ace-assign 0.71.0 → 0.73.0

data/lib/ace/assign/authority/endcap_reviews.rb

@@ -1,130 +0,0 @@
-# frozen_string_literal: true
-
-module Ace
-  module Assign
-    module Authority
-      class Endcap
-        private
-
-        # Historical assignment lookup stays separate: revocation removes
-        # permission, never the original receipt or response.
-        def active_review_reservation(events, current)
-          reservation = events.reverse.find do |event|
-            event["type"] == "authority_mutation" &&
-              %w[request_review assign_review].include?(event.dig("payload", "operation")) &&
-              !event.dig("payload", "mutation_id").to_s.start_with?("review-delegate.") &&
-              event.dig("payload", "data", "head") == current.fetch("head") &&
-              event.dig("payload", "data", "candidate_generation") == current.fetch("candidate_generation")
-          end
-          return unless reservation
-          cancelled = events.any? do |event|
-            event["type"] == "authority_mutation" && event.dig("payload", "operation") == "cancel_review" &&
-              event.dig("payload", "data", "review_event_id") == reservation.fetch("digest")
-          end
-          reservation unless cancelled
-        end
-
-        def active_review_event(events, current)
-          reservation = active_review_reservation(events, current)
-          return unless reservation
-          return reservation if reservation.dig("payload", "operation") == "assign_review"
-          events.find do |event|
-            event["type"] == "authority_mutation" && event.dig("payload", "operation") == "assign_review" &&
-              event.dig("payload", "mutation_id") == "review-delegate.#{reservation.fetch('digest')}"
-          end
-        end
-
-        # Reserved spelling is not authorization. Reconstruct the immutable
-        # request through the original-launcher reader before historical replay,
-        # then separately check the active reservation for a fresh mutation.
-        def delegated_review_request!(journal, events, request, params, peer, role)
-          mutation = request.fetch("mutation_id")
-          return unless mutation.is_a?(String) && mutation.start_with?("review-delegate.")
-          digest = mutation.delete_prefix("review-delegate.")
-          original = events.find { |event| event["digest"] == digest && event["type"] == "authority_mutation" &&
-            event.dig("payload", "operation") == "request_review" }
-          raise AttemptErrors::UnauthorizedIdentity, "delegation requires a canonical request" unless original
-          accepted = journal.mutation_result(original.dig("payload", "mutation_id"))
-          selectors = params.slice("mapping_id", "assignment_id", "attempt_id").merge(
-            "mutation_id" => original.dig("payload", "mutation_id"), "request_event_id" => digest,
-            "journal_commit" => accepted.fetch("journal_commit"),
-            "original_binding_digest" => original.dig("payload", "data", "original_binding_digest"))
-          intent = @launch.launch_review_intent!(request: request.merge("operation" => "launch_review_intent",
-            "mutation_id" => nil, "params" => selectors), peer: peer, role: role)
-          unless Atoms::EvidenceDigest.digest(intent.dig(:data, "assignment_params")) == Atoms::EvidenceDigest.digest(params)
-            raise AttemptErrors::UnauthorizedIdentity, "delegation differs from exact canonical request"
-          end
-          original
-        end
-
-        def cancel_review(request, params, map, peer, role, transfer)
-          raise ArgumentError, "review cancellation forbids upload" unless transfer.nil?
