ace-assign 0.71.0 → 0.73.0

data/lib/ace/assign/authority/endcap_campaign_rounds.rb

@@ -1,266 +0,0 @@
-# frozen_string_literal: true
-require_relative "campaign_round_transfer"
-
-module Ace
-  module Assign
-    module Authority
-      class Endcap
-        private
-
-        def campaign_round_request!(request)
-          params = request.fetch("params")
-          unless params.is_a?(Hash) && params.keys.sort == PARAMETERS.fetch("campaign_record_round").sort &&
-              params["head"].is_a?(String) && params["head"].match?(CandidateTransfer::SHA) &&
-              params["candidate_generation"].is_a?(Integer) && params["candidate_generation"].positive? &&
-              params["input_sha256"].is_a?(String) && params["input_sha256"].match?(DIGEST)
-            raise ArgumentError, "campaign round request differs"
-          end
-          %w[mapping_id assignment_id attempt_id].each { |key| result_id!(params.fetch(key)) }
-          result_id!(request.fetch("mutation_id"))
-          map = @deployment.mapping(params.fetch("mapping_id"))
-          raise AttemptErrors::UnauthorizedIdentity, "campaign project differs" unless map["project_id"] == request.fetch("project_id")
-          [params, map]
-        end
-
-        def authorize_campaign_round!(request:, peer:, role:)
-          params, map = campaign_round_request!(request)
-          @launch.with_assignment(params: params, map: map) do |journal, registration|
-            protected_journal!(journal)
-            descriptor = @launch.send(:control_original_descriptor!, registration.fetch("lifecycle_control"))
-            original_map = descriptor.mapping(params.fetch("mapping_id"))
-            events = @launch.preview_attempt_events!(journal: journal, commit: journal.ref_value, params: params, map: original_map)
-            finish_identity!(events, params, original_map, peer, role)
-            definition = @launch.preview_attempt_definition!(journal: journal, commit: journal.ref_value, params: params, map: original_map)
-            CampaignExecution.validate_parent!(definition.review_campaign)
-          end
-          true
-        end
-
-        def with_campaign_receipt!(journal:, commit:, events:, params:, map:, receipt:, result:, historical:)
-          unless result.is_a?(Hash) && result["schema"] == "ace.review.accepted-result/v2" &&
-              receipt["campaign"].is_a?(Hash) && receipt["campaign"].keys.sort == %w[id result] &&
-              receipt["operation"] == "review" && receipt["verdict"] == "succeeded"
-            raise AttemptErrors::ReceiptRejected, "parent campaign receipt differs"
-          end
-          context = @launch.send(:control_registration_context!, params, map, journal, commit: commit)
-          original_map = context.fetch(:map)
-          descriptor = context.fetch(:descriptor)
-          selected = CampaignExecution.validate_parent!(@launch.preview_attempt_definition!(journal: journal,
-            commit: commit, params: params, map: original_map).review_campaign)
-          unless receipt.dig("campaign", "id") == selected.fetch("campaign_id") && result["campaign_id"] == selected.fetch("campaign_id")
-            raise AttemptErrors::ReceiptRejected, "parent campaign identity differs"
-          end
-          origin = retained_origin(events, params)
-          parent = params.merge("scope" => origin.fetch("scope"), "base" => origin.fetch("base_head"), "head" => receipt.fetch("head"))
-          current = exact_candidate!(retained_candidate(events, params.fetch("candidate_generation")), parent)
-          project = descriptor.project(original_map.fetch("project_id"))
-          root = File.join(project.fetch("campaign_repository"), ".ace-local", "review", "candidate-views")
-          FileUtils.mkdir_p(root, mode: 0o700)
-          bundle = journal.bounded_blob(current.fetch("bundle_ref"), commit: commit, max_bytes: CandidateTransfer::MAX_BYTES)
-          CandidateTransfer.new(root: root).with_campaign_repository(bytes: bundle, sha256: current.fetch("sha256"),
-            size: current.fetch("bytes"), head: current.fetch("head"), tree: current.fetch("tree"), base: parent.fetch("base")) do |candidate_reader|
-            manager = @launch.send(:campaign_manager_for!, context,
-              **campaign_execution_dependencies!(journal: journal, commit: commit, parent_params: parent, parent_map: original_map),
-              candidate_reader: candidate_reader)
-            binding = selected.slice("subject", "contract_identity", "policy").transform_keys(&:to_sym).merge(
-              result: result, head: receipt.fetch("head"), base: parent.fetch("base"),
-              producer: receipt.fetch("producer").fetch("actor"), reviewer: receipt.fetch("review").fetch("reviewer").fetch("actor"))
-            if historical
-              manager.verify_retained_result!(**binding)
-              yield
-            else
-              deployment_sha = @launch.send(:protected_descriptor_sha256!)
