ace-assign 0.71.0 → 0.73.0

data/lib/ace/assign/authority/fixed_service_lifecycle.rb

@@ -1,594 +0,0 @@
-# frozen_string_literal: true
-
-module Ace
-  module Assign
-    module Authority
-      module FixedServiceLifecycle
-        SERVICE_IDENTITY = %w[request_id assignment_id attempt_id project_id operation input_digest target
-          authorization service_id caller_uid candidate_head candidate_generation executor_uid transport policy_digest
-          worker_process_binding launch_ticket reservation_generation mapping_id].freeze
-
-        # Source-owned terminal admission. Caller already owns lifecycle/journal
-        # exclusion; the immutable commit is the current CAS input, never a
-        # caller-selected alternate evidence ref.
-        def service_settlement_complete!(journal:, events:, params:, map:, commit:)
-          service_settlement_evidence!(journal: journal, events: events, params: params, map: map, commit: commit)
-          true
-        end
-
-        def service_settlement_evidence!(journal:, events:, params:, map:, commit:)
-          service_journal!(journal)
-          journal.verify_commit!(commit)
-          retained = journal.read_events(params.fetch("assignment_id"), commit: commit)
-            .select { |event| event["attempt_id"] == params.fetch("attempt_id") }
-          unless retained == events && Models::EvidenceEvent.chain_valid?(events)
-            raise AttemptErrors::EvidenceUnavailable, "service settlement requires exact canonical commit"
-          end
-          references = events.select { |event| %w[service_claim service_transition].include?(event["type"]) }
-            .map { |event| event.fetch("payload").fetch("request_id") }.uniq.sort
-          records = journal.service_request_records(commit: commit).select do |record|
-            record["assignment_id"] == params.fetch("assignment_id") && record["attempt_id"] == params.fetch("attempt_id")
-          end
-          unless records.map { |record| record.fetch("request_id") }.uniq.sort == references
-            raise AttemptErrors::EvidenceUnavailable, "canonical service request set is incomplete"
-          end
-          pending = false
-          projected = records.sort_by { |record| record.fetch("request_id") }.map do |record|
-            unless record["project_id"] == map.fetch("project_id") && record["mapping_id"] == params.fetch("mapping_id")
-              raise AttemptErrors::EvidenceUnavailable, "canonical service request is not settled for this scope"
-            end
-            # This existing reader verifies the accepted record digest and all
-            # imported terminal/no-effect evidence against this exact commit.
-            verified = journal.service_request(record.fetch("request_id"), commit: commit)
-            unless verified == record && %w[accepted uncertain rejected succeeded failed failed-settled].include?(verified.fetch("state"))
-              raise AttemptErrors::EvidenceUnavailable, "canonical service record differs"
-            end
-            if %w[no_effect_challenge challenge_generation challenge_event_digest].any? { |key| verified.key?(key) }
-              ServiceEvidence.new(journal: journal).challenge!(verified, pending: {commit: commit}, current: false)
-            end
-            unless %w[succeeded failed-settled].include?(verified.fetch("state"))
-              pending = true
-              next
-            end
-            transition = events.reverse.find { |event| %w[service_claim service_transition].include?(event["type"]) &&
-              event.dig("payload", "request_id") == record.fetch("request_id") }
-            receipt = verified.fetch("receipt")
-            unless transition && transition["type"] == "service_transition" &&
-                transition.dig("payload", "state") == verified.fetch("state") &&
-                transition.dig("payload", "record_digest") == Atoms::EvidenceDigest.digest(verified) &&
-                transition.dig("payload", "receipt_digest") == Atoms::EvidenceDigest.digest(receipt)
-              raise AttemptErrors::EvidenceUnavailable, "accepted service terminal transition differs"
-            end
-            {"request_id" => verified.fetch("request_id"), "state" => verified.fetch("state"),
-              "event_digest" => transition.fetch("digest"), "record_digest" => transition.dig("payload", "record_digest"),
-              "receipt_digest" => transition.dig("payload", "receipt_digest"),
-              "evidence_refs" => receipt.fetch("evidence").sort_by { |ref| ref.values_at("ref", "sha256") }}
-          end
-          projected.compact!
-          unless projected.empty?
