ace-assign 0.71.0 → 0.73.0

data/lib/ace/assign/authority/client.rb

@@ -1,257 +0,0 @@
-# frozen_string_literal: true
-require "securerandom"
-require_relative "deployment"
-require_relative "transfer_codec"
-require_relative "campaign_execution"
-require_relative "candidate_transfer"
-require_relative "../molecules/canonical_evidence"
-require_relative "../molecules/execution_scope_lineage"
-
-module Ace
-  module Assign
-    module Authority
-      class Client
-        Reply = Struct.new(:data, :replayed, :parts, keyword_init: true)
-        attr_reader :mapping_id
-        def initialize(mapping_id:, deployment: Deployment.load, kernel: Ace::Runtime::Molecules::ProtectedLinux.new)
-          @mapping_id, @deployment, @kernel = mapping_id, deployment, kernel
-          @map = deployment.mapping(mapping_id)
-          @service = deployment.authority(@map.fetch("authority_id"))
-        end
-
-        def call(operation, params, mutation_id: nil, timeout: nil, upload_parts: nil, download: false, purpose: nil)
-          if operation == "register_assignment" && (!upload_parts || purpose != :candidate || download)
-            raise ArgumentError, "prepared registration requires fixed candidate upload"
-          end
-          if operation == "evidence_fetch" && (!download || purpose != (%w[prepared_work campaign_candidate].include?(params["kind"]) ? :candidate : :artifacts) || upload_parts)
-            raise ArgumentError, "evidence fetch requires source-fixed kind download"
-          end
-          if operation == "submit_result" && (!upload_parts || purpose != :receipt_artifacts || download)
-            raise ArgumentError, "result submission requires fixed receipt upload"
-          end
-          if operation == "campaign_export_result" && (!download || purpose != :artifacts || upload_parts || mutation_id)
-            raise ArgumentError, "campaign result requires fixed read-only artifact download"
-          end
-          if operation == "campaign_record_round" && (!upload_parts || purpose != :receipt_artifacts || download)
-            raise ArgumentError, "campaign round requires fixed bounded upload"
-          end
-          @deployment.verify!(mapping_id, kernel: @kernel)
-          wire = Ace::Runtime::Molecules::ProtectedSocket
-          path = @service.fetch("socket_path")
-          before = wire.socket_identity(path)
-          raise Ace::Runtime::RuntimeUnavailableError, "authority endpoint owner differs" unless before.last == @service.fetch("uid")
-          raise ArgumentError, "cannot upload and download on one request" if upload_parts && download
-          prepared_download = operation == "evidence_fetch" && %w[prepared_work campaign_candidate].include?(params["kind"])
-          codec = transfer_codec if upload_parts || download && !prepared_download
-          descriptor = codec.descriptor(upload_parts, purpose: purpose) if upload_parts
-          parameters = upload_parts ? params.merge("transfer" => descriptor) : params
-          cap = %w[reserve_attempt close_execution_scope stop_attempt].include?(operation) ? 90 : 30
-          duration = timeout || (cap == 90 ? 90 : 5)
-          unless duration.is_a?(Numeric) && duration.positive? && duration.finite?