-          unless params["review_event_id"].is_a?(String) && params["review_event_id"].match?(/\A[0-9a-f]{64}\z/)
-            raise ArgumentError, "review cancellation selector differs"
-          end
-          @launch.with_assignment(params: params, map: map) do |journal, _registration|
-            protected_journal!(journal)
-            events = attempt_events(journal, params)
-            authenticate_review_cancellation!(events, params, map, peer, role)
-            result = journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
-              mutation_id: request.fetch("mutation_id"), operation: "cancel_review",
-              parameters_digest: Atoms::EvidenceDigest.digest(params), expected_generation: params.fetch("expected_generation"),
-              with_replay: true) do |current_events, _commit, _generation|
-              authenticate_review_cancellation!(current_events, params, map, peer, role)
-              current = exact_candidate!(candidate(current_events), params)
-              reservation = active_review_reservation(current_events, current)
-              unless reservation && reservation.fetch("digest") == params.fetch("review_event_id")
-                raise AttemptErrors::Conflict, "review reservation is no longer active"
-              end
-              {data: current.slice("head", "candidate_generation").merge(
-                "review_event_id" => reservation.fetch("digest"),
-                "review_id" => active_review_event(current_events, current)&.dig("payload", "data", "review_id"), "state" => "cancelled")}
-            end
-            review_event_reply(journal, result, request, params, "cancellation_event_id")
-          end
-        end
-
-        def review_event_reply(journal, result, request, params, field)
-          accepted = journal.read_events(params.fetch("assignment_id"), commit: result.fetch(:data).fetch("journal_commit")).find do |event|
-            event["attempt_id"] == params.fetch("attempt_id") && event["type"] == "authority_mutation" &&
-              event.dig("payload", "operation") == request.fetch("operation") &&
-              event.dig("payload", "mutation_id") == request.fetch("mutation_id")
-          end
-          raise AttemptErrors::EvidenceUnavailable, "accepted review event is unavailable" unless accepted
-          result.merge(data: result.fetch(:data).merge(field => accepted.fetch("digest")))
-        end
-
-        def authenticate_review_cancellation!(events, params, map, peer, role)
-          origin = active_origin(events, params)
-          @kernel.live!(peer)
-          original = events.find { |event| event["digest"] == params.fetch("review_event_id") }
-          unless original && original["type"] == "authority_mutation" &&
-              %w[request_review assign_review].include?(original.dig("payload", "operation")) &&
-              !original.dig("payload", "mutation_id").to_s.start_with?("review-delegate.") &&
-              original.dig("payload", "data", "head") == params.fetch("head") &&
-              original.dig("payload", "data", "candidate_generation") == params.fetch("candidate_generation")
-            raise AttemptErrors::UnauthorizedIdentity, "review cancellation requires the exact reservation root"
-          end
-          if role == :launcher
-            unless @kernel.same?(origin.fetch("launcher_identity"), peer)
-              raise AttemptErrors::UnauthorizedIdentity, "cancellation requires original launcher birth"
-            end
-            worker_or_launcher!(peer, role, map, origin, launcher_only: true)
-          elsif role == :reviewer && original.dig("payload", "operation") == "request_review"
-            project = @deployment.project(map.fetch("project_id"))
-            credentials = project.fetch("peer_credentials")[peer.fetch("uid").to_s]
-            principal = peer.slice("uid", "gid", "groups").merge("role" => "reviewer")
-            unless project.fetch("reviewer_uids").include?(peer.fetch("uid")) && peer.fetch("uid") != map.fetch("worker_uid") &&
-                credentials && peer.values_at("gid", "groups") == credentials.values_at("gid", "groups") &&
-                Atoms::EvidenceDigest.digest(principal) == Atoms::EvidenceDigest.digest(original.dig("payload", "data", "requester"))
-              raise AttemptErrors::UnauthorizedIdentity, "cancellation requires the original mapped requester"
-            end
-          else
-            raise AttemptErrors::UnauthorizedIdentity, "review reservation cancellation is unauthorized"
-          end
-          original
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/authority/endcap_service_context.rb

@@ -1,38 +0,0 @@
-# frozen_string_literal: true
-
-module Ace
-  module Assign
-    module Authority
-      # Protected admission remains here. The shared fixed service transitions
-      # never manufacture a Deployment mapping or a protected launch origin.