-            journal.event_commits!(assignment_id: params.fetch("assignment_id"),
-              event_digests: projected.map { |row| row.fetch("event_digest") }, commit: commit)
-          end
-          if pending
-            raise AttemptErrors::ServiceSettlementPending, "authenticated canonical service requests remain unsettled"
-          end
-          settlement_immutable({"commit" => commit, "services" => projected})
-        rescue KeyError, TypeError, ArgumentError, NoMethodError, AttemptErrors::ReceiptRejected
-          raise AttemptErrors::EvidenceUnavailable, "canonical service settlement is unverifiable"
-        end
-
-        # Called only by the installed journal composition, including lower
-        # service writers. It never reacquires lifecycle/authority locks.
-        def authorize_service_update!(journal:, existing:, replacement:, pending:)
-          service_journal!(journal)
-          if existing && existing.key?("executor_process_binding") &&
-              Atoms::EvidenceDigest.digest(existing.fetch("executor_process_binding")) != Atoms::EvidenceDigest.digest(replacement["executor_process_binding"])
-            raise AttemptErrors::InvalidState, "original cleanup executor cannot change"
-          end
-          if existing && existing.key?("operation_owner_binding") &&
-              Atoms::EvidenceDigest.digest(existing.fetch("operation_owner_binding")) != Atoms::EvidenceDigest.digest(replacement["operation_owner_binding"])
-            raise AttemptErrors::InvalidState, "original cleanup dispatch owner cannot change"
-          end
-          if existing && %w[no_effect_challenge challenge_generation challenge_event_digest].any? { |key| existing[key] != replacement[key] }
-            unless pending && pending[:operation] == "claim_service_settlement" &&
-                existing["state"] == replacement["state"] && existing["receipt"] == replacement["receipt"] &&
-                existing["dispatch_phase"] == replacement["dispatch_phase"]
-              raise AttemptErrors::InvalidState, "no-effect challenge requires its fixed source owner"
-            end
-            ServiceEvidence.new(journal: journal).challenge!(replacement, pending: pending)
-          end
-          initial = existing.nil? && %w[accepted uncertain].include?(replacement["state"])
-          if initial && (replacement.key?("operation_owner_binding") || replacement.key?("executor_process_binding"))
-            raise AttemptErrors::InvalidState, "cleanup owner identity requires fresh dispatch admission"
-          end
-          begin_dispatch = existing && existing["dispatch_phase"] == "issued" && replacement["dispatch_phase"] == "dispatch_started"
-          if existing && existing["operation"] == "publish" && pending && %w[publication_challenge publication_continue].include?(pending[:operation])
-            return authorize_publication_update!(journal: journal, existing: existing, replacement: replacement, pending: pending)
-          end
-          if existing && existing["dispatch_phase"] != replacement["dispatch_phase"] && !begin_dispatch
-            raise AttemptErrors::InvalidState, "invalid protected dispatch phase change"
-          end
-          return true unless initial || begin_dispatch
-          unless replacement["state"] == "uncertain" && (initial ? replacement["dispatch_phase"] == "issued" : true)
-            raise AttemptErrors::InvalidState, "fresh protected effect requires an uncertain dispatch ticket"
-          end
-          bytes = pending && pending.fetch(:service_inputs, {})[replacement.fetch("request_id")]
-          raise AttemptErrors::UnauthorizedIdentity, "fresh service effect requires its exact original input" unless bytes.is_a?(String)
-          map = service_mapping!(replacement.fetch("mapping_id"))
-          unless replacement["project_id"] == map["project_id"] && replacement["caller_uid"] == map["worker_uid"]
-            raise AttemptErrors::UnauthorizedIdentity, "protected service mapping differs"
-          end
-          params = replacement.slice("mapping_id", "assignment_id", "attempt_id", "candidate_generation").merge("head" => replacement.fetch("candidate_head"))
-          events = pending.fetch(:current_events)
-          service_scope_open!(events: events, params: params, map: map)
-          origin = service_origin!(events, params)
-          unless service_origin_matches!(replacement, origin)
-            raise AttemptErrors::UnauthorizedIdentity, "protected service origin differs"
-          end
-          receiver = service_project!(map.fetch("project_id")).fetch("service_receivers").fetch(replacement.fetch("service_id"))
-          raise AttemptErrors::UnauthorizedIdentity, "protected service executor differs" unless receiver.fetch("executor_uid") == replacement.fetch("executor_uid")
-          current = exact_candidate!(candidate(events), params)
-          service_review!(journal, events, params, map, current, service_operation: replacement.fetch("operation")) unless %w[create update].include?(replacement.fetch("operation"))