-            raise ArgumentError, "authority timeout must be finite and positive"
-          end
-          deadline = wire.deadline([duration, cap].min)
-          wire.connect(path, deadline: deadline) do |socket|
-            peer = @kernel.peer(socket)
-            unless peer["uid"] == @service.fetch("uid") && peer["gid"] == @service.fetch("gid") &&
-                peer["groups"] == @service.fetch("groups") && wire.socket_identity(path) == before
-              raise AttemptErrors::UnauthorizedIdentity, "authority endpoint peer changed"
-            end
-            wire.write(socket, {"version" => 1, "operation" => operation,
-              "mutation_id" => mutation_id, "project_id" => @map.fetch("project_id"),
-              "params" => parameters.merge("mapping_id" => mapping_id)}, deadline: deadline, limit: upload_parts || download ? 16_384 : wire::LIMIT)
-            if %w[bind_inbox finish recover request_review review_status launch_review_intent cancel_review assignment_inventory evidence_fetch observe_execution_scope close_execution_scope stop_attempt prompt_status launch_input_inhibit_selection launch_input_inhibit_completion launch_prompt_intent launch_prompt_completion claim_service_settlement workspace_prune_preview_context].include?(operation) || (operation == "attempt_status" && params.key?("result_candidate_generation"))
-              socket.shutdown(Socket::SHUT_WR)
-            end
-            if upload_parts
-              codec.send(socket, parts: upload_parts, descriptor: descriptor, purpose: purpose, deadline: deadline)
-              socket.shutdown(Socket::SHUT_WR)
-            end
-            result = wire.read(socket, deadline: deadline, limit: 16_384)
-            unless result.is_a?(Hash) && result["status"] == "ok" && result["data"].is_a?(Hash)
-              code = result.is_a?(Hash) ? result.dig("error", "code") : nil
-              raise AttemptErrors::BoundedResultUnavailable, "protected authority result exceeds frame bound" if code == "bounded_result"
-              raise AttemptErrors::EvidenceUnavailable, "protected authority refused (#{code || 'invalid_response'})"
-            end
-            transport = result.fetch("transport")
-            unless transport.is_a?(Hash) && transport.keys == ["replayed"] && [true, false].include?(transport["replayed"])
-              raise AttemptErrors::EvidenceUnavailable, "authority replay metadata is unavailable"
-            end
-            if operation == "evidence_fetch"
-              if %w[prepared_work campaign_candidate].include?(params["kind"]) && transport.fetch("replayed")
-                raise AttemptErrors::EvidenceUnavailable, "prepared fetch cannot replay a mutation"
-              end
-              validate_evidence_download!(result.fetch("data"), params)
-            end
-            parts = if download
-              codec = prepared_transfer_codec(result.fetch("data").fetch("descriptor")) if prepared_download
-              codec.receive(socket, descriptor: result.fetch("data").fetch("transfer"), purpose: purpose, deadline: deadline) do |input|
-                Array.new(input.count) { |index| input.bytes(index: index) }
-              end
-            end
-            Reply.new(data: result.fetch("data"), replayed: transport.fetch("replayed"), parts: parts)
-          end
-        rescue SystemCallError, IOError
-          raise AttemptErrors::EvidenceUnavailable, "protected authority connection unavailable; no local fallback"
-        end
-
-
-        # Fixed original-launcher stream. Public calls retain their existing
-        # complete-upload EOF contract; no caller-selected framing flag exists.
-        def with_launch_control(state:)
-          @deployment.verify!(mapping_id, kernel: @kernel)
-          wire = Ace::Runtime::Molecules::ProtectedSocket
-          path = @service.fetch("socket_path")
-          before = wire.socket_identity(path)
-          raise Ace::Runtime::RuntimeUnavailableError, "Authority endpoint owner differs" unless before.last == @service.fetch("uid")
-          deadline = wire.deadline(30)
-          wire.connect(path, deadline: deadline) do |socket|
-            peer = @kernel.peer(socket)
-            unless peer.values_at("uid", "gid", "groups") == @service.values_at("uid", "gid", "groups") && wire.socket_identity(path) == before