-              CampaignConsumerPolicy.new.with(@deployment.project(original_map.fetch("project_id")).fetch("campaign_policy")) do |profiles, held|
-                manager.with_verified_result!(**binding, consumer_profiles: profiles) do |_verified, snapshot|
-                  unless result == snapshot
-                    raise AttemptErrors::ReceiptRejected, "exported campaign result bytes differ from verified owner"
-                  end
-                  held.verify_unchanged!
-                  campaign_parent_candidate!(journal: journal, commit: commit, params: parent, map: original_map)
-                  unless @launch.send(:protected_descriptor_sha256!) == deployment_sha
-                    raise AttemptErrors::Conflict, "campaign consumer policy descriptor advanced"
-                  end
-                  value = yield
-                  held.verify_unchanged!
-                  unless @launch.send(:protected_descriptor_sha256!) == deployment_sha
-                    raise AttemptErrors::Conflict, "campaign consumer policy descriptor advanced"
-                  end
-                  value
-                end
-              end
-            end
-          end
-        rescue Ace::Review::Atoms::CampaignContract::Invalid, KeyError, TypeError, ArgumentError
-          raise AttemptErrors::ReceiptRejected, "canonical parent campaign evidence is unavailable"
-        end
-
-        def with_campaign_submission!(journal:, commit:, events:, params:, map:, admitted:, replay:)
-          receipt = admitted.fetch(:receipt)
-          return yield unless receipt["campaign"]
-          definition = @launch.preview_attempt_definition!(journal: journal, commit: commit, params: params, map: map)
-          unless definition.review_campaign
-            raise AttemptErrors::EvidenceUnavailable, "protected campaigns require their canonical owner"
-          end
-          reference = receipt.fetch("campaign").fetch("result")
-          index = receipt.fetch("artifacts").index(reference)
-          raise AttemptErrors::ReceiptRejected, "campaign result is not an uploaded artifact" unless index
-          result = JSON.parse(admitted.fetch(:artifacts).fetch(index), create_additions: false,
-            max_nesting: 64, allow_duplicate_key: false, allow_comments: false)
-          with_campaign_receipt!(journal: journal, commit: commit, events: events, params: params, map: map,
-            receipt: receipt, result: result, historical: !replay.nil?) { yield }
-        rescue JSON::ParserError
-          raise AttemptErrors::ReceiptRejected, "campaign result JSON is malformed"
-        end
-
-        # Service callers already retain with_assignment's original control SH
-        # and authority mutex through CAS. Round writers take the same keys EX
-        # before R1, so this read cannot invert with an admitted round writer.