-          service_policy!.prepare!(replacement, input_bytes: bytes)
-          if begin_dispatch && %w[prune-preserved-workspace publish].include?(replacement.fetch("operation"))
-            executor = replacement.fetch("executor_process_binding")
-            boot = replacement.fetch("worker_process_binding").fetch("started_at").split(":").fetch(1)
-            Molecules::ExecutionScopeLineage.validate_process_identity!(executor, boot_id: boot)
-            credentials = service_project!(map.fetch("project_id")).fetch("peer_credentials").fetch(receiver.fetch("executor_uid").to_s)
-            unless executor.slice("uid", "gid", "groups") == credentials.slice("gid", "groups").merge("uid" => receiver.fetch("executor_uid"))
-              raise AttemptErrors::UnauthorizedIdentity, "original cleanup executor credentials differ"
-            end
-            @kernel.live!(executor)
-            unless replacement["operation"] != "prune-preserved-workspace" || Atoms::EvidenceDigest.digest(service_policy!.dispatch_owner_binding!(replacement)) ==
-                Atoms::EvidenceDigest.digest(replacement.fetch("operation_owner_binding"))
-              raise AttemptErrors::UnauthorizedIdentity, "fixed cleanup owner changed before dispatch acceptance"
-            end
-          end
-          true
-        rescue KeyError
-          raise AttemptErrors::UnauthorizedIdentity, "protected service admission context is incomplete"
-        end
-
-        private
-
-        def settlement_immutable(value)
-          case value
-          when Hash then value.each_with_object({}) { |(key, item), result| result[key.dup.freeze] = settlement_immutable(item) }.freeze
-          when Array then value.map { |item| settlement_immutable(item) }.freeze
-          when String then value.dup.freeze
-          else value.freeze
-          end
-        end
-
-        def authorize_service_transfer!(request, params, map, peer, role)
-          service_policy!
-          service_policy!.visible!(project: map.fetch("project_id"), uid: map.fetch("worker_uid")) unless request.fetch("operation") == "complete_service"
-          with_service_scope(params: params, map: map) do |journal, _registration|
-            service_journal!(journal)
-            if request.fetch("operation") == "request_service"
-              existing = journal.service_request(params.fetch("request_id"))
-              if existing
-                service_executor!(peer, role, existing)
-                service_replay_binding!(existing, params, map)
-              else
-                events = attempt_events(journal, params)
-                origin = service_origin!(events, params)
-                service_worker!(params.fetch("worker_process_binding"), :worker, map, origin)
-                service_receiver!(peer, role, map, params.fetch("service_id"))
-              end
-            else
-              record = journal.service_request(params.fetch("request_id"))
-              raise AttemptErrors::NotFound, "service request is unavailable" unless record
-              service_executor!(peer, role, record)
-              service_ticket!(record, params, map, peer)
-            end
-          end
-          true
-        end
-
-        # Receiver identity and forwarded worker identity are independent checks.
-        # This immutable observation grants no service claim or dispatch permit.
-        def workspace_prune_preview_context(_request, params, map, peer, role, transfer)
-          raise ArgumentError, "preview context forbids upload" unless transfer.nil?
-          with_service_scope(params: params, map: map) do |journal, _registration|
-            {data: workspace_prune_preview_context_at!(journal: journal, params: params, map: map, peer: peer, role: role), replayed: false}
-          end
-        end
-
-        # Only source composition supplies this fixed journal/snapshot owner.
-        # Both ordinary admission and the root read-only view use the same
-        # original registration, process and candidate proof implementation.
-        public
-
-        def workspace_prune_preview_context_at!(journal:, params:, map:, peer:, role:)
-          service_policy!.visible!(project: map.fetch("project_id"), uid: map.fetch("worker_uid"))
-          service_journal!(journal)
-          commit = journal.ref_value
-          events = service_preview_events!(journal: journal, commit: commit, params: params, map: map)
-          origin = service_origin!(events, params)
-          service_worker!(params.fetch("worker_process_binding"), :worker, map, origin)
-          receiver = service_receiver!(peer, role, map, params.fetch("service_id"))
-          service_policy!.workspace_prune_receiver!(project: map.fetch("project_id"), uid: map.fetch("worker_uid"),
-            service_id: params.fetch("service_id"), executor_uid: receiver.fetch("executor_uid"))
-          selected = candidate(events)
-          unless selected && selected["head"].is_a?(String) && selected["head"].match?(CandidateTransfer::SHA) &&
-              selected["candidate_generation"].is_a?(Integer) && selected["candidate_generation"].positive?