-              raise AttemptErrors::UnauthorizedIdentity, "Authority stream peer changed"
-            end
-            wire.write(socket, {"version" => 1, "operation" => "launch_control", "mutation_id" => nil,
-              "project_id" => @map.fetch("project_id"), "params" => state.slice("assignment_id", "attempt_id").merge("mapping_id" => mapping_id)},
-              deadline: deadline, limit: 16_384)
-            ready = wire.read(socket, deadline: deadline, limit: 16_384)
-            validate_launch_control_ready!(ready, state)
-            yield socket, transfer_codec, ready
-          end
-        rescue IOError, SystemCallError
-          raise AttemptErrors::EvidenceUnavailable, "Original launch control connection is unavailable"
-        end
-
-        private
-
-        def validate_launch_control_ready!(ready, state)
-          unless ready.is_a?(Hash) && ready.keys.sort == %w[attempt_id generation journal_commit original_binding_digest type version] &&
-              ready["version"].is_a?(Integer) && ready["version"] == 1 && ready["type"] == "launch_control_ready" &&
-              ready["attempt_id"] == state.fetch("attempt_id") && ready["generation"].is_a?(Integer) && ready["generation"].positive? &&
-              ready["journal_commit"].is_a?(String) && ready["journal_commit"].match?(/\A(?:[0-9a-f]{40}|[0-9a-f]{64})\z/) &&
-              ready["original_binding_digest"].is_a?(String) && ready["original_binding_digest"].match?(/\A[0-9a-f]{64}\z/)
-            raise AttemptErrors::EvidenceUnavailable, "Original launch control admission is unavailable"
-          end
-          true
-        end
-
-        def validate_evidence_download!(data, params)
-          descriptor, transfer = data.values_at("descriptor", "transfer")
-          if params["kind"] == "prepared_work"
-            validate_prepared_download!(data, params)
-            return
-          end
-          if params["kind"] == "campaign_candidate"
-            validate_campaign_candidate_download!(data, params)
-            return
-          end
-          unless data.keys.sort == %w[descriptor generation journal_commit transfer] &&
-              Molecules::CanonicalEvidence.valid_descriptor?(descriptor) &&
-              descriptor["project_id"] == @map.fetch("project_id") &&
-              {"assignment_id" => "assignment_id", "attempt_id" => "attempt_id", "kind" => "kind",
-                "request_id_or_event_id" => "purpose_id", "artifact_id" => "artifact_id"}.all? { |field, key| descriptor[field] == params[key] } &&
-              data["generation"].is_a?(Integer) && data["generation"] >= 0 &&
-              data["journal_commit"].is_a?(String) && data["journal_commit"].match?(/\A[0-9a-f]{40,64}\z/) &&
-              transfer.is_a?(Hash) && transfer.keys.sort == %w[bytes parts sha256 version] && transfer["version"] == 1 &&
-              transfer["bytes"] == descriptor["bytes"] && transfer["sha256"] == descriptor["sha256"] &&
-              transfer["parts"] == [descriptor.slice("bytes", "sha256")]
-            raise AttemptErrors::EvidenceUnavailable, "canonical download descriptor differs"
-          end
-        end
-
-        def transfer_codec
-          peer = @kernel.capture(Process.pid)
-          project = @deployment.project(@map.fetch("project_id"))
-          installed = project.fetch("peer_credentials").fetch(peer.fetch("uid").to_s)
-          unless peer["gid"] == installed["gid"] && peer["groups"] == installed["groups"]
-            raise AttemptErrors::UnauthorizedIdentity, "transfer scratch principal differs"
-          end
-          TransferCodec.new(root: installed.fetch("scratch_root"))
-        end
-
-        def validate_prepared_download!(data, params)
-          descriptor, transfer = data.values_at("descriptor", "transfer")
-          fields = %w[version kind purpose artifact project_id mapping_id assignment_id attempt_id task_id scope definition_digest selection_sha256 prepared_head prepared_tree manifest_bytes manifest_sha256 registration_generation registration_commit original_binding_digest ref bytes sha256 task_context_entry original_worker_identity original_worker_scratch_root workspace_exclusion].sort