-        def campaign_service_checks!(journal:, commit:, events:, params:, map:, current:)
-          definition = @launch.preview_attempt_definition!(journal: journal, commit: commit, params: params, map: map)
-          return true unless definition.review_campaign
-          parent = params.merge("head" => current.fetch("head"), "candidate_generation" => current.fetch("candidate_generation"))
-          result = verified_result(journal, events, parent, map, retained_origin(events, parent), current, commit)
-          unless result&.dig("receipt", "campaign") && result.dig("receipt", "verdict") == "succeeded"
-            raise AttemptErrors::ReceiptRejected, "ready or merge requires its canonical parent campaign result and executed checks"
-          end
-          with_campaign_finish!(journal: journal, commit: commit, events: events,
-            params: parent.merge("result_id" => result.fetch("result_id")), map: map) { true }
-        end
-
-        def with_campaign_finish!(journal:, commit:, events:, params:, map:)
-          record = events.find { |event| event["type"] == "result_submitted" && event.dig("payload", "result_id") == params["result_id"] }
-          return yield unless record&.dig("payload", "receipt", "campaign")
-          current = exact_candidate!(candidate(events), params)
-          payload = verified_result(journal, events, params, map, retained_origin(events, params), current, commit,
-            result_id: params.fetch("result_id"))
-          reference = payload.fetch("receipt").fetch("campaign").fetch("result")
-          canonical = Molecules::CanonicalEvidence.new(journal: journal)
-          bytes = canonical.read({"ref" => reference.fetch("path"), "sha256" => reference.fetch("sha256")},
-            **result_context(payload.fetch("binding")), commit: commit)
-          result = JSON.parse(bytes, create_additions: false, max_nesting: 64, allow_duplicate_key: false, allow_comments: false)
-          with_campaign_receipt!(journal: journal, commit: commit, events: events, params: params, map: map,
-            receipt: payload.fetch("receipt"), result: result, historical: false) { yield }
-        rescue JSON::ParserError
-          raise AttemptErrors::ReceiptRejected, "canonical campaign result JSON is malformed"
-        end
-
-        def dispatch_campaign_export(request:, peer:, role:, body: true)
-          params = request.fetch("params")
-          unless params.is_a?(Hash) && params.keys.sort == PARAMETERS.fetch("campaign_export_result").sort &&
-              params["head"].is_a?(String) && params["head"].match?(CandidateTransfer::SHA) &&
-              params["candidate_generation"].is_a?(Integer) && params["candidate_generation"].positive? && request["mutation_id"].nil?
-            raise ArgumentError, "campaign result selectors differ"
-          end
-          %w[mapping_id assignment_id attempt_id].each { |key| result_id!(params.fetch(key)) }
-          map = @deployment.mapping(params.fetch("mapping_id"))
-          raise AttemptErrors::UnauthorizedIdentity, "campaign project differs" unless map["project_id"] == request.fetch("project_id")
-          @launch.with_assignment(params: params, map: map, exclusive: true) do |journal, registration|
-            protected_journal!(journal)
-            commit = journal.ref_value
-            descriptor = @launch.send(:control_original_descriptor!, registration.fetch("lifecycle_control"))
-            original_map = descriptor.mapping(params.fetch("mapping_id"))
-            context = @launch.send(:control_registration_context!, params, original_map, journal, commit: commit)
-            events = @launch.preview_attempt_events!(journal: journal, commit: commit, params: params, map: original_map)
-            origin = active_origin(events, params)
-            role == :worker ? worker_or_launcher!(peer, role, original_map, origin) : finish_identity!(events, params, original_map, peer, role)
-            selected = CampaignExecution.validate_parent!(@launch.preview_attempt_definition!(journal: journal,
-              commit: commit, params: params, map: original_map).review_campaign)
-            return true unless body
-            parent = params.merge("scope" => origin.fetch("scope"), "base" => origin.fetch("base_head"))
-            campaign_parent_candidate!(journal: journal, commit: commit, params: parent, map: original_map)
-            current = exact_candidate!(candidate(events), params)
-            bundle = journal.bounded_blob(current.fetch("bundle_ref"), commit: commit, max_bytes: CandidateTransfer::MAX_BYTES)
-            project = descriptor.project(original_map.fetch("project_id"))
-            root = File.join(project.fetch("campaign_repository"), ".ace-local", "review", "candidate-views")
-            FileUtils.mkdir_p(root, mode: 0o700)
-            CandidateTransfer.new(root: root).with_campaign_repository(bytes: bundle, sha256: current.fetch("sha256"),
-              size: current.fetch("bytes"), head: current.fetch("head"), tree: current.fetch("tree"), base: parent.fetch("base")) do |candidate_reader|
-              manager = @launch.send(:campaign_manager_for!, context,
-                **campaign_execution_dependencies!(journal: journal, commit: commit, parent_params: parent, parent_map: original_map),
-                candidate_reader: candidate_reader)
-              result = manager.accepted_result_snapshot(selected.fetch("campaign_id"))
-              deployment_sha = @launch.send(:protected_descriptor_sha256!)