-            raise AttemptErrors::EvidenceUnavailable, "preview candidate is unavailable"
-          end
-          data = {
-            "journal_commit" => commit,
-            "maintenance" => params.slice("mapping_id", "assignment_id", "attempt_id").merge("project_id" => map.fetch("project_id")),
-            "head" => selected.fetch("head"), "candidate_generation" => selected.fetch("candidate_generation"),
-            "worker_process_binding" => service_origin_fields!(origin).fetch("worker_process_binding"),
-            "caller_process_binding" => params.fetch("worker_process_binding")
-          }
-          raise AttemptErrors::Conflict, "preview canonical selection changed" unless journal.ref_value == commit
-          raise AttemptErrors::EvidenceUnavailable, "preview context exceeds bound" if JSON.generate(data).bytesize > 16_384
-          Atoms::EvidenceDigest.digest(data) # Reject unsupported transport values before copying.
-          JSON.parse(JSON.generate(data))
-        end
-
-        private
-
-        def service_status(_request, params, map, peer, role)
-          with_service_scope(params: params, map: map) do |journal, _registration|
-            service_journal!(journal)
-            commit = journal.ref_value
-            read = role == :executor && journal.service_settlement_read(params.fetch("request_id"), commit: commit)
-            record = read ? read.fetch(:record) : journal.service_request(params.fetch("request_id"), commit: commit)
-            unless record && record["assignment_id"] == params["assignment_id"] && record["attempt_id"] == params["attempt_id"] &&
-                record["project_id"] == map["project_id"] && record["candidate_head"] == params["head"] &&
-                record["candidate_generation"] == params["candidate_generation"]
-              raise AttemptErrors::UnauthorizedIdentity, "service status binding differs"
-            end
-            if role != :executor && %w[no_effect_challenge challenge_generation challenge_event_digest].any? { |key| record.key?(key) }
-              ServiceEvidence.new(journal: journal).challenge!(record, pending: {commit: commit}, current: false)
-            end
-            selected = read ? read.fetch(:read_view).inventory.fetch("events").fetch(params.fetch("assignment_id")) :
-              journal.read_events(params.fetch("assignment_id"), commit: commit)
-            events = selected.select { |event| event.fetch("attempt_id") == params.fetch("attempt_id") }
-            @kernel.live!(peer)
-            service_policy!.visible!(project: map.fetch("project_id"), uid: peer.fetch("uid"))
-            if role == :executor
-              record = service_settlement_record!(journal, params, map, peer, role, record: record)
-            else
-              authorized = case role
-              when :worker
-                peer["uid"] == record["caller_uid"] && @kernel.descendant?(peer, record.fetch("worker_process_binding"))
-              when :reviewer
-                review = assigned_review(events)
-                review && review["reviewer_uid"] == peer["uid"] && review["head"] == params["head"] &&
-                  review["candidate_generation"] == params["candidate_generation"] && @kernel.descendant?(peer, review.fetch("reviewer_process_binding"))
-              when :supervisor
-                service_project!(map.fetch("project_id")).fetch("supervisor_uids").include?(peer["uid"])
-              else
-                false
-              end
-              raise AttemptErrors::UnauthorizedIdentity, "service status purpose differs" unless authorized
-            end
-            data = service_projection(record).merge("generation" => journal.authority_generation(events),
-              "journal_commit" => commit)
-            data["input_digest"] = record.fetch("input_digest") if %w[create update ready merge].include?(record["operation"])
-            if %w[create update ready merge].include?(record["operation"]) && record["state"] == "succeeded"
-              event = ServiceDeliveryEvidence.new(journal: journal).verified(record: record, events: events, commit: commit)
-              data.merge!(record.slice("input_digest", "authorization", "executor_uid", "completion_digest", "receipt"))
-              data["delivery_event"] = event
-            end
-            if role == :executor
-              data["settlement_context"] = read.fetch(:settlement_context) ||
-                ServiceEvidence.new(journal: journal).settlement_context(record, commit: commit, read_view: read.fetch(:read_view))
-            end
-            {data: data, replayed: false}
-          end
-        end
-
-        def service_authorization(request, params, map, peer, role, transfer)
-          authorize_service_transfer!(request, params, map, peer, role)
-          raise ArgumentError, "structured service input transfer is missing" unless transfer && transfer.count == 1
-          bytes = transfer.bytes.dup.freeze
-          with_service_scope(params: params, map: map) do |journal, _registration|
-            service_journal!(journal)
-            record = journal.service_request(params.fetch("request_id"))
-            service_executor!(peer, role, record)
-            service_ticket!(record, params, map, peer)
-            unless record.fetch("input_digest") == params.fetch("input_digest")
-              raise AttemptErrors::Conflict, "authorization input binding differs"
-            end
-            events = attempt_events(journal, params)
-            service_scope_open!(events: events, params: params, map: map)
-            origin = service_origin!(events, params)