-          valid = data.keys.sort == %w[descriptor generation journal_commit transfer] && descriptor.is_a?(Hash) && descriptor.keys.sort == fields &&
-            descriptor["version"].is_a?(Integer) && descriptor["version"] == 1 &&
-            params.values_at("kind", "purpose_id", "artifact_id") == %w[prepared_work original_prepared_work prepared_bundle] &&
-            descriptor.values_at("kind", "purpose", "artifact") == %w[prepared_work original_prepared_work prepared_bundle] &&
-            descriptor["project_id"] == @map.fetch("project_id") && descriptor["mapping_id"] == mapping_id &&
-            %w[assignment_id attempt_id].all? { |key| descriptor[key] == params[key] } &&
-            descriptor["task_id"].is_a?(String) && descriptor["task_id"].match?(Deployment::TOKEN) &&
-            descriptor["scope"].is_a?(String) && descriptor["scope"].bytesize.between?(1, 128) && descriptor["scope"].match?(/\A[0-9]+(?:\.[0-9]+)*\z/) &&
-            %w[definition_digest selection_sha256 manifest_sha256 original_binding_digest sha256].all? { |key| descriptor[key].is_a?(String) && descriptor[key].match?(/\A[0-9a-f]{64}\z/) } &&
-            %w[prepared_head prepared_tree].all? { |key| descriptor[key].is_a?(String) && descriptor[key].match?(/\A[0-9a-f]{40}\z/) } &&
-            descriptor["manifest_bytes"].is_a?(Integer) && descriptor["manifest_bytes"].between?(1, 32_768) &&
-            descriptor["registration_generation"].is_a?(Integer) && descriptor["registration_generation"].positive? &&
-            descriptor["bytes"].is_a?(Integer) && descriptor["bytes"].between?(1, TransferCodec::LIMITS.fetch(:candidate).first) &&
-            descriptor["registration_commit"].is_a?(String) && descriptor["registration_commit"].match?(/\A(?:[0-9a-f]{40}|[0-9a-f]{64})\z/) &&
-            descriptor["ref"] == "execution/prepared/#{params.fetch('assignment_id')}-#{descriptor['sha256']}.bundle" &&
-            data["generation"].is_a?(Integer) && data["generation"].positive? &&
-            data["journal_commit"].is_a?(String) && data["journal_commit"].match?(/\A(?:[0-9a-f]{40}|[0-9a-f]{64})\z/) &&
-            transfer.is_a?(Hash) && transfer.keys.sort == %w[bytes parts sha256 version] && transfer["version"].is_a?(Integer) && transfer["version"] == 1 &&
-            transfer.values_at("bytes", "sha256") == descriptor.values_at("bytes", "sha256") && transfer["parts"] == [descriptor.slice("bytes", "sha256")]
-          raise AttemptErrors::EvidenceUnavailable, "original prepared download descriptor differs" unless valid
-          TaskContextEntry.validate!(descriptor.fetch("task_context_entry"))
-          Molecules::LifecycleExclusion.workspace_reader(projection: descriptor.fetch("workspace_exclusion"))
-          unless descriptor.dig("workspace_exclusion", "root_resource", "view_path") ==
-              "/run/ace/lifecycle-exclusion/#{descriptor.fetch('mapping_id')}"
-            raise AttemptErrors::EvidenceUnavailable, "original prepared lifecycle mapping differs"
-          end
-          identity = descriptor.fetch("original_worker_identity")
-          birth = identity.is_a?(Hash) && identity["started_at"]
-          boot = birth.is_a?(String) && birth.split(":", -1)[1]
-          Molecules::ExecutionScopeLineage.validate_process_identity!(identity, boot_id: boot)
-          root = descriptor.fetch("original_worker_scratch_root")
-          unless root.is_a?(String) && root.valid_encoding? && root.bytesize.between?(2, 4096) &&
-              root.start_with?("/") && !root.include?("\0") && File.expand_path(root) == root
-            raise AttemptErrors::EvidenceUnavailable, "original prepared scratch root differs"
-          end
-        rescue ArgumentError, KeyError
-          raise AttemptErrors::EvidenceUnavailable, "original prepared download descriptor differs"
-        end
-
-        def validate_campaign_candidate_download!(data, params)
-          descriptor, transfer = data.values_at("descriptor", "transfer")
-          fields = %w[head tree bytes sha256 candidate_generation campaign_execution mapping_id assignment_id attempt_id
-            project_id original_worker_identity original_worker_scratch_root original_binding_digest].sort
-          unless data.keys.sort == %w[descriptor generation journal_commit transfer] &&
-              descriptor.is_a?(Hash) && descriptor.keys.sort == fields &&