-              CampaignConsumerPolicy.new.with(@deployment.project(original_map.fetch("project_id")).fetch("campaign_policy")) do |profiles, held|
-              manager.with_verified_result!(result: result, **selected.slice("subject", "contract_identity", "policy").transform_keys(&:to_sym),
-                head: params.fetch("head"), base: parent.fetch("base"), producer: result.fetch("producer"), reviewer: result.fetch("reviewer"),
-                consumer_profiles: profiles) do
-                held.verify_unchanged!
-                unless @launch.send(:protected_descriptor_sha256!) == deployment_sha
-                  raise AttemptErrors::Conflict, "campaign export policy descriptor advanced"
-                end
-                campaign_parent_candidate!(journal: journal, commit: commit, params: parent, map: original_map)
-                bytes = JSON.generate(result).b
-                raise AttemptErrors::EvidenceUnavailable, "campaign result exceeds artifact bound" if bytes.bytesize > 64 * 1024
-                {data: {"campaign_id" => selected.fetch("campaign_id"), "result_identity" => result.fetch("result_identity"),
-                  "sha256" => Digest::SHA256.hexdigest(bytes), "bytes" => bytes.bytesize, "head" => params.fetch("head"),
-                  "candidate_generation" => params.fetch("candidate_generation"), "journal_commit" => commit},
-                  replayed: false, transfer_parts: [bytes]}
-              end
-              end
-            end
-          end
-        rescue Ace::Review::Atoms::CampaignContract::Invalid, KeyError, TypeError
-          raise AttemptErrors::EvidenceUnavailable, "canonical campaign result is unavailable"
-        end
-
-        def dispatch_campaign_round(request:, peer:, role:, transfer:)
-          params, map = campaign_round_request!(request)
-          admitted = CampaignRoundTransfer.decode(input: transfer, sha256: params.fetch("input_sha256"))
-          input = admitted.fetch(:round)
-          unless input["attempt_id"] == request.fetch("mutation_id") && input["head"] == params.fetch("head")
-            raise AttemptErrors::Conflict, "campaign round stable request or head differs"
-          end
-          @launch.with_assignment(params: params, map: map, exclusive: true) do |journal, registration|
-            protected_journal!(journal)
-            commit = journal.ref_value
-            descriptor = @launch.send(:control_original_descriptor!, registration.fetch("lifecycle_control"))
-            original_map = descriptor.mapping(params.fetch("mapping_id"))
-            context = @launch.send(:control_registration_context!, params, original_map, journal, commit: commit)
-            events = @launch.preview_attempt_events!(journal: journal, commit: commit, params: params, map: original_map)
-            origin = finish_identity!(events, params, original_map, peer, role)
-            selected = CampaignExecution.validate_parent!(@launch.preview_attempt_definition!(journal: journal,
-              commit: commit, params: params, map: original_map).review_campaign)
-            parent_params = params.merge("scope" => origin.fetch("scope"), "base" => input.fetch("base"))
-            project = descriptor.project(original_map.fetch("project_id"))
-            paths = CampaignRoundTransfer.materialize(admitted: admitted, repository: project.fetch("campaign_repository"),
-              request_id: request.fetch("mutation_id"))
-            dependencies = campaign_execution_dependencies!(journal: journal, commit: commit,
-              parent_params: parent_params, parent_map: original_map)
-            current = exact_candidate!(retained_candidate(events, params.fetch("candidate_generation")), params)
-            bundle = journal.bounded_blob(current.fetch("bundle_ref"), commit: commit, max_bytes: CandidateTransfer::MAX_BYTES)
-            quarantine = File.join(project.fetch("campaign_repository"), ".ace-local", "review", "candidate-views")
-            FileUtils.mkdir_p(quarantine, mode: 0o700)
-            transfer_owner = CandidateTransfer.new(root: quarantine)
-            transfer_owner.with_campaign_repository(bytes: bundle, sha256: current.fetch("sha256"), size: current.fetch("bytes"),
-              head: current.fetch("head"), tree: current.fetch("tree"), base: input.fetch("base")) do |candidate_reader|
-              manager = @launch.send(:campaign_manager_for!, context, **dependencies, artifact_paths: paths, candidate_reader: candidate_reader)
-              deployment_sha = @launch.send(:protected_descriptor_sha256!)
