              registration.fetch("prepared_bundle_ref") == "execution/prepared/#{selector.fetch('assignment_id')}-#{registration.fetch('prepared_bundle_sha256')}.bundle"
-            raise AttemptErrors::EvidenceUnavailable, "Inventory prepared input identity differs"
-          end
-          assignment = Models::Assignment.from_h(value)
-          unless assignment.managed? && assignment.id == selector.fetch("assignment_id") &&
-              assignment.project_id == registration.fetch("project_id") && assignment.task_id == registration.fetch("task_id") &&
-              registration.fetch("definition_generation").is_a?(Integer) && registration.fetch("definition_generation").positive?
-            raise AttemptErrors::EvidenceUnavailable, "Inventory definition provenance differs"
-          end
-          assignment
-        end
-
-        def inventory_row!(journal, commit, entry)
-          inventory_definition!(journal, commit, entry)
-          selector, registration = entry.values_at(:selector, :registration)
-          row = selector.merge(registration.slice("task_id", "definition_digest", "definition_generation", "prepared_bundle_ref", "prepared_bundle_bytes", "prepared_bundle_sha256", "selection_sha256"),
-            "scope" => nil, "reservation_mutation_id" => nil, "base_head" => nil, "reservation_generation" => nil, "generation" => nil, "canonical_state" => nil,
-            "original_binding_digest" => nil, "terminal_event_id" => nil, "reservation_release_event_id" => nil)
-          return row unless selector.fetch("attempt_id")
-          events = entry.fetch(:events)
-          map = entry.fetch(:map)
-          state = origin(events, **selector.merge("mapping_id" => registration.fetch("mapping_id")).transform_keys(&:to_sym))
-          generation = journal.authority_generation(events)
-          unless generation.is_a?(Integer) && generation.positive? && state.fetch("reservation_generation").is_a?(Integer) && state.fetch("reservation_generation").positive?
-            raise AttemptErrors::EvidenceUnavailable, "Inventory attempt generation is invalid"
-          end
-          reservations = events.select { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "reserve_attempt" }
-          raise AttemptErrors::EvidenceUnavailable, "Inventory original reservation is ambiguous" unless reservations.one?
-          reservation = reservations.first.fetch("payload")
-          mutation_id = reservation.fetch("mutation_id")
-          token!(mutation_id)
-          base_head = reservation.fetch("data").fetch("base_head")
-          unless base_head.is_a?(String) && base_head.match?(/\A[0-9a-f]{40}\z/) && state.fetch("base_head") == base_head
-            raise AttemptErrors::EvidenceUnavailable, "Inventory original reservation base differs"
-          end
-          row.merge!("scope" => state.fetch("scope"), "reservation_mutation_id" => mutation_id, "base_head" => base_head, "reservation_generation" => state.fetch("reservation_generation"),
-            "generation" => generation, "canonical_state" => journal.canonical_attempt_state(events))
-          if events.any? { |event| event.dig("payload", "operation") == "record_launch" }
-            row["original_binding_digest"] = original_prompt_record!(events, state,
-              params: selector.merge("mapping_id" => registration.fetch("mapping_id"))).fetch("binding_digest")
-          end
-          terminal_events = events.select { |event| %w[receipt_accepted attempt_stopped].include?(event["type"]) }
-          releases = events.select { |event| event.dig("payload", "operation") == "scope_reservation_release" }
-          guarded_abort = events.any? { |event| event.dig("payload", "operation") == "abort_launch" }
-          return row if terminal_events.empty? && releases.empty? && !guarded_abort
-          original, original_map = inventory_original_deployment!(journal, events, registration.fetch("mapping_id"), map)
-          lineage = Molecules::ExecutionScopeLineage.new(events: events, project_id: original_map.fetch("project_id"),
-            assignment_id: selector.fetch("assignment_id"), attempt_id: selector.fetch("attempt_id"), mapping_id: registration.fetch("mapping_id"))
-          introductions = entry.fetch(:introductions)
-          terminal_introduction = nil
-          terminal = if events.any? { |event| event["type"] == "attempt_stopped" }
-            stopped = events.find { |event| event["type"] == "attempt_stopped" }
-            accepted = events.select { |event| event["type"] == "authority_mutation" && event["previous_digest"] == stopped.fetch("digest") }
-            raise AttemptErrors::EvidenceUnavailable, "Inventory stopped acceptance is ambiguous" unless accepted.one?