-              params.values_at("purpose_id", "artifact_id") == %w[original_campaign_candidate candidate_bundle] &&
-              descriptor["mapping_id"] == mapping_id && descriptor["project_id"] == @map.fetch("project_id") &&
-              %w[assignment_id attempt_id].all? { |key| descriptor[key] == params[key] } &&
-              %w[head tree].all? { |key| descriptor[key].is_a?(String) && descriptor[key].match?(CandidateTransfer::SHA) } &&
-              %w[sha256 original_binding_digest].all? { |key| descriptor[key].is_a?(String) && descriptor[key].match?(/\A[0-9a-f]{64}\z/) } &&
-              descriptor["candidate_generation"].is_a?(Integer) && descriptor["candidate_generation"].positive? &&
-              descriptor["bytes"].is_a?(Integer) && descriptor["bytes"].between?(1, CandidateTransfer::MAX_BYTES) &&
-              descriptor["campaign_execution"].is_a?(Hash) && descriptor["campaign_execution"].keys.sort == CampaignExecution::FIELDS &&
-              data["generation"].is_a?(Integer) && data["generation"].positive? &&
-              data["journal_commit"].is_a?(String) && data["journal_commit"].match?(/\A(?:[0-9a-f]{40}|[0-9a-f]{64})\z/) &&
-              transfer.is_a?(Hash) && transfer.keys.sort == %w[bytes parts sha256 version] && transfer["version"] == 1 &&
-              transfer["version"].is_a?(Integer) &&
-              transfer.values_at("bytes", "sha256") == descriptor.values_at("bytes", "sha256") && transfer["parts"] == [descriptor.slice("bytes", "sha256")]
-            raise AttemptErrors::EvidenceUnavailable, "original campaign candidate download differs"
-          end
-          identity = descriptor.fetch("original_worker_identity")
-          birth = identity.is_a?(Hash) && identity["started_at"]
-          Molecules::ExecutionScopeLineage.validate_process_identity!(identity, boot_id: birth.to_s.split(":", -1)[1])
-          root = descriptor.fetch("original_worker_scratch_root")
-          unless root.is_a?(String) && root.valid_encoding? && root.bytesize.between?(2, 4096) &&
-              root.start_with?("/") && !root.include?("\0") && File.expand_path(root) == root
-            raise AttemptErrors::EvidenceUnavailable, "original campaign scratch root differs"
-          end
-        rescue ArgumentError, KeyError
-          raise AttemptErrors::EvidenceUnavailable, "original campaign candidate download differs"
-        end
-
-        def prepared_transfer_codec(descriptor)
-          peer = @kernel.capture(Process.pid)
-          original = descriptor.fetch("original_worker_identity")
-          unless peer.values_at("uid", "gid", "groups") == original.values_at("uid", "gid", "groups")
-            raise AttemptErrors::UnauthorizedIdentity, "original prepared scratch principal differs"
-          end
-          TransferCodec.new(root: descriptor.fetch("original_worker_scratch_root"))
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/authority/command_execution.rb

@@ -1,180 +0,0 @@
-# frozen_string_literal: true
-
-require "json"
-require "digest"
-require_relative "../molecules/evidence_journal"
-
-module Ace
-  module Assign
-    module Authority
-      # Project commands share the installed journal, without manufacturing a
-      # managed task or projecting command exit as completed product delivery.
-      class CommandExecution
-        OPERATIONS = %w[command_admit command_status command_claim command_bind command_complete].freeze
-        ID = /\A[a-zA-Z0-9][a-zA-Z0-9_.-]{0,63}\z/
-        SHA = /\A[0-9a-f]{64}\z/
-
-        def initialize(project:, journal:, admission:)
-          @project, @journal, @admission = project, journal, admission
-        end
-
-        attr_reader :journal
-
-        def dispatch(request:, peer:, role:, deadline:)
-          operation = request.fetch("operation")
-          params = request.fetch("params")
-          raise ArgumentError, "invalid command project" unless request.fetch("project_id") == @project
-          id = params.fetch("execution_id")
-          raise ArgumentError, "invalid command reference" unless id.is_a?(String) && ID.match?(id)
-          if operation == "command_status"
-            strict!(params, %w[execution_id])
-            raise ArgumentError, "status mutation must be null" unless request.fetch("mutation_id").nil?