-              CampaignConsumerPolicy.new.with(@deployment.project(original_map.fetch("project_id")).fetch("campaign_policy")) do |profiles, held|
-                # The existing R1 store checks exact replay before fresh policy,
-                # and binds the complete supplied frame in its input_digest.
-                data = manager.record_round(selected.fetch("campaign_id"), input, source_digest: admitted.fetch(:sha256),
-                  expected_campaign: selected.reject { |key, _| key == "version" }, consumer_profiles: profiles,
-                  before_record: -> {
-                    held.verify_unchanged!
-                    campaign_parent_candidate!(journal: journal, commit: commit, params: parent_params, map: original_map)
-                    unless @launch.send(:protected_descriptor_sha256!) == deployment_sha
-                      raise AttemptErrors::Conflict, "campaign policy descriptor advanced"
-                    end
-                  })
-                held.verify_unchanged!
-                unless journal.ref_value == commit && @launch.send(:protected_descriptor_sha256!) == deployment_sha
-                  raise AttemptErrors::Conflict, "campaign round canonical selection advanced"
-                end
-                reply = data.slice("campaign_id", "recorded_complete", "completed_rounds", "accepted", "result_identity", "replayed")
-                  .merge("request_id" => request.fetch("mutation_id"), "round_id" => input.fetch("round_id"))
-                {data: reply, replayed: data["replayed"] == true}
-              end
-            end
-          end
-        rescue Ace::Review::Atoms::CampaignContract::Invalid, KeyError, TypeError
-          raise AttemptErrors::EvidenceUnavailable, "canonical campaign round is unavailable"
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/authority/endcap_contexts.rb

@@ -1,23 +0,0 @@
-# frozen_string_literal: true
-require "ace/herdr/molecules/inbox_context_client"
-
-module Ace
-  module Assign
-    module Authority
-      class Endcap
-        private
-
-        def with_inbox_context(params, map, mutation_id:)
-          context = @deployment.inbox_context(params.fetch("mapping_id"), params.fetch("inbox_context_id"))
-          @deployment.verify_inbox_context!(params.fetch("mapping_id"), params.fetch("inbox_context_id"))
-          client = @inbox_context_clients&.fetch(params.fetch("inbox_context_id"))
-          client ||= Ace::Herdr::Molecules::InboxContextClient.selected(context_id: params.fetch("inbox_context_id"),
-            socket_path: context.fetch("control_socket_path"), owner_credentials: context.fetch("owner_credentials"), kernel: @kernel)
-          yield client
-        rescue Ace::Runtime::RuntimeUnavailableError, Ace::Herdr::Error
-          raise AttemptErrors::EvidenceUnavailable, "protected inbox context is unavailable"
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/authority/endcap_inboxes.rb

@@ -1,37 +0,0 @@
-# frozen_string_literal: true
-
-module Ace
-  module Assign
-    module Authority
-      class Endcap
-        INBOX_REGISTRATION_FIELDS = %w[event_id attempt_id payload_sha256].freeze
-
-        private
-
-        def inbox_registration?(value)
-          value.is_a?(Hash) && value.keys.sort == INBOX_REGISTRATION_FIELDS.sort &&
-            %w[event_id attempt_id].all? { |key| value[key].is_a?(String) && Molecules::JournalMutation::ID.match?(value[key]) } &&
-            %w[payload_sha256].all? { |key| value[key].is_a?(String) && DIGEST.match?(value[key]) }
-        end
-
-        def inbox_native_lineage!(record, lineage)
-          workspace = lineage.native_event.fetch("payload").fetch("workspace_id")
-          original = record.fetch("origin_target")
-          binding = record.fetch("binding")
-          unless original.is_a?(Hash) && binding.is_a?(Hash) &&
-              original["session"] == workspace && binding["session"] == workspace
-            raise AttemptErrors::EvidenceUnavailable, "inbox original native workspace differs"
-          end
-          if lineage.child_event
-            child = lineage.child_event.fetch("payload").fetch("original_process_binding")