-      class Endcap
-        include FixedServiceLifecycle
-        include FixedPublicationLifecycle
-
-        private
-
-        def with_service_scope(**options, &block) = @launch.with_assignment(**options, &block)
-        def service_journal!(journal) = protected_journal!(journal)
-        def service_mapping!(id) = @deployment.mapping(id)
-        def service_project!(id) = @deployment.project(id)
-        def service_scope_open!(**options) = @launch.scope_open_for_effect!(**options)
-        def service_preview_events!(**options) = @launch.preview_attempt_events!(**options)
-        def service_origin!(events, params) = active_origin(events, params)
-
-        def service_origin_fields!(origin)
-          {"worker_process_binding" => origin.fetch("process_binding").fetch("process_identity"),
-            "launch_ticket" => origin.fetch("launch_ticket"),
-            "reservation_generation" => origin.fetch("reservation_generation")}
-        end
-
-        def service_origin_matches!(record, origin)
-          expected = service_origin_fields!(origin)
-          record.slice(*expected.keys) == expected
-        end
-
-        def service_worker!(*args, **options) = worker_or_launcher!(*args, **options)
-        def service_review!(*args, **options) = approved_review!(*args, **options)
-      end
-    end
-  end
-end

data/lib/ace/assign/authority/endcap_service_settlement.rb

@@ -1,152 +0,0 @@
-# frozen_string_literal: true
-
-module Ace
-  module Assign
-    module Authority
-      class Endcap
-        private
-
-        def authorize_service_settlement!(request, params, map, peer, role)
-          @launch.with_assignment(params: params, map: map) do |journal, _registration|
-            protected_journal!(journal)
-            service_settlement_record!(journal, params, map, peer, role)
-          end
-          true
-        end
-
-        def service_settlement_record!(journal, params, map, peer, role, record: nil)
-          record ||= journal.service_request(params.fetch("request_id"))
-          raise AttemptErrors::NotFound, "canonical service request is missing" unless record
-          service_executor!(peer, role, record)
-          receiver = service_receiver!(peer, role, map, record.fetch("service_id"))
-          credentials = @deployment.project(map.fetch("project_id")).fetch("peer_credentials").fetch(peer.fetch("uid").to_s)
-          unless peer["gid"] == credentials.fetch("gid") && peer["groups"] == credentials.fetch("groups") &&
-              receiver.fetch("executor_uid") == record.fetch("executor_uid") &&
-              %w[assignment_id attempt_id mapping_id].all? { |key| record[key] == params[key] } &&
-              record["project_id"] == map.fetch("project_id") && record["candidate_head"] == params.fetch("head") &&
-              record["candidate_generation"] == params.fetch("candidate_generation") &&
-              %w[issued dispatch_started].include?(record["dispatch_phase"])
-            raise AttemptErrors::UnauthorizedIdentity, "original service settlement identity differs"
-          end
-          # The normal protected binding validates original ticket/claim, even
-          # while effect policy, worker liveness or current candidate changed.
-          ServiceEvidence.new(journal: journal).context(record)
-          record
-        rescue KeyError
-          raise AttemptErrors::EvidenceUnavailable, "original service settlement binding is incomplete"
-        end
-
-        def dispatch_service_settlement(request, params, map, peer, role, transfer)
-          authorize_service_settlement!(request, params, map, peer, role)
-          completion = request.fetch("operation") == "complete_no_effect"
-          admitted = completion && ReceiptTransfer.decode(input: transfer, receipt_sha256: params.fetch("receipt_sha256"),
-            artifact_field: "evidence", reference_key: "ref")
-          @launch.with_assignment(params: params, map: map) do |journal, _registration|
-            record = service_settlement_record!(journal, params, map, peer, role)
-            no_effect_completion_binding!(record, params, admitted) if completion
-            journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
-              mutation_id: request.fetch("mutation_id"), operation: request.fetch("operation"),
-              parameters_digest: Atoms::EvidenceDigest.digest(params),
-              expected_generation: completion ? nil : params.fetch("expected_generation"),
-              generation_mode: completion ? :recorded_completion : :expected, with_replay: true) do |events, commit, generation|
-              current = service_settlement_record!(journal, params, map, peer, role)
-              if completion
-                no_effect_completion_plan(journal, events, current, params, admitted)
-              else
-                service_challenge_plan(journal, events, current, params, map, generation, commit)
-              end
-            end
-          end
-        end
-
-        def service_challenge_projection(record)
-          record.slice("request_id", "state", "dispatch_ticket_id", "claim_binding", "dispatch_phase").merge(
-            "reconciliation_challenge" => %w[succeeded failed-settled].include?(record.fetch("state")) ? nil :
-              record.slice("no_effect_challenge", "challenge_generation", "challenge_event_digest"))
-        end
-
-        def service_challenge_plan(journal, events, record, params, map, generation, commit)
-          lineage = Molecules::ExecutionScopeLineage.new(events: events, project_id: map.fetch("project_id"),
-            assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"), mapping_id: params.fetch("mapping_id"))
-          unless lineage.sealed? && lineage.binding && record["reservation_generation"] == lineage.binding.fetch("reservation_generation")
-            raise AttemptErrors::Conflict, "original service generation is not sealed"
-          end
-          return {data: service_challenge_projection(record)} if %w[succeeded failed-settled].include?(record.fetch("state"))
-          unless %w[uncertain failed].include?(record.fetch("state"))
-            raise AttemptErrors::EvidenceUnavailable, "original protected request has no uncertainty outcome"
-          end
-          if record["challenge_event_digest"]
-            begin
-              ServiceEvidence.new(journal: journal).challenge!(record, pending: {commit: commit})
-              return {data: service_challenge_projection(record)}
-            rescue AttemptErrors::EvidenceUnavailable
-              # Only a positively authenticated later failure may supersede a
-              # challenge. Corrupt/missing old history never becomes freshness.