-            commit = @journal.ref_value
-            data = projection(id, commit)
-            @admission.command_reader!(peer: peer, definition: data.fetch("definition"), deadline: deadline)
-            return {data: data.merge("journal_commit" => commit), replayed: false}
-          end
-          strict!(params, case operation
-          when "command_admit" then %w[execution_id selection]
-          when "command_claim" then %w[execution_id caller]
-          when "command_bind" then %w[execution_id child]
-          when "command_complete" then %w[execution_id result]
-          else raise ArgumentError, "unknown command operation"
-          end)
-          authenticated_peer = peer
-          launcher = nil
-          plan = if operation == "command_admit"
-            @admission.command_request!(selection: params.fetch("selection"), peer: peer, deadline: deadline)
-          else
-            launcher = @admission.command_launcher!(peer: authenticated_peer, deadline: deadline)
-            nil
-          end
-          authenticate = lambda do
-            if operation == "command_admit"
-              unless @admission.command_request!(selection: params.fetch("selection"), peer: peer, deadline: deadline) == plan
-                raise AttemptErrors::UnauthorizedIdentity, "command admission changed"
-              end
-            else
-              unless @admission.command_launcher!(peer: authenticated_peer, deadline: deadline) == launcher
-                raise AttemptErrors::UnauthorizedIdentity, "installed command launcher changed"
-              end
-            end
-          end
-          peer = launcher if launcher
-          expected = {"command_admit" => 0, "command_claim" => 1, "command_bind" => 2, "command_complete" => 3}.fetch(operation)
-          digest = Atoms::EvidenceDigest.digest({"project" => @project, "params" => params, "peer" => peer, "plan" => plan})
-          @journal.mutate(assignment_id: namespace(id), attempt_id: namespace(id),
-            mutation_id: request.fetch("mutation_id"), operation: operation, parameters_digest: digest,
-            expected_generation: expected, with_replay: true, deadline: deadline,
-            replay_authorizer: authenticate) do |_events, commit, _generation|
-            authenticate.call
-            prior = projection(id, commit, missing: true)
-            data = transition(operation, id, params, plan, prior, peer, deadline)
-            {events: [], data: data}
-          end
-        end
-
-        # Read only the accepted launcher-owned four-stage execution at the
-        # caller's held CAS prefix. Arbitrary allowed commands are not tests.
-        def test_evidence_at!(execution_id:, commit:, head:, tree:, deadline:)
-          unless execution_id.is_a?(String) && ID.match?(execution_id) && commit && @journal.ref_value == commit
-            raise AttemptErrors::EvidenceUnavailable, "test execution prefix or selector differs"
-          end
-          data = projection(execution_id, commit)
-          definition = data.fetch("definition")
-          events = @journal.read_events(namespace(execution_id), commit: commit)
-          accepted = events.select { |event| event["type"] == "authority_mutation" }
-          stages = accepted.map { |event| event.fetch("payload").fetch("data") }
-          unless accepted.size == 4 && data["phase"] == "exited" && data["result"] == {"exit_status" => 0, "signal" => nil} &&
-              definition["purpose"] == "test" && definition["source"] == {"head" => head, "tree" => tree} &&
-              [head, tree].all? { |value| value.is_a?(String) && value.match?(/\A[0-9a-f]{40}\z/) } &&
-              stages.all? { |stage| stage.fetch("definition") == definition } &&
-              stages.map { |stage| stage.fetch("phase") } == %w[admitted claimed running exited] &&
-              stages.drop(1).all? { |stage| stage.fetch("launcher") == data.fetch("launcher") } &&
-              stages[2].fetch("child") == data.fetch("child") && data.dig("launcher", "uid") == 0 &&
-              data.dig("child", "witnessed_by") == data.fetch("launcher") &&
-              data.dig("child", "kernel_identity") == data.dig("child", "root_witness")&.slice("pid", "uid", "started_at", "host") &&
-              data.dig("child", "root_witness", "cwd") == definition.dig("executor", "cwd") &&
-              data.dig("child", "kernel_identity", "uid") == definition.dig("executor", "uid")