-            terminal_introduction = introductions.fetch(accepted.first.fetch("digest"))
-            verify_stopped_terminal_at_prefix!(events, journal, terminal_introduction, deployment: original)
-          else
-            inventory_terminal_at_introduction!(journal, selector, events, original, original_map, registration.fetch("mapping_id"), introductions)
-          end
-          row["terminal_event_id"] = terminal.fetch("digest")
-          unless releases.empty?
-            raise AttemptErrors::EvidenceUnavailable, "Inventory release is ambiguous" unless releases.one?
-            release = releases.first
-            prefix = introductions.fetch(release.fetch("digest"))
-            verify_released_lineage_at_prefix!(journal, prefix, selector.fetch("assignment_id"), selector.fetch("attempt_id"), events, original, original_map, terminal_introduction: terminal_introduction)
-            row["reservation_release_event_id"] = release.fetch("digest")
-          end
-          row
-        rescue KeyError, TypeError, JSON::ParserError, NoMethodError
-          raise AttemptErrors::EvidenceUnavailable, "Inventory canonical row is malformed"
-        end
-
-        def inventory_terminal_at_introduction!(journal, selector, events, original, map, mapping_id, introductions)
-          terminals = events.select { |event| event["type"] == "receipt_accepted" ||
-            (event["type"] == "authority_mutation" && event.dig("payload", "operation") == "abort_launch") }
-          raise AttemptErrors::EvidenceUnavailable, "Inventory terminal provenance is ambiguous" unless terminals.one?
-          event = terminals.first
-          prefix_commit = introductions.fetch(event.fetch("digest"))
-          prefix = journal.read_events(selector.fetch("assignment_id"), commit: prefix_commit).select { |entry| entry["attempt_id"] == selector.fetch("attempt_id") }
-          terminal_length = events.index(event) + 1
-          if event["type"] == "receipt_accepted"
-            transition, acceptance = events.drop(terminal_length).take(2)
-            if transition && acceptance && transition["type"] == "transition" &&
-                acceptance["type"] == "authority_mutation" && acceptance.dig("payload", "operation") == "finish"
-              unless introductions.fetch(transition.fetch("digest")) == prefix_commit &&
-                  introductions.fetch(acceptance.fetch("digest")) == prefix_commit
-                raise AttemptErrors::EvidenceUnavailable, "Inventory finish acceptance introduction differs"
-              end
-              terminal_length += 2
-            end
-          end
-          unless prefix == events.take(terminal_length)
-            raise AttemptErrors::EvidenceUnavailable, "Inventory terminal introduction differs"
-          end
-          lineage = Molecules::ExecutionScopeLineage.new(events: prefix, project_id: map.fetch("project_id"),
-            assignment_id: selector.fetch("assignment_id"), attempt_id: selector.fetch("attempt_id"), mapping_id: mapping_id)
-          terminal = terminal_scope_receipt!(prefix, lineage, journal, prefix_commit, deployment: original)
-          if prefix.any? { |entry| entry.dig("payload", "operation") == "finish" }
-            unless lineage.proof_event && !pending_prompt_issuers?(prefix, journal, prefix_commit) && @result_owner
-              raise AttemptErrors::EvidenceUnavailable, "Inventory finish closure owner is unavailable"
-            end
-            lineage.require_positive!(scope_generation: lineage.binding.fetch("scope_generation"),
-              scope_binding_event_id: lineage.binding_event.fetch("digest"), seal_event_id: lineage.seal_event.fetch("digest"), proof_id: lineage.proof_id)
-            params = selector.merge("mapping_id" => mapping_id)
-            if terminal.dig("payload", "receipt", "verdict") == "succeeded"
-              finish = prefix.find { |entry| entry.dig("payload", "operation") == "finish" }
-              review_params = params.merge(finish.fetch("payload").fetch("data").slice("head", "candidate_generation"))
-              @result_owner.finished_review_evidence!(journal: journal, events: prefix, params: review_params,
-                map: map, commit: prefix_commit)
-            end
-            @result_owner.service_settlement_complete!(journal: journal, events: prefix, params: params, map: map, commit: prefix_commit)
-          end
-          terminal
-        end
-
-        def inventory_original_deployment!(journal, events, mapping_id, current_map)
-          provisioning = events.select { |event| event["type"] == "scope_provisioning" }
-          raise AttemptErrors::EvidenceUnavailable, "Inventory original provisioning is ambiguous" unless provisioning.one?