-            unless service_origin_matches!(record, origin)
-              raise AttemptErrors::UnauthorizedIdentity, "authorization launch origin differs"
-            end
-            current = exact_candidate!(candidate(events), params)
-            unless record["candidate_head"] == current["head"] && record["candidate_generation"] == current["candidate_generation"]
-              raise AttemptErrors::Conflict, "authorization candidate changed"
-            end
-            service_receiver!(peer, role, map, record.fetch("service_id"))
-            service_review!(journal, events, params, map, current, service_operation: record.fetch("operation")) unless %w[create update].include?(record.fetch("operation"))
-            prepared = service_policy!.prepare!(record, input_bytes: bytes)
-            data = params.slice("request_id", "claim_binding", "head", "candidate_generation").merge(
-              "policy_digest" => prepared.fetch(:policy_digest), "operation_digest" => prepared.fetch(:operation_digest))
-            {data: data, replayed: false}
-          end
-        end
-
-        def dispatch_service(request, params, map, peer, role, transfer)
-          return service_authorization(request, params, map, peer, role, transfer) if request.fetch("operation") == "service_authorization"
-          authorize_service_transfer!(request, params, map, peer, role)
-          admitted = if request.fetch("operation") == "complete_service"
-            ReceiptTransfer.decode(input: transfer, receipt_sha256: params.fetch("receipt_sha256"), artifact_field: "evidence", reference_key: "ref")
-          else
-            raise ArgumentError, "structured service input transfer is missing" unless transfer && transfer.count == 1
-            transfer.bytes.dup.freeze
-          end
-          with_service_scope(params: params, map: map) do |journal, _registration|
-            service_journal!(journal)
-            unless request.fetch("operation") == "complete_service"
-              input_record = request.fetch("operation") == "request_service" ? params : journal.service_request(params.fetch("request_id"))
-              # Replay bypasses the mutation callback, never input validation.
-              # Only body binding is checked here; current effect policy stays
-              # inside each fresh CAS callback.
-              service_policy!.input_binding(admitted, expected_digest: input_record.fetch("input_digest"),
-                expected_target: input_record.fetch("target"), operation: input_record.fetch("operation"))
-            end
-            # Admission also runs outside mutate: an exact mutation replay
-            # skips its callback and cannot bypass the authenticated ticket.
-            service_policy!.visible!(project: map.fetch("project_id"), uid: map.fetch("worker_uid")) unless request.fetch("operation") == "complete_service"
-            retained = request.fetch("operation") == "request_service" && journal.service_request(params.fetch("request_id"))
-            if retained
-              service_executor!(peer, role, retained)
-              service_replay_binding!(retained, params, map)
-            end
-            if !retained && request.fetch("operation") != "request_service"
-              record = journal.service_request(params.fetch("request_id"))
-              service_executor!(peer, role, record)
-              service_ticket!(record, params, map, peer)
-              completion_binding!(record, params, admitted) if request.fetch("operation") == "complete_service"
-            elsif !retained
-              origin = service_origin!(attempt_events(journal, params), params)
-              service_worker!(params.fetch("worker_process_binding"), :worker, map, origin)
-              service_receiver!(peer, role, map, params.fetch("service_id"))
-            end
-            result = journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
-              mutation_id: request.fetch("mutation_id"), operation: request.fetch("operation"),
-              parameters_digest: Atoms::EvidenceDigest.digest(params),
-              expected_generation: request.fetch("operation") == "complete_service" ? nil : params.fetch("expected_generation"),
-              generation_mode: request.fetch("operation") == "complete_service" ? :recorded_completion : :expected, with_replay: true) do |events, _commit, _generation|
-              if request.fetch("operation") == "request_service"
-                existing = journal.service_request(params.fetch("request_id"))
-                if existing
-                  service_executor!(peer, role, existing)
-                  service_replay_binding!(existing, params, map)
-                  {data: service_projection(existing).merge("claim" => "retained")}
-                else
-                  service_claim_plan(journal, events, params, map, peer, role, admitted)
-                end
-              elsif request.fetch("operation") == "begin_dispatch"
-                service_begin_plan(journal, events, params, map, peer, role, admitted)
-              else
-                service_completion_plan(journal, events, params, map, peer, role, admitted)
-              end
-            end
-            if request.fetch("operation") == "begin_dispatch" && result.fetch(:replayed)
-              result = result.merge(data: result.fetch(:data).merge("invocation" => "already_started"))
-            end
-            if request.fetch("operation") == "request_service"
-              # Acceptance metadata belongs to this exact mutation, while
-              # retained service state may have advanced since acceptance.