-            unless original.values_at("session", "pane", "terminal_id") == child.values_at("session", "pane", "terminal_id")
-              raise AttemptErrors::EvidenceUnavailable, "inbox original native child differs"
-            end
-          end
-          true
-        end
-
-      end
-    end
-  end
-end

data/lib/ace/assign/authority/endcap_prepared_work.rb

@@ -1,80 +0,0 @@
-# frozen_string_literal: true
-
-module Ace
-  module Assign
-    module Authority
-      class Endcap
-
-        def prepared_fetch?(request)
-          request["operation"] == "evidence_fetch" && %w[prepared_work campaign_candidate].include?(request.dig("params", "kind"))
-        end
-
-        def dispatch_prepared_fetch(request:, peer:, role:, body: true)
-          params = request.fetch("params")
-          unless request.fetch("mutation_id").nil? && params.is_a?(Hash) && params.keys.sort == PARAMETERS.fetch("evidence_fetch").sort &&
-              [%w[prepared_work original_prepared_work prepared_bundle],
-                %w[campaign_candidate original_campaign_candidate candidate_bundle]].include?(params.values_at("kind", "purpose_id", "artifact_id"))
-            raise ArgumentError, "prepared fetch envelope differs"
-          end
-          %w[mapping_id assignment_id attempt_id].each { |key| result_id!(params.fetch(key)) }
-          map = @deployment.mapping(params.fetch("mapping_id"))
-          raise AttemptErrors::UnauthorizedIdentity, "prepared project differs" unless map.fetch("project_id") == request.fetch("project_id")
-          raise AttemptErrors::UnauthorizedIdentity, "prepared fetch requires original worker" unless role == :worker
-          @kernel.live!(peer)
-          service_policy!.visible!(project: map.fetch("project_id"), uid: peer.fetch("uid"))
-          journal = @launch.send(:journal_for, map)
-          protected_journal!(journal)
-          commit = journal.ref_value
-          selected = @launch.original_prepared_registration!(journal: journal, params: params, commit: commit) do |original_map, state|
-            unless peer.values_at("uid", "gid", "groups") == original_map.values_at("worker_uid", "worker_gid", "worker_groups")
-              raise AttemptErrors::UnauthorizedIdentity, "prepared worker principal differs"
-            end
-            binding = state.fetch("process_binding")
-            @kernel.live!(binding.fetch("process_identity"))
-            @kernel.live!(binding.fetch("native_origin").fetch("server_identity"))
-            worker_or_launcher!(peer, role, original_map, state)
-          end
-          original_map = selected.fetch(:map)
-          registration = selected.fetch(:registration)
-          if params.fetch("kind") == "campaign_candidate"
-            definition = @launch.preview_attempt_definition!(journal: journal, commit: commit, params: params, map: original_map)
-            execution = definition.campaign_execution
-            raise AttemptErrors::UnauthorizedIdentity, "original worker is not a campaign child" unless execution
-            descriptor, candidate_bytes = campaign_prepared_candidate!(journal: journal, commit: commit, execution: execution, map: original_map)
-            return true unless body
-            unless journal.ref_value == commit
-              raise AttemptErrors::Conflict, "campaign original candidate selection advanced"
-            end
-            descriptor = descriptor.merge(params.slice("mapping_id", "assignment_id", "attempt_id"),
-              "project_id" => original_map.fetch("project_id"),
-              "original_worker_identity" => selected.fetch(:state).fetch("process_binding").fetch("process_identity"),
-              "original_worker_scratch_root" => selected.fetch(:original_worker_scratch_root),
-              "original_binding_digest" => selected.fetch(:original_binding_digest))
-            return {data: {"descriptor" => descriptor, "generation" => journal.authority_generation(selected.fetch(:events)),
-              "journal_commit" => commit}, replayed: false, transfer_parts: [candidate_bytes]}
-          end
-          return true unless body
-          reference = registration.fetch("prepared_work")