-          identity = provisioning.first.fetch("payload")
-          unless identity.is_a?(Hash) && identity.keys.sort == %w[deployment_digest descriptor_sha256 reservation_generation slot_id]
-            raise AttemptErrors::EvidenceUnavailable, "Inventory original provisioning is malformed"
-          end
-          original = if identity.fetch("descriptor_sha256") == protected_descriptor_sha256!
-            @deployment
-          else
-            raise AttemptErrors::EvidenceUnavailable, "Inventory original descriptor owner unavailable" unless @deployment_history
-            @deployment_history.descriptor!(sha256: identity.fetch("descriptor_sha256"))
-          end
-          map = original.mapping(mapping_id)
-          project = original.project(map.fetch("project_id"))
-          unless map.fetch("project_id") == current_map.fetch("project_id") &&
-              map.fetch("execution_scope").fetch("slot_id") == identity.fetch("slot_id") &&
-              original.mapping_digest(mapping_id) == identity.fetch("deployment_digest") &&
-              [project.fetch("journal_repository"), project.fetch("evidence_git_ref"), project.fetch("evidence_checkout_root")] == [journal.repo_root, journal.ref, journal.checkout_root]
-            raise AttemptErrors::EvidenceUnavailable, "Inventory original descriptor association differs"
-          end
-          [original, map]
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/authority/campaign_consumer_policy.rb

@@ -1,100 +0,0 @@
-# frozen_string_literal: true
-require "json"
-require "ace/runtime/molecules/protected_artifact_set"
-require_relative "campaign_execution"
-require_relative "posix_acl"
-
-module Ace
-  module Assign
-    module Authority
-      # One accepted descriptor reference, held for the entire store/CAS guard.
-      # There is deliberately no ordinary review configuration cascade here.
-      class CampaignConsumerPolicy
-        class Protection < Ace::Runtime::Molecules::ProtectedArtifactSet::Protection
-          def initialize(acl: PosixAcl.new, **options)
-            super(**options)
-            @acl = acl
-          end
-
-          def verify!(path, handle, directory:)
-            super
-            unless @acl.entries(path).nil? && (!directory || @acl.entries(path, attribute: "system.posix_acl_default").nil?)
-              raise Ace::Runtime::RuntimeUnavailableError, "campaign policy ACL differs"
-            end
-          end
-        end
-        def self.reference!(reference)
-          unless reference.is_a?(Hash) && reference.keys.sort == %w[bytes path sha256] &&
-              reference["path"].is_a?(String) && reference["path"].encoding == Encoding::UTF_8 &&
-              reference["path"].valid_encoding? && reference["path"].bytesize.between?(1, 4096) &&
-              !reference["path"].include?("\0") && reference["path"].start_with?("/") &&
-              File.expand_path(reference["path"]) == reference["path"] &&
-              reference["sha256"].is_a?(String) && reference["sha256"].match?(/\A[0-9a-f]{64}\z/) &&
-              reference["bytes"].is_a?(Integer) && reference["bytes"].between?(1, 65_536)
-            raise ArgumentError, "invalid campaign consumer policy reference"
-          end
-          reference
-        end
-
-        def initialize(artifacts: Ace::Runtime::Molecules::ProtectedArtifactSet.new(protection: Protection.new))
-          @artifacts = artifacts
-        end
-
-        def with(reference)
-          begin
-            self.class.reference!(reference)
-          rescue ArgumentError
-            unavailable!
-          end
-          @artifacts.with do |artifacts|
-            profiles = read_profiles!(artifacts, reference)
-            verify_artifacts!(artifacts)
-            result = yield profiles, artifacts
-            verify_artifacts!(artifacts)
-            result
-          end
-        end
-
-        private
-
-        def read_profiles!(artifacts, reference)
-          bytes = artifacts.read!(reference).dup.force_encoding(Encoding::UTF_8)
-          raise ArgumentError, "campaign consumer policy is not UTF-8" unless bytes.valid_encoding?
-          value = JSON.parse(bytes, create_additions: false, max_nesting: 16,
-            allow_duplicate_key: false, allow_comments: false)
-          unless value.is_a?(Hash) && value.keys.sort == %w[profiles schema] &&
-              value["schema"] == "ace.review.consumer-policy/v1" && value["profiles"].is_a?(Hash) &&
-              value["profiles"].size <= 32
-            raise ArgumentError, "campaign consumer policy fields differ"
-          end
-          profiles = value.fetch("profiles").to_h do |id, policy|
-            CampaignExecution::Contract.id!(id, "consumer profile")
-            [id, policy.nil? ? nil : CampaignExecution::Contract.policy!(policy)]
-          end
-          freeze_value!(profiles)
-          profiles
-        rescue ArgumentError, KeyError, TypeError, JSON::ParserError, Ace::Runtime::RuntimeUnavailableError, SystemCallError, IOError
-          unavailable!