-              current = journal.service_request(params.fetch("request_id"))
-              data = service_projection(current).merge(result.fetch(:data).slice("generation", "journal_commit"))
-              data["claim"] = retained || result.fetch(:replayed) || result.dig(:data, "claim") == "retained" ? "retained" : "created"
-              result = result.merge(data: data)
-            end
-            if %w[request_service begin_dispatch].include?(request.fetch("operation")) &&
-                %w[prune-preserved-workspace publish].include?(result.fetch(:data).fetch("operation"))
-              selector = request.fetch("operation") == "request_service" ? "request_event_digest" : "dispatch_event_digest"
-              digest = cleanup_service_mutation_event!(journal, request, params, result.fetch(:data).fetch("journal_commit"))
-              result = result.merge(data: result.fetch(:data).merge(selector => digest))
-            end
-            result
-          end
-        end
-
-        # Selectors refer to the actual accepted mutation, never a caller's
-        # pathname or the latest service record. They are derived after CAS,
-        # avoiding a self-reference in the persisted mutation reply.
-        def cleanup_service_mutation_event!(journal, request, params, commit)
-          events = journal.read_events(params.fetch("assignment_id"), commit: commit)
-            .select { |event| event["attempt_id"] == params.fetch("attempt_id") }
-          unless Models::EvidenceEvent.chain_valid?(events)
-            raise AttemptErrors::EvidenceUnavailable, "cleanup service mutation chain is unavailable"
-          end
-          selected = events.select do |event|
-            event["type"] == "authority_mutation" && event.dig("payload", "mutation_id") == request.fetch("mutation_id")
-          end
-          event = selected.one? && selected.first
-          unless event && event.dig("payload", "operation") == request.fetch("operation") &&
-              event.dig("payload", "parameters_digest") == Atoms::EvidenceDigest.digest(params) &&
-              event.dig("payload", "assignment_id") == params.fetch("assignment_id") &&
-              event.dig("payload", "attempt_id") == params.fetch("attempt_id") &&
-              event.dig("payload", "data", "request_id") == params.fetch("request_id") &&
-              journal.event_commit!(assignment_id: params.fetch("assignment_id"), event_digest: event.fetch("digest"), commit: commit) == commit
-            raise AttemptErrors::EvidenceUnavailable, "cleanup service mutation introduction is unavailable"
-          end
-          event.fetch("digest")
-        end
-
-        def service_policy!
-          @service_policy || raise(ArgumentError, "full-service authority requires its installed policy owner")
-        end
-
-        def service_executor!(peer, role, record)
-          unless record && role == :executor && peer["uid"] == record.fetch("executor_uid")
-            raise AttemptErrors::UnauthorizedIdentity, "completion requires the recorded executor"
-          end
-          if record["operation"] == "publish" && record["dispatch_phase"] != "issued" && peer != record["executor_process_binding"]
-            raise AttemptErrors::UnauthorizedIdentity, "publication requires its original receiver birth"
-          end
-          @kernel.live!(peer)
-          true
-        end
-
-        def service_receiver!(peer, role, map, service_id)
-          project = service_project!(map.fetch("project_id"))
-          receiver = project.fetch("service_receivers").fetch(service_id)
-          unless role == :executor && peer["uid"] == receiver.fetch("executor_uid") &&
-              project.fetch("service_executor_uids").include?(peer["uid"]) &&
-              !project.fetch("worker_uids").include?(peer["uid"])
-            raise AttemptErrors::UnauthorizedIdentity, "service requires its fixed independent receiver"
-          end
-          @kernel.live!(peer)
-          receiver
-        rescue KeyError
-          raise AttemptErrors::UnauthorizedIdentity, "fixed service receiver is unavailable"
-        end
-
-        def service_claim_plan(journal, events, params, map, peer, role, input_bytes)
-          origin = service_origin!(events, params)
-          worker = params.fetch("worker_process_binding")
-          service_worker!(worker, :worker, map, origin)
-          current = exact_candidate!(candidate(events), params)
-          service_review!(journal, events, params, map, current, service_operation: params.fetch("operation")) unless %w[create update].include?(params.fetch("operation"))
-          receiver = service_receiver!(peer, role, map, params.fetch("service_id"))
-          binding = params.slice("request_id", "assignment_id", "attempt_id", "operation", "input_digest", "target",