-            raise AttemptErrors::ReceiptRejected, "candidate requires an exact successful executed test command"
-          end
-          @admission.command_test_evidence!(definition: definition, deadline: deadline)
-          command = JSON.generate(definition.fetch("argv"))
-          raise AttemptErrors::ReceiptRejected, "executed test command reference is oversized" if command.bytesize > 2048
-          {"schema" => "ace.test.execution-reference/v1", "reference" => execution_id,
-            "candidate_head" => head, "command" => command, "result" => "passed",
-            "recorded_at" => accepted.last.fetch("recorded_at"), "receipt_sha256" => Atoms::EvidenceDigest.digest(data)}
-        rescue KeyError, TypeError
-          raise AttemptErrors::EvidenceUnavailable, "canonical test execution is incomplete"
-        end
-
-        private
-
-        def transition(operation, id, params, plan, prior, peer, deadline)
-          base = {"schema" => "project-command/v1", "execution_id" => id, "project_id" => @project}
-          case operation
-          when "command_admit"
-            raise AttemptErrors::Conflict, "command already admitted" if prior
-            # Plan contains references and nonsecret context; its closed schema
-            # is owned by the installed Lab admission, never requester input.
-            base.merge("phase" => "admitted", "definition" => plan)
-          when "command_claim"
-            phase!(prior, "admitted")
-            @admission.command_claim!(definition: prior.fetch("definition"), caller: params.fetch("caller"),
-              launcher: peer, deadline: deadline)
-            prior.merge("phase" => "claimed", "launcher" => peer)
-          when "command_bind"
-            phase!(prior, "claimed")
-            launcher!(prior, peer)
-            child = @admission.command_child!(definition: prior.fetch("definition"), child: params.fetch("child"),
-              launcher: peer, deadline: deadline)
-            prior.merge("phase" => "running", "child" => child)
-          when "command_complete"
-            phase!(prior, "running")
-            launcher!(prior, peer)
-            result = params.fetch("result")
-            strict!(result, %w[exit_status signal])
-            exit_status, signal = result.values_at("exit_status", "signal")
-            unless (exit_status.is_a?(Integer) && exit_status.between?(0, 255) && signal.nil?) ||
-                (exit_status.nil? && signal.is_a?(Integer) && signal.between?(1, 127))
-              raise ArgumentError, "invalid command termination"
-            end
-            prior.merge("phase" => "exited", "result" => result)
-          end
-        end
-
-        def projection(id, commit, missing: false)
-          events = @journal.read_events(namespace(id), commit: commit)
-          unless Models::EvidenceEvent.chain_valid?(events)
-            raise AttemptErrors::EvidenceUnavailable, "command history is corrupt"
-          end
-          accepted = events.select { |event| event["type"] == "authority_mutation" }
-          if accepted.empty?
-            return nil if missing
-            raise AttemptErrors::NotFound, "command reference is unknown"
-          end
-          operations = accepted.map { |event| event.dig("payload", "operation") }
-          unless operations == OPERATIONS.reject { |name| name == "command_status" }.take(operations.size) && operations.size <= 4
-            raise AttemptErrors::EvidenceUnavailable, "command lifecycle is corrupt"
-          end
-          data = accepted.last.fetch("payload").fetch("data")
-          unless data.values_at("schema", "project_id", "execution_id") == ["project-command/v1", @project, id]
-            raise AttemptErrors::EvidenceUnavailable, "command association differs"
-          end
-          data
-        end
-
-        def namespace(id) = "command-#{id}"
-        def strict!(value, keys)
-          raise ArgumentError, "invalid command fields" unless value.is_a?(Hash) && value.keys.sort == keys.sort
-        end
-        def phase!(prior, phase)
-          raise AttemptErrors::Conflict, "command phase differs; inspect original execution" unless prior && prior["phase"] == phase
-        end
-        def launcher!(prior, peer)
-          raise AttemptErrors::UnauthorizedIdentity, "command launcher changed" unless prior.fetch("launcher") == peer
-        end
-      end
-    end
-  end
-end