-        end
-
-        def verify_artifacts!(artifacts)
-          artifacts.verify_unchanged!
-        rescue Ace::Runtime::RuntimeUnavailableError, SystemCallError, IOError
-          unavailable!
-        end
-
-        def unavailable!
-          raise AttemptErrors::EvidenceUnavailable, "current campaign consumer policy is unavailable"
-        end
-
-        def freeze_value!(value)
-          case value
-          when Hash then value.each { |key, child| key.freeze; freeze_value!(child) }
-          when Array then value.each { |child| freeze_value!(child) }
-          end
-          value.freeze
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/authority/campaign_execution.rb

@@ -1,119 +0,0 @@
-# frozen_string_literal: true
-
-require "ace/git/atoms/pr_identifier"
-require "ace/review/atoms/campaign_contract"
-require_relative "../molecules/receipt_verifier"
-
-module Ace
-  module Assign
-    module Authority
-      # Closed child linkage. Validation is structural; the registration owner
-      # must independently compare it with canonical parent/campaign state.
-      module CampaignExecution
-        Contract = Ace::Review::Atoms::CampaignContract
-        FIELDS = %w[version parent_assignment_id parent_attempt_id parent_scope parent_candidate_generation
-          subject campaign_id contract_identity policy_digest round_id phase review_scope scope_identity_digest
-          head base operation check_name].sort.freeze
-
-        def self.validate_parent!(value)
-          unless value.is_a?(Hash) && value.keys.sort == %w[campaign_id contract_identity policy subject version] &&
-              value["version"].is_a?(Integer) && value["version"] == 1
-            raise ArgumentError, "parent campaign fields differ"
-          end
-          Contract.id!(value["campaign_id"], "campaign ID")
-          unless value["contract_identity"].is_a?(String) && /\A[0-9a-f]{64}\z/.match?(value["contract_identity"]) &&
-              Contract.subject!(value["subject"]) == value["subject"]
-            raise ArgumentError, "parent campaign identity differs"
-          end
-          Contract.policy!(value["policy"])
-          value
-        end
-
-        def self.validate_round!(value, parent:, round:)
-          validate!(value, parent: parent, policy: round.fetch("policy"))
-          binding = round.fetch("binding")
-          expected = round.slice("campaign_id", "subject", "contract_identity", "round_id").merge(
-            "head" => binding.fetch("head"), "base" => binding.fetch("base"),
-            "scope_identity_digest" => Contract.digest(binding.fetch("scope_identity").fetch(value.fetch("review_scope"))))
-          unless expected.all? { |key, item| value.fetch(key) == item }
-            raise ArgumentError, "campaign execution differs from pinned round"
-          end
-          value
-        rescue KeyError, TypeError
-          raise ArgumentError, "campaign execution round is incomplete"
-        end
-
-        # This does not accept a receipt; the canonical result owner still
-        # validates its producer, artifacts and introduction before use.
-        def self.validate_result!(value, receipt:, base:)
-          unless receipt.is_a?(Hash) && receipt["campaign"].nil? &&
-              receipt["operation"] == value.fetch("operation") &&
-              receipt["head"] == value.fetch("head") && base == value.fetch("base")
-            raise ArgumentError, "campaign child result differs from registered phase or candidate"
-          end
-          if receipt["verdict"] == "succeeded" && !Array(receipt["checks"]).any? { |check|
-              check.is_a?(Hash) && check["name"] == value.fetch("check_name") && check["verdict"] == "passed" }
-            raise ArgumentError, "campaign child result lacks its executed phase check"
-          end
-          value
-        rescue KeyError, TypeError
-          raise ArgumentError, "campaign child result binding is incomplete"
-        end
-
-        def self.validate_finished_review!(value, receipt:, accepted_review:)
-          executed = Array(receipt.fetch("artifacts")).map { |ref| ref.fetch("sha256") }
-          reviewed = Array(accepted_review.fetch("artifacts")).map { |ref| ref.fetch("sha256") }
-          unless (executed - reviewed).empty?