-            "authorization", "service_id").merge("project_id" => map.fetch("project_id"),
-              "caller_uid" => map.fetch("worker_uid"), "mapping_id" => params.fetch("mapping_id"), "candidate_head" => current.fetch("head"),
-              "candidate_generation" => current.fetch("candidate_generation"))
-            .merge(service_origin_fields!(origin))
-          prepared = service_policy!.prepare!(binding, input_bytes: input_bytes)
-          binding = prepared.fetch(:binding).merge("policy_digest" => prepared.fetch(:policy_digest))
-          unless binding["executor_uid"] == receiver.fetch("executor_uid")
-            raise AttemptErrors::UnauthorizedIdentity, "policy and fixed receiver disagree"
-          end
-          existing = journal.service_request(binding.fetch("request_id"))
-          if existing
-            unless existing.slice(*SERVICE_IDENTITY) == binding.slice(*SERVICE_IDENTITY)
-              raise AttemptErrors::Conflict, "service request immutable identity differs"
-            end
-            return {data: service_projection(existing).merge("claim" => "retained")}
-          end
-          ticket = SecureRandom.hex(16)
-          record = binding.merge("dispatch_ticket_id" => ticket,
-            "claim_binding" => Atoms::EvidenceDigest.digest(binding.merge("dispatch_ticket_id" => ticket)),
-            "claim_generation" => 1, "dispatch_phase" => "issued", "state" => "uncertain",
-            "claimed_at" => Time.now.utc.iso8601(9))
-          {data: service_projection(record).merge("claim" => "created"), service_inputs: {record.fetch("request_id") => input_bytes}, service_updates: [{request_id: record.fetch("request_id"),
-            expected: nil, replacement: record, event_type: "service_claim"}]}
-        end
-
-        def service_begin_plan(journal, events, params, map, peer, role, input_bytes)
-          record = journal.service_request(params.fetch("request_id"))
-          raise AttemptErrors::NotFound, "service request is unavailable" unless record
-          service_receiver!(peer, role, map, record.fetch("service_id"))
-          service_ticket!(record, params, map, peer)
-          # A repeated begin never grants a second invocation, including after
-          # lease expiry or terminality. It reports only retained ticket truth.
-          return {data: service_projection(record).merge("invocation" => "already_started")} unless record["dispatch_phase"] == "issued"
-          origin = service_origin!(events, params)
-          unless service_origin_matches!(record, origin)
-            raise AttemptErrors::UnauthorizedIdentity, "dispatch launch origin differs"
-          end
-          current = exact_candidate!(candidate(events), params)
-          unless record["candidate_head"] == current["head"] && record["candidate_generation"] == current["candidate_generation"]
-            raise AttemptErrors::Conflict, "dispatch candidate changed"
-          end
-          service_review!(journal, events, params, map, current, service_operation: record.fetch("operation")) unless %w[create update].include?(record.fetch("operation"))
-          service_policy!.prepare!(record, input_bytes: input_bytes)
-          replacement = record.merge("dispatch_phase" => "dispatch_started")
-          if record.fetch("operation") == "prune-preserved-workspace"
-            replacement["operation_owner_binding"] = service_policy!.dispatch_owner_binding!(record)
-          end
-          if %w[prune-preserved-workspace publish].include?(record.fetch("operation"))
-            replacement["executor_process_binding"] = JSON.parse(JSON.generate(peer))
-          end
-          {data: service_projection(replacement).merge("invocation" => "permitted"),
-            service_inputs: {record.fetch("request_id") => input_bytes},
-            service_updates: [{request_id: record.fetch("request_id"), expected: record,
-              replacement: replacement, event_type: "service_transition"}]}
-        end
-
-        def service_ticket!(record, params, map, peer)
-          unless record["assignment_id"] == params["assignment_id"] && record["attempt_id"] == params["attempt_id"] &&
-              record["project_id"] == map["project_id"] && record["executor_uid"] == peer["uid"] &&
-              record["claim_binding"] == params["claim_binding"]
-            raise AttemptErrors::UnauthorizedIdentity, "dispatch ticket binding differs"
-          end
-          true
-        end
-
-        def service_replay_binding!(record, params, map)
-          fields = %w[request_id assignment_id attempt_id operation input_digest target authorization service_id mapping_id]
-          unless fields.all? { |field| record[field] == params[field] } && record["project_id"] == map["project_id"] &&