-              old = ServiceEvidence.new(journal: journal).challenge!(record, pending: {commit: commit}, current: false)
-              raise unless events.drop_while { |event| event["digest"] != old.fetch("digest") }.drop(1).any? do |event|
-                %w[service_claim service_transition].include?(event["type"]) && event.dig("payload", "request_id") == record.fetch("request_id") &&
-                  %w[uncertain failed].include?(event.dig("payload", "state"))
-              end
-            end
-          end
-          failure = events.reverse.find { |event| %w[service_claim service_transition].include?(event["type"]) &&
-            event.dig("payload", "request_id") == record.fetch("request_id") && %w[uncertain failed].include?(event.dig("payload", "state")) }
-          raise AttemptErrors::EvidenceUnavailable, "canonical service failure is missing" unless failure
-          failure_prefix = events.take_while { |event| event["digest"] != failure.fetch("digest") }
-          payload = record.slice("request_id", "input_digest", "claim_binding", "dispatch_ticket_id").merge(
-            "version" => 1, "no_effect_challenge" => SecureRandom.hex(16), "challenge_generation" => generation + 1,
-            "failure_event_digest" => failure.fetch("digest"), "failure_generation" => journal.authority_generation(failure_prefix) + 1)
-          recorded_at = Time.now.utc
-          challenge = Models::EvidenceEvent.build(type: "service_no_effect_challenge", attempt_id: params.fetch("attempt_id"),
-            payload: payload, previous_digest: events.last&.fetch("digest"), recorded_at: recorded_at)
-          replacement = record.merge(payload.slice("no_effect_challenge", "challenge_generation"), "challenge_event_digest" => challenge.fetch("digest"))
-          {events: [{type: "service_no_effect_challenge", payload: payload, recorded_at: recorded_at}],
-            data: service_challenge_projection(replacement), service_updates: [{request_id: record.fetch("request_id"),
-              expected: record, replacement: replacement, event_type: "service_challenge"}]}
-        end
-
-        def no_effect_completion_binding!(record, params, admitted)
-          selector = params.fetch("reconciliation_challenge")
-          unless selector.is_a?(Hash) && selector.keys.sort == %w[no_effect_challenge challenge_generation challenge_event_digest].sort &&
-              selector["no_effect_challenge"].is_a?(String) && selector["no_effect_challenge"].match?(/\A[0-9a-f]{32}\z/) &&
-              selector["challenge_generation"].is_a?(Integer) && selector["challenge_generation"].positive? &&
-              selector["challenge_event_digest"].is_a?(String) && selector["challenge_event_digest"].match?(/\A[0-9a-f]{64}\z/)
-            raise ArgumentError, "no-effect challenge selector is malformed"
-          end
-          unless selector.all? { |key, value| record[key] == value } && record["claim_binding"] == params.fetch("claim_binding")
-            raise AttemptErrors::Conflict, "no-effect challenge or claim differs"
-          end
-          receipt = admitted.fetch(:receipt)
-          unless receipt.keys.sort == Molecules::EvidenceJournal::TERMINAL_RECEIPT_FIELDS.sort && receipt["outcome"] == "failed" &&
-              Molecules::EvidenceJournal::TERMINAL_BINDING_FIELDS.all? { |field| receipt[field] == record[field] }
-            raise AttemptErrors::ReceiptRejected, "no-effect receipt original binding differs"
-          end
-          digest = Atoms::EvidenceDigest.digest("challenge" => selector, "receipt_sha256" => admitted.fetch(:receipt_sha256),
-            "artifacts" => admitted.fetch(:artifacts).map { |bytes| Digest::SHA256.hexdigest(bytes) })
-          if record["state"] == "succeeded" || record["no_effect_completion_digest"] && record["no_effect_completion_digest"] != digest
-            raise AttemptErrors::Conflict, "no-effect completion contradicts retained outcome"
-          end
-          digest
-        end
-
-        def no_effect_completion_plan(journal, events, record, params, admitted)
-          digest = no_effect_completion_binding!(record, params, admitted)