-            raise ArgumentError, "independent campaign review does not cover executed artifacts"
-          end
-          if value.fetch("phase") == "approval" && receipt["review"] != accepted_review.fetch("review")
-            raise ArgumentError, "campaign approval differs from canonical independent review"
-          end
-          true
-        rescue KeyError, TypeError
-          raise ArgumentError, "campaign independent review binding is incomplete"
-        end
-
-        def self.validate!(value, parent:, policy:)
-          unless value.is_a?(Hash) && value.keys.sort == FIELDS && value["version"].is_a?(Integer) && value["version"] == 1
-            raise ArgumentError, "campaign execution fields differ"
-          end
-          %w[parent_assignment_id parent_attempt_id parent_scope campaign_id round_id review_scope].each do |key|
-            Contract.id!(value[key], key)
-          end
-          unless value["parent_assignment_id"] == parent && value["parent_candidate_generation"].is_a?(Integer) &&
-              value["parent_candidate_generation"] >= 0
-            raise ArgumentError, "campaign execution parent differs"
-          end
-          %w[contract_identity policy_digest scope_identity_digest].each do |key|
-            unless value[key].is_a?(String) && /\A[0-9a-f]{64}\z/.match?(value[key])
-              raise ArgumentError, "campaign execution digest differs"
-            end
-          end
-          %w[head base].each { |key| Contract.sha!(value[key], key) }
-          unless Contract.subject!(value["subject"]) == value["subject"]
-            raise ArgumentError, "campaign execution subject is not canonical"
-          end
-          policy = Contract.policy!(policy)
-          unless Contract.digest(policy) == value["policy_digest"] && policy["required_scopes"].include?(value["review_scope"])
-            raise ArgumentError, "campaign execution policy differs"
-          end
-          expected = case value["phase"]
-          when "collection" then ["review-collect", "review-execution"]
-          when "approval" then ["review", "review-approval"]
-          when "check"
-            check = value["check_name"]
-            if Molecules::ReceiptVerifier::EXTERNAL_EFFECT_OPERATIONS.include?(check)
-              raise ArgumentError, "external effects cannot be campaign checks"
-            end
-            raise ArgumentError, "campaign execution check is not required" unless policy["required_checks"].include?(check)
-            [check == "tests" ? "test" : check, check]
-          else raise ArgumentError, "campaign execution phase differs"
-          end
-          raise ArgumentError, "campaign execution operation differs" unless value.values_at("operation", "check_name") == expected
-          value
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/authority/campaign_round_transfer.rb

@@ -1,82 +0,0 @@
-# frozen_string_literal: true
-require "fileutils"
-require "tmpdir"
-require_relative "receipt_transfer"
-
-module Ace
-  module Assign
-    module Authority
-      module CampaignRoundTransfer
-        def self.decode(input:, sha256:)
-          admitted = ReceiptTransfer.decode(input: input, receipt_sha256: sha256,
-            artifact_field: "artifacts", reference_key: "path")
-          text = input.bytes(index: 0).dup.force_encoding(Encoding::UTF_8)
-          raise ArgumentError, "round JSON encoding differs" unless text.valid_encoding? && !text.include?("\0")
-          envelope = JSON.parse(text, create_additions: false, max_nesting: 32, allow_duplicate_key: false, allow_comments: false)
-          unless envelope.keys.sort == %w[artifacts round version] && envelope["version"].is_a?(Integer) && envelope["version"] == 1 &&
-              envelope["round"].is_a?(Hash) && envelope["artifacts"].all? { |ref| relative_path?(ref["path"]) }
-            raise ArgumentError, "round envelope differs"
-          end
-          {round: envelope.fetch("round"), references: envelope.fetch("artifacts"),
-            bytes: admitted.fetch(:artifacts), sha256: sha256}.freeze
-        rescue JSON::ParserError, KeyError, TypeError
-          raise ArgumentError, "round envelope is malformed"
-        end
-
-        def self.relative_path?(path)
-          path.is_a?(String) && path.encoding == Encoding::UTF_8 && path.valid_encoding? && path.bytesize.between?(1, 256) &&
-            !path.start_with?("/") && !path.include?("\\") && !path.include?("\0") &&
-            path.split("/", -1).none? { |component| component.empty? || %w[. ..].include?(component) }
-        end
-
-        # Paths are private materialization names, never source filesystem reads.
-        # The original R1 replay digest binds all supplied bytes independently.