-              record["caller_uid"] == map["worker_uid"] && params.dig("worker_process_binding", "uid") == map["worker_uid"]
-            raise AttemptErrors::Conflict, "service replay immutable identity differs"
-          end
-          @kernel.live!(params.fetch("worker_process_binding"))
-          unless @kernel.descendant?(params.fetch("worker_process_binding"), record.fetch("worker_process_binding"))
-            raise AttemptErrors::UnauthorizedIdentity, "service replay requires recorded native worker ownership"
-          end
-          true
-        end
-
-        def service_completion_plan(journal, events, params, map, peer, role, admitted)
-          record = journal.service_request(params.fetch("request_id"))
-          service_executor!(peer, role, record)
-          service_ticket!(record, params, map, peer)
-          digest = completion_binding!(record, params, admitted)
-          if record["completion_digest"]
-            return {data: service_projection(record)}
-          end
-          receipt = admitted.fetch(:receipt)
-          if record["operation"] == "publish"
-            unless admitted.fetch(:artifacts).size == 1
-              raise AttemptErrors::ReceiptRejected, "publication requires its one exact result"
-            end
-            ServiceEvidence.new(journal: journal).publication_result!(admitted.fetch(:artifacts).first, record, state: receipt.fetch("outcome"))
-          end
-          owner = ServiceEvidence.new(journal: journal)
-          canonical = Molecules::CanonicalEvidence.new(journal: journal)
-          plan = canonical.import_plan(**owner.context(record), artifacts: admitted.fetch(:artifacts),
-            admitted_after_event_digest: events.last.fetch("digest"))
-          normalized = JSON.parse(JSON.generate(receipt)).merge("evidence" => plan.fetch(:references))
-          replacement = record.merge("state" => receipt.fetch("outcome"), "receipt" => normalized, "completion_digest" => digest)
-          replacement["failed_at"] = Time.now.utc.iso8601(9) if receipt["outcome"] == "failed"
-          if %w[create update ready merge].include?(replacement["operation"]) && replacement["state"] == "succeeded"
-            event = ServiceDeliveryEvidence.new(journal: journal).completion_event(record: replacement,
-              receipt: normalized, completion_digest: digest, artifacts: admitted.fetch(:artifacts))
-            plan = plan.merge(events: plan.fetch(:events) + [event])
-          end
-          plan.merge(data: service_projection(replacement), service_updates: [{request_id: record.fetch("request_id"),
-            expected: record, replacement: replacement, event_type: "service_transition"}])
-        end
-
-        def completion_binding!(record, params, admitted)
-          unless record["candidate_head"] == params["head"] && record["candidate_generation"] == params["candidate_generation"]
-            raise AttemptErrors::Conflict, "completion candidate binding differs"
-          end
-          digest = Atoms::EvidenceDigest.digest("receipt_sha256" => admitted.fetch(:receipt_sha256),
-            "artifacts" => admitted.fetch(:artifacts).map { |bytes| Digest::SHA256.hexdigest(bytes) })
-          if record["completion_digest"] && record["completion_digest"] != digest
-            raise AttemptErrors::Conflict, "service completion content differs"
-          end
-          receipt = admitted.fetch(:receipt)
-          unless receipt.keys.sort == Molecules::EvidenceJournal::TERMINAL_RECEIPT_FIELDS.sort &&
-              Molecules::EvidenceJournal::TERMINAL_BINDING_FIELDS.all? { |field| receipt[field] == record[field] } &&
-              %w[succeeded failed].include?(receipt["outcome"]) &&
-              (receipt["outcome"] != "succeeded" || record["dispatch_phase"] == "dispatch_started" || (record["operation"] == "publish" && record["dispatch_phase"] == "issuing"))
-            raise AttemptErrors::ReceiptRejected, "completion must attest the exact dispatched request"
-          end
-          digest
-        end
-
-        def service_projection(record)
-          record.slice("request_id", "assignment_id", "attempt_id", "project_id", "operation", "service_id", "target",
-            "candidate_head", "candidate_generation", "state", "dispatch_ticket_id", "claim_binding", "claim_generation", "dispatch_phase", "policy_digest", "operation_owner_binding", "executor_process_binding", *ServicePublicationEvidence::PUBLICATION_FIELDS).tap do |projection|
-              if record["operation"] == "publish" && %w[succeeded failed].include?(record["state"])
-                projection.merge!(record.slice("receipt", "completion_digest", "authorization", "input_digest"))
-              end
-            end
-        end
-      end
-    end
-  end
-end