-          bytes = journal.bounded_blob(registration.fetch("prepared_bundle_ref"), commit: selected.fetch(:registration_commit), max_bytes: CandidateTransfer::MAX_BYTES)
-          unless bytes.is_a?(String) && bytes.bytesize == registration.fetch("prepared_bundle_bytes") &&
-              bytes.bytesize.between?(1, CandidateTransfer::MAX_BYTES) && Digest::SHA256.hexdigest(bytes) == registration.fetch("prepared_bundle_sha256")
-            raise AttemptErrors::EvidenceUnavailable, "original prepared bundle differs"
-          end
-          descriptor = reference.slice("task_id", "scope", "selection_sha256", "prepared_head", "prepared_tree", "manifest_bytes", "manifest_sha256").merge(
-            params.slice("mapping_id", "assignment_id", "attempt_id"), "version" => 1, "kind" => "prepared_work", "purpose" => "original_prepared_work", "artifact" => "prepared_bundle",
-            "project_id" => original_map.fetch("project_id"), "definition_digest" => registration.fetch("definition_digest"),
-            "task_context_entry" => registration.fetch("task_context_entry"),
-            "original_worker_identity" => selected.fetch(:state).fetch("process_binding").fetch("process_identity"),
-            "original_worker_scratch_root" => selected.fetch(:original_worker_scratch_root),
-            "workspace_exclusion" => selected.fetch(:workspace_exclusion),
-            "registration_generation" => registration.fetch("generation"), "registration_commit" => selected.fetch(:registration_commit),
-            "original_binding_digest" => selected.fetch(:original_binding_digest), "ref" => registration.fetch("prepared_bundle_ref"), "bytes" => bytes.bytesize,
-            "sha256" => registration.fetch("prepared_bundle_sha256"))
-          {data: {"descriptor" => descriptor, "generation" => journal.authority_generation(selected.fetch(:events)), "journal_commit" => commit}, replayed: false, transfer_parts: [bytes]}
-        rescue KeyError, TypeError
-          raise AttemptErrors::EvidenceUnavailable, "original prepared input is unavailable"
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/authority/endcap_publication.rb

@@ -1,41 +0,0 @@
-# frozen_string_literal: true
-
-module Ace
-  module Assign
-    module Authority
-      class Endcap
-        # The same held assignment owner authenticates the receiver and current
-        # candidate both before transfer and inside each canonical CAS attempt.
-        # Ordinary HITL uses this same original launch and project journal;
-        # no local assignment cache or caller-selected coordinator participates.
-        def with_worker_hitl!(assignment:, attempt:, project:, requester_uid:, peer: nil)
-          selected = @deployment.data.fetch("launch_mappings").select do |_id, map|
-            map.fetch("project_id") == project && map.fetch("worker_uid") == requester_uid
-          end
-          raise AttemptErrors::UnauthorizedIdentity, "HITL worker mapping is missing or ambiguous" unless selected.size == 1
-          mapping_id, map = selected.first
-          params = {"mapping_id" => mapping_id, "assignment_id" => assignment, "attempt_id" => attempt}
-          @launch.with_assignment(params: params, map: map) do |journal, _registration|
-            protected_journal!(journal)
-            events = attempt_events(journal, params)
-            origin = active_origin(events, params)
-            @launch.scope_open_for_effect!(events: events, params: params, map: map)
-            if peer
-              unless peer.values_at("uid", "gid", "groups") == map.values_at("worker_uid", "worker_gid", "worker_groups")
-                raise AttemptErrors::UnauthorizedIdentity, "HITL requester credentials differ"
-              end
-              @kernel.live!(peer)
-              worker_or_launcher!(peer, :worker, map, origin)
-            end
-            reverse = origin.fetch("process_binding").slice("session", "pane")
-            unless reverse.values.all? { |value| value.is_a?(String) && !value.empty? } && reverse.size == 2
-              raise AttemptErrors::EvidenceUnavailable, "HITL native reverse is unavailable"
-            end
-            yield settlement_immutable(reverse.merge("schema" => "ace.hitl.ref/v1"))
-          end
-        end
-
-      end
-    end
-  end
-end