-          return {data: service_projection(record)} if record["no_effect_completion_digest"]
-          owner = ServiceEvidence.new(journal: journal)
-          challenge = owner.challenge!(record)
-          if record["operation"] == "prune-preserved-workspace"
-            owner.cleanup_inspection_inputs!(admitted.fetch(:artifacts), record, challenge)
-          else
-            admitted.fetch(:artifacts).each { |bytes| owner.inspection!(bytes, record, challenge) }
-          end
-          plan = Molecules::CanonicalEvidence.new(journal: journal).import_plan(**owner.context(record, no_effect: true),
-            artifacts: admitted.fetch(:artifacts), admitted_after_event_digest: challenge.fetch("digest"))
-          receipt = admitted.fetch(:receipt).merge("evidence" => plan.fetch(:references))
-          replacement = record.merge("state" => "failed-settled", "receipt" => receipt, "no_effect_completion_digest" => digest)
-          plan.merge(data: service_projection(replacement), service_updates: [{request_id: record.fetch("request_id"),
-            expected: record, replacement: replacement, event_type: "service_transition"}])
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/authority/evidence_transfer.rb

@@ -1,67 +0,0 @@
-# frozen_string_literal: true
-
-require "digest"
-require_relative "private_directory"
-require_relative "../molecules/canonical_evidence"
-
-module Ace
-  module Assign
-    module Authority
-      # Receiver-side collection from its own fixed private handler staging.
-      # These bytes are transport input, not accepted evidence. The authority
-      # must import them through CanonicalEvidence in its terminal mutation.
-      module EvidenceTransfer
-        module_function
-
-        def read_staged(root:, evidence:)
-          root = PrivateDirectory.verify!(root)
-          limits = Molecules::CanonicalEvidence
-          unless evidence.is_a?(Array) && evidence.length.between?(1, limits::MAX_ARTIFACTS)
-            reject!("Invalid staged evidence count")
-          end
-          total = 0
-          evidence.map do |reference|
-            unless reference.is_a?(Hash) && reference.keys.sort == %w[ref sha256] &&
-                reference["ref"].is_a?(String) && reference["ref"].match?(%r{\A[a-zA-Z0-9_.-]+(?:/[a-zA-Z0-9_.-]+)*\z}) &&
-                reference["ref"].bytesize <= 256 &&
-                reference["ref"].split("/").none? { |part| %w[. ..].include?(part) } &&
-                reference["sha256"].is_a?(String) && reference["sha256"].match?(/\A[0-9a-f]{64}\z/)
-              reject!("Invalid staged evidence binding")
-            end
-            path = root
-            parts = reference.fetch("ref").split("/")
-            parts[0...-1].each do |part|
-              path = File.join(path, part)
-              stat = File.lstat(path)
-              unless stat.directory? && !stat.symlink? && stat.uid == Process.uid && (stat.mode & 0022).zero?
-                reject!("Staged evidence ancestry is not private")
-              end
-            end
-            path = File.join(path, parts.last)
-            File.open(path, File::RDONLY | File::NOFOLLOW | File::NONBLOCK) do |file|
-              stat = file.stat
-              unless stat.file? && stat.uid == Process.uid && stat.nlink == 1 &&
-                  (stat.mode & 0022).zero? && stat.size <= limits::MAX_ARTIFACT_BYTES
-                reject!("Staged evidence is not a bounded private regular file")
-              end
-              bytes = (file.read(limits::MAX_ARTIFACT_BYTES + 1) || "").b
-              total += bytes.bytesize
-              unless bytes.bytesize <= limits::MAX_ARTIFACT_BYTES && total <= limits::MAX_TOTAL_BYTES &&
-                  Digest::SHA256.hexdigest(bytes) == reference["sha256"]
-                reject!("Staged evidence bytes differ or exceed limits")
-              end
-              bytes
-            end
-          end
-        rescue SystemCallError
-          reject!("Staged evidence is unavailable or substituted")
-        end
-
-        def reject!(message)
-          raise AttemptErrors::ReceiptRejected, message
-        end
-        private_class_method :reject!
-      end
-    end
-  end
-end