-        def self.materialize(admitted:, repository:, request_id:)
-          base = File.join(repository, ".ace-local", "review", "campaign-inputs")
-          FileUtils.mkdir_p(base, mode: 0o700)
-          PrivateDirectory.verify!(base)
-          final = File.join(base, Digest::SHA256.hexdigest(request_id))
-          if File.exist?(final)
-            PrivateDirectory.verify!(final)
-            verify_materialization!(admitted, final)
-          else
-            temporary = Dir.mktmpdir("round-", base)
-            admitted.fetch(:references).zip(admitted.fetch(:bytes)).each do |reference, bytes|
-              path = File.join(temporary, reference.fetch("path"))
-              FileUtils.mkdir_p(File.dirname(path), mode: 0o700)
-              File.open(path, File::WRONLY | File::CREAT | File::EXCL | File::NOFOLLOW, 0o600) do |file|
-                file.write(bytes)
-                file.flush
-                file.fsync
-              end
-            end
-            File.rename(temporary, final)
-            temporary = nil
-            File.open(base, File::RDONLY) { |directory| directory.fsync }
-          end
-          admitted.fetch(:references).to_h { |reference| [reference.fetch("path"), File.join(final, reference.fetch("path"))] }.freeze
-        ensure
-          FileUtils.remove_entry(temporary) if temporary && File.directory?(temporary)
-        end
-
-        def self.verify_materialization!(admitted, root)
-          expected = admitted.fetch(:references).map { |ref| ref.fetch("path") }.sort
-          actual = Dir.glob(File.join(root, "**", "*"), File::FNM_DOTMATCH).reject { |path| File.directory?(path) }
-            .map { |path| path.delete_prefix(root + "/") }.sort
-          raise AttemptErrors::Conflict, "round materialization differs" unless expected == actual
-          admitted.fetch(:references).each do |reference|
-            path = File.join(root, reference.fetch("path"))
-            PrivateDirectory.verify!(File.dirname(path))
-            File.open(path, File::RDONLY | File::NOFOLLOW | File::NONBLOCK) do |file|
-              stat = file.stat
-              unless stat.file? && stat.uid == Process.uid && stat.nlink == 1 && (stat.mode & 0o777) == 0o600 &&
-                  stat.size <= 64 * 1024 && Digest::SHA256.hexdigest(file.read(64 * 1024 + 1)) == reference.fetch("sha256")
-                raise AttemptErrors::Conflict, "round materialization bytes differ"
-              end
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/authority/candidate_blob_batch.rb

@@ -1,55 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "../atoms/git_blob_batch"
-
-module Ace
-  module Assign
-    module Authority
-      # Same cat-file batch dialect/codec as the canonical journal. Chunked
-      # bodies avoid retaining the entire expanded tree a second time.
-      module CandidateBlobBatch
-        BATCH_BYTES = 8 * 1024 * 1024
-        BATCH_OBJECTS = 512
-        MAX_OBJECTS = 20_000
-
-        private
-
-        def candidate_blob_sizes(repository, deadline, oids)
-          unless oids.is_a?(Array) && oids.size <= MAX_OBJECTS &&
-              oids.all? { |oid| oid.is_a?(String) && self.class::SHA.match?(oid) }
-            reject!("Candidate blob inventory is invalid or oversized")
-          end
-          oids.each_slice(64).flat_map do |slice|
-            raw = git(repository, deadline, "cat-file", "--batch-check", stdin_data: slice.join("\n") + "\n", limit: slice.size * 128)
-            Atoms::GitBlobBatch.sizes(slice, raw)
-          end
-        rescue Atoms::GitBlobBatch::Invalid => error
-          reject!("Candidate blob batch #{error.reason} differs")
-        end
-
-        def each_candidate_blob(repository, deadline, entries)
-          batch = []
-          bytes = 0
-          entries.each do |entry|
-            if !batch.empty? && (batch.size >= BATCH_OBJECTS || bytes + entry.last > BATCH_BYTES)
-              yield_candidate_blob_batch(repository, deadline, batch) { |oid, content| yield oid, content }
-              batch = []
-              bytes = 0
-            end
-            batch << entry
-            bytes += entry.last
-          end
-          yield_candidate_blob_batch(repository, deadline, batch) { |oid, content| yield oid, content } unless batch.empty?
-        end
-
-        def yield_candidate_blob_batch(repository, deadline, entries)
-          limit = entries.sum { |_oid, size| size + 128 }
-          raw = git(repository, deadline, "cat-file", "--batch", stdin_data: entries.map { |oid, _size| "#{oid}\n" }.join, limit: limit)
-          Atoms::GitBlobBatch.decode(entries, raw).zip(entries).each { |content, (oid, _size)| yield oid, content }
-        rescue Atoms::GitBlobBatch::Invalid => error
-          reject!("Candidate blob batch #{error.reason} differs")
-        end
-      end
-    end
-  end
-end